Edit tour

Windows Analysis Report
rQuotation3200025006.exe

Overview

General Information

Sample name:	rQuotation3200025006.exe
Analysis ID:	1520520
MD5:	36c4bff0f1cdcda62da9229500ca1e38
SHA1:	de74dbf7bac85a3a06c7038a4d4241389e6a5c8f
SHA256:	fda83ecb5bd6a07dedaf6be0fce7c626e21e9df94d82ddb905460e9d6a25a162
Tags:	AgentTeslaexeuser-Porcupine
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Connects to many ports of the same IP (likely port scanning)

Contains functionality to log keystrokes (.Net Source)

Contains functionality to register a low level keyboard hook

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses FTP

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

rQuotation3200025006.exe (PID: 6744 cmdline: "C:\Users\user\Desktop\rQuotation3200025006.exe" MD5: 36C4BFF0F1CDCDA62DA9229500CA1E38)

powershell.exe (PID: 824 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rQuotation3200025006.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7476 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 6108 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pBBqGOzrz.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7068 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp3D2.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rQuotation3200025006.exe (PID: 2756 cmdline: "C:\Users\user\Desktop\rQuotation3200025006.exe" MD5: 36C4BFF0F1CDCDA62DA9229500CA1E38)

pBBqGOzrz.exe (PID: 7260 cmdline: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe MD5: 36C4BFF0F1CDCDA62DA9229500CA1E38)

schtasks.exe (PID: 7420 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp1AB5.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

pBBqGOzrz.exe (PID: 7608 cmdline: "C:\Users\user\AppData\Roaming\pBBqGOzrz.exe" MD5: 36C4BFF0F1CDCDA62DA9229500CA1E38)

pBBqGOzrz.exe (PID: 7616 cmdline: "C:\Users\user\AppData\Roaming\pBBqGOzrz.exe" MD5: 36C4BFF0F1CDCDA62DA9229500CA1E38)

sgxIb.exe (PID: 7844 cmdline: "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe" MD5: 36C4BFF0F1CDCDA62DA9229500CA1E38)

schtasks.exe (PID: 7932 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp4705.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sgxIb.exe (PID: 7988 cmdline: "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe" MD5: 36C4BFF0F1CDCDA62DA9229500CA1E38)

sgxIb.exe (PID: 7996 cmdline: "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe" MD5: 36C4BFF0F1CDCDA62DA9229500CA1E38)

sgxIb.exe (PID: 8004 cmdline: "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe" MD5: 36C4BFF0F1CDCDA62DA9229500CA1E38)

sgxIb.exe (PID: 8012 cmdline: "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe" MD5: 36C4BFF0F1CDCDA62DA9229500CA1E38)

sgxIb.exe (PID: 7096 cmdline: "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe" MD5: 36C4BFF0F1CDCDA62DA9229500CA1E38)

schtasks.exe (PID: 736 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp6606.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sgxIb.exe (PID: 7188 cmdline: "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe" MD5: 36C4BFF0F1CDCDA62DA9229500CA1E38)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.haliza.com.my", "Username": "origin@haliza.com.my", "Password": "JesusChrist007$"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001C.00000002.4163218058.00000000033DC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001C.00000002.4163218058.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000002.4163218058.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.4164492788.000000000354A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.4163306810.0000000002CDC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000016.00000002.1961223046.0000000003241000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000002.1961223046.0000000003241000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000016.00000002.1958682977.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000002.1958682977.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.4164492788.0000000003501000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.4164492788.0000000003501000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000016.00000002.1961223046.000000000326C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.4163306810.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.4163306810.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1732806803.00000000036B9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1732806803.00000000036B9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: rQuotation3200025006.exe PID: 6744	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: rQuotation3200025006.exe PID: 6744	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: rQuotation3200025006.exe PID: 6744	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: rQuotation3200025006.exe PID: 2756	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: rQuotation3200025006.exe PID: 2756	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: pBBqGOzrz.exe PID: 7616	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: pBBqGOzrz.exe PID: 7616	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: sgxIb.exe PID: 8012	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: sgxIb.exe PID: 8012	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: sgxIb.exe PID: 7188	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: sgxIb.exe PID: 7188	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.rQuotation3200025006.exe.377e4e0.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rQuotation3200025006.exe.377e4e0.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.rQuotation3200025006.exe.377e4e0.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3317c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x331ee:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33278:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3330a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33374:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x333e6:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3347c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3350c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.rQuotation3200025006.exe.377e4e0.2.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x30370:$s2: GetPrivateProfileString 0x2f9fa:$s3: get_OSFullName 0x3116b:$s5: remove_Key 0x31357:$s5: remove_Key 0x32275:$s6: FtpWebRequest 0x3315e:$s7: logins 0x336d0:$s7: logins 0x36427:$s7: logins 0x36493:$s7: logins 0x37f12:$s7: logins 0x3702d:$s9: 1.85 (Hash, version 2, native byte-order)
22.2.sgxIb.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
22.2.sgxIb.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
22.2.sgxIb.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34f7c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34fee:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35078:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3510a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35174:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x351e6:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3527c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3530c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
22.2.sgxIb.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x32170:$s2: GetPrivateProfileString 0x317fa:$s3: get_OSFullName 0x32f6b:$s5: remove_Key 0x33157:$s5: remove_Key 0x34075:$s6: FtpWebRequest 0x34f5e:$s7: logins 0x354d0:$s7: logins 0x38227:$s7: logins 0x38293:$s7: logins 0x39d12:$s7: logins 0x38e2d:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.rQuotation3200025006.exe.3741cc0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rQuotation3200025006.exe.3741cc0.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.rQuotation3200025006.exe.3741cc0.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3317c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x331ee:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33278:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3330a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33374:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x333e6:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3347c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3350c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.rQuotation3200025006.exe.3741cc0.3.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x30370:$s2: GetPrivateProfileString 0x2f9fa:$s3: get_OSFullName 0x3116b:$s5: remove_Key 0x31357:$s5: remove_Key 0x32275:$s6: FtpWebRequest 0x3315e:$s7: logins 0x336d0:$s7: logins 0x36427:$s7: logins 0x36493:$s7: logins 0x37f12:$s7: logins 0x3702d:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.rQuotation3200025006.exe.377e4e0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rQuotation3200025006.exe.377e4e0.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.rQuotation3200025006.exe.377e4e0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34f7c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x7159c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34fee:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x7160e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35078:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x71698:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3510a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x7172a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35174:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x71794:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x351e6:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x71806:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3527c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x7189c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3530c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x7192c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.rQuotation3200025006.exe.377e4e0.2.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x32170:$s2: GetPrivateProfileString 0x6e790:$s2: GetPrivateProfileString 0x317fa:$s3: get_OSFullName 0x6de1a:$s3: get_OSFullName 0x32f6b:$s5: remove_Key 0x33157:$s5: remove_Key 0x6f58b:$s5: remove_Key 0x6f777:$s5: remove_Key 0x34075:$s6: FtpWebRequest 0x70695:$s6: FtpWebRequest 0x34f5e:$s7: logins 0x354d0:$s7: logins 0x38227:$s7: logins 0x38293:$s7: logins 0x39d12:$s7: logins 0x7157e:$s7: logins 0x71af0:$s7: logins 0x74847:$s7: logins 0x748b3:$s7: logins 0x76332:$s7: logins 0x38e2d:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.rQuotation3200025006.exe.3741cc0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rQuotation3200025006.exe.3741cc0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.rQuotation3200025006.exe.3741cc0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34f7c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x7179c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xaddbc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34fee:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x7180e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xade2e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35078:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x71898:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xadeb8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3510a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x7192a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xadf4a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35174:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x71994:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xadfb4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x351e6:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x71a06:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xae026:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3527c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x71a9c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xae0bc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.rQuotation3200025006.exe.3741cc0.3.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x32170:$s2: GetPrivateProfileString 0x6e990:$s2: GetPrivateProfileString 0xaafb0:$s2: GetPrivateProfileString 0x317fa:$s3: get_OSFullName 0x6e01a:$s3: get_OSFullName 0xaa63a:$s3: get_OSFullName 0x32f6b:$s5: remove_Key 0x33157:$s5: remove_Key 0x6f78b:$s5: remove_Key 0x6f977:$s5: remove_Key 0xabdab:$s5: remove_Key 0xabf97:$s5: remove_Key 0x34075:$s6: FtpWebRequest 0x70895:$s6: FtpWebRequest 0xaceb5:$s6: FtpWebRequest 0x34f5e:$s7: logins 0x354d0:$s7: logins 0x38227:$s7: logins 0x38293:$s7: logins 0x39d12:$s7: logins 0x7177e:$s7: logins
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rQuotation3200025006.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rQuotation3200025006.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\rQuotation3200025006.exe", ParentImage: C:\Users\user\Desktop\rQuotation3200025006.exe, ParentProcessId: 6744, ParentProcessName: rQuotation3200025006.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rQuotation3200025006.exe", ProcessId: 824, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\rQuotation3200025006.exe, ProcessId: 2756, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sgxIb

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp1AB5.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp1AB5.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe, ParentImage: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe, ParentProcessId: 7260, ParentProcessName: pBBqGOzrz.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp1AB5.tmp", ProcessId: 7420, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp3D2.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp3D2.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\rQuotation3200025006.exe", ParentImage: C:\Users\user\Desktop\rQuotation3200025006.exe, ParentProcessId: 6744, ParentProcessName: rQuotation3200025006.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp3D2.tmp", ProcessId: 7068, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rQuotation3200025006.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rQuotation3200025006.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\rQuotation3200025006.exe", ParentImage: C:\Users\user\Desktop\rQuotation3200025006.exe, ParentProcessId: 6744, ParentProcessName: rQuotation3200025006.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rQuotation3200025006.exe", ProcessId: 824, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp3D2.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp3D2.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\rQuotation3200025006.exe", ParentImage: C:\Users\user\Desktop\rQuotation3200025006.exe, ParentProcessId: 6744, ParentProcessName: rQuotation3200025006.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp3D2.tmp", ProcessId: 7068, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE AgentTesla Exfil via FTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T13:10:17.718048+0200	2029927	1	A Network Trojan was detected	192.168.2.4	49741	110.4.45.197	21	TCP
2024-09-27T13:10:24.710806+0200	2029927	1	A Network Trojan was detected	192.168.2.4	49751	110.4.45.197	21	TCP
2024-09-27T13:10:31.146663+0200	2029927	1	A Network Trojan was detected	192.168.2.4	49756	110.4.45.197	21	TCP

ETPRO MALWARE Agent Tesla CnC Exfil Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T13:10:19.571041+0200	2855542	1	A Network Trojan was detected	192.168.2.4	49746	110.4.45.197	53334	TCP
2024-09-27T13:10:19.576306+0200	2855542	1	A Network Trojan was detected	192.168.2.4	49746	110.4.45.197	53334	TCP
2024-09-27T13:10:25.537921+0200	2855542	1	A Network Trojan was detected	192.168.2.4	49753	110.4.45.197	51497	TCP
2024-09-27T13:10:25.543689+0200	2855542	1	A Network Trojan was detected	192.168.2.4	49753	110.4.45.197	51497	TCP
2024-09-27T13:10:31.976691+0200	2855542	1	A Network Trojan was detected	192.168.2.4	49757	110.4.45.197	55730	TCP
2024-09-27T13:10:31.982121+0200	2855542	1	A Network Trojan was detected	192.168.2.4	49757	110.4.45.197	55730	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.rQuotation3200025006.exe.3741cc0.3.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.haliza.com.my", "Username": "origin@haliza.com.my", "Password": "JesusChrist007$"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	ReversingLabs: Detection: 57%

Multi AV Scanner detection for submitted file

Source: rQuotation3200025006.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: rQuotation3200025006.exe

Joe Sandbox ML: detected

Source: rQuotation3200025006.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49755 version: TLS 1.2

Source: rQuotation3200025006.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 4x nop then jmp 06CC57B2h	0_2_06CC4D7B
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 4x nop then jmp 06CC57B2h	0_2_06CC4ECD
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 4x nop then jmp 06CC57B2h	0_2_06CC4EE4
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 4x nop then jmp 06AC4AAAh	9_2_06AC4073
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 4x nop then jmp 06AC4AAAh	9_2_06AC41C5
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 4x nop then jmp 06AC4AAAh	9_2_06AC41DC
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4x nop then jmp 066D4AAAh	16_2_066D4073
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4x nop then jmp 066D4AAAh	16_2_066D41C5
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4x nop then jmp 066D4AAAh	16_2_066D41DC
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4x nop then jmp 07274AAAh	25_2_07274073
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4x nop then jmp 07274AAAh	25_2_072741C5
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4x nop then jmp 07274AAAh	25_2_072741DC

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:49753 -> 110.4.45.197:51497
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:49746 -> 110.4.45.197:53334
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.4:49751 -> 110.4.45.197:21
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.4:49756 -> 110.4.45.197:21
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.4:49741 -> 110.4.45.197:21
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:49757 -> 110.4.45.197:55730

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 110.4.45.197 ports 65186,64130,59960,61524,61759,53786,55824,55768,51546,61163,57406,65361,64095,62561,62089,1,53694,52440,2,56668,53334,58620,51497,55730,55438,60182,52328,21,55958

Source: global traffic

TCP traffic: 192.168.2.4:49738 -> 110.4.45.197:53694

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205

Source: Joe Sandbox View

ASN Name: EXABYTES-AS-APExaBytesNetworkSdnBhdMY EXABYTES-AS-APExaBytesNetworkSdnBhdMY

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown

FTP traffic detected: 110.4.45.197:21 -> 192.168.2.4:49737 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 19:10. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 19:10. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 19:10. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 19:10. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ftp.haliza.com.my

Source: rQuotation3200025006.exe, 00000008.00000002.4163306810.0000000002E28000.00000004.00000800.00020000.00000000.sdmp, rQuotation3200025006.exe, 00000008.00000002.4163306810.0000000002CDC000.00000004.00000800.00020000.00000000.sdmp, rQuotation3200025006.exe, 00000008.00000002.4163306810.0000000002D3B000.00000004.00000800.00020000.00000000.sdmp, rQuotation3200025006.exe, 00000008.00000002.4163306810.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp, pBBqGOzrz.exe, 0000000E.00000002.4164492788.000000000354A000.00000004.00000800.00020000.00000000.sdmp, pBBqGOzrz.exe, 0000000E.00000002.4164492788.00000000035FF000.00000004.00000800.00020000.00000000.sdmp, pBBqGOzrz.exe, 0000000E.00000002.4164492788.00000000036EA000.00000004.00000800.00020000.00000000.sdmp, pBBqGOzrz.exe, 0000000E.00000002.4164492788.00000000036E5000.00000004.00000800.00020000.00000000.sdmp, pBBqGOzrz.exe, 0000000E.00000002.4164492788.0000000003634000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000016.00000002.1961223046.000000000326C000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 0000001C.00000002.4163218058.00000000036C7000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 0000001C.00000002.4163218058.00000000033DC000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 0000001C.00000002.4163218058.0000000003496000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.haliza.com.my
Source: rQuotation3200025006.exe, 00000000.00000002.1732045998.0000000002701000.00000004.00000800.00020000.00000000.sdmp, rQuotation3200025006.exe, 00000008.00000002.4163306810.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, pBBqGOzrz.exe, 00000009.00000002.1841537852.00000000026F1000.00000004.00000800.00020000.00000000.sdmp, pBBqGOzrz.exe, 0000000E.00000002.4164492788.00000000034B1000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000010.00000002.1901166814.0000000002521000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000016.00000002.1961223046.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000019.00000002.1979059945.0000000002F24000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 0000001C.00000002.4163218058.000000000336C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: rQuotation3200025006.exe, 00000000.00000002.1735717457.0000000005030000.00000004.00000020.00020000.00000000.sdmp, rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: rQuotation3200025006.exe, 00000000.00000002.1732806803.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000016.00000002.1958682977.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: rQuotation3200025006.exe, 00000000.00000002.1732806803.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, rQuotation3200025006.exe, 00000008.00000002.4163306810.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, pBBqGOzrz.exe, 0000000E.00000002.4164492788.00000000034B1000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000016.00000002.1958682977.0000000000402000.00000040.00000400.00020000.00000000.sdmp, sgxIb.exe, 00000016.00000002.1961223046.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 0000001C.00000002.4163218058.000000000336C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: rQuotation3200025006.exe, 00000008.00000002.4163306810.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, pBBqGOzrz.exe, 0000000E.00000002.4164492788.00000000034B1000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000016.00000002.1961223046.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 0000001C.00000002.4163218058.000000000336C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: rQuotation3200025006.exe, 00000008.00000002.4163306810.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, pBBqGOzrz.exe, 0000000E.00000002.4164492788.00000000034B1000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000016.00000002.1961223046.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 0000001C.00000002.4163218058.000000000336C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49755 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.rQuotation3200025006.exe.3741cc0.3.raw.unpack, SKTzxzsJw.cs	.Net Code: _71ZRqC1D
Source: 0.2.rQuotation3200025006.exe.377e4e0.2.raw.unpack, SKTzxzsJw.cs	.Net Code: _71ZRqC1D

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\rQuotation3200025006.exe

Code function: 8_2_0692C628 SetWindowsHookExA 0000000D,00000000,?,?,?,?,?,?,?,?,?,0692D458,00000000,00000000

8_2_0692C628

Installs a global keyboard hook

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\rQuotation3200025006.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\pBBqGOzrz.exe
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.rQuotation3200025006.exe.377e4e0.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.rQuotation3200025006.exe.377e4e0.2.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 22.2.sgxIb.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 22.2.sgxIb.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.rQuotation3200025006.exe.3741cc0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.rQuotation3200025006.exe.3741cc0.3.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.rQuotation3200025006.exe.377e4e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.rQuotation3200025006.exe.377e4e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.rQuotation3200025006.exe.3741cc0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.rQuotation3200025006.exe.3741cc0.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

.NET source code contains very large array initializations

Source: rQuotation3200025006.exe, MainMenu.cs

Large array initialization: : array initializer size 590396

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: rQuotation3200025006.exe

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 0_2_008AF2E4	0_2_008AF2E4
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 0_2_04BBB7E8	0_2_04BBB7E8
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 0_2_04BBE7D8	0_2_04BBE7D8
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 0_2_04BBB7D8	0_2_04BBB7D8
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 0_2_04BBE7CB	0_2_04BBE7CB
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 0_2_04BBE3A0	0_2_04BBE3A0
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 0_2_04BBE39B	0_2_04BBE39B
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 0_2_04BBEC10	0_2_04BBEC10
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 0_2_04BB5E28	0_2_04BB5E28
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 0_2_04BB5E18	0_2_04BB5E18
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 0_2_06CC0E70	0_2_06CC0E70
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 0_2_06CC0A38	0_2_06CC0A38
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_02A6EA08	8_2_02A6EA08
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_02A64A68	8_2_02A64A68
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_02A63E50	8_2_02A63E50
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_02A6ADA0	8_2_02A6ADA0
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_02A64198	8_2_02A64198
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_060B1540	8_2_060B1540
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_060B1550	8_2_060B1550
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_0692C76C	8_2_0692C76C
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_069239C4	8_2_069239C4
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_069262D7	8_2_069262D7
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_069255E3	8_2_069255E3
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_069255E8	8_2_069255E8
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_069239B8	8_2_069239B8
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_06937E90	8_2_06937E90
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_069356A8	8_2_069356A8
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_06936700	8_2_06936700
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_06932758	8_2_06932758
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_0693B348	8_2_0693B348
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_06935E08	8_2_06935E08
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_069377B0	8_2_069377B0
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_0693E4C8	8_2_0693E4C8
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_06930040	8_2_06930040
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 8_2_0693003F	8_2_0693003F
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 9_2_00D2F2E4	9_2_00D2F2E4
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 9_2_06AC0E70	9_2_06AC0E70
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 9_2_06AC0A38	9_2_06AC0A38
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 14_2_018CE9F8	14_2_018CE9F8
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 14_2_018C4A68	14_2_018C4A68
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 14_2_018CAD90	14_2_018CAD90
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 14_2_018C3E50	14_2_018C3E50
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 14_2_018C4198	14_2_018C4198
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 14_2_07086700	14_2_07086700
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 14_2_07087E90	14_2_07087E90
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 14_2_070856A8	14_2_070856A8
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 14_2_07083578	14_2_07083578
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 14_2_0708B343	14_2_0708B343
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 14_2_0708274B	14_2_0708274B
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 14_2_070877B0	14_2_070877B0
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 14_2_07085DF7	14_2_07085DF7
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 14_2_0708E4C8	14_2_0708E4C8
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 14_2_07080040	14_2_07080040
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 14_2_0708003F	14_2_0708003F
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_00B0F2E4	16_2_00B0F2E4
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_066D0E70	16_2_066D0E70
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_066D2780	16_2_066D2780
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_066D0A38	16_2_066D0A38
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 22_2_03024A68	22_2_03024A68
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 22_2_03023E50	22_2_03023E50
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 22_2_0302AC70	22_2_0302AC70
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 22_2_03024198	22_2_03024198
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 22_2_0302E9C1	22_2_0302E9C1
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 22_2_06F13580	22_2_06F13580
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 22_2_06F10040	22_2_06F10040
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 22_2_06F177B8	22_2_06F177B8
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 22_2_06F10006	22_2_06F10006
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 25_2_02CDF2E4	25_2_02CDF2E4
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 25_2_05420508	25_2_05420508
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 25_2_05420518	25_2_05420518
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 25_2_05421D31	25_2_05421D31
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 25_2_07270E70	25_2_07270E70
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 25_2_07270A38	25_2_07270A38
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 28_2_032C4A68	28_2_032C4A68
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 28_2_032CE8D8	28_2_032CE8D8
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 28_2_032C3E50	28_2_032C3E50
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 28_2_032C4198	28_2_032C4198
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 28_2_032C1990	28_2_032C1990
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 28_2_071AC3FC	28_2_071AC3FC
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 28_2_071A52A8	28_2_071A52A8
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 28_2_071A52A2	28_2_071A52A2
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 28_2_071B6708	28_2_071B6708
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 28_2_071B7E98	28_2_071B7E98
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 28_2_071B56B0	28_2_071B56B0
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 28_2_071B3580	28_2_071B3580
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 28_2_071B0040	28_2_071B0040
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 28_2_071B77B8	28_2_071B77B8
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 28_2_071B5DFF	28_2_071B5DFF
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 28_2_071BE4D0	28_2_071BE4D0
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 28_2_071B001D	28_2_071B001D

Source: rQuotation3200025006.exe, 00000000.00000002.1731067314.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs rQuotation3200025006.exe
Source: rQuotation3200025006.exe, 00000000.00000002.1732806803.00000000036B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename472d0e4f-32a4-4ea2-b137-597340264f0d.exe4 vs rQuotation3200025006.exe
Source: rQuotation3200025006.exe, 00000000.00000002.1738225361.0000000006F70000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs rQuotation3200025006.exe
Source: rQuotation3200025006.exe, 00000000.00000000.1676301194.0000000000290000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBWmX.exeD vs rQuotation3200025006.exe
Source: rQuotation3200025006.exe, 00000000.00000002.1739676085.0000000007710000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBWmX.exeD vs rQuotation3200025006.exe
Source: rQuotation3200025006.exe, 00000000.00000002.1732806803.0000000003924000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs rQuotation3200025006.exe
Source: rQuotation3200025006.exe, 00000000.00000002.1732045998.0000000002701000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename472d0e4f-32a4-4ea2-b137-597340264f0d.exe4 vs rQuotation3200025006.exe
Source: rQuotation3200025006.exe, 00000008.00000002.4157176054.0000000000CF8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs rQuotation3200025006.exe
Source: rQuotation3200025006.exe	Binary or memory string: OriginalFilenameBWmX.exeD vs rQuotation3200025006.exe

Source: rQuotation3200025006.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.rQuotation3200025006.exe.377e4e0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.rQuotation3200025006.exe.377e4e0.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 22.2.sgxIb.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 22.2.sgxIb.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.rQuotation3200025006.exe.3741cc0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.rQuotation3200025006.exe.3741cc0.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.rQuotation3200025006.exe.377e4e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.rQuotation3200025006.exe.377e4e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.rQuotation3200025006.exe.3741cc0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.rQuotation3200025006.exe.3741cc0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: rQuotation3200025006.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: pBBqGOzrz.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.rQuotation3200025006.exe.3741cc0.3.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rQuotation3200025006.exe.3741cc0.3.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rQuotation3200025006.exe.3741cc0.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rQuotation3200025006.exe.3741cc0.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rQuotation3200025006.exe.3741cc0.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rQuotation3200025006.exe.3741cc0.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rQuotation3200025006.exe.3741cc0.3.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rQuotation3200025006.exe.3741cc0.3.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, KHpWQ0SIuHGDwagjf6.cs	Security API names: _0020.SetAccessControl
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, KHpWQ0SIuHGDwagjf6.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, KHpWQ0SIuHGDwagjf6.cs	Security API names: _0020.AddAccessRule
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, SIQfwITd9ei2CpANlp.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@39/20@2/2

Source: C:\Users\user\Desktop\rQuotation3200025006.exe

File created: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7568:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6512:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6744:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5460:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7940:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1748:120:WilError_03
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Mutant created: \Sessions\1\BaseNamedObjects\dUNTqlHSZjNOL

Source: C:\Users\user\Desktop\rQuotation3200025006.exe

File created: C:\Users\user\AppData\Local\Temp\tmp3D2.tmp

Jump to behavior

Source: rQuotation3200025006.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: rQuotation3200025006.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\rQuotation3200025006.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\rQuotation3200025006.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: rQuotation3200025006.exe

ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\rQuotation3200025006.exe

File read: C:\Users\user\Desktop\rQuotation3200025006.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\rQuotation3200025006.exe "C:\Users\user\Desktop\rQuotation3200025006.exe"
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rQuotation3200025006.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pBBqGOzrz.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp3D2.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process created: C:\Users\user\Desktop\rQuotation3200025006.exe "C:\Users\user\Desktop\rQuotation3200025006.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe C:\Users\user\AppData\Roaming\pBBqGOzrz.exe
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp1AB5.tmp"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process created: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe "C:\Users\user\AppData\Roaming\pBBqGOzrz.exe"
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process created: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe "C:\Users\user\AppData\Roaming\pBBqGOzrz.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp4705.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp6606.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rQuotation3200025006.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pBBqGOzrz.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp3D2.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process created: C:\Users\user\Desktop\rQuotation3200025006.exe "C:\Users\user\Desktop\rQuotation3200025006.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp1AB5.tmp"
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process created: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe "C:\Users\user\AppData\Roaming\pBBqGOzrz.exe"
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process created: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe "C:\Users\user\AppData\Roaming\pBBqGOzrz.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp4705.tmp"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp6606.tmp"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windowscodecs.dll

Source: C:\Users\user\Desktop\rQuotation3200025006.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\rQuotation3200025006.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\rQuotation3200025006.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: rQuotation3200025006.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: rQuotation3200025006.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: rQuotation3200025006.exe, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.rQuotation3200025006.exe.4fb0000.4.raw.unpack, JK.cs	.Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 0.2.rQuotation3200025006.exe.26e8b6c.0.raw.unpack, JK.cs	.Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, KHpWQ0SIuHGDwagjf6.cs	.Net Code: ouhZd92ZvS System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 0_2_04BBFC58 pushfd ; retf	0_2_04BBFC5A
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 0_2_04BB1888 pushad ; retf	0_2_04BB1889
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 0_2_06CC4710 push eax; retf	0_2_06CC4711
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 0_2_06CC7B85 push FFFFFF8Bh; iretd	0_2_06CC7B87
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Code function: 0_2_06CC4B83 pushad ; iretd	0_2_06CC4B85
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 9_2_06AC5168 pushad ; iretd	9_2_06AC5169
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 9_2_06AC6F2D push FFFFFF8Bh; iretd	9_2_06AC6F2F
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 14_2_018CF8E8 pushad ; retf	14_2_018CF8F1
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Code function: 14_2_018C0C55 push edi; retf	14_2_018C0C7A
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_066D6F2D push FFFFFF8Bh; iretd	16_2_066D6F2F
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 16_2_066D5168 pushad ; iretd	16_2_066D5169
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 25_2_05426105 push esi; iretd	25_2_05426106
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 25_2_07276E6D push FFFFFF8Bh; iretd	25_2_07276E6F
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 28_2_032CF7C8 pushad ; retf	28_2_032CF7D1

Source: rQuotation3200025006.exe	Static PE information: section name: .text entropy: 7.946103748533992
Source: pBBqGOzrz.exe.0.dr	Static PE information: section name: .text entropy: 7.946103748533992

Source: 0.2.rQuotation3200025006.exe.4fb0000.4.raw.unpack, JK.cs	High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 0.2.rQuotation3200025006.exe.26e8b6c.0.raw.unpack, JK.cs	High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, wMS4Kp4PS7QXLDwFba.cs	High entropy of concatenated method names: 'GPa0KfIwhl', 's1L0kRMuS2', 'NEI0Rp8qmY', 'hEA0DmCcjC', 'Qs105gGPF0', 'JoT0cSEOwq', 'gs70OQEa2N', 'jv80LkQslm', 'KTw0Un7g5y', 'twv0wQKHVw'
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, TAKKyQpcGnSdH0xi7T.cs	High entropy of concatenated method names: 'AMbquEdkgh', 'EN9qXGFR8O', 'b7MqybfdBC', 'eiXyPfVVIK', 'E30yzTD3u3', 'sYqqGSICpi', 'aHFqBwBv5b', 'WRUqVlu65H', 'AnLqrBxRG2', 'CEhqZ0721q'
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, nKwRxOEJXPmCwrdxu7.cs	High entropy of concatenated method names: 'KVWdThSED', 'GdpYV7TKo', 'QoMo7s1Zs', 'JUxAwQhTZ', 'nqYk6UE8P', 'JdYvn4hiY', 'EAGGHqd9EgXB7jraa8', 'vQE8wR5IQhYq0hC6yX', 'MX5e7sotc', 'gTZ1nvpE6'
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, GJOr6KCN4jXCBadg9n.cs	High entropy of concatenated method names: 'c4jyjxpgId', 'DX8yIAX1Xv', 'xDNyQ6d15x', 'c5UyqjLpqH', 'WqkyH0jGM2', 'JtGQ3jArKF', 'fYIQhtaP47', 'ysvQEBTbma', 'QEpQtjKGlE', 'w2GQis3dFf'
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, JSvpK7PbC3ADjp6YBha.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LAp1FZm3Yj', 'dg41MWYkhc', 'NEI14RQHmh', 'BKY1snDrQ8', 'CEZ13BkKip', 'aCc1hRVQ9Y', 'GJ31Eu0yvO'
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, daS1DKPWJeoLefLlWoA.cs	High entropy of concatenated method names: 'zbZpgL6Hjl', 'Nyhplswj0a', 'hZmpdVGxGR', 'tSNpYeuwV5', 'EhUpJ4F0JR', 'F3Tpob1PSo', 'ksspAeJCEO', 'cjDpKwsZn5', 'hcypkSTjYV', 'NXmpvFlKmU'
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, PyH0ExoJb7qhW6t6e0.cs	High entropy of concatenated method names: 'tX0ntVYDlc', 'AXSnPSNe1P', 'ampeGI5mjS', 'WULeBcKmJQ', 'jtjnwZ2ZG6', 'LaQn6GfHox', 'gWKnbAHOHS', 'veunFBgDBM', 'MHlnMRBX8h', 'dexn4ZuktS'
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, KHpWQ0SIuHGDwagjf6.cs	High entropy of concatenated method names: 'liirjhkj6a', 'cNhru5avY3', 'Gn6rIVUWn3', 'RgjrX9Jjha', 'F2vrQXJYMk', 'xytryolMZP', 'yggrqi1E0k', 'TWArH3TW69', 'FZIraDZIYt', 'wifr8NpYFs'
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, SIQfwITd9ei2CpANlp.cs	High entropy of concatenated method names: 'pQDIFusNum', 'cmPIM6Or55', 'ex3I4ZgLkW', 'UpXIswQFrs', 'jyGI3FVxnK', 'b9DIhsPulk', 'U6IIEdvaEM', 'vYdItAF6DL', 'HIKIiiTltH', 'doEIPK629q'
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, AlgpF0sIMI7wBJ03Gu.cs	High entropy of concatenated method names: 'AELpBKGQsO', 'sqJprkPo4o', 'og8pZ39RM4', 'o8WpuhuwR5', 'CWnpIRHmag', 'TrDpQY3hdW', 'H8VpyaYXBt', 'UkieEp5Mei', 'RSjetoDFPm', 'M8ueiY9Tv5'
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, A99IY269OrPLqVFrp2.cs	High entropy of concatenated method names: 'VWnQJNfWBW', 'v0hQALLcqH', 'GilXmHukg6', 'G0uX5W1cYN', 'TyjXc3AY6b', 'GUdXSnoV37', 'Jw2XOw11mR', 'yEkXLxAFD5', 'sNfXC7fh4w', 'fvHXUCBILP'
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, jy272HJXpTWWhUZ0r3.cs	High entropy of concatenated method names: 'eViXYOW3rR', 'CLUXokd0fa', 'spFXKTBYHt', 'YwPXkXByRW', 'nLaXTtwSZj', 'zHGX9eDSND', 'GXIXnZTY7a', 'c6aXe4jigC', 'QtsXp9R8wI', 'DUnX1gArEW'
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, yUXuXNUq68P96YSGRh.cs	High entropy of concatenated method names: 'Dispose', 'tDpBipLP9D', 'aTFVDRF0cm', 'Uc1xx1lYd4', 'k4yBPx91Au', 'S9ZBzBhCMu', 'ProcessDialogKey', 'F1SVGp5Zl9', 'vNHVBKayAi', 'ziRVVYSItn'
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, vpCmup94T7VrxmPluJ.cs	High entropy of concatenated method names: 'ToString', 'C7R9wLoLx6', 'bc69DxrQMw', 'NIk9mQtVNn', 'eLw95IwZun', 'hP79cb1omf', 'T239S70NAo', 'cUV9OwjF9a', 'VyT9L12h06', 'fHt9CXOlSJ'
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, nn0B2Ei9tlVnIbvlnQ.cs	High entropy of concatenated method names: 'PKOqgA3dKi', 'bvDqlLnOkX', 'TBEqddkUxe', 'wiAqYuRSj4', 'IoWqJidZLS', 'uiWqoIGN28', 'VlBqA2joqV', 'TYFqKjDTgV', 'dlfqkE8Yqf', 't3SqvoGdJK'
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, astpH0IZwtMO22Sbdr.cs	High entropy of concatenated method names: 'rGWeuX4peC', 'IwaeI5wHSi', 'fJReX62T2l', 'gEveQZkvZF', 'cj6eyspwy4', 'dAIeqVk9rB', 'Rj5eHalvte', 'BVbeaIEYHX', 'Iufe8yDHwg', 'PLRe7vyQx0'
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, IsXVmmk7SsweRGxjwD.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'CCpVi9kBDY', 'zf4VPmQ3fT', 'yJQVzDJk4P', 'j9krGKrrWH', 'v2qrB1Y7xQ', 'MBGrV3xpEc', 'USprr8fDJD', 'Kd559AYYiqVDk2EXsTc'
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, uGs8lVOZpO8VCg0kB1.cs	High entropy of concatenated method names: 'rlUTUCYMft', 'n3jT6IsyPB', 'oVgTFiq9Fp', 'eXrTM8R9BX', 'uDcTDMnNyi', 'sUuTmtow7h', 'CCwT56xB2S', 'a2mTcNsqA8', 'RyETSmMEl4', 'jC6TOwShGk'
Source: 0.2.rQuotation3200025006.exe.6f70000.5.raw.unpack, OWdE7xw0tiiGCQCYNU.cs	High entropy of concatenated method names: 'qeSBqjCPlZ', 'Q2dBHUnVTJ', 'WbOB8s7lbK', 'zeWB7DCKVY', 'gYPBTn7q4J', 'OY7B9oC5ZK', 'GlTAKmQGI5iXqkYVxQ', 'Yloi4TMxjBLjKV7ToY', 'H0uBBMWCV4', 'iSjBra1CpO'

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	File created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe			Jump to dropped file
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	File created: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\rQuotation3200025006.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp3D2.tmp"

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sgxIb			Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sgxIb			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	File opened: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	File opened: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe:Zone.Identifier read attributes \| delete

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: rQuotation3200025006.exe PID: 6744, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Memory allocated: 8A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Memory allocated: 26B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Memory allocated: 2560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Memory allocated: 7800000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Memory allocated: 8800000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Memory allocated: 89C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Memory allocated: 99C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Memory allocated: 1190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Memory allocated: 2C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Memory allocated: 1190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Memory allocated: D20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Memory allocated: 26A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Memory allocated: 2500000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Memory allocated: 72F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Memory allocated: 82F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Memory allocated: 8490000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Memory allocated: 9490000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Memory allocated: 18C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Memory allocated: 34B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Memory allocated: 32F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: AA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 24D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 22C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 7280000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 8280000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 8430000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 9430000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 3020000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 31F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 51F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 2C90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 2ED0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 2D10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 7C40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 8C40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 8DF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 9DF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 32C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 3360000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 5360000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 598889	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 598561	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 598451	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 598124	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 598002	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 597789	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 597683	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 597553	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 597308	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 596417	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 595749	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 595639	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 595410	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 595279	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 595169	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 594864	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 594585	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 594468	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 594359	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 594244	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 594125	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 594015	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 599859
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 599750
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 599640
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 599531
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 599421
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 599312
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 599203
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 599093
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 598984
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 598874
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 598726
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 598609
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 598499
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 598390
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 598281
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 598171
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 598059
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 597953
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 597843
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 597317
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 597165
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 597049
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 596921
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 596812
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 596697
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 596574
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 596468
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 596302
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 596171
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 596062
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 595949
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 595843
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 595734
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 595624
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 595515
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 595406
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 595268
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 595146
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 594450
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 594343
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 594234
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 594125
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 594015
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 593906
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 593794
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 593687
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 593578
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 593464
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 593310
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599890
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599768
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599640
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599454
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599328
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599217
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599109
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599000
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598890
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598781
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598671
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598562
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598453
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598343
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598234
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598125
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598015
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597906
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597796
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597687
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597578
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597468
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597359
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597250
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597140
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597031
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596921
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596812
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596703
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596593
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596484
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596375
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596260
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596142
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596015
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595905
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595791
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595679
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595575
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595468
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595358
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599765
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599654
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599547
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599437
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599327
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599218
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599109
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598994
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598890
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598781
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598668
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598562
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598453
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598339
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598234
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598125
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598015
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597906
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597797
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597687
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597578
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597468
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597359
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597250
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597140
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597031
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596915
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596812
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596703
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596593
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596484
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596375
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596265
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596156
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596046
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595934
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595828
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595718
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595609
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595500
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595390
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595281
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595171
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595062
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594953
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594839
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594734
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594625

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7917	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1660	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7848	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1809	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Window / User API: threadDelayed 3835	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Window / User API: threadDelayed 6006	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Window / User API: threadDelayed 2702
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Window / User API: threadDelayed 7150
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Window / User API: threadDelayed 5038
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Window / User API: threadDelayed 3268
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Window / User API: threadDelayed 2671
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Window / User API: threadDelayed 7188

Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 6800	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6416	Thread sleep count: 7917 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1004	Thread sleep count: 1660 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7196	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -599546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -598999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -598889s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -598561s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -598451s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -598343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -598124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -598002s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -597789s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -597683s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -597553s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -597422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -597308s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -597187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -597078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -596968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -596859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -596750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -596640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -596531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -596417s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -596297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -596187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -596078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -595968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -595859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -595749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -595639s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -595531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -595410s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -595279s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -595169s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -594864s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -594734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -594585s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -594468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -594359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -594244s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -594125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe TID: 7372	Thread sleep time: -594015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7280	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -34126476536362649s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -599859s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -599750s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -599640s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -599531s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -599421s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -599312s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -599203s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -599093s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -598984s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -598874s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -598726s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -598609s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -598499s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -598390s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -598281s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -598171s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -598059s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -597953s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -597843s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -597317s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -597165s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -597049s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -596921s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -596812s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -596697s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -596574s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -596468s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -596302s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -596171s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -596062s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -595949s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -595843s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -595734s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -595624s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -595515s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -595406s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -595268s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -595146s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -594450s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -594343s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -594234s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -594125s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -594015s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -593906s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -593794s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -593687s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -593578s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -593464s >= -30000s
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe TID: 7728	Thread sleep time: -593310s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7872	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -24903104499507879s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7148	Thread sleep count: 5038 > 30
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -599890s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7148	Thread sleep count: 3268 > 30
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -599768s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -599640s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -599454s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -599328s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -599217s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -599109s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -599000s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -598890s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -598781s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -598671s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -598562s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -598453s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -598343s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -598234s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -598125s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -598015s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -597906s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -597796s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -597687s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -597578s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -597468s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -597359s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -597250s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -597140s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -597031s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -596921s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -596812s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -596703s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -596593s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -596484s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -596375s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -596260s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -596142s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -596015s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -595905s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -595791s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -595679s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -595575s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -595468s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7100	Thread sleep time: -595358s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 352	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -26747778906878833s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -599875s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -599765s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -599654s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -599547s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -599437s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -599327s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -599218s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -599109s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -598994s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -598890s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -598781s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -598668s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -598562s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -598453s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -598339s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -598234s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -598125s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -598015s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -597906s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -597797s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -597687s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -597578s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -597468s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -597359s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -597250s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -597140s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -597031s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -596915s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -596812s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -596703s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -596593s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -596484s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -596375s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -596265s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -596156s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -596046s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -595934s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -595828s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -595718s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -595609s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -595500s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -595390s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -595281s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -595171s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -595062s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -594953s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -594839s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -594734s >= -30000s
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 7424	Thread sleep time: -594625s >= -30000s

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 598889	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 598561	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 598451	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 598124	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 598002	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 597789	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 597683	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 597553	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 597308	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 596417	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 595749	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 595639	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 595410	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 595279	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 595169	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 594864	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 594585	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 594468	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 594359	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 594244	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 594125	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Thread delayed: delay time: 594015	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 599859
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 599750
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 599640
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 599531
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 599421
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 599312
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 599203
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 599093
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 598984
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 598874
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 598726
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 598609
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 598499
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 598390
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 598281
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 598171
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 598059
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 597953
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 597843
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 597317
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 597165
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 597049
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 596921
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 596812
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 596697
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 596574
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 596468
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 596302
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 596171
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 596062
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 595949
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 595843
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 595734
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 595624
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 595515
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 595406
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 595268
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 595146
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 594450
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 594343
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 594234
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 594125
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 594015
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 593906
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 593794
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 593687
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 593578
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 593464
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Thread delayed: delay time: 593310
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599890
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599768
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599640
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599454
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599328
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599217
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599109
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599000
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598890
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598781
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598671
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598562
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598453
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598343
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598234
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598125
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598015
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597906
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597796
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597687
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597578
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597468
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597359
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597250
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597140
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597031
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596921
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596812
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596703
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596593
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596484
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596375
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596260
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596142
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596015
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595905
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595791
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595679
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595575
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595468
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595358
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599765
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599654
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599547
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599437
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599327
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599218
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599109
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598994
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598890
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598781
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598668
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598562
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598453
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598339
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598234
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598125
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598015
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597906
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597797
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597687
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597578
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597468
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597359
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597250
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597140
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597031
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596915
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596812
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596703
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596593
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596484
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596375
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596265
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596156
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596046
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595934
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595828
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595718
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595609
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595500
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595390
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595281
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595171
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595062
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594953
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594839
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594734
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594625

Source: rQuotation3200025006.exe, 00000008.00000002.4158424515.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllO
Source: sgxIb.exe, 0000001C.00000002.4158194442.000000000181E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllf
Source: pBBqGOzrz.exe, 0000000E.00000002.4157797826.000000000168A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll?
Source: sgxIb.exe, 00000016.00000002.1959190035.00000000015C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll$

Source: C:\Users\user\Desktop\rQuotation3200025006.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\rQuotation3200025006.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rQuotation3200025006.exe"
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pBBqGOzrz.exe"
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rQuotation3200025006.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pBBqGOzrz.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Memory written: C:\Users\user\Desktop\rQuotation3200025006.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Memory written: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory written: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory written: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rQuotation3200025006.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pBBqGOzrz.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp3D2.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Process created: C:\Users\user\Desktop\rQuotation3200025006.exe "C:\Users\user\Desktop\rQuotation3200025006.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp1AB5.tmp"
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process created: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe "C:\Users\user\AppData\Roaming\pBBqGOzrz.exe"
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Process created: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe "C:\Users\user\AppData\Roaming\pBBqGOzrz.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp4705.tmp"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp6606.tmp"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"

Source: rQuotation3200025006.exe, 00000008.00000002.4163306810.0000000002D3B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q3<b>[ Program Manager]</b> (27/09/2024 22:02:17)<br>
Source: rQuotation3200025006.exe, 00000008.00000002.4163306810.0000000002D3B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: rQuotation3200025006.exe, 00000008.00000002.4163306810.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: <html>Time: 10/15/2024 03:01:59<br>User Name: user<br>Computer Name: 849224<br>OSFullName: Microsoft Windows 10 Pro<br>CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz<br>RAM: 8191.25 MB<br>IP Address: 8.46.123.33<br><hr><b>[ Program Manager]</b> (27/09/2024 22:02:17)<br>{Win}r</html>
Source: rQuotation3200025006.exe, 00000008.00000002.4163306810.0000000002D3B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q
Source: rQuotation3200025006.exe, 00000008.00000002.4163306810.0000000002D3B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q8<b>[ Program Manager]</b> (27/09/2024 22:02:17)<br>{Win}THcq
Source: rQuotation3200025006.exe, 00000008.00000002.4163306810.0000000002D3B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q9<b>[ Program Manager]</b> (27/09/2024 22:02:17)<br>{Win}rTHcq

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Users\user\Desktop\rQuotation3200025006.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Users\user\Desktop\rQuotation3200025006.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Queries volume information: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Queries volume information: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\rQuotation3200025006.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.rQuotation3200025006.exe.377e4e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.sgxIb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rQuotation3200025006.exe.3741cc0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rQuotation3200025006.exe.377e4e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rQuotation3200025006.exe.3741cc0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.4163218058.00000000033DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.4163218058.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4164492788.000000000354A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4163306810.0000000002CDC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1961223046.0000000003241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1958682977.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4164492788.0000000003501000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1961223046.000000000326C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4163306810.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1732806803.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rQuotation3200025006.exe PID: 6744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rQuotation3200025006.exe PID: 2756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pBBqGOzrz.exe PID: 7616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sgxIb.exe PID: 8012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sgxIb.exe PID: 7188, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\rQuotation3200025006.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\rQuotation3200025006.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.rQuotation3200025006.exe.377e4e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.sgxIb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rQuotation3200025006.exe.3741cc0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rQuotation3200025006.exe.377e4e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rQuotation3200025006.exe.3741cc0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.4163218058.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1961223046.0000000003241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1958682977.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4164492788.0000000003501000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4163306810.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1732806803.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rQuotation3200025006.exe PID: 6744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rQuotation3200025006.exe PID: 2756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pBBqGOzrz.exe PID: 7616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sgxIb.exe PID: 8012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sgxIb.exe PID: 7188, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.rQuotation3200025006.exe.377e4e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.sgxIb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rQuotation3200025006.exe.3741cc0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rQuotation3200025006.exe.377e4e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rQuotation3200025006.exe.3741cc0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.4163218058.00000000033DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.4163218058.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4164492788.000000000354A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4163306810.0000000002CDC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1961223046.0000000003241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1958682977.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4164492788.0000000003501000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1961223046.000000000326C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4163306810.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1732806803.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rQuotation3200025006.exe PID: 6744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rQuotation3200025006.exe PID: 2756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pBBqGOzrz.exe PID: 7616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sgxIb.exe PID: 8012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sgxIb.exe PID: 7188, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	112 Process Injection	1 Deobfuscate/Decode Files or Information	31 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	3 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	211 Security Software Discovery	Distributed Component Object Model	31 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rQuotation3200025006.exe	58%	ReversingLabs	ByteCode-MSIL.Spyware.Negasteal
rQuotation3200025006.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\pBBqGOzrz.exe	58%	ReversingLabs	ByteCode-MSIL.Spyware.Negasteal
C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	58%	ReversingLabs	ByteCode-MSIL.Spyware.Negasteal

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false		unknown
ftp.haliza.com.my	110.4.45.197	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	rQuotation3200025006.exe, 00000000.00000002.1732806803.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000016.00000002.1958682977.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	rQuotation3200025006.exe, 00000008.00000002.4163306810.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, pBBqGOzrz.exe, 0000000E.00000002.4164492788.00000000034B1000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000016.00000002.1961223046.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 0000001C.00000002.4163218058.000000000336C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.carterandcone.coml	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org	rQuotation3200025006.exe, 00000000.00000002.1732806803.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, rQuotation3200025006.exe, 00000008.00000002.4163306810.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, pBBqGOzrz.exe, 0000000E.00000002.4164492788.00000000034B1000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000016.00000002.1958682977.0000000000402000.00000040.00000400.00020000.00000000.sdmp, sgxIb.exe, 00000016.00000002.1961223046.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 0000001C.00000002.4163218058.000000000336C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ftp.haliza.com.my	rQuotation3200025006.exe, 00000008.00000002.4163306810.0000000002E28000.00000004.00000800.00020000.00000000.sdmp, rQuotation3200025006.exe, 00000008.00000002.4163306810.0000000002CDC000.00000004.00000800.00020000.00000000.sdmp, rQuotation3200025006.exe, 00000008.00000002.4163306810.0000000002D3B000.00000004.00000800.00020000.00000000.sdmp, rQuotation3200025006.exe, 00000008.00000002.4163306810.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp, pBBqGOzrz.exe, 0000000E.00000002.4164492788.000000000354A000.00000004.00000800.00020000.00000000.sdmp, pBBqGOzrz.exe, 0000000E.00000002.4164492788.00000000035FF000.00000004.00000800.00020000.00000000.sdmp, pBBqGOzrz.exe, 0000000E.00000002.4164492788.00000000036EA000.00000004.00000800.00020000.00000000.sdmp, pBBqGOzrz.exe, 0000000E.00000002.4164492788.00000000036E5000.00000004.00000800.00020000.00000000.sdmp, pBBqGOzrz.exe, 0000000E.00000002.4164492788.0000000003634000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000016.00000002.1961223046.000000000326C000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 0000001C.00000002.4163218058.00000000036C7000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 0000001C.00000002.4163218058.00000000033DC000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 0000001C.00000002.4163218058.0000000003496000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.jiyu-kobo.co.jp/	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	rQuotation3200025006.exe, 00000000.00000002.1732045998.0000000002701000.00000004.00000800.00020000.00000000.sdmp, rQuotation3200025006.exe, 00000008.00000002.4163306810.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, pBBqGOzrz.exe, 00000009.00000002.1841537852.00000000026F1000.00000004.00000800.00020000.00000000.sdmp, pBBqGOzrz.exe, 0000000E.00000002.4164492788.00000000034B1000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000010.00000002.1901166814.0000000002521000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000016.00000002.1961223046.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000019.00000002.1979059945.0000000002F24000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 0000001C.00000002.4163218058.000000000336C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	rQuotation3200025006.exe, 00000000.00000002.1735717457.0000000005030000.00000004.00000020.00020000.00000000.sdmp, rQuotation3200025006.exe, 00000000.00000002.1735923407.0000000006762000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
110.4.45.197	ftp.haliza.com.my	Malaysia		46015	EXABYTES-AS-APExaBytesNetworkSdnBhdMY	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520520
Start date and time:	2024-09-27 13:09:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rQuotation3200025006.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@39/20@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 415 Number of non-executed functions: 30
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: rQuotation3200025006.exe

Simulations

Behavior and APIs

Time	Type	Description
07:09:58	API Interceptor	6782479x Sleep call for process: rQuotation3200025006.exe modified
07:10:01	API Interceptor	74x Sleep call for process: powershell.exe modified
07:10:04	API Interceptor	1539219x Sleep call for process: pBBqGOzrz.exe modified
07:10:17	API Interceptor	5531601x Sleep call for process: sgxIb.exe modified
12:10:03	Task Scheduler	Run new task: pBBqGOzrz path: C:\Users\user\AppData\Roaming\pBBqGOzrz.exe
12:10:08	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run sgxIb C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
12:10:16	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run sgxIb C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.Evo-gen.13899.14592.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
110.4.45.197	z38PO_20248099-1_pdf.exe	Get hash	malicious	AgentTesla	Browse
	z64MT103_126021720924_pdf.exe	Get hash	malicious	AgentTesla	Browse
	rPO_20248099-112,300PCS.exe	Get hash	malicious	AgentTesla	Browse
	PO__20248099-1 12,300PCS.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	mSLEwIfTGL.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	RTGS-WB-ABS-240730-NEW.lnk	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Purchase order.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://mzansibonds.com/dshk/tmpasdfghjklkjhgfdewertyuioiuytresdxcvbnmnbvfcdsew345678987654rewsdfvgbhnjhbgvfdesw23e45678uijdhgfcsvzbdncqasdcxw.php	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	http://correctingservicesalakks.pages.dev/	Get hash	malicious	Unknown	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	104.26.12.205
	https://lothanse-heracklarne.pages.dev/help/contact/547074160798771	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	104.26.13.205
ftp.haliza.com.my	z38PO_20248099-1_pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	z64MT103_126021720924_pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	rPO_20248099-112,300PCS.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	PO__20248099-1 12,300PCS.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	PO.xls	Get hash	malicious	Remcos	Browse	104.21.64.88
	.05.2024.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	ATT71725.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://metapolicyreview.com/	Get hash	malicious	Unknown	Browse	104.16.79.73
	Payment Notification.msg	Get hash	malicious	Unknown	Browse	104.21.68.220
	Aisha C. Yetman shared you a document..msg	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjsulL2bcqZSGb5TVbFOhW-BzJJtb8_QJJBgbE1zqe78Ie8BMxsNyhIFwdKd0pdA90RMhgTdSzkU9EZ9vbhoKh9hWuvNOpIawTAXoH5R0ak3U5rG_o-sZZz3gEiDRvTxtIDu5LY0qOySZABWrjrj9OfeDXHmC1qe7sBrjM2U90kovZKuuD34ZvXQ_OD2Hq--rkZwnu_VhQVAySwVh2ojndP52NUX9X40zwPfUt6TCc4F2rNspoMzray6vSBsFLXUX7nVDHqqILMYBWJr9fSc6AC0-g4meRNvX0rdEgcGztZ5SXk2Zbb1UlFLMFg&sai=AMfl-YQ851Qqa8i013PHKiB6TgTZ-QzfEpO1vcyiniBLSOaNAv3siIC9L9LV3aRq_nbn81w6wFB7OvNqhOdGvo-t7Q&sig=Cg0ArKJSzNuc_g1R_f21EAE&fbs_aeid=&urlfix=1&adurl=https://t.events.caixabank.com/r/?id=h665ab089,6dc7f7ae,f89fd96&p1=d70r46aqireop.cloudfront.net%23QZ~MamRpYXpAZXZlcnNoZWRzLXN1dGhlcmxhbmQuZXM=	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	bfINGx7hvL.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	mSLEwIfTGL.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
EXABYTES-AS-APExaBytesNetworkSdnBhdMY	z38PO_20248099-1_pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	z64MT103_126021720924_pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	103.6.198.219
	PO#005.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	103.6.198.178
	purchase order.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	103.6.198.178
	rPO_20248099-112,300PCS.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	PO__20248099-1 12,300PCS.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	https://hijauanhills.com.my/wp-content/upgrade/index.php?uid=qvc-communication@qvcjp.com	Get hash	malicious	Unknown	Browse	43.252.214.42
	https://hijauanhills.com.my/wp-content/upgrade/index.php?uid=qvc-communication@qvcjp.com	Get hash	malicious	Unknown	Browse	43.252.214.42
	https://trk.klclick3.com/ls/click?upn=%75001%2ec09Q0Iaa5JBKaMwLC9cMjFMyHYn-2B6EZxbTX-2FaxXPaGrg5dbeFH4fD3EuQFBIIXLREGZ-2FcOKC34mnxZPxIQx7XghFIqGaXY6alnacloe8xRo-3DgClE_PsKyq3SDuMFd2Bvwnm7-2BcmPfS0aZrbIGf331gXNHUSe-2BhQgqUpFiX3w7h5jUnRd6n-2FE8HERNVnz6BOvKs-2F6ulrBAPhqq4y7BxG-2Bd6kG7tLUxcOuHiFWpTHeDGZUnvDZvP6FM52V2kHQ6WJAZs6KQLxfqZHXfS07MTZdpG9vj-2FyhrEPsl2OqZg5lzEsrvURNsKVvDj6AmF6Sc1Z4lZAW7CGdtCrIGzdnodzXHJg2ktm7ptAUSv125vaGKXpRXhbzmAu5lE-2BvgScXpoVnTswlbot2XqG-2FJI21NuECHLJYOtT13mulLg3LyC43ioSpIwstqzATUDNosl6pb3KNNf3I-2F07dDO2NkZcrZt-2B2G5uraxeQ-3D#/?/c3plbGxAam9uZXNqdW5jdGlvbi5jb20=	Get hash	malicious	Unknown	Browse	103.6.198.53

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	.05.2024.exe	Get hash	malicious	Snake Keylogger	Browse	104.26.12.205
	file.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://smallpdf.com/sign-pdf/document#data=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2VzaWduLnNtYWxscGRmLXN0YWdpbmcuY29tIiwic3ViIjoiNjE3MmQyMzMtODcyNy00M2NhLWI1NjQtYjgwZDUyZjYxYmVjIiwiYXVkIjpbImVzaWduIl0sImV4cCI6MTcyODYzODEyMCwibmJmIjoxNzI3NDI4NTIwLCJpYXQiOjE3Mjc0Mjg1MjAsImp0aSI6IjYxNzJkMjMzLTg3MjctNDNjYS1iNTY0LWI4MGQ1MmY2MWJlYyIsInBheWxvYWQiOnsiZW52ZWxvcGVfaWQiOiI2ZWRlMzFjZS00Mzc2LTQwYzItYjJjNy1jMDc2Y2M3MjY4NjIiLCJzaWduX3JlcXVlc3RfaWQiOiI2MTcyZDIzMy04NzI3LTQzY2EtYjU2NC1iODBkNTJmNjFiZWMiLCJ0b2tlbl90eXBlIjoibm90aWZpY2F0aW9uIiwidXNlcl9lbWFpbCI6ImNoYW8ud3VAd3JpLm9yZyIsInVzZXJfZmlyc3RuYW1lIjoiY2hhby53dUB3cmkub3JnIiwidXNlcl9sYXN0bmFtZSI6ImNoYW8ud3VAd3JpLm9yZyJ9fQ.UX67GiHBKgjV8XyH-SFTt_KgB2I_q2j9cbGTSqbzRvY&eid=6ede31ce-4376-40c2-b2c7-c076cc726862&esrt=6172d233-8727-43ca-b564-b80d52f61bec	Get hash	malicious	Unknown	Browse	104.26.12.205
	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	104.26.12.205
	GfGxum1sf3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.12.205
	GfGxum1sf3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.12.205
	1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.12.205
	Teklif-6205018797-6100052155-UUE.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	RFQ 2024.09.26-89 vivecta.vbs	Get hash	malicious	PureLog Stealer	Browse	104.26.12.205
	RTGS-WB-ABS-240730-NEW.lnk	Get hash	malicious	AgentTesla	Browse	104.26.12.205

Process:	C:\Users\user\AppData\Roaming\pBBqGOzrz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rQuotation3200025006.exe.log

Download File

Process:	C:\Users\user\Desktop\rQuotation3200025006.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sgxIb.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380805901110357
Encrypted:	false
SSDEEP:	48:lylWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//Z+Uyus:lGLHyIFKL3IZ2KRH9OugIs
MD5:	BB0D009D716C19EF3E3D871F7E5615A7
SHA1:	24A3A9549BBF1704F44604631DF92D78D48ED3B5
SHA-256:	CAD65E7B83D76910680E43406ED1EEF6BB6CDC27ED79E3462EDD5F90CFD37F05
SHA-512:	D3159537188A4AE3F51CA245E63DAFDFA286D6172573847371382F84A4B5F819730B03F4A541BBEAAC022F20F283B92127C526A675FEB1D33636FF17CBDD0C17
Malicious:	false
Preview:	@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5yxvmcso.vcw.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cvroevrq.yjr.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ef5osgc1.1rh.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f2mf5iym.s1p.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hmntbso3.xpb.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hnualhbp.jmy.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iu1bd2vm.grk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w5d5d3d2.qtb.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp1AB5.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\pBBqGOzrz.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1575
Entropy (8bit):	5.11956975542299
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNta6xvn:cge1wYrFdOFzOzN33ODOiDdKrsuTZv
MD5:	0BC1179F57AA1484371BB1B435F4BD7D
SHA1:	CB4BE3E603D898E3F1839E3C1FCBFC5E1F90107F
SHA-256:	C1F88BCE4E2860F745C5F16ED6C6E97F8B3BB651A8EE4BBFB37FC2B558A1EDC5
SHA-512:	A56D005FCCC977E55701CDEA3B88DF0AC337420BFA3CFCB7F016149CA70C0A7EEFEAE9A8E499D1C14D005163E9BC6BB783E093D73B7673687DCDC68DFD84BC9A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp3D2.tmp

Download File

Process:	C:\Users\user\Desktop\rQuotation3200025006.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1575
Entropy (8bit):	5.11956975542299
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNta6xvn:cge1wYrFdOFzOzN33ODOiDdKrsuTZv
MD5:	0BC1179F57AA1484371BB1B435F4BD7D
SHA1:	CB4BE3E603D898E3F1839E3C1FCBFC5E1F90107F
SHA-256:	C1F88BCE4E2860F745C5F16ED6C6E97F8B3BB651A8EE4BBFB37FC2B558A1EDC5
SHA-512:	A56D005FCCC977E55701CDEA3B88DF0AC337420BFA3CFCB7F016149CA70C0A7EEFEAE9A8E499D1C14D005163E9BC6BB783E093D73B7673687DCDC68DFD84BC9A
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp4705.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1575
Entropy (8bit):	5.11956975542299
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNta6xvn:cge1wYrFdOFzOzN33ODOiDdKrsuTZv
MD5:	0BC1179F57AA1484371BB1B435F4BD7D
SHA1:	CB4BE3E603D898E3F1839E3C1FCBFC5E1F90107F
SHA-256:	C1F88BCE4E2860F745C5F16ED6C6E97F8B3BB651A8EE4BBFB37FC2B558A1EDC5
SHA-512:	A56D005FCCC977E55701CDEA3B88DF0AC337420BFA3CFCB7F016149CA70C0A7EEFEAE9A8E499D1C14D005163E9BC6BB783E093D73B7673687DCDC68DFD84BC9A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp6606.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1575
Entropy (8bit):	5.11956975542299
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNta6xvn:cge1wYrFdOFzOzN33ODOiDdKrsuTZv
MD5:	0BC1179F57AA1484371BB1B435F4BD7D
SHA1:	CB4BE3E603D898E3F1839E3C1FCBFC5E1F90107F
SHA-256:	C1F88BCE4E2860F745C5F16ED6C6E97F8B3BB651A8EE4BBFB37FC2B558A1EDC5
SHA-512:	A56D005FCCC977E55701CDEA3B88DF0AC337420BFA3CFCB7F016149CA70C0A7EEFEAE9A8E499D1C14D005163E9BC6BB783E093D73B7673687DCDC68DFD84BC9A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\pBBqGOzrz.exe

Download File

Process:	C:\Users\user\Desktop\rQuotation3200025006.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	645120
Entropy (8bit):	7.93913808186164
Encrypted:	false
SSDEEP:	12288:rWVw0rZbRJNrpBr6NM+2543sxKNEV28KddaEWtyef:ydbRXpBraM+2W3EKc2gxtx
MD5:	36C4BFF0F1CDCDA62DA9229500CA1E38
SHA1:	DE74DBF7BAC85A3A06C7038A4D4241389E6A5C8F
SHA-256:	FDA83ECB5BD6A07DEDAF6BE0FCE7C626E21E9DF94D82DDB905460E9D6A25A162
SHA-512:	661CDEE4EFE389DAC6AB7D8F5CF92A04403E7B6934942E18B4D2E5A7C609DF58EEA44D2E85EBB9592BF8544BC89C543CC7F01A2E67E0D1041AA22654CCBF124C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....".f................................. ........@.. .......................@............@.....................................W............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......d...0?......2....................................................0..A....... :........%.@...(.....A... .........%.'...(.....(...( ........&.....{...."..}........0..h...............%.r...p.%.r...p.%.r...p.%.r...p.%.r...p.%.r...p.%.r...p.%.r...p.%.r...p.%..r...p.}....+..(......0..{.............%.....(.................. ....... .-..... .,..... =..... .7..... .+..... v...... .$....................( ........&..0..Y.......~A.....~(.....+Z..E................m...4....

C:\Users\user\AppData\Roaming\pBBqGOzrz.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\rQuotation3200025006.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Download File

Process:	C:\Users\user\Desktop\rQuotation3200025006.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	645120
Entropy (8bit):	7.93913808186164
Encrypted:	false
SSDEEP:	12288:rWVw0rZbRJNrpBr6NM+2543sxKNEV28KddaEWtyef:ydbRXpBraM+2W3EKc2gxtx
MD5:	36C4BFF0F1CDCDA62DA9229500CA1E38
SHA1:	DE74DBF7BAC85A3A06C7038A4D4241389E6A5C8F
SHA-256:	FDA83ECB5BD6A07DEDAF6BE0FCE7C626E21E9DF94D82DDB905460E9D6A25A162
SHA-512:	661CDEE4EFE389DAC6AB7D8F5CF92A04403E7B6934942E18B4D2E5A7C609DF58EEA44D2E85EBB9592BF8544BC89C543CC7F01A2E67E0D1041AA22654CCBF124C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....".f................................. ........@.. .......................@............@.....................................W............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......d...0?......2....................................................0..A....... :........%.@...(.....A... .........%.'...(.....(...( ........&.....{...."..}........0..h...............%.r...p.%.r...p.%.r...p.%.r...p.%.r...p.%.r...p.%.r...p.%.r...p.%.r...p.%..r...p.}....+..(......0..{.............%.....(.................. ....... .-..... .,..... =..... .7..... .+..... v...... .$....................( ........&..0..Y.......~A.....~(.....+Z..E................m...4....

C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\rQuotation3200025006.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.93913808186164
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	rQuotation3200025006.exe
File size:	645'120 bytes
MD5:	36c4bff0f1cdcda62da9229500ca1e38
SHA1:	de74dbf7bac85a3a06c7038a4d4241389e6a5c8f
SHA256:	fda83ecb5bd6a07dedaf6be0fce7c626e21e9df94d82ddb905460e9d6a25a162
SHA512:	661cdee4efe389dac6ab7d8f5cf92a04403e7b6934942e18b4d2e5a7c609df58eea44d2e85ebb9592bf8544bc89c543cc7f01a2e67e0d1041aa22654ccbf124c
SSDEEP:	12288:rWVw0rZbRJNrpBr6NM+2543sxKNEV28KddaEWtyef:ydbRXpBraM+2W3EKc2gxtx
TLSH:	59D423CC77AA8E36EA7C87B60462541813F364C59213FA0D5F8A35CA2E577CCA589F13
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....".f................................. ........@.. .......................@............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x49edee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F622F9 [Fri Sep 27 03:14:01 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9ed94	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa0000	0x600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9cdf4	0x9ce00	e78b011486a082e9197e2d965fb514b0	False	0.9600550921314741	data	7.946103748533992	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa0000	0x600	0x600	73346f2547818793e4e1f6f605b9d794	False	0.4225260416666667	data	4.11143285591599	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa2000	0xc	0x200	b70c11876092b370c3eeffc8aa726bbc	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa0090	0x32c	data			0.42980295566502463
RT_MANIFEST	0xa03cc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T13:10:17.718048+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.4	49741	110.4.45.197	21	TCP
2024-09-27T13:10:19.571041+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49746	110.4.45.197	53334	TCP
2024-09-27T13:10:19.576306+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49746	110.4.45.197	53334	TCP
2024-09-27T13:10:24.710806+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.4	49751	110.4.45.197	21	TCP
2024-09-27T13:10:25.537921+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49753	110.4.45.197	51497	TCP
2024-09-27T13:10:25.543689+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49753	110.4.45.197	51497	TCP
2024-09-27T13:10:31.146663+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.4	49756	110.4.45.197	21	TCP
2024-09-27T13:10:31.976691+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49757	110.4.45.197	55730	TCP
2024-09-27T13:10:31.982121+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49757	110.4.45.197	55730	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 13:10:02.316216946 CEST	49733	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:02.316262960 CEST	443	49733	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:02.316363096 CEST	49733	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:02.366570950 CEST	49733	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:02.366595030 CEST	443	49733	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:02.928730011 CEST	443	49733	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:02.928808928 CEST	49733	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:02.932893038 CEST	49733	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:02.932904959 CEST	443	49733	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:02.934041977 CEST	443	49733	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:02.997900963 CEST	49733	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:03.790529013 CEST	49733	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:03.831480980 CEST	443	49733	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:03.900651932 CEST	443	49733	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:03.900799036 CEST	443	49733	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:03.900868893 CEST	49733	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:04.157330036 CEST	49733	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:07.076766014 CEST	49736	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:07.081787109 CEST	21	49736	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:07.081937075 CEST	49736	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:07.134562016 CEST	49736	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:07.139583111 CEST	21	49736	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:07.139667988 CEST	49736	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:07.426703930 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:07.432915926 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:07.433006048 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:08.907953024 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:08.908003092 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:08.908032894 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:08.908128977 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:08.908215046 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:08.908216000 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:08.913192034 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:09.235133886 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:09.235284090 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:09.240219116 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:09.609087944 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:09.609256983 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:09.614214897 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:09.939069033 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:09.942521095 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:09.947500944 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:10.269857883 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:10.270051003 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:10.275121927 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:10.596981049 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:10.599124908 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:10.604007959 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:10.925662041 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:10.927442074 CEST	49738	53694	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:10.932336092 CEST	53694	49738	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:10.933264017 CEST	49738	53694	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:10.933353901 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:10.938177109 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:11.762018919 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:11.818424940 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:11.823148966 CEST	49738	53694	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:11.823651075 CEST	49738	53694	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:11.828017950 CEST	53694	49738	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:11.828027010 CEST	53694	49738	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:11.828037024 CEST	53694	49738	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:11.828672886 CEST	53694	49738	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:11.828742027 CEST	49738	53694	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:12.151508093 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:12.152465105 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:12.157346964 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:12.479223013 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:12.479662895 CEST	49739	53786	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:12.484497070 CEST	53786	49739	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:12.484592915 CEST	49739	53786	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:12.484707117 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:12.489475965 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:12.653898954 CEST	49740	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:12.653965950 CEST	443	49740	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:12.654089928 CEST	49740	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:12.658118010 CEST	49740	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:12.658150911 CEST	443	49740	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:13.122411013 CEST	443	49740	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:13.122508049 CEST	49740	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:13.124608040 CEST	49740	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:13.124618053 CEST	443	49740	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:13.124998093 CEST	443	49740	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:13.177814007 CEST	49740	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:13.247605085 CEST	49740	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:13.295420885 CEST	443	49740	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:13.321419954 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:13.321685076 CEST	49739	53786	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:13.326834917 CEST	53786	49739	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:13.326910019 CEST	49739	53786	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:13.353102922 CEST	443	49740	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:13.353228092 CEST	443	49740	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:13.353522062 CEST	49740	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:13.355443954 CEST	49740	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:13.365302086 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:13.884481907 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:13.885103941 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:13.885153055 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:14.658535957 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:14.757188082 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:14.757277966 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:15.600683928 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:15.600987911 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:15.605936050 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:15.931091070 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:15.935343027 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:15.940515041 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:16.301481962 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:16.301673889 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:16.306566954 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:16.631720066 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:16.631902933 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:16.636815071 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:16.961774111 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:17.005969048 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:17.045949936 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:17.050843000 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:17.376188993 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:17.382038116 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:17.386898994 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:17.711987972 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:17.712822914 CEST	49746	53334	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:17.717789888 CEST	53334	49746	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:17.717855930 CEST	49746	53334	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:17.718048096 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:17.722975016 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:18.820713043 CEST	49748	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:18.820749998 CEST	443	49748	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:18.820830107 CEST	49748	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:18.823816061 CEST	49748	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:18.823827982 CEST	443	49748	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:19.570696115 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:19.570862055 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:19.570960045 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:19.571041107 CEST	49746	53334	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:19.571049929 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:19.571101904 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:19.571192980 CEST	49746	53334	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:19.571302891 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:19.574316025 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:19.575839043 CEST	53334	49746	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:19.576230049 CEST	53334	49746	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:19.576306105 CEST	49746	53334	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:19.901110888 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:19.943479061 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:20.025316954 CEST	443	49748	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:20.025427103 CEST	49748	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:20.031899929 CEST	49748	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:20.031909943 CEST	443	49748	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:20.032247066 CEST	443	49748	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:20.084069967 CEST	49748	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:20.195568085 CEST	49748	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:20.202588081 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:20.207396984 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:20.243400097 CEST	443	49748	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:21.281092882 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:21.281181097 CEST	443	49748	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:21.281246901 CEST	443	49748	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:21.281387091 CEST	49748	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:21.283852100 CEST	49748	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:21.284106016 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:21.284137011 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:21.284158945 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:21.284311056 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:21.336075068 CEST	49750	59960	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:21.340892076 CEST	59960	49750	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:21.340964079 CEST	49750	59960	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:21.341022015 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:21.345844984 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:21.858325005 CEST	49751	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:21.863250017 CEST	21	49751	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:21.863333941 CEST	49751	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:22.180212975 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:22.180468082 CEST	49750	59960	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:22.180468082 CEST	49750	59960	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:22.185501099 CEST	59960	49750	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:22.185558081 CEST	59960	49750	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:22.185570955 CEST	59960	49750	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:22.185951948 CEST	59960	49750	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:22.186067104 CEST	49750	59960	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:22.224679947 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:22.513676882 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:22.516904116 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:22.521747112 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:22.701957941 CEST	21	49751	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:22.702133894 CEST	49751	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:22.707009077 CEST	21	49751	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:22.847029924 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:22.847414970 CEST	49752	65186	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:22.852679014 CEST	65186	49752	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:22.852802038 CEST	49752	65186	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:22.852849007 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:22.857779026 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:23.032072067 CEST	21	49751	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:23.032488108 CEST	49751	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:23.037455082 CEST	21	49751	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:23.385102034 CEST	21	49751	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:23.385229111 CEST	49751	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:23.390089989 CEST	21	49751	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:23.682950020 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:23.686599016 CEST	49752	65186	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:23.691596985 CEST	65186	49752	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:23.691737890 CEST	65186	49752	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:23.691812038 CEST	49752	65186	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:23.715152979 CEST	21	49751	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:23.715291977 CEST	49751	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:23.722523928 CEST	21	49751	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:23.740365028 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:24.018543005 CEST	21	49741	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:24.044948101 CEST	21	49751	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:24.045090914 CEST	49751	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:24.049859047 CEST	21	49751	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:24.068455935 CEST	49741	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:24.374522924 CEST	21	49751	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:24.374686003 CEST	49751	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:24.379771948 CEST	21	49751	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:24.704941034 CEST	21	49751	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:24.705620050 CEST	49753	51497	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:24.710485935 CEST	51497	49753	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:24.710586071 CEST	49753	51497	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:24.710805893 CEST	49751	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:24.715643883 CEST	21	49751	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:25.537411928 CEST	21	49751	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:25.537920952 CEST	49753	51497	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:25.537965059 CEST	49753	51497	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:25.542953014 CEST	51497	49753	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:25.543416023 CEST	51497	49753	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:25.543689013 CEST	49753	51497	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:25.584090948 CEST	49751	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:25.868066072 CEST	21	49751	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:25.892936945 CEST	49751	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:25.897993088 CEST	21	49751	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:26.223146915 CEST	21	49751	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:26.223920107 CEST	49754	65361	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:26.228841066 CEST	65361	49754	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:26.228899002 CEST	49754	65361	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:26.228996992 CEST	49751	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:26.233768940 CEST	21	49751	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:26.766532898 CEST	49755	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:26.766634941 CEST	443	49755	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:26.766735077 CEST	49755	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:26.770224094 CEST	49755	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:26.770261049 CEST	443	49755	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:27.066812992 CEST	21	49751	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:27.115348101 CEST	49751	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:27.242949963 CEST	443	49755	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:27.243043900 CEST	49755	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:27.276046038 CEST	49755	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:27.276139975 CEST	443	49755	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:27.276385069 CEST	443	49755	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:27.318695068 CEST	49755	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:27.347425938 CEST	49755	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:27.395406961 CEST	443	49755	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:27.457593918 CEST	443	49755	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:27.457649946 CEST	443	49755	104.26.12.205	192.168.2.4
Sep 27, 2024 13:10:27.457695961 CEST	49755	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:27.462587118 CEST	49755	443	192.168.2.4	104.26.12.205
Sep 27, 2024 13:10:28.301472902 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:28.306507111 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:28.306807041 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:28.350281000 CEST	49751	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:28.351356030 CEST	49754	65361	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:29.133990049 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:29.134206057 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:29.139206886 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:29.461889982 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:29.462064028 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:29.467634916 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:29.822135925 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:29.826246977 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:29.831170082 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:30.154460907 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:30.154666901 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:30.159470081 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:30.482898951 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:30.483570099 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:30.489854097 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:30.811661959 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:30.812300920 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:30.817274094 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:31.140465021 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:31.141289949 CEST	49757	55730	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:31.146450043 CEST	55730	49757	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:31.146544933 CEST	49757	55730	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:31.146662951 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:31.152157068 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:31.976399899 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:31.976691008 CEST	49757	55730	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:31.976773024 CEST	49757	55730	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:31.981568098 CEST	55730	49757	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:31.982063055 CEST	55730	49757	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:31.982120991 CEST	49757	55730	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:32.021596909 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:32.303776026 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:32.323329926 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:32.328181982 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:32.656864882 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:32.657329082 CEST	49758	60182	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:32.663191080 CEST	60182	49758	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:32.663345098 CEST	49758	60182	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:32.663347960 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:32.668981075 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:33.498569965 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:33.499006033 CEST	49758	60182	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:33.499133110 CEST	49758	60182	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:33.503952026 CEST	60182	49758	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:33.503974915 CEST	60182	49758	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:33.503985882 CEST	60182	49758	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:33.504762888 CEST	60182	49758	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:33.504839897 CEST	49758	60182	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:33.552867889 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:33.828073978 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:33.828564882 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:33.834392071 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:34.156984091 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:34.157469034 CEST	49759	61163	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:34.162374020 CEST	61163	49759	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:34.162461996 CEST	49759	61163	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:34.162580967 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:34.167361975 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:34.992522955 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:34.992733955 CEST	49759	61163	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:34.999034882 CEST	61163	49759	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:34.999120951 CEST	49759	61163	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:35.037350893 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:10:35.323205948 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:10:35.365360022 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:39.040805101 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:39.055085897 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:39.110284090 CEST	49761	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:39.116904974 CEST	21	49761	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:39.117002010 CEST	49761	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:39.117321968 CEST	49761	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:39.127830029 CEST	21	49761	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:39.129703045 CEST	21	49761	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:39.129842997 CEST	49761	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:39.378043890 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:39.379965067 CEST	49762	52440	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:39.386188030 CEST	52440	49762	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:39.386261940 CEST	49762	52440	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:39.386344910 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:39.397891045 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:40.304414988 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:40.304596901 CEST	49762	52440	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:40.304620028 CEST	49762	52440	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:40.314883947 CEST	52440	49762	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:40.317925930 CEST	52440	49762	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:40.317984104 CEST	49762	52440	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:40.349874973 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:40.667108059 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:40.709254980 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:57.040282011 CEST	49763	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:57.045429945 CEST	21	49763	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:57.052282095 CEST	49763	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:57.052282095 CEST	49763	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:57.057550907 CEST	21	49763	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:57.064270973 CEST	49763	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:58.709117889 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:58.714050055 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.099595070 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.104652882 CEST	49764	52328	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:59.109605074 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.110402107 CEST	49764	52328	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:59.110579967 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:59.115483046 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.945193052 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.947577953 CEST	49764	52328	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:59.952594995 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.952625036 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.952675104 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.952702999 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.952728987 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.952766895 CEST	49764	52328	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:59.952825069 CEST	49764	52328	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:59.952883005 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.952930927 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.952958107 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.952984095 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.953015089 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.953047037 CEST	49764	52328	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:59.953116894 CEST	49764	52328	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:59.957741976 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.957859993 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.958029032 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.958055019 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.958082914 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.958112955 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.958142996 CEST	49764	52328	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:59.958189011 CEST	49764	52328	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:59.958275080 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.958328009 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.958369970 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.958415985 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.958431959 CEST	49764	52328	192.168.2.4	110.4.45.197
Sep 27, 2024 13:11:59.958444118 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.958472013 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.958534956 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.963048935 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.963098049 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.963289022 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.963433027 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.963459969 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.963534117 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.963715076 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.964019060 CEST	52328	49764	110.4.45.197	192.168.2.4
Sep 27, 2024 13:11:59.968400002 CEST	49764	52328	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:00.021800995 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:00.185642958 CEST	49765	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:00.190757990 CEST	21	49765	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:00.190838099 CEST	49765	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:00.191011906 CEST	49765	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:00.196269989 CEST	21	49765	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:00.196331978 CEST	49765	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:00.780853033 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:01.021878958 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:01.023907900 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:01.023972988 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:02.980319977 CEST	49766	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:03.038110018 CEST	21	49766	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:03.038214922 CEST	49766	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:03.038531065 CEST	49766	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:03.043587923 CEST	21	49766	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:03.043860912 CEST	49766	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:19.012639999 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:19.017728090 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:19.463406086 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:19.464323997 CEST	49767	55958	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:19.528762102 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:19.528964996 CEST	49767	55958	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:19.528964043 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:19.544011116 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:19.748332024 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:19.822715998 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.253776073 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.257672071 CEST	49768	62561	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:20.286994934 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.287070036 CEST	49768	62561	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:20.294255972 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:20.301851034 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.528198004 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.528481007 CEST	49767	55958	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:20.534140110 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.534168959 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.534197092 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.534205914 CEST	49767	55958	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:20.534259081 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.534260988 CEST	49767	55958	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:20.534287930 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.534315109 CEST	49767	55958	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:20.534346104 CEST	49767	55958	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:20.534445047 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.534472942 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.534499884 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.534504890 CEST	49767	55958	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:20.534527063 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.534534931 CEST	49767	55958	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:20.534569979 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.534571886 CEST	49767	55958	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:20.534645081 CEST	49767	55958	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:20.540103912 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.540138960 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.540165901 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.540168047 CEST	49767	55958	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:20.540211916 CEST	49767	55958	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:20.540236950 CEST	49767	55958	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:20.540386915 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.540414095 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.540441990 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.540446997 CEST	49767	55958	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:20.540469885 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.540477037 CEST	49767	55958	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:20.540498018 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.540503025 CEST	49767	55958	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:20.540525913 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.540558100 CEST	49767	55958	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:20.546041965 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.546152115 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.546184063 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.546231985 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.546260118 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.546653986 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.546681881 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.546709061 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.546756983 CEST	55958	49767	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.546827078 CEST	49767	55958	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:20.740597010 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:20.766846895 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:20.766907930 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:21.233882904 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.234174967 CEST	49768	62561	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:21.242105961 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.242135048 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.242162943 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.242176056 CEST	49768	62561	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:21.242230892 CEST	49768	62561	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:21.242939949 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.242969036 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.242995977 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.243012905 CEST	49768	62561	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:21.243022919 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.243048906 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.243060112 CEST	49768	62561	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:21.243074894 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.243083954 CEST	49768	62561	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:21.243093014 CEST	49768	62561	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:21.243102074 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.243139982 CEST	49768	62561	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:21.243149042 CEST	49768	62561	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:21.247097015 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.247159004 CEST	49768	62561	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:21.247241974 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.247314930 CEST	49768	62561	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:21.247375965 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.247436047 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.247462988 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.247493982 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.247509003 CEST	49768	62561	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:21.247582912 CEST	49768	62561	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:21.248126030 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.248153925 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.248186111 CEST	49768	62561	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:21.248198032 CEST	49768	62561	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:21.248222113 CEST	49768	62561	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:21.248399019 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.248426914 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.248456955 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.248852968 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.248883009 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.252269983 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.252434969 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.252535105 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.252564907 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.252758026 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.252784014 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.253333092 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.253604889 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.253846884 CEST	62561	49768	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.253962994 CEST	49768	62561	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:21.318715096 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:21.349622011 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:21.555351973 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:22.146176100 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:22.258740902 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:26.871378899 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:26.876511097 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:27.250178099 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:27.256285906 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:27.261142969 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:27.264455080 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:27.264462948 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:27.269412994 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.204030037 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.204361916 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.209297895 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.209353924 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.209357977 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.209404945 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.209415913 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.209434986 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.209453106 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.209460974 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.209485054 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.209520102 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.209548950 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.209577084 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.209600925 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.209603071 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.209631920 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.209631920 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.209661007 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.209680080 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.209681034 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.209816933 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.214288950 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.214346886 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.214452982 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.214508057 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.214579105 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.214605093 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.214629889 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.214638948 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.214664936 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.214687109 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.214694977 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.214740992 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.214752913 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.214780092 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.214806080 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.214811087 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.214829922 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.214855909 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.214962006 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.214991093 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.219270945 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.219702005 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.219731092 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.219810009 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.219942093 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.219985962 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.220016003 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.220067024 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.220376968 CEST	61524	49769	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.220428944 CEST	49769	61524	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.295928001 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.934423923 CEST	49770	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.939512014 CEST	21	49770	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.939594030 CEST	49770	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.941293955 CEST	49770	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:28.946320057 CEST	21	49770	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:28.946393013 CEST	49770	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:29.347023964 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:29.463661909 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:29.464018106 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:30.072341919 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:30.079711914 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:30.461297035 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:30.461822033 CEST	49771	55824	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:30.466815948 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:30.466905117 CEST	49771	55824	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:30.466968060 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:30.471918106 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.309773922 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.313445091 CEST	49771	55824	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:31.318507910 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.318566084 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.318593025 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.318599939 CEST	49771	55824	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:31.318623066 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.318650961 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.318677902 CEST	49771	55824	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:31.318769932 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.318797112 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.318810940 CEST	49771	55824	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:31.318845987 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.318856001 CEST	49771	55824	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:31.318873882 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.318902016 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.318948984 CEST	49771	55824	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:31.320988894 CEST	49771	55824	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:31.323642969 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.323671103 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.323698044 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.323750973 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.323769093 CEST	49771	55824	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:31.323777914 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.323827028 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.323854923 CEST	49771	55824	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:31.323875904 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.323966026 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.324050903 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.324078083 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.324103117 CEST	49771	55824	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:31.324143887 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.324179888 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.326025963 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.328834057 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.328861952 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.328983068 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.329061985 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.329111099 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.329137087 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.329168081 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.329227924 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.329566002 CEST	55824	49771	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:31.332767963 CEST	49771	55824	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:31.524348974 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:32.126585960 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:32.289938927 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:37.660360098 CEST	49772	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:37.665560961 CEST	21	49772	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:37.665694952 CEST	49772	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:37.665891886 CEST	49772	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:37.671145916 CEST	21	49772	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:37.671538115 CEST	49772	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:37.840342999 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:37.845503092 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:38.203234911 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:38.203908920 CEST	49773	64130	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:38.208750963 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:38.208827972 CEST	49773	64130	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:38.208956003 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:38.214075089 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:38.216949940 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:38.222384930 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:38.587141991 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:38.587615967 CEST	49774	55438	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:38.592801094 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:38.592883110 CEST	49774	55438	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:38.592953920 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:38.598037958 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.049989939 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.050199986 CEST	49773	64130	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.055248022 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.055277109 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.055308104 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.055335045 CEST	49773	64130	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.055358887 CEST	49773	64130	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.055361986 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.055411100 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.055413008 CEST	49773	64130	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.055474997 CEST	49773	64130	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.055475950 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.055502892 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.055531979 CEST	49773	64130	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.055550098 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.055560112 CEST	49773	64130	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.055597067 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.055623055 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.055628061 CEST	49773	64130	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.055649996 CEST	49773	64130	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.055861950 CEST	49773	64130	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.060580015 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.060607910 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.060636044 CEST	49773	64130	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.060652971 CEST	49773	64130	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.060666084 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.060692072 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.060740948 CEST	49773	64130	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.060740948 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.060767889 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.060795069 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.060821056 CEST	49773	64130	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.060821056 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.060856104 CEST	49773	64130	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.060856104 CEST	49773	64130	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.060868979 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.060894966 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.060920000 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.060965061 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.060991049 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.065968990 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.066090107 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.066117048 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.066143990 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.066175938 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.066422939 CEST	64130	49773	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.066474915 CEST	49773	64130	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.244476080 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.521429062 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.525985003 CEST	49774	55438	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.531059027 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.531162024 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.531189919 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.531217098 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.531243086 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.531292915 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.531297922 CEST	49774	55438	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.531321049 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.531348944 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.531359911 CEST	49774	55438	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.531377077 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.531415939 CEST	49774	55438	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.531445026 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.531464100 CEST	49774	55438	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.531615019 CEST	49774	55438	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.536489010 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.536515951 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.536561966 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.536565065 CEST	49774	55438	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.536590099 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.536636114 CEST	49774	55438	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.536645889 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.536673069 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.536689043 CEST	49774	55438	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.536720037 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.536746025 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.536776066 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.536814928 CEST	49774	55438	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.536839962 CEST	49774	55438	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.536842108 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.536874056 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.536942959 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.536989927 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.542032003 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.542125940 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.542567015 CEST	55438	49774	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:39.544456959 CEST	49774	55438	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.712356091 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:39.848197937 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:40.032361984 CEST	49775	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:40.037781954 CEST	21	49775	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:40.040584087 CEST	49775	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:40.040584087 CEST	49775	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:40.046258926 CEST	21	49775	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:40.052349091 CEST	49775	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:40.056344032 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:40.469153881 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:40.579972029 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:45.103346109 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:45.108381987 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:45.459942102 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:45.461419106 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:45.466389894 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:45.467087030 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:45.467314959 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:45.472197056 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.360636950 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.360892057 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.365973949 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.366004944 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.366036892 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.366038084 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.366053104 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.366066933 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.366089106 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.366113901 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.366158962 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.366175890 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.366329908 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.366380930 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.366386890 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.366406918 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.366429090 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.366437912 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.366455078 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.366487026 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.366503000 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.366556883 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.371115923 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.371144056 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.371170044 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.371170044 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.371186972 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.371220112 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.371220112 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.371248007 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.371274948 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.371280909 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.371303082 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.371309996 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.371330976 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.371341944 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.371367931 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.371390104 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.371445894 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.371478081 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.371494055 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.371504068 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.371531010 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.371575117 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.376236916 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.376451015 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.376498938 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.376528025 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.376559019 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.376605034 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.376635075 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.376678944 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.376708031 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.377135038 CEST	55768	49776	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:46.377182961 CEST	49776	55768	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:46.467490911 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:47.265567064 CEST	21	49756	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:47.318897963 CEST	49756	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:52.298134089 CEST	49777	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:52.303175926 CEST	21	49777	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:52.303256989 CEST	49777	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:53.126218081 CEST	21	49777	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:53.126368999 CEST	49777	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:53.132963896 CEST	21	49777	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:53.454895973 CEST	21	49777	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:53.456473112 CEST	49777	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:53.462038994 CEST	21	49777	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:53.820796013 CEST	21	49777	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:53.824496984 CEST	49777	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:53.829380035 CEST	21	49777	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:54.150491953 CEST	21	49777	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:54.152523041 CEST	49777	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:54.157500029 CEST	21	49777	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:54.480330944 CEST	21	49777	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:54.480482101 CEST	49777	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:54.486978054 CEST	21	49777	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:54.806366920 CEST	21	49777	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:54.806555033 CEST	49777	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:54.811742067 CEST	21	49777	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:55.133074045 CEST	21	49777	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:55.133421898 CEST	49778	58620	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:55.138619900 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:55.138688087 CEST	49778	58620	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:55.138752937 CEST	49777	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:55.143568039 CEST	21	49777	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:55.714776993 CEST	49779	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:55.719839096 CEST	21	49779	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:55.720567942 CEST	49779	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:55.720567942 CEST	49779	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:55.725646973 CEST	21	49779	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:55.731033087 CEST	49779	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:56.066729069 CEST	21	49777	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.071171999 CEST	49778	58620	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:56.076201916 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.076231003 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.076256990 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.076370001 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.076397896 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.076401949 CEST	49778	58620	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:56.076445103 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.076457977 CEST	49778	58620	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:56.076472044 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.076502085 CEST	49778	58620	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:56.076549053 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.076575041 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.076584101 CEST	49778	58620	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:56.076605082 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.076725006 CEST	49778	58620	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:56.081594944 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.081624031 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.081671000 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.081698895 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.081724882 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.081751108 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.081777096 CEST	49778	58620	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:56.081778049 CEST	49778	58620	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:56.081798077 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.081825018 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.081836939 CEST	49778	58620	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:56.081851006 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.081873894 CEST	49778	58620	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:56.081907034 CEST	49778	58620	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:56.081923008 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.081984043 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.082031012 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.082058907 CEST	49778	58620	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:56.082081079 CEST	49778	58620	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:56.082916975 CEST	49778	58620	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:56.086818933 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.086847067 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.086941004 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.086987972 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.087018013 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.087100029 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.087146044 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.087172031 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.087218046 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.087244034 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.087830067 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.088073015 CEST	58620	49778	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:56.094624996 CEST	49778	58620	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:56.156761885 CEST	49777	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:56.997684002 CEST	21	49777	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:57.115677118 CEST	49777	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:57.608388901 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:57.613449097 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:57.973038912 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:57.976418018 CEST	49780	57406	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:57.981611013 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:57.981709003 CEST	49780	57406	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:57.981863976 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:57.986726999 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.811820030 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.812227964 CEST	49780	57406	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:58.817228079 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.817259073 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.817286968 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.817336082 CEST	49780	57406	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:58.817394972 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.817423105 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.817450047 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.817456961 CEST	49780	57406	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:58.817481995 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.817507029 CEST	49780	57406	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:58.817531109 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.817537069 CEST	49780	57406	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:58.817564011 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.817590952 CEST	49780	57406	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:58.817620993 CEST	49780	57406	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:58.817627907 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.817706108 CEST	49780	57406	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:58.822483063 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.822547913 CEST	49780	57406	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:58.822565079 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.822613001 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.822617054 CEST	49780	57406	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:58.822640896 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.822666883 CEST	49780	57406	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:58.822668076 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.822695017 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.822701931 CEST	49780	57406	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:58.822731018 CEST	49780	57406	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:58.822757006 CEST	49780	57406	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:58.822765112 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.822793007 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.822839975 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.822855949 CEST	49780	57406	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:58.822866917 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.822895050 CEST	49780	57406	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:58.822920084 CEST	49780	57406	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:58.822979927 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.823007107 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.827539921 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.827780008 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.827832937 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.827999115 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.828028917 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.828079939 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.828107119 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.828152895 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.828177929 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.828376055 CEST	57406	49780	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:58.828430891 CEST	49780	57406	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:59.053177118 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:12:59.608923912 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:12:59.741053104 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:15.246606112 CEST	49781	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:15.253818989 CEST	21	49781	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:15.255680084 CEST	49781	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:15.255680084 CEST	49781	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:15.261090040 CEST	21	49781	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:15.267432928 CEST	49781	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:26.072145939 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:26.077079058 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:26.452203989 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:26.452831984 CEST	49782	51546	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:26.460716009 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:26.460778952 CEST	49782	51546	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:26.460886002 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:26.466106892 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.453784943 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.461007118 CEST	49782	51546	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:27.468913078 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.469073057 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.469100952 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.469213009 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.469239950 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.469320059 CEST	49782	51546	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:27.469579935 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.469588995 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.469594955 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.469603062 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.469690084 CEST	49782	51546	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:27.469692945 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.475007057 CEST	49782	51546	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:27.481846094 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.481857061 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.481868029 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.481889009 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.481897116 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.481905937 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.481914043 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.481920004 CEST	49782	51546	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:27.481921911 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.481930971 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.481935024 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.481939077 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.481983900 CEST	49782	51546	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:27.482739925 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.486968994 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.488734007 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.488749981 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.488758087 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.488902092 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.489161015 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.489168882 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.489906073 CEST	51546	49782	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:27.491203070 CEST	49782	51546	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:27.553255081 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:28.407711029 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:28.553220987 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:43.310105085 CEST	49783	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:43.376849890 CEST	21	49783	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:43.378640890 CEST	49783	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:43.381428957 CEST	49783	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:43.386570930 CEST	21	49783	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:43.386666059 CEST	49783	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:44.648521900 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:44.677779913 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.057925940 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.059056997 CEST	49784	56668	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:45.075129032 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.075202942 CEST	49784	56668	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:45.077049971 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:45.082439899 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.984015942 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.984380960 CEST	49784	56668	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:45.989547014 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.989639997 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.989670038 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.989696980 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.989722013 CEST	49784	56668	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:45.989723921 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.989753008 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.989772081 CEST	49784	56668	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:45.989803076 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.989806890 CEST	49784	56668	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:45.989833117 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.989859104 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.989891052 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.989933968 CEST	49784	56668	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:45.989969015 CEST	49784	56668	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:45.994796038 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.995007038 CEST	49784	56668	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:45.996397972 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.996449947 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.996476889 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.996509075 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.996534109 CEST	49784	56668	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:45.996536016 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.996577024 CEST	49784	56668	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:45.996634960 CEST	49784	56668	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:45.997206926 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:45.997392893 CEST	49784	56668	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:46.000174999 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:46.002537966 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:46.002566099 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:46.002593994 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:46.002619982 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:46.003479004 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:46.003695965 CEST	56668	49784	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:46.003900051 CEST	49784	56668	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:46.037661076 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:46.922559023 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:47.053344965 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:52.715584040 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:52.721434116 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.077083111 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.077557087 CEST	49785	61759	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:53.082598925 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.082673073 CEST	49785	61759	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:53.082746029 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:53.087680101 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.282509089 CEST	49786	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:53.287573099 CEST	21	49786	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.287687063 CEST	49786	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:53.287988901 CEST	49786	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:53.293046951 CEST	21	49786	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.294898033 CEST	49786	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:53.906615019 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.906888962 CEST	49785	61759	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:53.911917925 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.911947966 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.911994934 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.912020922 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.912025928 CEST	49785	61759	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:53.912065029 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.912069082 CEST	49785	61759	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:53.912097931 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.912177086 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.912203074 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.912211895 CEST	49785	61759	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:53.912236929 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.912252903 CEST	49785	61759	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:53.912283897 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.912487984 CEST	49785	61759	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:53.917006969 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.917133093 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.917263031 CEST	49785	61759	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:53.917300940 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.917349100 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.917411089 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.917438030 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.917464018 CEST	49785	61759	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:53.917470932 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.917536020 CEST	49785	61759	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:53.917536020 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.917583942 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.917613983 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.917659998 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.917690039 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.917692900 CEST	49785	61759	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:53.917742014 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.922292948 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.922607899 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.922638893 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.922718048 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.922744989 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.922780991 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.922826052 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.922852039 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.923075914 CEST	61759	49785	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:53.923321962 CEST	49785	61759	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:54.053283930 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:54.731836081 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:54.850157976 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:57.559030056 CEST	49787	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:57.564023018 CEST	21	49787	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:57.566580057 CEST	49787	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:57.566694975 CEST	49787	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:13:57.571959019 CEST	21	49787	110.4.45.197	192.168.2.4
Sep 27, 2024 13:13:57.574671984 CEST	49787	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:01.758456945 CEST	49788	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:01.763614893 CEST	21	49788	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:01.763712883 CEST	49788	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:01.763900042 CEST	49788	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:01.769047022 CEST	21	49788	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:01.769128084 CEST	49788	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:02.400526047 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:02.469710112 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:02.839585066 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:02.839992046 CEST	49789	64095	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:02.844880104 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:02.845016956 CEST	49789	64095	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:02.845113993 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:02.849905968 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:03.993027925 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:03.995950937 CEST	49789	64095	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:04.056494951 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:04.215801001 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.216586113 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:04.217263937 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.217392921 CEST	49789	64095	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:04.217426062 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.217545033 CEST	49789	64095	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:04.217590094 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.217675924 CEST	49789	64095	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:04.217912912 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.218002081 CEST	49789	64095	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:04.218105078 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.218116999 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.218149900 CEST	49789	64095	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:04.218199015 CEST	49789	64095	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:04.218225002 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.218236923 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.218249083 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.218260050 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.218286991 CEST	49789	64095	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:04.218286991 CEST	49789	64095	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:04.222840071 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.222870111 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.222897053 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.222923040 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.222934961 CEST	49789	64095	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:04.222949982 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.222966909 CEST	49789	64095	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:04.222976923 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.222987890 CEST	49789	64095	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:04.222987890 CEST	49789	64095	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:04.223023891 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.223051071 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.223067045 CEST	49789	64095	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:04.223083973 CEST	49789	64095	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:04.223117113 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.223150969 CEST	49789	64095	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:04.223201990 CEST	49789	64095	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:04.227710009 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.227754116 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.227781057 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.227852106 CEST	49789	64095	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:04.227889061 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.228027105 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.228117943 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.232601881 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.232630968 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.232656956 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.232683897 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.232709885 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.232873917 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.233350992 CEST	64095	49789	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:04.236573935 CEST	49789	64095	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:05.018769026 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:05.240798950 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:12.715809107 CEST	49790	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:12.720983982 CEST	21	49790	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:12.721059084 CEST	49790	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:12.806090117 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:12.811044931 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:12.947923899 CEST	49791	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:12.952835083 CEST	21	49791	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:12.952908039 CEST	49791	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:13.186691046 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:13.187110901 CEST	49792	62089	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:13.192140102 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:13.192212105 CEST	49792	62089	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:13.192327976 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:13.197230101 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:13.666157007 CEST	21	49790	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:13.666340113 CEST	49790	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:13.671287060 CEST	21	49790	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:13.965307951 CEST	21	49791	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:13.965465069 CEST	49791	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:13.970426083 CEST	21	49791	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.024213076 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.024406910 CEST	49792	62089	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.032387018 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.032439947 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.032458067 CEST	49792	62089	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.032468081 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.032494068 CEST	49792	62089	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.032686949 CEST	49792	62089	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.032717943 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.032747030 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.032774925 CEST	49792	62089	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.032797098 CEST	49792	62089	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.033559084 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.033588886 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.033615112 CEST	49792	62089	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.033617020 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.033646107 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.033647060 CEST	49792	62089	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.033673048 CEST	49792	62089	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.033673048 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.033704042 CEST	49792	62089	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.033727884 CEST	49792	62089	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.037528992 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.037556887 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.037611008 CEST	49792	62089	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.037616014 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.037643909 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.037683964 CEST	49792	62089	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.037698984 CEST	49792	62089	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.037728071 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.037755013 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.037782907 CEST	49792	62089	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.037796974 CEST	49792	62089	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.037815094 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.037846088 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.037868977 CEST	49792	62089	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.037899017 CEST	49792	62089	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.038686991 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.038820982 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.038849115 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.038875103 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.038904905 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.042546988 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.042752028 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.042779922 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.042864084 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.042890072 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.042959929 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.043006897 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.043034077 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.043436050 CEST	62089	49792	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.043493986 CEST	49792	62089	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.053566933 CEST	21	49790	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.053886890 CEST	49790	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.058950901 CEST	21	49790	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.068937063 CEST	49737	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.334882975 CEST	21	49791	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.335005045 CEST	49791	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.339932919 CEST	21	49791	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.443470001 CEST	21	49790	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.443749905 CEST	49790	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.448733091 CEST	21	49790	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.713192940 CEST	21	49791	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.756432056 CEST	49791	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.776681900 CEST	21	49790	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.818948030 CEST	49790	21	192.168.2.4	110.4.45.197
Sep 27, 2024 13:14:14.831434011 CEST	21	49737	110.4.45.197	192.168.2.4
Sep 27, 2024 13:14:14.881442070 CEST	49737	21	192.168.2.4	110.4.45.197

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 13:10:02.280484915 CEST	62984	53	192.168.2.4	1.1.1.1
Sep 27, 2024 13:10:02.308217049 CEST	53	62984	1.1.1.1	192.168.2.4
Sep 27, 2024 13:10:06.803459883 CEST	61284	53	192.168.2.4	1.1.1.1
Sep 27, 2024 13:10:07.075886011 CEST	53	61284	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 27, 2024 13:10:02.280484915 CEST	192.168.2.4	1.1.1.1	0xafb2	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 13:10:06.803459883 CEST	192.168.2.4	1.1.1.1	0xd8ab	Standard query (0)	ftp.haliza.com.my	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 27, 2024 13:10:02.308217049 CEST	1.1.1.1	192.168.2.4	0xafb2	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Sep 27, 2024 13:10:02.308217049 CEST	1.1.1.1	192.168.2.4	0xafb2	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Sep 27, 2024 13:10:02.308217049 CEST	1.1.1.1	192.168.2.4	0xafb2	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Sep 27, 2024 13:10:07.075886011 CEST	1.1.1.1	192.168.2.4	0xd8ab	No error (0)	ftp.haliza.com.my	110.4.45.197	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	104.26.12.205	443	2756	C:\Users\user\Desktop\rQuotation3200025006.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 11:10:03 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-09-27 11:10:03 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 11:10:03 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c9b0b8a0a530f69-EWR
2024-09-27 11:10:03 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	104.26.12.205	443	7616	C:\Users\user\AppData\Roaming\pBBqGOzrz.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 11:10:13 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-09-27 11:10:13 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 11:10:13 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c9b0bc51fd70f63-EWR
2024-09-27 11:10:13 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49748	104.26.12.205	443	8012	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 11:10:20 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-09-27 11:10:21 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 11:10:20 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c9b0bf08c9943ed-EWR
2024-09-27 11:10:21 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49755	104.26.12.205	443	7188	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 11:10:27 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-09-27 11:10:27 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 11:10:27 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c9b0c1d38730f78-EWR
2024-09-27 11:10:27 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Sep 27, 2024 13:10:08.907953024 CEST	21	49737	110.4.45.197	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 19:10. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 19:10. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 19:10. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 19:10. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Sep 27, 2024 13:10:08.908003092 CEST	21	49737	110.4.45.197	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 19:10. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 19:10. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 19:10. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 19:10. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Sep 27, 2024 13:10:08.908032894 CEST	21	49737	110.4.45.197	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 19:10. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 19:10. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 19:10. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 19:10. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Sep 27, 2024 13:10:08.908216000 CEST	49737	21	192.168.2.4	110.4.45.197	USER origin@haliza.com.my
Sep 27, 2024 13:10:09.235133886 CEST	21	49737	110.4.45.197	192.168.2.4	331 User origin@haliza.com.my OK. Password required
Sep 27, 2024 13:10:09.235284090 CEST	49737	21	192.168.2.4	110.4.45.197	PASS JesusChrist007$
Sep 27, 2024 13:10:09.609087944 CEST	21	49737	110.4.45.197	192.168.2.4	230 OK. Current restricted directory is /
Sep 27, 2024 13:10:09.939069033 CEST	21	49737	110.4.45.197	192.168.2.4	504 Unknown command
Sep 27, 2024 13:10:09.942521095 CEST	49737	21	192.168.2.4	110.4.45.197	PWD
Sep 27, 2024 13:10:10.269857883 CEST	21	49737	110.4.45.197	192.168.2.4	257 "/" is your current location
Sep 27, 2024 13:10:10.270051003 CEST	49737	21	192.168.2.4	110.4.45.197	TYPE I
Sep 27, 2024 13:10:10.596981049 CEST	21	49737	110.4.45.197	192.168.2.4	200 TYPE is now 8-bit binary
Sep 27, 2024 13:10:10.599124908 CEST	49737	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:10:10.925662041 CEST	21	49737	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,209,190)
Sep 27, 2024 13:10:10.933353901 CEST	49737	21	192.168.2.4	110.4.45.197	STOR CO_Chrome_Default.txt_user-849224_2024_09_27_08_10_04.txt
Sep 27, 2024 13:10:11.762018919 CEST	21	49737	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:10:12.151508093 CEST	21	49737	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.389 seconds (measured here), 8.42 Kbytes per second
Sep 27, 2024 13:10:12.152465105 CEST	49737	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:10:12.479223013 CEST	21	49737	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,210,26)
Sep 27, 2024 13:10:12.484707117 CEST	49737	21	192.168.2.4	110.4.45.197	STOR CO_Firefox_fqs92o4p.default-release.txt_user-849224_2024_09_27_14_38_12.txt
Sep 27, 2024 13:10:13.321419954 CEST	21	49737	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:10:13.884481907 CEST	21	49737	110.4.45.197	192.168.2.4	226 File successfully transferred
Sep 27, 2024 13:10:13.885103941 CEST	21	49737	110.4.45.197	192.168.2.4	226 File successfully transferred
Sep 27, 2024 13:10:15.600683928 CEST	21	49741	110.4.45.197	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 19:10. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 19:10. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 19:10. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 19:10. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Sep 27, 2024 13:10:15.600987911 CEST	49741	21	192.168.2.4	110.4.45.197	USER origin@haliza.com.my
Sep 27, 2024 13:10:15.931091070 CEST	21	49741	110.4.45.197	192.168.2.4	331 User origin@haliza.com.my OK. Password required
Sep 27, 2024 13:10:15.935343027 CEST	49741	21	192.168.2.4	110.4.45.197	PASS JesusChrist007$
Sep 27, 2024 13:10:16.301481962 CEST	21	49741	110.4.45.197	192.168.2.4	230 OK. Current restricted directory is /
Sep 27, 2024 13:10:16.631720066 CEST	21	49741	110.4.45.197	192.168.2.4	504 Unknown command
Sep 27, 2024 13:10:16.631902933 CEST	49741	21	192.168.2.4	110.4.45.197	PWD
Sep 27, 2024 13:10:16.961774111 CEST	21	49741	110.4.45.197	192.168.2.4	257 "/" is your current location
Sep 27, 2024 13:10:17.045949936 CEST	49741	21	192.168.2.4	110.4.45.197	TYPE I
Sep 27, 2024 13:10:17.376188993 CEST	21	49741	110.4.45.197	192.168.2.4	200 TYPE is now 8-bit binary
Sep 27, 2024 13:10:17.382038116 CEST	49741	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:10:17.711987972 CEST	21	49741	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,208,86)
Sep 27, 2024 13:10:17.718048096 CEST	49741	21	192.168.2.4	110.4.45.197	STOR PW_user-849224_2024_09_27_07_10_13.html
Sep 27, 2024 13:10:19.570696115 CEST	21	49741	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:10:19.570862055 CEST	21	49741	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:10:19.571049929 CEST	21	49741	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:10:19.571302891 CEST	21	49741	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:10:19.901110888 CEST	21	49741	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 1.341 seconds (measured here), 258.03 bytes per second
Sep 27, 2024 13:10:20.202588081 CEST	49741	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:10:21.281092882 CEST	21	49741	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,234,56)
Sep 27, 2024 13:10:21.284106016 CEST	21	49741	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,234,56)
Sep 27, 2024 13:10:21.284137011 CEST	21	49741	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,234,56)
Sep 27, 2024 13:10:21.341022015 CEST	49741	21	192.168.2.4	110.4.45.197	STOR CO_Chrome_Default.txt_user-849224_2024_09_27_13_38_41.txt
Sep 27, 2024 13:10:22.180212975 CEST	21	49741	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:10:22.513676882 CEST	21	49741	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.334 seconds (measured here), 9.82 Kbytes per second
Sep 27, 2024 13:10:22.516904116 CEST	49741	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:10:22.701957941 CEST	21	49751	110.4.45.197	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed.220-Local time is now 19:10. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed.220-Local time is now 19:10. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed.220-Local time is now 19:10. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed.220-Local time is now 19:10. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Sep 27, 2024 13:10:22.702133894 CEST	49751	21	192.168.2.4	110.4.45.197	USER origin@haliza.com.my
Sep 27, 2024 13:10:22.847029924 CEST	21	49741	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,254,162)
Sep 27, 2024 13:10:22.852849007 CEST	49741	21	192.168.2.4	110.4.45.197	STOR CO_Firefox_fqs92o4p.default-release.txt_user-849224_2024_09_27_16_16_58.txt
Sep 27, 2024 13:10:23.032072067 CEST	21	49751	110.4.45.197	192.168.2.4	331 User origin@haliza.com.my OK. Password required
Sep 27, 2024 13:10:23.032488108 CEST	49751	21	192.168.2.4	110.4.45.197	PASS JesusChrist007$
Sep 27, 2024 13:10:23.385102034 CEST	21	49751	110.4.45.197	192.168.2.4	230 OK. Current restricted directory is /
Sep 27, 2024 13:10:23.682950020 CEST	21	49741	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:10:23.715152979 CEST	21	49751	110.4.45.197	192.168.2.4	504 Unknown command
Sep 27, 2024 13:10:23.715291977 CEST	49751	21	192.168.2.4	110.4.45.197	PWD
Sep 27, 2024 13:10:24.018543005 CEST	21	49741	110.4.45.197	192.168.2.4	226 File successfully transferred
Sep 27, 2024 13:10:24.044948101 CEST	21	49751	110.4.45.197	192.168.2.4	257 "/" is your current location
Sep 27, 2024 13:10:24.045090914 CEST	49751	21	192.168.2.4	110.4.45.197	TYPE I
Sep 27, 2024 13:10:24.374522924 CEST	21	49751	110.4.45.197	192.168.2.4	200 TYPE is now 8-bit binary
Sep 27, 2024 13:10:24.374686003 CEST	49751	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:10:24.704941034 CEST	21	49751	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,201,41)
Sep 27, 2024 13:10:24.710805893 CEST	49751	21	192.168.2.4	110.4.45.197	STOR PW_user-849224_2024_09_27_07_10_21.html
Sep 27, 2024 13:10:25.537411928 CEST	21	49751	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:10:25.868066072 CEST	21	49751	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.331 seconds (measured here), 1.02 Kbytes per second
Sep 27, 2024 13:10:25.892936945 CEST	49751	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:10:26.223146915 CEST	21	49751	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,255,81)
Sep 27, 2024 13:10:26.228996992 CEST	49751	21	192.168.2.4	110.4.45.197	STOR CO_Chrome_Default.txt_user-849224_2024_09_27_12_59_12.txt
Sep 27, 2024 13:10:27.066812992 CEST	21	49751	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:10:29.133990049 CEST	21	49756	110.4.45.197	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed.220-Local time is now 19:10. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed.220-Local time is now 19:10. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed.220-Local time is now 19:10. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed.220-Local time is now 19:10. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Sep 27, 2024 13:10:29.134206057 CEST	49756	21	192.168.2.4	110.4.45.197	USER origin@haliza.com.my
Sep 27, 2024 13:10:29.461889982 CEST	21	49756	110.4.45.197	192.168.2.4	331 User origin@haliza.com.my OK. Password required
Sep 27, 2024 13:10:29.462064028 CEST	49756	21	192.168.2.4	110.4.45.197	PASS JesusChrist007$
Sep 27, 2024 13:10:29.822135925 CEST	21	49756	110.4.45.197	192.168.2.4	230 OK. Current restricted directory is /
Sep 27, 2024 13:10:30.154460907 CEST	21	49756	110.4.45.197	192.168.2.4	504 Unknown command
Sep 27, 2024 13:10:30.154666901 CEST	49756	21	192.168.2.4	110.4.45.197	PWD
Sep 27, 2024 13:10:30.482898951 CEST	21	49756	110.4.45.197	192.168.2.4	257 "/" is your current location
Sep 27, 2024 13:10:30.483570099 CEST	49756	21	192.168.2.4	110.4.45.197	TYPE I
Sep 27, 2024 13:10:30.811661959 CEST	21	49756	110.4.45.197	192.168.2.4	200 TYPE is now 8-bit binary
Sep 27, 2024 13:10:30.812300920 CEST	49756	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:10:31.140465021 CEST	21	49756	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,217,178)
Sep 27, 2024 13:10:31.146662951 CEST	49756	21	192.168.2.4	110.4.45.197	STOR PW_user-849224_2024_09_27_07_10_27.html
Sep 27, 2024 13:10:31.976399899 CEST	21	49756	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:10:32.303776026 CEST	21	49756	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.336 seconds (measured here), 1.01 Kbytes per second
Sep 27, 2024 13:10:32.323329926 CEST	49756	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:10:32.656864882 CEST	21	49756	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,235,22)
Sep 27, 2024 13:10:32.663347960 CEST	49756	21	192.168.2.4	110.4.45.197	STOR CO_Chrome_Default.txt_user-849224_2024_09_27_13_09_18.txt
Sep 27, 2024 13:10:33.498569965 CEST	21	49756	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:10:33.828073978 CEST	21	49756	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.328 seconds (measured here), 9.98 Kbytes per second
Sep 27, 2024 13:10:33.828564882 CEST	49756	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:10:34.156984091 CEST	21	49756	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,238,235)
Sep 27, 2024 13:10:34.162580967 CEST	49756	21	192.168.2.4	110.4.45.197	STOR CO_Firefox_fqs92o4p.default-release.txt_user-849224_2024_09_27_15_28_13.txt
Sep 27, 2024 13:10:34.992522955 CEST	21	49756	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:10:35.323205948 CEST	21	49756	110.4.45.197	192.168.2.4	226 File successfully transferred
Sep 27, 2024 13:11:39.040805101 CEST	49737	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:11:39.378043890 CEST	21	49737	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,204,216)
Sep 27, 2024 13:11:39.386344910 CEST	49737	21	192.168.2.4	110.4.45.197	STOR KL_user-849224_2024_10_15_03_01_59.html
Sep 27, 2024 13:11:40.304414988 CEST	21	49737	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:11:40.667108059 CEST	21	49737	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.361 seconds (measured here), 0.76 Kbytes per second
Sep 27, 2024 13:11:58.709117889 CEST	49756	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:11:59.099595070 CEST	21	49756	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,204,104)
Sep 27, 2024 13:11:59.110579967 CEST	49756	21	192.168.2.4	110.4.45.197	STOR SC_user-849224_2024_10_14_02_30_34.jpeg
Sep 27, 2024 13:11:59.945193052 CEST	21	49756	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:12:00.780853033 CEST	21	49756	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.836 seconds (measured here), 66.92 Kbytes per second
Sep 27, 2024 13:12:01.023907900 CEST	21	49756	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.836 seconds (measured here), 66.92 Kbytes per second
Sep 27, 2024 13:12:19.012639999 CEST	49737	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:12:19.463406086 CEST	21	49737	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,218,150)
Sep 27, 2024 13:12:19.528964043 CEST	49737	21	192.168.2.4	110.4.45.197	STOR SC_user-849224_2024_11_03_04_07_46.jpeg
Sep 27, 2024 13:12:19.748332024 CEST	49756	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:12:20.253776073 CEST	21	49756	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,244,97)
Sep 27, 2024 13:12:20.294255972 CEST	49756	21	192.168.2.4	110.4.45.197	STOR SC_user-849224_2024_10_25_12_14_45.jpeg
Sep 27, 2024 13:12:20.528198004 CEST	21	49737	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:12:20.766846895 CEST	21	49737	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:12:21.233882904 CEST	21	49756	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:12:21.349622011 CEST	21	49737	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.802 seconds (measured here), 69.67 Kbytes per second
Sep 27, 2024 13:12:22.146176100 CEST	21	49756	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.937 seconds (measured here), 59.65 Kbytes per second
Sep 27, 2024 13:12:26.871378899 CEST	49756	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:12:27.250178099 CEST	21	49756	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,240,84)
Sep 27, 2024 13:12:27.264462948 CEST	49756	21	192.168.2.4	110.4.45.197	STOR SC_user-849224_2024_10_30_18_53_08.jpeg
Sep 27, 2024 13:12:28.204030037 CEST	21	49756	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:12:29.347023964 CEST	21	49756	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.971 seconds (measured here), 57.55 Kbytes per second
Sep 27, 2024 13:12:29.463661909 CEST	21	49756	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.971 seconds (measured here), 57.55 Kbytes per second
Sep 27, 2024 13:12:30.072341919 CEST	49756	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:12:30.461297035 CEST	21	49756	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,218,16)
Sep 27, 2024 13:12:30.466968060 CEST	49756	21	192.168.2.4	110.4.45.197	STOR SC_user-849224_2024_11_05_10_22_41.jpeg
Sep 27, 2024 13:12:31.309773922 CEST	21	49756	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:12:32.126585960 CEST	21	49756	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.818 seconds (measured here), 68.35 Kbytes per second
Sep 27, 2024 13:12:37.840342999 CEST	49737	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:12:38.203234911 CEST	21	49737	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,250,130)
Sep 27, 2024 13:12:38.208956003 CEST	49737	21	192.168.2.4	110.4.45.197	STOR SC_user-849224_2024_11_14_11_04_28.jpeg
Sep 27, 2024 13:12:38.216949940 CEST	49756	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:12:38.587141991 CEST	21	49756	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,216,142)
Sep 27, 2024 13:12:38.592953920 CEST	49756	21	192.168.2.4	110.4.45.197	STOR SC_user-849224_2024_11_11_04_13_22.jpeg
Sep 27, 2024 13:12:39.049989939 CEST	21	49737	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:12:39.521429062 CEST	21	49756	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:12:39.848197937 CEST	21	49737	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.802 seconds (measured here), 69.67 Kbytes per second
Sep 27, 2024 13:12:40.469153881 CEST	21	49756	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.946 seconds (measured here), 59.07 Kbytes per second
Sep 27, 2024 13:12:45.103346109 CEST	49756	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:12:45.459942102 CEST	21	49756	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,217,216)
Sep 27, 2024 13:12:45.467314959 CEST	49756	21	192.168.2.4	110.4.45.197	STOR SC_user-849224_2024_11_18_13_13_57.jpeg
Sep 27, 2024 13:12:46.360636950 CEST	21	49756	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:12:47.265567064 CEST	21	49756	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.905 seconds (measured here), 61.79 Kbytes per second
Sep 27, 2024 13:12:53.126218081 CEST	21	49777	110.4.45.197	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 13 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 13 of 50 allowed.220-Local time is now 19:12. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 13 of 50 allowed.220-Local time is now 19:12. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 13 of 50 allowed.220-Local time is now 19:12. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 13 of 50 allowed.220-Local time is now 19:12. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Sep 27, 2024 13:12:53.126368999 CEST	49777	21	192.168.2.4	110.4.45.197	USER origin@haliza.com.my
Sep 27, 2024 13:12:53.454895973 CEST	21	49777	110.4.45.197	192.168.2.4	331 User origin@haliza.com.my OK. Password required
Sep 27, 2024 13:12:53.456473112 CEST	49777	21	192.168.2.4	110.4.45.197	PASS JesusChrist007$
Sep 27, 2024 13:12:53.820796013 CEST	21	49777	110.4.45.197	192.168.2.4	230 OK. Current restricted directory is /
Sep 27, 2024 13:12:54.150491953 CEST	21	49777	110.4.45.197	192.168.2.4	504 Unknown command
Sep 27, 2024 13:12:54.152523041 CEST	49777	21	192.168.2.4	110.4.45.197	PWD
Sep 27, 2024 13:12:54.480330944 CEST	21	49777	110.4.45.197	192.168.2.4	257 "/" is your current location
Sep 27, 2024 13:12:54.480482101 CEST	49777	21	192.168.2.4	110.4.45.197	TYPE I
Sep 27, 2024 13:12:54.806366920 CEST	21	49777	110.4.45.197	192.168.2.4	200 TYPE is now 8-bit binary
Sep 27, 2024 13:12:54.806555033 CEST	49777	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:12:55.133074045 CEST	21	49777	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,228,252)
Sep 27, 2024 13:12:55.138752937 CEST	49777	21	192.168.2.4	110.4.45.197	STOR SC_user-849224_2024_11_23_20_57_19.jpeg
Sep 27, 2024 13:12:56.066729069 CEST	21	49777	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:12:56.997684002 CEST	21	49777	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.931 seconds (measured here), 65.26 Kbytes per second
Sep 27, 2024 13:12:57.608388901 CEST	49737	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:12:57.973038912 CEST	21	49737	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,224,62)
Sep 27, 2024 13:12:57.981863976 CEST	49737	21	192.168.2.4	110.4.45.197	STOR SC_user-849224_2024_11_25_03_40_54.jpeg
Sep 27, 2024 13:12:58.811820030 CEST	21	49737	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:12:59.608923912 CEST	21	49737	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.804 seconds (measured here), 69.50 Kbytes per second
Sep 27, 2024 13:13:26.072145939 CEST	49737	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:13:26.452203989 CEST	21	49737	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,201,90)
Sep 27, 2024 13:13:26.460886002 CEST	49737	21	192.168.2.4	110.4.45.197	STOR SC_user-849224_2024_12_14_01_34_56.jpeg
Sep 27, 2024 13:13:27.453784943 CEST	21	49737	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:13:28.407711029 CEST	21	49737	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.934 seconds (measured here), 59.88 Kbytes per second
Sep 27, 2024 13:13:44.648521900 CEST	49737	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:13:45.057925940 CEST	21	49737	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,221,92)
Sep 27, 2024 13:13:45.077049971 CEST	49737	21	192.168.2.4	110.4.45.197	STOR SC_user-849224_2024_12_24_06_30_21.jpeg
Sep 27, 2024 13:13:45.984015942 CEST	21	49737	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:13:46.922559023 CEST	21	49737	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.931 seconds (measured here), 60.04 Kbytes per second
Sep 27, 2024 13:13:52.715584040 CEST	49737	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:13:53.077083111 CEST	21	49737	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,241,63)
Sep 27, 2024 13:13:53.082746029 CEST	49737	21	192.168.2.4	110.4.45.197	STOR SC_user-849224_2024_12_29_21_58_53.jpeg
Sep 27, 2024 13:13:53.906615019 CEST	21	49737	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:13:54.731836081 CEST	21	49737	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.798 seconds (measured here), 70.09 Kbytes per second
Sep 27, 2024 13:14:02.400526047 CEST	49737	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:14:02.839585066 CEST	21	49737	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,250,95)
Sep 27, 2024 13:14:02.845113993 CEST	49737	21	192.168.2.4	110.4.45.197	STOR SC_user-849224_2025_01_07_06_50_58.jpeg
Sep 27, 2024 13:14:03.993027925 CEST	21	49737	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:14:04.215801001 CEST	21	49737	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:14:05.018769026 CEST	21	49737	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 1.343 seconds (measured here), 41.63 Kbytes per second
Sep 27, 2024 13:14:12.806090117 CEST	49737	21	192.168.2.4	110.4.45.197	PASV
Sep 27, 2024 13:14:13.186691046 CEST	21	49737	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,242,137)
Sep 27, 2024 13:14:13.192327976 CEST	49737	21	192.168.2.4	110.4.45.197	STOR SC_user-849224_2024_09_27_07_14_12.jpeg
Sep 27, 2024 13:14:13.666157007 CEST	21	49790	110.4.45.197	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 14 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 14 of 50 allowed.220-Local time is now 19:14. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 14 of 50 allowed.220-Local time is now 19:14. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 14 of 50 allowed.220-Local time is now 19:14. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 14 of 50 allowed.220-Local time is now 19:14. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Sep 27, 2024 13:14:13.666340113 CEST	49790	21	192.168.2.4	110.4.45.197	USER origin@haliza.com.my
Sep 27, 2024 13:14:13.965307951 CEST	21	49791	110.4.45.197	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 15 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 15 of 50 allowed.220-Local time is now 19:14. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 15 of 50 allowed.220-Local time is now 19:14. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 15 of 50 allowed.220-Local time is now 19:14. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 15 of 50 allowed.220-Local time is now 19:14. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Sep 27, 2024 13:14:13.965465069 CEST	49791	21	192.168.2.4	110.4.45.197	USER origin@haliza.com.my
Sep 27, 2024 13:14:14.024213076 CEST	21	49737	110.4.45.197	192.168.2.4	150 Accepted data connection
Sep 27, 2024 13:14:14.053566933 CEST	21	49790	110.4.45.197	192.168.2.4	331 User origin@haliza.com.my OK. Password required
Sep 27, 2024 13:14:14.053886890 CEST	49790	21	192.168.2.4	110.4.45.197	PASS JesusChrist007$
Sep 27, 2024 13:14:14.334882975 CEST	21	49791	110.4.45.197	192.168.2.4	331 User origin@haliza.com.my OK. Password required
Sep 27, 2024 13:14:14.335005045 CEST	49791	21	192.168.2.4	110.4.45.197	PASS JesusChrist007$
Sep 27, 2024 13:14:14.443470001 CEST	21	49790	110.4.45.197	192.168.2.4	230 OK. Current restricted directory is /
Sep 27, 2024 13:14:14.713192940 CEST	21	49791	110.4.45.197	192.168.2.4	230 OK. Current restricted directory is /
Sep 27, 2024 13:14:14.776681900 CEST	21	49790	110.4.45.197	192.168.2.4	504 Unknown command
Sep 27, 2024 13:14:14.831434011 CEST	21	49737	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.810 seconds (measured here), 69.05 Kbytes per second

Target ID:	0
Start time:	07:09:57
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\rQuotation3200025006.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rQuotation3200025006.exe"
Imagebase:	0x1f0000
File size:	645'120 bytes
MD5 hash:	36C4BFF0F1CDCDA62DA9229500CA1E38
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1732806803.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1732806803.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:10:00
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rQuotation3200025006.exe"
Imagebase:	0x880000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:10:00
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:10:00
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pBBqGOzrz.exe"
Imagebase:	0x880000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:10:00
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:10:00
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp3D2.tmp"
Imagebase:	0x6f0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:10:00
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:10:00
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\rQuotation3200025006.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rQuotation3200025006.exe"
Imagebase:	0x8c0000
File size:	645'120 bytes
MD5 hash:	36C4BFF0F1CDCDA62DA9229500CA1E38
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.4163306810.0000000002CDC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.4163306810.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.4163306810.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	07:10:03
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Roaming\pBBqGOzrz.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\pBBqGOzrz.exe
Imagebase:	0x1c0000
File size:	645'120 bytes
MD5 hash:	36C4BFF0F1CDCDA62DA9229500CA1E38
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:10:10
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp1AB5.tmp"
Imagebase:	0x6f0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:10:09
Start date:	27/09/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:10:10
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:10:11
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Roaming\pBBqGOzrz.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\pBBqGOzrz.exe"
Imagebase:	0x180000
File size:	645'120 bytes
MD5 hash:	36C4BFF0F1CDCDA62DA9229500CA1E38
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:10:11
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Roaming\pBBqGOzrz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\pBBqGOzrz.exe"
Imagebase:	0xff0000
File size:	645'120 bytes
MD5 hash:	36C4BFF0F1CDCDA62DA9229500CA1E38
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.4164492788.000000000354A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.4164492788.0000000003501000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.4164492788.0000000003501000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	07:10:16
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Imagebase:	0x90000
File size:	645'120 bytes
MD5 hash:	36C4BFF0F1CDCDA62DA9229500CA1E38
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:10:17
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp4705.tmp"
Imagebase:	0x6f0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	07:10:17
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:10:17
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Imagebase:	0x2f0000
File size:	645'120 bytes
MD5 hash:	36C4BFF0F1CDCDA62DA9229500CA1E38
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	07:10:17
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Imagebase:	0xc0000
File size:	645'120 bytes
MD5 hash:	36C4BFF0F1CDCDA62DA9229500CA1E38
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	07:10:17
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Imagebase:	0x240000
File size:	645'120 bytes
MD5 hash:	36C4BFF0F1CDCDA62DA9229500CA1E38
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	07:10:17
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Imagebase:	0xe80000
File size:	645'120 bytes
MD5 hash:	36C4BFF0F1CDCDA62DA9229500CA1E38
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000002.1961223046.0000000003241000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000016.00000002.1961223046.0000000003241000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000002.1958682977.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000016.00000002.1958682977.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000016.00000002.1961223046.000000000326C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	07:10:24
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Imagebase:	0x7ff70f330000
File size:	645'120 bytes
MD5 hash:	36C4BFF0F1CDCDA62DA9229500CA1E38
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	07:10:25
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pBBqGOzrz" /XML "C:\Users\user\AppData\Local\Temp\tmp6606.tmp"
Imagebase:	0x6f0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	07:10:25
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	07:10:25
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Imagebase:	0xfe0000
File size:	645'120 bytes
MD5 hash:	36C4BFF0F1CDCDA62DA9229500CA1E38
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001C.00000002.4163218058.00000000033DC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000002.4163218058.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001C.00000002.4163218058.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.1%
Total number of Nodes:	143
Total number of Limit Nodes:	13

Executed Functions

Function 04BBB7D8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735067470.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bb0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf8539364e9f96aee739d65ce1825f96787e23bc2cc16683f35b792ebbe357b
Instruction ID: 67bd8a6b2b78e56c7842d40867b650d65b45cc16a55d184d18ea1fc1a2625851
Opcode Fuzzy Hash: cdf8539364e9f96aee739d65ce1825f96787e23bc2cc16683f35b792ebbe357b
Instruction Fuzzy Hash: B521FAB0D046188FEB18CFABD9543EEBBF3AFC8300F14C06AD448A6264DB7419468F90

Function 04BBB7E8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735067470.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bb0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57c197b923edb1f18a1155537d9e738680a8c57bb543499b4da92e5c8b45fb90
Instruction ID: 4a94c7eec8e28da0d8df6b57d719740392f0a19fc1a36096e135255bf61ae46c
Opcode Fuzzy Hash: 57c197b923edb1f18a1155537d9e738680a8c57bb543499b4da92e5c8b45fb90
Instruction Fuzzy Hash: 9B2198B0E056189BEB18CFABD9547EEFAF6AFC8300F14C06AD41966264EB7419458F90

Function 06CC4D7B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737607240.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 322e2b198bd582d27ecfa7a6f2fbf9539e0e352a432da745f282ca001c18ac6a
Instruction ID: 2545618e90b733780cece92db38d9f72618f697e8eedd15a8242b492e31ddd9c
Opcode Fuzzy Hash: 322e2b198bd582d27ecfa7a6f2fbf9539e0e352a432da745f282ca001c18ac6a
Instruction Fuzzy Hash: FD114C39809218CFDBA4CF55D9447E8B7F8EB4A321F00A1AEC40EA3291D7346AD5CF80

Function 06CC4EE4 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737607240.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b17bc6dd27c6c40ac5d62316993ba4964836af4e870afda0969287cc00c0de1
Instruction ID: d90e63b93274e0f34eefb2413182e6480b86fa86070d31e483ecba05808fb7d7
Opcode Fuzzy Hash: 2b17bc6dd27c6c40ac5d62316993ba4964836af4e870afda0969287cc00c0de1
Instruction Fuzzy Hash: CDF04934C4A258CFCB94DF51E9442F8B7B8EB5A361F40A0AAD40AA3251CA346B90CF84

Function 06CC4ECD Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737607240.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73ca22271f6fa3d9699005bf7b8341d40fe85c76c56fff133ece3026b8105e24
Instruction ID: d4f6cbd9357a95c6822c4cd3410edcddfa2e80aae92d5d4f800b8b93b223fbe4
Opcode Fuzzy Hash: 73ca22271f6fa3d9699005bf7b8341d40fe85c76c56fff133ece3026b8105e24
Instruction Fuzzy Hash: 92F03034D5E244CFD7909F95E4444F8BBB8EB5B260F44209AD40A93222C6207AA5DB80

Function 008AD7F0 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 008AD87E
GetCurrentThread.KERNEL32 ref: 008AD8BB
GetCurrentProcess.KERNEL32 ref: 008AD8F8
GetCurrentThreadId.KERNEL32 ref: 008AD951

Memory Dump Source

Source File: 00000000.00000002.1730545540.00000000008A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_rQuotation3200025006.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4fc80b6975ac72c84942bde01a44396e1e93d2d39dcc9e551c9a00255012b0e0
Instruction ID: 5f88ee312754a19badcecba9f246adebb63faca4c50b3a5378f1d8bd5778bdd9
Opcode Fuzzy Hash: 4fc80b6975ac72c84942bde01a44396e1e93d2d39dcc9e551c9a00255012b0e0
Instruction Fuzzy Hash: E25185B09017498FDB14CFA9C948BDEBBF0FB49314F208469E059A72A1DB749984CF66

Function 008AD800 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 008AD87E
GetCurrentThread.KERNEL32 ref: 008AD8BB
GetCurrentProcess.KERNEL32 ref: 008AD8F8
GetCurrentThreadId.KERNEL32 ref: 008AD951

Memory Dump Source

Source File: 00000000.00000002.1730545540.00000000008A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_rQuotation3200025006.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 92852fa0c3bfa4c5261585ca047c7bb89a7cc4e7f661e416c781b6468b3ec7c7
Instruction ID: 515e9d5143f75b36d2a0a214ef53ee7090c245c37bc8709b968dde612e91cb9b
Opcode Fuzzy Hash: 92852fa0c3bfa4c5261585ca047c7bb89a7cc4e7f661e416c781b6468b3ec7c7
Instruction Fuzzy Hash: D55165B09017098FDB14DFA9C948BDEBBF1FB48304F20C429E059A7660DB749984CF66

Function 06CC15E5 Relevance: 1.8, APIs: 1, Instructions: 250
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06CC1826

Memory Dump Source

Source File: 00000000.00000002.1737607240.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_rQuotation3200025006.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 72920688e529508a4dae90120535602ee94f3f949df143e71dceda5ada3c22fc
Instruction ID: 452aaff8ec0239b090ab0bd7c97a9ec3607f476c7f9f24fec2c5d8234da74141
Opcode Fuzzy Hash: 72920688e529508a4dae90120535602ee94f3f949df143e71dceda5ada3c22fc
Instruction Fuzzy Hash: E8A17B70D00619CFEB50CF69C841BDDBBB2EF44320F1885AAE848A7641DB749A85CF91

Function 06CC15F0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06CC1826

Memory Dump Source

Source File: 00000000.00000002.1737607240.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_rQuotation3200025006.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: fa839659140ea91f235e43c02070157b266ed3c788faf85989ede0712a1c9dac
Instruction ID: a42aa83f1531dc6395f5e12983767d34a556cfbd6773facf1171c95ef09c6531
Opcode Fuzzy Hash: fa839659140ea91f235e43c02070157b266ed3c788faf85989ede0712a1c9dac
Instruction Fuzzy Hash: 34915B71D00619CFEB60CF69C841BDDBBB2FF44324F1885A9E848A7641DB749A85CF91

Function 008AB159 Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 008AB3BE

Memory Dump Source

Source File: 00000000.00000002.1730545540.00000000008A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_rQuotation3200025006.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 18ee8a05bc485cd26a0631036d797a4aaf274ec55d86a662156252b4aeec689b
Instruction ID: 2c9fe62e904f8b018a58374610d1fd426c305fd0a913d319397e242f57d89276
Opcode Fuzzy Hash: 18ee8a05bc485cd26a0631036d797a4aaf274ec55d86a662156252b4aeec689b
Instruction Fuzzy Hash: 72816670A00B058FEB24DF69D45579ABBF1FF89304F008A2ED48ADBA51D774E849CB91

Function 008A5E75 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 008A5F31

Memory Dump Source

Source File: 00000000.00000002.1730545540.00000000008A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_rQuotation3200025006.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 92f8ce1a047540074f5f02ed16d7779c78c9ba5d2aa1fa4a5f7c22b1691dbeaf
Instruction ID: 0c99d7aff413e656f039545806b4f69c6907a26982c96e75a2b263fa0a3c7da2
Opcode Fuzzy Hash: 92f8ce1a047540074f5f02ed16d7779c78c9ba5d2aa1fa4a5f7c22b1691dbeaf
Instruction Fuzzy Hash: 5D41E2B0C00619CFDB24CFA9C944BDDBBB5BF49304F24846AD408AB255DB756986CF90

Function 008A49D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 008A5F31

Memory Dump Source

Source File: 00000000.00000002.1730545540.00000000008A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_rQuotation3200025006.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3cb22381ef70b351e30f4f562bd386d12de22b62dd9203c361c21376f200e5b7
Instruction ID: e37ecb3a6f8b146981dee34f95ceea081651710ea5abbdc34f6bc2aa17657d47
Opcode Fuzzy Hash: 3cb22381ef70b351e30f4f562bd386d12de22b62dd9203c361c21376f200e5b7
Instruction Fuzzy Hash: A041D0B0C00719DEDB24CFA9C844B9DBBB5FF49304F20846AD408AB255DB756985CF90

Function 06CC1361 Relevance: 1.6, APIs: 1, Instructions: 73
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06CC13F8

Memory Dump Source

Source File: 00000000.00000002.1737607240.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_rQuotation3200025006.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 94cc5654d336e560c0695c8a762d505897ec1a3e9ddfa4099cd02062e8650b1f
Instruction ID: e9d74bffe38f2e0a618e9de2e2ebfdd35ff9b201f1f32303881f4580cd4cc28e
Opcode Fuzzy Hash: 94cc5654d336e560c0695c8a762d505897ec1a3e9ddfa4099cd02062e8650b1f
Instruction Fuzzy Hash: 7B2148B19003599FCB10CFAAC881BDEBBF5FF48324F14842EE958A7651C7789955CBA0

Function 06CC1368 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06CC13F8

Memory Dump Source

Source File: 00000000.00000002.1737607240.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_rQuotation3200025006.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ad2a750ab3249fc490870ea84017217b6ceb62e5fc96fc8663f643874fe932c0
Instruction ID: fd785078bed219f5ec0e0c4b00f9f8a63262e3b19a9534af4aedb21eccd41680
Opcode Fuzzy Hash: ad2a750ab3249fc490870ea84017217b6ceb62e5fc96fc8663f643874fe932c0
Instruction Fuzzy Hash: 882157B19003499FCB10CFAAC881BDEBBF5FF48324F14842DE958A7251C7789944CBA4

Function 06CC1450 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06CC14D8

Memory Dump Source

Source File: 00000000.00000002.1737607240.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_rQuotation3200025006.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 4051a9305d1065f0fa394a2d568cf5b3767431dde80683f15e1d8d00af2700f2
Instruction ID: fdc75f15a481170dc2e3acb3c99b32462ec6493855fafdd582592b46286d956d
Opcode Fuzzy Hash: 4051a9305d1065f0fa394a2d568cf5b3767431dde80683f15e1d8d00af2700f2
Instruction Fuzzy Hash: B32136B18002499FCB10DFAAC881ADEFBF5FF48320F10842AE958A7250C7389945CBA1

Function 06CC095B Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06CC09DE

Memory Dump Source

Source File: 00000000.00000002.1737607240.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_rQuotation3200025006.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: d82eb9f99352bbd7982ac2383e6e81af2d00a04515490487fdca4ba30786ebcb
Instruction ID: 7e9fe6780214243f26add2b20bf1273c9236aee6dae54347ecd770ef6a478ad6
Opcode Fuzzy Hash: d82eb9f99352bbd7982ac2383e6e81af2d00a04515490487fdca4ba30786ebcb
Instruction Fuzzy Hash: 682109B1D003098FDB50DFAAC4857EEBBF4AB48324F14842DD459A7240DB78A985CFA5

Function 008ADA40 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 008ADACF

Memory Dump Source

Source File: 00000000.00000002.1730545540.00000000008A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_rQuotation3200025006.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 72b95296a658f1d92628b678ee10743935397de1314a382c04d10ff5f8bac0f3
Instruction ID: 1b385b531bce0a36856e6b24dcaec31b81cb9b74530df4941e95b312b02609a1
Opcode Fuzzy Hash: 72b95296a658f1d92628b678ee10743935397de1314a382c04d10ff5f8bac0f3
Instruction Fuzzy Hash: B62100B59042589FDB10CFAAE984AEEBFF5FB48310F14841AE959A7351C374A944CF60

Function 06CC1458 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06CC14D8

Memory Dump Source

Source File: 00000000.00000002.1737607240.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_rQuotation3200025006.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: ae6206c44382524e1366be3eda861d7f7d3898b719bb9b09c2004e711b176eb3
Instruction ID: e878a30c068d11f44184a43a5b8651e4e17de3d1122b46b706ee46fef7f81c22
Opcode Fuzzy Hash: ae6206c44382524e1366be3eda861d7f7d3898b719bb9b09c2004e711b176eb3
Instruction Fuzzy Hash: B72128B19003599FCB10DFAAC841ADEFBF5FF48320F10842DE558A7250C734A944CBA4

Function 06CC0960 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06CC09DE

Memory Dump Source

Source File: 00000000.00000002.1737607240.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_rQuotation3200025006.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 419a77ec2130988969e01698cb9e66234a928781f2d4ac2dac5a6ef909b79583
Instruction ID: abb0c7f19c78e7271eee3ef0b68f4646cae66a5f78fab4f1c5315f37a27ede8e
Opcode Fuzzy Hash: 419a77ec2130988969e01698cb9e66234a928781f2d4ac2dac5a6ef909b79583
Instruction Fuzzy Hash: 5D2107B19003098FDB50DFAAC4857EEBBF4AB88324F14842DD459A7240CB78A985CFA5

Function 008ADA48 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 008ADACF

Memory Dump Source

Source File: 00000000.00000002.1730545540.00000000008A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_rQuotation3200025006.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 23af2056ef00781a78e29cdeaebf89c751ffa4f9be18ebb3b15072168b969027
Instruction ID: 0d8d354f08834398bd25d846700e70070297be812fddc0e5e58956142caca268
Opcode Fuzzy Hash: 23af2056ef00781a78e29cdeaebf89c751ffa4f9be18ebb3b15072168b969027
Instruction Fuzzy Hash: E021C2B59003589FDB10CFAAD984ADEFBF9FB48320F14841AE958A7350D374A944CFA5

Function 06CC5CD3 Relevance: 1.6, APIs: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06CC5C95

Memory Dump Source

Source File: 00000000.00000002.1737607240.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_rQuotation3200025006.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e2afc1dd7a9e7fd9af1c9b98ecf8a7557be36970736cae7752da6bfba0f3727b
Instruction ID: 2d83bce922a6aa4fcdec94cb90e66fc7588f9e0dc751993828a09a3f271eec2a
Opcode Fuzzy Hash: e2afc1dd7a9e7fd9af1c9b98ecf8a7557be36970736cae7752da6bfba0f3727b
Instruction Fuzzy Hash: 992188B1D043698EDB20EFAAD9087EEBBF0AF48320F50841DC441B7251C7796A54CFA0

Function 06CC12A6 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06CC1316

Memory Dump Source

Source File: 00000000.00000002.1737607240.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_rQuotation3200025006.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 695b7d97bdd11fd13660dd15f8ecdee4d6312dc7df3be16f084851b445873d7c
Instruction ID: 3bc0277b825e0aa20edc653be2840d385aa48593205270873b2161716c1af52d
Opcode Fuzzy Hash: 695b7d97bdd11fd13660dd15f8ecdee4d6312dc7df3be16f084851b445873d7c
Instruction Fuzzy Hash: D51179B18002488FCB10DFAAC845BDEFFF5EF88324F248419E559A7250C7359944CFA0

Function 06CC12A8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06CC1316

Memory Dump Source

Source File: 00000000.00000002.1737607240.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_rQuotation3200025006.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8c7b54c0f43cc2d620397a40b3e477ab160d11eb7a98dc067260539a7d91ba3d
Instruction ID: 4c8a929d2102b53a37d81973bf9dd5e6af47a0695a3d2e0d4e620ccb7ac3ac6f
Opcode Fuzzy Hash: 8c7b54c0f43cc2d620397a40b3e477ab160d11eb7a98dc067260539a7d91ba3d
Instruction Fuzzy Hash: EE1167B18002488FCB10DFAAC844BDEFFF5EF88324F248419E559A7250C735A944CFA4

Function 06CC08AB Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06CC0912

Memory Dump Source

Source File: 00000000.00000002.1737607240.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_rQuotation3200025006.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 185aa8c58c8cc66da227a74f8ac6107cc00446bc1cb18bd74b5bb31281f25aa9
Instruction ID: a9786da51a5630f563db68c45b2bdcff5f3f60c67b8a961fcef479678bb9b18c
Opcode Fuzzy Hash: 185aa8c58c8cc66da227a74f8ac6107cc00446bc1cb18bd74b5bb31281f25aa9
Instruction Fuzzy Hash: 601128B19002488BDB20DFAAC4457DEFBF5EB88324F248419D459A7250C675A945CFA4

Function 06CC5C30 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06CC5C95

Memory Dump Source

Source File: 00000000.00000002.1737607240.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_rQuotation3200025006.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 62173b1356127d4e1762c728264249a4b828b2c4ab50711854221bfa3d84b74a
Instruction ID: 21f6a5ebcdef49615a913d8290dd8220f47c056d11f8c6f32a140e4bec14afb1
Opcode Fuzzy Hash: 62173b1356127d4e1762c728264249a4b828b2c4ab50711854221bfa3d84b74a
Instruction Fuzzy Hash: 511106B58003499FDB10DF99D845BDEFFF8EB48324F208819E958A7610C375A995CFA1

Function 06CC08B0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06CC0912

Memory Dump Source

Source File: 00000000.00000002.1737607240.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_rQuotation3200025006.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d278fc2ba67125849869a3a0781406bcdd2e6e657385c0f3b1f151d68c555ab8
Instruction ID: 7470d19b615d034a955b91ac99ecb7887bb2573916c4cb2a7f2789762c1d72f1
Opcode Fuzzy Hash: d278fc2ba67125849869a3a0781406bcdd2e6e657385c0f3b1f151d68c555ab8
Instruction Fuzzy Hash: CF1125B19002488BDB20DFAAC8457EEFBF5EB88324F208429D459A7250CA75A944CFA4

Function 008AB358 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 008AB3BE

Memory Dump Source

Source File: 00000000.00000002.1730545540.00000000008A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_rQuotation3200025006.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a5f48a634163c10b7d0523a08d85bc33667278d9cc549f7f68a483be37861673
Instruction ID: c2c9f3a5b51cd3444e4de616863eeec8e389922cf20f5ec59c1cbc61ad3d24da
Opcode Fuzzy Hash: a5f48a634163c10b7d0523a08d85bc33667278d9cc549f7f68a483be37861673
Instruction Fuzzy Hash: 8811DFB5C006498FDB10CF9AD844ADEFBF4EB89324F10842AD569A7610C379A945CFA5

Function 06CC2D94 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06CC5C95

Memory Dump Source

Source File: 00000000.00000002.1737607240.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_rQuotation3200025006.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e32097911c46248522e8db540b2d12039812ec36f54cf7f178f7aa374713e8b5
Instruction ID: fe5fd9dd5f40e2bd9859d69e9fe50e1360b830e911687d55e1a2626c761b27f6
Opcode Fuzzy Hash: e32097911c46248522e8db540b2d12039812ec36f54cf7f178f7aa374713e8b5
Instruction Fuzzy Hash: E211F2B5800348DFDB50DF9AD989BDEBBF8EB48324F108419E558A7210C375A994CFA5

Function 0084D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1730229397.000000000084D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0084D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_84d000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 273348986e07ebb92f487c0105c93ef82db34f1ca55855e8bd895e3dba19f389
Instruction ID: f77daf04066af8b26947c99a71e1af72a7f02edc610146ea3a235621c4b9c48f
Opcode Fuzzy Hash: 273348986e07ebb92f487c0105c93ef82db34f1ca55855e8bd895e3dba19f389
Instruction Fuzzy Hash: 7E212571500308DFDB05DF14D9C0B26BF65FB98328F20C169E9098B256C33AE856CAA2

Function 0085D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1730340384.000000000085D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0085D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85d000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c086ab5b44fa26972e27be6074a3888082b33aff9bbba778fd39e0fdb2a53cbb
Instruction ID: 692c54aa6bd2fcfd0dfbf5471052000ce4a88b25bf02cf8042dafd29cfee7922
Opcode Fuzzy Hash: c086ab5b44fa26972e27be6074a3888082b33aff9bbba778fd39e0fdb2a53cbb
Instruction Fuzzy Hash: 5E21D075604704DFDB24DF14D984B26BBA5FB84319F20C569DC0A8B296C33AD84BCA61

Function 0085D005 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1730340384.000000000085D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0085D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85d000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7f6534e17e5a32c2e21340d8c06f739429e1bee78224e79ee57845977e2ea11
Instruction ID: 23dc1b2c55645c75081f3aa42f84b0902eb39ba4aa541ec396c116fdf63406ba
Opcode Fuzzy Hash: e7f6534e17e5a32c2e21340d8c06f739429e1bee78224e79ee57845977e2ea11
Instruction Fuzzy Hash: D1219F755097808FDB12CF24D994B15BF71FB46314F28C5EADC498B6A7C33A980ACB62

Function 0084D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1730229397.000000000084D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0084D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_84d000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 1a703aebb10326f5e4c17d147f6f123a9fbfddae4647cf8d14704afdb7d0a785
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 7C11E176404344CFCB02CF10D5C4B16BF71FB94324F24C2A9D8094B256C33AE85ACBA1

Function 0084D731 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1730229397.000000000084D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0084D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_84d000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adc614c1e49f341afb60f785684f8267aa15145951e5e94ca9b7adbaad5da487
Instruction ID: 5dc923d8d42643478d5ce98919d5301f21ecc98a45749aa0ac0dad763cea97d1
Opcode Fuzzy Hash: adc614c1e49f341afb60f785684f8267aa15145951e5e94ca9b7adbaad5da487
Instruction Fuzzy Hash: 5601A7711093489AE7114B25CDC4767FFD8FF81364F28C56AED098A296C6799C40C671

Function 0084D730 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1730229397.000000000084D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0084D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_84d000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8252da2f484a76daae48a7160d9001b9d71a9f119f2f9bf1e6eb40b0f01d19b4
Instruction ID: e7afa15f00061d39754607dba208703644beb2906aac868264a6eaf1a1a6f3af
Opcode Fuzzy Hash: 8252da2f484a76daae48a7160d9001b9d71a9f119f2f9bf1e6eb40b0f01d19b4
Instruction Fuzzy Hash: 13F062724043449AE7118B16DDC4B66FFE8EB91734F18C55AED484E296C2799C44CA71

Non-executed Functions

Function 06CC0E70 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737607240.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b39122f97403eedc98123dfda390bf13fbe2c0f5a4d2605e49c58640ed9a17
Instruction ID: e787b64193bbb0e5b89ae1fd9a4a9119c69afa6d05c2561e23a97fdc35d0339c
Opcode Fuzzy Hash: e7b39122f97403eedc98123dfda390bf13fbe2c0f5a4d2605e49c58640ed9a17
Instruction Fuzzy Hash: 52E11A74E002598FCB14DFA9D5809AEFBB2FF89314F248159E814AB35AD731AD81CF60

Function 06CC0A38 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737607240.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58b434000911a2a0bb99cf2159aa510f8dfc1cf00476fc758d39708fd45b96d8
Instruction ID: a9e67644f3fce0f5d8ad6f677de3efb3532ceca9410481a94823b447801920a3
Opcode Fuzzy Hash: 58b434000911a2a0bb99cf2159aa510f8dfc1cf00476fc758d39708fd45b96d8
Instruction Fuzzy Hash: 3FE10974E00219CFCB14DFA9D5809AEFBB2BF88314F249159D814AB35AD731AD81CFA1

Function 04BBE7D8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735067470.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bb0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f88f7ab9f27395ea0a4b4faf4f0a7278f5af05275949997b613184a1b9ef8d6
Instruction ID: 38b6c94ac40fe68b8a2e263af79eca036fab5ec42a2de312ac09c30bd41d742b
Opcode Fuzzy Hash: 3f88f7ab9f27395ea0a4b4faf4f0a7278f5af05275949997b613184a1b9ef8d6
Instruction Fuzzy Hash: 5BE1FA74E002198FCB14DFA9D5809AEFBB2FF89304F249199D855AB35AD770AD41CFA0

Function 04BBE3A0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735067470.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bb0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 798a61e16659e3e815a92e954a7411cd1fac452643e9aeda161d00a210b8dc65
Instruction ID: 3af29ebb1d517dd859e977d0ad98ae19b5e423ca3d03d3d071d747c34681577e
Opcode Fuzzy Hash: 798a61e16659e3e815a92e954a7411cd1fac452643e9aeda161d00a210b8dc65
Instruction Fuzzy Hash: B2E10A74E002198FDB14DFA9D5809EEBBB2FF89304F2491A9D854AB359D770AD41CFA0

Function 04BBEC10 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735067470.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bb0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b892bc6c252af4bfc989fdc9f770d906c3235f510a16c14e08e966b4db9a762
Instruction ID: d3a1ecb044742c67b7ffa94c5b23c1fa982b3bf533f9746fba43b96eef4326e7
Opcode Fuzzy Hash: 4b892bc6c252af4bfc989fdc9f770d906c3235f510a16c14e08e966b4db9a762
Instruction Fuzzy Hash: 08E11A74E002198FCB14DFA9D5809AEFBB2FF88304F249199E854AB359D770AD41CFA0

Function 04BB5E18 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735067470.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bb0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 673135ac64682a1e450b86a4a7e79a1745d771f3938fb6b8429b985cfbc0b688
Instruction ID: 79bb983add7340559d54e736ce45da5eccabd7dc2a265bc56b4a5ca790f7cfe0
Opcode Fuzzy Hash: 673135ac64682a1e450b86a4a7e79a1745d771f3938fb6b8429b985cfbc0b688
Instruction Fuzzy Hash: EBE11731D10A1ACADB10EB64D954A9DF7B1FF95300F108B9AE5093B225FB70AAC5CF91

Function 008AF2E4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1730545540.00000000008A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e90b7e1125c9bf9808451dd9b0c1283c05902c7b6451f5ece75aaa52d1ab982a
Instruction ID: 39b197d15ea120dde495f732d7d10f278c94afac7c824e574b0eb14997825ea2
Opcode Fuzzy Hash: e90b7e1125c9bf9808451dd9b0c1283c05902c7b6451f5ece75aaa52d1ab982a
Instruction Fuzzy Hash: D4A16E32E002198FDF05DFB5C84059EBBB2FF86310B15857AE906EB226DB71E956CB50

Function 04BB5E28 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735067470.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bb0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e077ce77f14e4dde1d34781372c2a91e45247b3db61d4a06f26e628112ca7d3c
Instruction ID: 5ee195121bcdf0f87ca723096e58e9f1721fcf6328fa7929dff7535069f59735
Opcode Fuzzy Hash: e077ce77f14e4dde1d34781372c2a91e45247b3db61d4a06f26e628112ca7d3c
Instruction Fuzzy Hash: 41D11531D10B1ACADB10EB64D954A9DB3B1FF95300F509B9AE5093B225FB70AAC4CF91

Function 04BBE7CB Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735067470.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bb0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ecbd76859b3333ee3948f760b7015d31df874aa0701ea9971fe32e349d29f9e
Instruction ID: 5fc3bf3482922aad929a427fca1e7fa6831bd61e42f007725570bb505fdec8d8
Opcode Fuzzy Hash: 0ecbd76859b3333ee3948f760b7015d31df874aa0701ea9971fe32e349d29f9e
Instruction Fuzzy Hash: A951FB70E002198FCB14CFA9D5805EEBBF2EF89304F24C1A9D458AB216D771A941CFA1

Function 04BBE39B Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735067470.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bb0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b23f49e7dbb11869a7c13cd387caeca01a92cb7357d8e98ec62082e8e1bc3c8
Instruction ID: e3c2c2a7a0521700072031fa5cc7a9ac658a208ac9bd99b92659a6e8e19fc090
Opcode Fuzzy Hash: 8b23f49e7dbb11869a7c13cd387caeca01a92cb7357d8e98ec62082e8e1bc3c8
Instruction Fuzzy Hash: 9951E674E002198FDB14DFA9D5805EEBBF2BF89304F24C1A9D458A7316D771A942CFA0

Analysis Process: rQuotation3200025006.exePID: 2756, Parent PID: 6744COMMON

Execution Graph

Execution Coverage:	13.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.2%
Total number of Nodes:	253
Total number of Limit Nodes:	30

Executed Functions

Function 06932758 Relevance: 9.0, Strings: 6, Instructions: 1532COMMON

Download Yara Rule

Strings

$^q, xrefs: 06933C5A
$^q, xrefs: 06933C9B
$^q, xrefs: 06933CA7
$^q, xrefs: 06933C83
$^q, xrefs: 06933C4E
$^q, xrefs: 06933C77

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 0db30bfc0630a9be8cc5854d45415a372f540ee5f2da54ca9db79247b018177d
Instruction ID: 82e39d0d50deccdd19fc4eadb8c217dbe1a45d441878c0261b18a01b99bd8313
Opcode Fuzzy Hash: 0db30bfc0630a9be8cc5854d45415a372f540ee5f2da54ca9db79247b018177d
Instruction Fuzzy Hash: 3DE24634E102198FDB64DF68C584A9DB7F6FF89300F6485A9D409AB665EB30ED85CF80

Function 0693B348 Relevance: 8.3, Strings: 6, Instructions: 769COMMON

Download Yara Rule

Strings

$^q, xrefs: 0693BD29
$^q, xrefs: 0693BCF5
$^q, xrefs: 0693BD01
$^q, xrefs: 0693BD35
$^q, xrefs: 0693BCCD
$^q, xrefs: 0693BCC1

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 9488e9b67408ac5c7bd7e17b263d7022de219f6efe2fe168520f85791710e348
Instruction ID: 5a66be777bab866d43d4a0abf6ac730b1a6dbb1d9e00fc3dc8c3d30132d8a244
Opcode Fuzzy Hash: 9488e9b67408ac5c7bd7e17b263d7022de219f6efe2fe168520f85791710e348
Instruction Fuzzy Hash: 27528130E101298FDF64CB68D5947ADB7F6EB95310F20882AE405EBB59DB34DC85CB51

Function 06937E90 Relevance: 3.0, Strings: 2, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0693842B
$^q, xrefs: 06938437

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 892dda508323309779f959033fd16e09001a841d0ce8b4678f443d64da6237a8
Instruction ID: ab23e77486e878326d686473a9d746b150642a43378ff0840826a5e6766934ed
Opcode Fuzzy Hash: 892dda508323309779f959033fd16e09001a841d0ce8b4678f443d64da6237a8
Instruction Fuzzy Hash: 9A02AE30B002158FDB54DBB5D9846AEB7E6FF84304F248529E41ADB794DB35EC86CB81

Function 069356A8 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 069359FB

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: b056328883c66aa4647f1d74692f0d3394581e29e6ed75ccab2bd3a2a59c59cd
Instruction ID: ce7f05ec9d133d29e8eef91251a7b479b97205df53f1ff4584ad37c14eaf1514
Opcode Fuzzy Hash: b056328883c66aa4647f1d74692f0d3394581e29e6ed75ccab2bd3a2a59c59cd
Instruction Fuzzy Hash: 0122D131E002258FDF60DFA4C4846AEBBF6EF88314F21846AD45AEB754DA35DD42CB91

Function 0692C628 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(0000000D,00000000,?,?,?,?,?,?,?,?,?,0692D458,00000000,00000000), ref: 0692D66B

Memory Dump Source

Source File: 00000008.00000002.4193699847.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_rQuotation3200025006.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: da2d435dbe4c0b215a9b802118618c73e8bdf741877d6c3dfc27e6ae1492d5ef
Instruction ID: 817869b7e9901c049a49007b67777e0a949e58d3011e8315d5caaaaf068c43f1
Opcode Fuzzy Hash: da2d435dbe4c0b215a9b802118618c73e8bdf741877d6c3dfc27e6ae1492d5ef
Instruction Fuzzy Hash: 502147B1D002199FCB54CF9AC884BEEFBF4EF88310F10842AE419A7250C774A944CFA5

Function 06936700 Relevance: .8, Instructions: 809COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 440f82d690fc5aa65e3d640d33da1e6a909264273be2b1ebe788fab6d809b792
Instruction ID: 1ca1b81f9542470f12b9096de618d8545cabdc2a18daa803cf2bb8dda4aa0799
Opcode Fuzzy Hash: 440f82d690fc5aa65e3d640d33da1e6a909264273be2b1ebe788fab6d809b792
Instruction Fuzzy Hash: 0062AF34A002149FDB54DFA8D994BAEB7F6EF88314F248469E406DB754DB35EC46CB80

Function 0693ADE0 Relevance: 12.9, Strings: 10, Instructions: 389
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0693AF0D
XM, xrefs: 0693B1A1
$^q, xrefs: 0693AFAC
XM, xrefs: 0693B282
$^q, xrefs: 0693AF01
$^q, xrefs: 0693AF8F
$^q, xrefs: 0693AF54
$^q, xrefs: 0693AF83
$^q, xrefs: 0693AF60
$^q, xrefs: 0693AFB8

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: XM$XM$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2488550430
Opcode ID: 98d08998d7977ab898a79d75c39c6b5db8c38aa2250a44a49a0ae3afceb52317
Instruction ID: 7ee286b053cb0140954d8f06ec45fbb7429c4097ffe1bfae0b419ea119116ad2
Opcode Fuzzy Hash: 98d08998d7977ab898a79d75c39c6b5db8c38aa2250a44a49a0ae3afceb52317
Instruction Fuzzy Hash: CDE16C30E102198FCF69DF69D5846AEB7B6EF84300F208929D41AEB758DB35DC46CB91

Function 06939260 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0693930B
$^q, xrefs: 069392D0
$^q, xrefs: 069392DC
$^q, xrefs: 06939317

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: ed4ed3da256c84186c8233af43e25252ea9f38f976ff35c8dbd66ade074f727b
Instruction ID: fc917094e032066c746b9800ec5646a969e2d647a506d14c133ab2045bd8aeeb
Opcode Fuzzy Hash: ed4ed3da256c84186c8233af43e25252ea9f38f976ff35c8dbd66ade074f727b
Instruction Fuzzy Hash: 80916D30B1021A8FDB54DB69D950BAEB3F6AFC9304F208569C80DEB344EB70DD468B95

Function 0693D068 Relevance: 4.6, Strings: 3, Instructions: 801
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0693D473
$^q, xrefs: 0693D467
$^q, xrefs: 0693D45F

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q
API String ID: 0-831282457
Opcode ID: 9fe4e2889affd861365fa77c4c8583825394c3700591b0aa081a78bd2afaee88
Instruction ID: 8ffa639a89c358bf11556a4c802cd068ea02b3235fc6e00bb978bbdc635957a0
Opcode Fuzzy Hash: 9fe4e2889affd861365fa77c4c8583825394c3700591b0aa081a78bd2afaee88
Instruction Fuzzy Hash: 74623F30A002168FCB55EB69D590A5EB7F2FF84304F208A29D409DF769DB71ED4ACB81

Function 060B4690 Relevance: 4.1, Strings: 3, Instructions: 341
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 060B49C7
(bq, xrefs: 060B480A
(bq, xrefs: 060B4835

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq
API String ID: 0-2716923250
Opcode ID: 4d0bf0c2b12e415bf5173778e5ca7be9221ad6c63efbac3538dd9c135edfd235
Instruction ID: e1d3458dc1384c6b34f10812aa0ac57700b80f259851ff03b786966353ecc9d3
Opcode Fuzzy Hash: 4d0bf0c2b12e415bf5173778e5ca7be9221ad6c63efbac3538dd9c135edfd235
Instruction Fuzzy Hash: C7D1AC30E402099FCB44DFA9C8546AEBBF2EF88310F14C569E405AB395DB74AE41CB91

Function 06934C78 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 06934CA3
XPcq, xrefs: 06934DC9
\Ocq, xrefs: 06934E53

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: a3012a9e48d29cf1d96d224442d5c0554e22426d65de91a7f97c5f647bacc720
Instruction ID: cc330f2469be9076e7befb1462bc230da5ecc3749466cfd00c4e8bdae6df395f
Opcode Fuzzy Hash: a3012a9e48d29cf1d96d224442d5c0554e22426d65de91a7f97c5f647bacc720
Instruction Fuzzy Hash: 3B615D31E002189FEB54DFB5C855BAEBBF6FB88700F208829E105AB395DB758D458B91

Function 060B1DC0 Relevance: 2.8, Strings: 2, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

nKvq, xrefs: 060B1FB8
nKvq, xrefs: 060B1F99

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: nKvq$nKvq
API String ID: 0-2223595353
Opcode ID: 7236bb4012440fce99d1ad5b32760efcd6477cb565f117157a4d218a521b851c
Instruction ID: 3e4fbaaa5a6716f0e1d838ed27f1fe1e6dfff60bc1eac1b6b13a70bbc279dd91
Opcode Fuzzy Hash: 7236bb4012440fce99d1ad5b32760efcd6477cb565f117157a4d218a521b851c
Instruction Fuzzy Hash: 29B16C75E006068FCB54DF68C4909AEFBB2BF88310B15C655ED55AB366DB30ED82CB90

Function 060B1DB0 Relevance: 2.7, Strings: 2, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

nKvq, xrefs: 060B1FB8
nKvq, xrefs: 060B1F99

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: nKvq$nKvq
API String ID: 0-2223595353
Opcode ID: 5463e854004fca27b630ed8ff5ba95ab883c9b2ac51fc521fe575ff74ee79840
Instruction ID: d8fb42065952f566cb91703a882fa44ce0cdcc8d59e6c13000ffd8fc198ebae8
Opcode Fuzzy Hash: 5463e854004fca27b630ed8ff5ba95ab883c9b2ac51fc521fe575ff74ee79840
Instruction Fuzzy Hash: 71B14935E006068FCB58DF58C4909AEFBB2BF88310B158655ED55AB356DB30FD82CB90

Function 06939253 Relevance: 2.7, Strings: 2, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0693930B
$^q, xrefs: 069392D0

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 46d5e5512c01e9fad730f8f9bd502f12a347498c41c09a0098125d019eade238
Instruction ID: 41cfe89d539ea064225418c3f7bb30f9b6fa05500991013e1f8b6bef4737b709
Opcode Fuzzy Hash: 46d5e5512c01e9fad730f8f9bd502f12a347498c41c09a0098125d019eade238
Instruction Fuzzy Hash: 2B514E30B101159FDB54EB79D990BAEB3FAABC8344F108469C40DEB388EB71DC428B95

Function 06934C69 Relevance: 2.6, Strings: 2, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 06934CA3
XPcq, xrefs: 06934DC9

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: fcq$XPcq
API String ID: 0-936005338
Opcode ID: 9f36968471a77c0181230b60651007113ef8c948be0a37b12787a868f71c5900
Instruction ID: bb418e3913d6d551bb45081449ad4741e44f810ba8070a1fc2c4891a47400803
Opcode Fuzzy Hash: 9f36968471a77c0181230b60651007113ef8c948be0a37b12787a868f71c5900
Instruction Fuzzy Hash: 49517D71F102189FDB55DFB4C855BAEBBF6BF88700F208929E105EB395DA758C018B91

Function 02A6EEA0 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4161716705.0000000002A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2a60000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fdb09d282cc7c5d452cf3d7f9b75058edd46d9a0de1fefe314873baaa6f1b04
Instruction ID: 222fb66981f256ebea178acc3a6c9debeaa7cd33870a5203610e0ff79776b885
Opcode Fuzzy Hash: 3fdb09d282cc7c5d452cf3d7f9b75058edd46d9a0de1fefe314873baaa6f1b04
Instruction Fuzzy Hash: E8411332E103558FCB14DFA9D8446AEBBF5FF88320F14866AE409A7350DB78A841CBD0

Function 06925FD3 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 069260EA

Memory Dump Source

Source File: 00000008.00000002.4193699847.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_rQuotation3200025006.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: d3e808d2547b7e4edad550740fcf141d7c4e00e3f56a48ce47a14fd4b2155b99
Instruction ID: de752e5038f8aefa9e9a18d8e4d2a5ad71923421dc44ce67307d18d00754dae8
Opcode Fuzzy Hash: d3e808d2547b7e4edad550740fcf141d7c4e00e3f56a48ce47a14fd4b2155b99
Instruction Fuzzy Hash: ED51D0B5D00319DFDB14CF9AC984ADEBFB5BF48300F24852AE419AB614D775A885CF90

Function 06925FD8 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 069260EA

Memory Dump Source

Source File: 00000008.00000002.4193699847.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_rQuotation3200025006.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 52afb1cdc86f3332b47d3829d8254a4475e69b2670a75e1bf90548f10767bf02
Instruction ID: e86063c0c7fe0849c5fefd9ee6ecffdc2361ba5ad616271e26484083ccf89af7
Opcode Fuzzy Hash: 52afb1cdc86f3332b47d3829d8254a4475e69b2670a75e1bf90548f10767bf02
Instruction Fuzzy Hash: AC41E0B1D00319DFDB14CF9AC980ADEBFB5BF48300F20852AE818AB214D771A885CF90

Function 06929AB4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0692AE29

Memory Dump Source

Source File: 00000008.00000002.4193699847.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_rQuotation3200025006.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 3593c1f7f452e8012c8c96a490968de6f3d395acf1b5dbe9b68558158ed3884a
Instruction ID: d7d8b06344e3f24a8cfa268775a934997fdaa118210f8ff061bb862b8023ba7f
Opcode Fuzzy Hash: 3593c1f7f452e8012c8c96a490968de6f3d395acf1b5dbe9b68558158ed3884a
Instruction Fuzzy Hash: 304129B5A00315CFCB54DF99C888AAABBF5FF88314F24C859D519AB325D734A841CFA0

Function 0692B4D0 Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 0692BB38

Memory Dump Source

Source File: 00000008.00000002.4193699847.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_rQuotation3200025006.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: a22841f4af9b7092df4a1184857097e92d53d3e0c4705d771ba6c72d092e2035
Instruction ID: ebb72bb862ae7d8b56de3a09ae3ec522bb6da1b2d39b9ba3d25fb48e94f62f7b
Opcode Fuzzy Hash: a22841f4af9b7092df4a1184857097e92d53d3e0c4705d771ba6c72d092e2035
Instruction Fuzzy Hash: 8C3112B0D01219DFDB50CF99C985BDEBBF5AF48308F208459E404BB298DB75A885CFA5

Function 0692BAB2 Relevance: 1.6, APIs: 1, Instructions: 70comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 0692BB38

Memory Dump Source

Source File: 00000008.00000002.4193699847.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_rQuotation3200025006.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 937118bfbb00ada840d756ace4d71de0121c65888ec2d6e60489e88b8b42d3c8
Instruction ID: 22d026e501b82e85bc74e9a2c2f3e7d5cf8dabc3ed11af3efcbb2e646bbb8036
Opcode Fuzzy Hash: 937118bfbb00ada840d756ace4d71de0121c65888ec2d6e60489e88b8b42d3c8
Instruction Fuzzy Hash: 673103B0D01219DFDB10CF99C984BDEBBF5AF48308F248059E408BB298DB755985CF55

Function 06929AF0 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,0692B075), ref: 0692B0FF

Memory Dump Source

Source File: 00000008.00000002.4193699847.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_rQuotation3200025006.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: cbdd141adc7adc255a7573d9f1638897e756aca9eb3c482f4c8392da81e1fa67
Instruction ID: 56b454d9e86ca9843c06d6ae8adf4fbf649ce2f8aaf59a40dd98d48eae0a92d9
Opcode Fuzzy Hash: cbdd141adc7adc255a7573d9f1638897e756aca9eb3c482f4c8392da81e1fa67
Instruction Fuzzy Hash: 7121CFB18083A88FCB11DF6DD8447DABFF4EF4A314F10449AD494AB256D734A848CBA5

Function 0692D6AB Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(0000000D,00000000,?,?,?,?,?,?,?,?,?,0692D458,00000000,00000000), ref: 0692D66B

Memory Dump Source

Source File: 00000008.00000002.4193699847.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_rQuotation3200025006.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 7ea0b727dff6177214b736a09d70e70bf283d02371971f2ef082b053e6cdd617
Instruction ID: 9cf038f6f2574ec15c88ae9e5ed4dca2bb26dc84dfe20d0c24319394f81c5f90
Opcode Fuzzy Hash: 7ea0b727dff6177214b736a09d70e70bf283d02371971f2ef082b053e6cdd617
Instruction Fuzzy Hash: 6621F631A043558FC764EB69D88469EFBF1EF81314F24882DD0ADD7650CB39A949CF90

Function 06929ED0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06929F5F

Memory Dump Source

Source File: 00000008.00000002.4193699847.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_rQuotation3200025006.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 422cea44faff9b31e163283cefa20f401e41b68affb5859b948a9f7baeac33e5
Instruction ID: ea655fff5cf9845cb80cf09daff5708be28b6c5433b0633a434a1ec99cd4f5c2
Opcode Fuzzy Hash: 422cea44faff9b31e163283cefa20f401e41b68affb5859b948a9f7baeac33e5
Instruction Fuzzy Hash: C32114B5D00259DFDB10CFAAD984ADEBFF4FB48320F24845AE958A3210C378A940CF64

Function 06929ED8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06929F5F

Memory Dump Source

Source File: 00000008.00000002.4193699847.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_rQuotation3200025006.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4ac010eda66ec5d0dbfc43d75d78ebfed30eba940b1ead7e7f3d507a03ba2e36
Instruction ID: 5d3369cd2939bb49654a66b6b59523b37e2bc9026b317aad99467f7cec68ced9
Opcode Fuzzy Hash: 4ac010eda66ec5d0dbfc43d75d78ebfed30eba940b1ead7e7f3d507a03ba2e36
Instruction Fuzzy Hash: 4321E4B5D00319AFDB10CFAAD984ADEBFF8EB48310F14841AE918A3310D374A940CFA5

Function 0692D5E8 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(0000000D,00000000,?,?,?,?,?,?,?,?,?,0692D458,00000000,00000000), ref: 0692D66B

Memory Dump Source

Source File: 00000008.00000002.4193699847.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_rQuotation3200025006.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: cb9ebc9547c822d8ef59d4a582f67072b20c4f66128c2fbdeb7870c5ae2299c5
Instruction ID: 1a517d560bcc2b5d00306e2e336ec44bed955df9726419ae70cf3d674633f3f6
Opcode Fuzzy Hash: cb9ebc9547c822d8ef59d4a582f67072b20c4f66128c2fbdeb7870c5ae2299c5
Instruction Fuzzy Hash: 862147B5D002199FCB14CF9AD884BDEFBF4EF88310F108429E459A7250C774A944CFA5

Function 02A68038 Relevance: 1.6, APIs: 1, Instructions: 58fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 02A680B0

Memory Dump Source

Source File: 00000008.00000002.4161716705.0000000002A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2a60000_rQuotation3200025006.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: b0d90f506e65f1781137a4ba76c756c75e0acb88bb48c8b4a3bb6d5ab32caf7a
Instruction ID: 6442b7e3f5f34ace47f928d2acb59e3bd70b6f17d7fadc1e5b01ee81027685eb
Opcode Fuzzy Hash: b0d90f506e65f1781137a4ba76c756c75e0acb88bb48c8b4a3bb6d5ab32caf7a
Instruction Fuzzy Hash: 5B2147B5C006198FCB20CF9AC5457AEFBB4AB48320F11856AD858B7350D738A944CFA1

Function 02A68040 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 02A680B0

Memory Dump Source

Source File: 00000008.00000002.4161716705.0000000002A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2a60000_rQuotation3200025006.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 3746be9b6765935bfe868b7f088c160521ccc463e1a9f4ed0917ae2d79472b59
Instruction ID: 38f9c99f3b3f02caaa92f0c7b7d76b68fc65d9fb6bca69d8ae92e88e5c54c1a2
Opcode Fuzzy Hash: 3746be9b6765935bfe868b7f088c160521ccc463e1a9f4ed0917ae2d79472b59
Instruction Fuzzy Hash: 4B1136B1C006199FCB10CF9AC5447AEFBF4BB48320F11856AD858A7240D778A944CFA5

Function 0692B098 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,0692B075), ref: 0692B0FF

Memory Dump Source

Source File: 00000008.00000002.4193699847.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_rQuotation3200025006.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 25f2bac45342685fbb7ddda898cf3d7741f06ccaecc0720673faaacee5074209
Instruction ID: dd15e53e50cc11d0339b8c08722d55bae53ec29d434ce6b374246149776cd407
Opcode Fuzzy Hash: 25f2bac45342685fbb7ddda898cf3d7741f06ccaecc0720673faaacee5074209
Instruction Fuzzy Hash: D01158B5D00219CFCB20CF9AD845BDEFBF8EB48324F20845AE518A3604C379A544CFA5

Function 02A6EF70 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 02A6EFDF

Memory Dump Source

Source File: 00000008.00000002.4161716705.0000000002A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2a60000_rQuotation3200025006.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 6732f23f46694e56fca8ce600c8ebb535c99993de7e8bf07dacd6b33f7b9ef73
Instruction ID: 1c7cbd13edeecd9dcb1cac952df3446cb23ff5781da63cdc35f9dcc9f3256eb2
Opcode Fuzzy Hash: 6732f23f46694e56fca8ce600c8ebb535c99993de7e8bf07dacd6b33f7b9ef73
Instruction Fuzzy Hash: 041114B5C006599FCB10CF9AC548BDEFBF4BF48324F14856AD818A7250D778A944CFA5

Function 0692B3A9 Relevance: 1.6, APIs: 1, Instructions: 51comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0692B9BD

Memory Dump Source

Source File: 00000008.00000002.4193699847.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_rQuotation3200025006.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 49942f6c63151df1b66cd180f9b054bdf2694682e72ed2ae8794019348dafd64
Instruction ID: 2ac261af27dd85a66d294b38475fc6f21d8ddb5a14351153222962285755b675
Opcode Fuzzy Hash: 49942f6c63151df1b66cd180f9b054bdf2694682e72ed2ae8794019348dafd64
Instruction Fuzzy Hash: 4F1155B4D043598FCB10DF9AD884B9EBFF8EB08314F20845AD458A7714C339A944CFA5

Function 06923864 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 06924F96

Memory Dump Source

Source File: 00000008.00000002.4193699847.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_rQuotation3200025006.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9a51cd325251b4ed9a48071dbfd76801e8c0bdffcedcbc9078d6b5874642b7ab
Instruction ID: ab30d86525ad168432c27950baeed3e50ceced83cc80c1b2afaca55d71f52dcd
Opcode Fuzzy Hash: 9a51cd325251b4ed9a48071dbfd76801e8c0bdffcedcbc9078d6b5874642b7ab
Instruction Fuzzy Hash: E01132B5C003598FCB10DF9AC844ADFFBF4EB88210F10842AD419B7614C379A544CFA1

Function 06924F2B Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 06924F96

Memory Dump Source

Source File: 00000008.00000002.4193699847.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_rQuotation3200025006.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ecf92691d9522b57bfaa3e94da71a9e2b14ff518e553a21294083f1f0d0093df
Instruction ID: 72d0b98226b3aa612343cd906aa020fd554aca1232d2f474c1444a6c4c083fdb
Opcode Fuzzy Hash: ecf92691d9522b57bfaa3e94da71a9e2b14ff518e553a21294083f1f0d0093df
Instruction Fuzzy Hash: 061113B5D00359CFCB10DF9AC444ADEFBF4AB89310F14845AD459B7610C379A545CFA1

Function 0692B3B8 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0692B9BD

Memory Dump Source

Source File: 00000008.00000002.4193699847.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_rQuotation3200025006.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 8b148a8efe99f15de94d27102273f8a7300e6ef8865dca9c22f267255caa1b7d
Instruction ID: a3adee9918b9856af85e97e0a518345e715b7895cd5896fdb1f940096b641b92
Opcode Fuzzy Hash: 8b148a8efe99f15de94d27102273f8a7300e6ef8865dca9c22f267255caa1b7d
Instruction Fuzzy Hash: 661145B49003198FCB20DF9AD544BDEBBF4EB48328F20845AD518B7714C374A940CFA5

Function 06929B0C Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,0692B075), ref: 0692B0FF

Memory Dump Source

Source File: 00000008.00000002.4193699847.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_rQuotation3200025006.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 74906e5c33fb5b5900fc3f652c08bb9409e79695b05d367d22570fd1ee3b29ae
Instruction ID: 966c5fd0de9657bb67073d8fe452266684c1f2f762f6a430d8e00e38c4cf4975
Opcode Fuzzy Hash: 74906e5c33fb5b5900fc3f652c08bb9409e79695b05d367d22570fd1ee3b29ae
Instruction Fuzzy Hash: AD1136B1900359CFCB10DF99D544BDEBBF4EB48324F208459D518A7205D775A940CFA5

Function 0692B961 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0692B9BD

Memory Dump Source

Source File: 00000008.00000002.4193699847.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_rQuotation3200025006.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 899fd54485a81be360556befbc70ec55a4dca32ebb6a56ca5a10cde3655a140b
Instruction ID: bff9988532c101df0bce95093581f0a03d8e45cdf134e5b98aa0488359dcce7f
Opcode Fuzzy Hash: 899fd54485a81be360556befbc70ec55a4dca32ebb6a56ca5a10cde3655a140b
Instruction Fuzzy Hash: AA1145B9900309CFCB10DF9AD544BCEBFF4EB48324F20841AD558A7610C334A944CFA4

Function 0693DBF0 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0693DD39

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 8ddefcadfbe38f5eb8f3efbc73bf231688db0afe16dae19d7766082f2042a5a8
Instruction ID: db6ff0d2699ba57d3cc9a99a3d3cb9b1620bb4e791937c712c644cc5e8f77340
Opcode Fuzzy Hash: 8ddefcadfbe38f5eb8f3efbc73bf231688db0afe16dae19d7766082f2042a5a8
Instruction Fuzzy Hash: 2F418F70E103199FDF61DFA5C8646AEBBB6BF86300F204929D405EB640EB71D94ACB91

Function 0693DBDD Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0693DD39

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 03155c1f04413d812cd5101e0eb836271bf96568812884a7f00d064d2a4b834a
Instruction ID: c42f6ed05d080f7b16248d6093fbcedddf14ac0de13e987633e36e9887cacafa
Opcode Fuzzy Hash: 03155c1f04413d812cd5101e0eb836271bf96568812884a7f00d064d2a4b834a
Instruction Fuzzy Hash: 3F41B230E103159FCF61DF65C8546AEBBB6FF86300F244929E405EB650DB70E84ACB81

Function 069321BD Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0693230B

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: a4f336818b17528d756ee2fbe3fdf53ecb28addcab24d8b7e8464e41c4e434fa
Instruction ID: 57e6b1776497dfd973e492306547f3d0d95538a28f1f6365eb3a11ffc800a517
Opcode Fuzzy Hash: a4f336818b17528d756ee2fbe3fdf53ecb28addcab24d8b7e8464e41c4e434fa
Instruction Fuzzy Hash: 16311030B102118FDB499B74CA1476EBBE6AF8A300F244838D406EB795DF35DE46CBA5

Function 069321D0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0693230B

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 965840bc765e51fdf9419e6dd670f78fcf9e6e46cfbf330d5d23472332eb7d81
Instruction ID: 3e607f8360d68b1e8f7b4196fd61f9c306c37c45ce49897bc7c0d8a10f53e935
Opcode Fuzzy Hash: 965840bc765e51fdf9419e6dd670f78fcf9e6e46cfbf330d5d23472332eb7d81
Instruction Fuzzy Hash: E531D030B102118FDB59AB74DA1476E7BE6AB89700F204838D406EB395EF35DE46CBA5

Function 060B1219 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

3, xrefs: 060B1303

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: 3
API String ID: 0-1842515611
Opcode ID: 33632035693bed783141f48ba829ca796ce0dd925e7a36a4fc2e84d6746938e8
Instruction ID: bdab6c8793b186ada7fb06b38b45d778fbad8048d7d400a3623cc13fc1d2a4c0
Opcode Fuzzy Hash: 33632035693bed783141f48ba829ca796ce0dd925e7a36a4fc2e84d6746938e8
Instruction Fuzzy Hash: 41214772A402048FC741EB78D5046EF7FE2EF81304B18C8A9D14ADB352EB34DC098BA0

Function 069383E0 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$^q, xrefs: 0693842B

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: aa17ffd9ab63d251a76c53d8189e041860992ae9fa551ac3ff9a7d0b9a039b90
Instruction ID: 3aeaab5509920ae813943f82e0dad9e9314eb303c3e9e8ea6dcc3ef7632cacc3
Opcode Fuzzy Hash: aa17ffd9ab63d251a76c53d8189e041860992ae9fa551ac3ff9a7d0b9a039b90
Instruction Fuzzy Hash: 35F0C231B102249FDF649E55EB88679B3BDFB80314F244825E909CBE45DB31DE06C761

Function 06934B61 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Ocq, xrefs: 06934B6D

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: \Ocq
API String ID: 0-2995510325
Opcode ID: 0769491917f9ad79c0b0790dca7da2fdd3e7273865889755b3cefda183f2b6cc
Instruction ID: 51dbbcb08849260ca75d566ea387d8d83167a6bfe7473cfbff00948a204f7feb
Opcode Fuzzy Hash: 0769491917f9ad79c0b0790dca7da2fdd3e7273865889755b3cefda183f2b6cc
Instruction Fuzzy Hash: 2FF0DA30A60129DFDB14DF94E899BAEBBB2FF88700F214519E402A7694CB741D05CB80

Function 0693C2A8 Relevance: .6, Instructions: 633COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27364cbeabdb043e6483446986e20376b14c9d667d07880ac1d127af2c214f26
Instruction ID: 019df24523c2f0ac903ed064adbbc0a3f2aab364d54e6bd0da5b67468ab00afa
Opcode Fuzzy Hash: 27364cbeabdb043e6483446986e20376b14c9d667d07880ac1d127af2c214f26
Instruction Fuzzy Hash: F032BE30B00615CFDB54DB68D990BAEB7B6FB88310F208925E406EB794DB35EC42CB91

Function 060B4434 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e948c36f930771a4c6d876e618ea9de62e527e33d04729a1226466fd71a5574e
Instruction ID: f50c37d163fe74d3961d00b36d44b84f078b85ce6e73ce5158601390e41fb170
Opcode Fuzzy Hash: e948c36f930771a4c6d876e618ea9de62e527e33d04729a1226466fd71a5574e
Instruction Fuzzy Hash: E141AD30D407089FCB54DFA9C8446DEBBF1FF89300F14C669E409AB255EB70AA80CB90

Function 0693B343 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b68280122229a3a3bec9ed2b29d0863d0b75fa5bcd090cf025e75218c126193
Instruction ID: 4461c4fd39e608e47f90aa25be1bac3ebcc2ef42cf80ba251bde20be57e937a0
Opcode Fuzzy Hash: 1b68280122229a3a3bec9ed2b29d0863d0b75fa5bcd090cf025e75218c126193
Instruction Fuzzy Hash: ADA1C430F101298FEF64CAA8D5947AEB7FAEB99310F304825E405E7799CA34DC818B56

Function 06936300 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bfad49491b2e610ad5b1ec5de5ca830c2010dec33ac250a1effb4d84f4a3284
Instruction ID: 38c9a6284f17bdc2d2e12fd49bbae3f6814d9ce79ab938c4660cb877c98b8ccd
Opcode Fuzzy Hash: 7bfad49491b2e610ad5b1ec5de5ca830c2010dec33ac250a1effb4d84f4a3284
Instruction Fuzzy Hash: B761B071F000215FCF549A7EC88466FBADBAFC5620B25443AE80EDB364EE65DD0287D6

Function 069343B3 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af85482e6cedec01b26ad70c5b7e98fbf458ab7480771598b9e50ea7ed7094a3
Instruction ID: a85412fbe37b76c036f118f85dce0e191bf091d21096047d87edba3b2d404b59
Opcode Fuzzy Hash: af85482e6cedec01b26ad70c5b7e98fbf458ab7480771598b9e50ea7ed7094a3
Instruction Fuzzy Hash: 3B815A30B102159FDB44DFA9D4947AEB7F6AF89704F218429D40AEB394EB34DC428B91

Function 069343C0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b638413e7b76789dce789feb8da0c7dd1c5d3e07180cad22073ff8d47751498f
Instruction ID: 3ed32b6c940a01075ad3c15e15947f9909872c0bf64bfd84eb39093f03606355
Opcode Fuzzy Hash: b638413e7b76789dce789feb8da0c7dd1c5d3e07180cad22073ff8d47751498f
Instruction Fuzzy Hash: 29814930B102199FDF44DFA9D4547AEB7F6AF89704F218429D40AEB394EB30EC428B91

Function 069346CC Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 082163b6e5257039e8c64d7615e237c35c5de8d34109dcac33ddcfaa04becbfa
Instruction ID: 183f217107d3ce7bb7f35c21893036c730f67f2fcd55820c30d0735c693b9be0
Opcode Fuzzy Hash: 082163b6e5257039e8c64d7615e237c35c5de8d34109dcac33ddcfaa04becbfa
Instruction Fuzzy Hash: DA917C34E102198FDF60DF68C990B9DB7B1FF89700F208699D449BB395DB70AA858F51

Function 069346E0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c7a43f37dfeed74e3ae9097bd3d9625d330753f658868d939469980b8536d6f
Instruction ID: 30171626b104de3932ea934e23e43e93c28b3994a87969dbb20e057fee9ed83a
Opcode Fuzzy Hash: 9c7a43f37dfeed74e3ae9097bd3d9625d330753f658868d939469980b8536d6f
Instruction Fuzzy Hash: 5C914C34E102198BDF60DF68C980B9DB7B1FF89700F208699D549BB355EB70AA85CF91

Function 0693F031 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b2feeaeb2db76e943f735cf444cf8352cdccc90225dbfc42b5226576b99a6c8
Instruction ID: 76e8e733a9942508ac7e150e718234f494bdbb7809535e448799af52a0e9e2f1
Opcode Fuzzy Hash: 3b2feeaeb2db76e943f735cf444cf8352cdccc90225dbfc42b5226576b99a6c8
Instruction Fuzzy Hash: 5F711830E002199FDB54DFA9D980AAEBBF6FF84300F248529D409EB665DB30ED46CB51

Function 0693F040 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f44a4142aa20403707b47316ebde6fc393a4d6de0ed0e0452c3088785575a0
Instruction ID: bed060479dd5c6061b41bfa01bf5ffa99b010885dfa0d7254ebbf05d5714928a
Opcode Fuzzy Hash: d2f44a4142aa20403707b47316ebde6fc393a4d6de0ed0e0452c3088785575a0
Instruction Fuzzy Hash: 54710731E002199FDB54DFA9D980AAEBBF6EF84300F248529E409EB755DB30ED46CB50

Function 060B1A98 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaaabd5822f7db4bf5841de90e9dd471b1e8d3d8021deec2122fd458ac288528
Instruction ID: 0b899a4af149d12ae286b285bd7bdbff72af29b783c3fe2c0c2921481a4edee3
Opcode Fuzzy Hash: eaaabd5822f7db4bf5841de90e9dd471b1e8d3d8021deec2122fd458ac288528
Instruction Fuzzy Hash: 3E718731D102098FCB50EFA9D994ADEFBF5EF49310F10C9AAD459A7211EB34A985CB90

Function 0693FCD0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ac4f807708b0614d14f9cc57f8d03f6b2d1099c1d6c525bf9c157421b12c56e
Instruction ID: 99baa664c4b7d705a0729e0cc5f30be45c71625d1e734fc5cba1078cf875ee01
Opcode Fuzzy Hash: 0ac4f807708b0614d14f9cc57f8d03f6b2d1099c1d6c525bf9c157421b12c56e
Instruction Fuzzy Hash: AC51EF31E00225DFDF64EB78E4486AEBBB6EB84314F20887AE11AD7651DB358C45CB80

Function 0693FA70 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 552fb06e36dd4732758fdf9208839cf80856acebc16895bc664495c90039c875
Instruction ID: 914b6759252a1d9df9ac432ea1ba12807c88ac193721649a5bf13e251081a528
Opcode Fuzzy Hash: 552fb06e36dd4732758fdf9208839cf80856acebc16895bc664495c90039c875
Instruction Fuzzy Hash: 2651EA70F602149FEFA4567CD954B3F266ED789310F30482AE50ED7798CA39CC4583A2

Function 0693FA80 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e19a8d930fe55cc88789e5c12aaf339b55abb6ecd9a011721d8751b6b2ba12
Instruction ID: 22b5a0bfc1b21589e42853f2fce76e67186847940b5874523fb72b4a04c7b6c7
Opcode Fuzzy Hash: 31e19a8d930fe55cc88789e5c12aaf339b55abb6ecd9a011721d8751b6b2ba12
Instruction Fuzzy Hash: C351C970F602149FEFA4566CD954B3F266FD789310F30482AE50ED7798CA79CC4547A2

Function 06935530 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09aa3f1d298e1e00b9db120ab3cd20a71638c59b0d22c024a97745fe68dd2bc4
Instruction ID: f2620e10f211c0a700e28932a2c56f39f01f24ea6f3780798a1e919e62011c12
Opcode Fuzzy Hash: 09aa3f1d298e1e00b9db120ab3cd20a71638c59b0d22c024a97745fe68dd2bc4
Instruction Fuzzy Hash: 37416F71E006198FDF70CEA9D880AAFF7F6FB88314F21492AE116D7A54D730E8558B90

Function 0693DA90 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2cdeac276fa7b25acd8b8e5fa7c20a7b0ba289695f91538f107624da820de2
Instruction ID: f247786b6f149f83c5259944800225708b5f5d3140456fde35e5c813af891b4b
Opcode Fuzzy Hash: 7d2cdeac276fa7b25acd8b8e5fa7c20a7b0ba289695f91538f107624da820de2
Instruction Fuzzy Hash: A331A330E1061A9FDF55DF69C95068EFBB5EF85310F244929E405EB740EB70A94A8B81

Function 060B1325 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40ef68b085349ef19f5dadb043be5f7e78299a579fb413e15a4098dab3bd0050
Instruction ID: c20f4c8a92ef1dd42a99ab7b6afb2f109713349016c14fd2706c66b6dbc47796
Opcode Fuzzy Hash: 40ef68b085349ef19f5dadb043be5f7e78299a579fb413e15a4098dab3bd0050
Instruction Fuzzy Hash: E441E3B1D00309DFDB50CF99C984ACEBFB5AF48304F248469D808BB215D7756A45CF90

Function 060B1330 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 722ac46c0f39aef82394a2fae82b0ed8591ba9b9c28240e30c0f8150b63baa49
Instruction ID: bfda4cdcedcf013bf56d6cc7173182de090620f7da3c6c73968965abdcd27abc
Opcode Fuzzy Hash: 722ac46c0f39aef82394a2fae82b0ed8591ba9b9c28240e30c0f8150b63baa49
Instruction Fuzzy Hash: 4B41C0B1D003099FDB64CFA9C984ADEBFB5AF48304F248469D808AB215D7756A4ACF90

Function 06932081 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b93031ee356ce29c07cce16d5b7e075a46e029b2b0979455df549d7a4293838
Instruction ID: 57d97e1eb7ca98d84e2c128e25f7264794bf0d56dfc47efb07d5c7991958ae5e
Opcode Fuzzy Hash: 8b93031ee356ce29c07cce16d5b7e075a46e029b2b0979455df549d7a4293838
Instruction Fuzzy Hash: 32319A34E106159BCB45DFA4D99469EBBF2BF89300F208829E906E7750DB31ED46CB40

Function 06932090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85a6b7246a53e9d52485ec309a2d0464b7541cf846ef71effd292208747c562d
Instruction ID: ab1f8499d89e7a17575fe052e173f6545e2e76f098da04574f5eb6d9e052ef57
Opcode Fuzzy Hash: 85a6b7246a53e9d52485ec309a2d0464b7541cf846ef71effd292208747c562d
Instruction Fuzzy Hash: E031AC30E106199FCB09DFA5D994A9EB7F6BF89300F208829E806E7750DB71ED42CB50

Function 0693A418 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0015607d34d61b8cbacadced780ff9b3941f04fa7578f9c62d148be8e8ab8422
Instruction ID: 5100526f9fa3de9c34ee71b295bc5cb58f75bd6558453171d35a7a5eae7b5ff3
Opcode Fuzzy Hash: 0015607d34d61b8cbacadced780ff9b3941f04fa7578f9c62d148be8e8ab8422
Instruction Fuzzy Hash: 7321AF30B100255FDB54EA7DE85576EB3DAEB85714F208939E24EC7794EE22EC028782

Function 060B4ED9 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9442a312ec8166f6543094456e1c84ef117431271ad5bbdbbce622fd7bfc4efb
Instruction ID: 0e97f509b2bff3c19927b0c3418fc38e123ba8b37757ae159c35922183df7da9
Opcode Fuzzy Hash: 9442a312ec8166f6543094456e1c84ef117431271ad5bbdbbce622fd7bfc4efb
Instruction Fuzzy Hash: 3921AF34B002159FDB44EB79D944B6E7BEAEB88310F204839E509E3399DB36ED468791

Function 06933FB9 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20aee4c2d251e572002e4baa4b38032e1029bfd93c7765c7d0f5e45648c3d75e
Instruction ID: 8dc9e900fade41f9d45e2eece9ff4bca4f6a87342e0eb3f7720ba28256702d20
Opcode Fuzzy Hash: 20aee4c2d251e572002e4baa4b38032e1029bfd93c7765c7d0f5e45648c3d75e
Instruction Fuzzy Hash: A2215572F102159FDB40DF69D880AAEBBF9FB48710F108029E905E7394E732DD418B95

Function 06933FC8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca96e77fa6d827c4df60529f69eccc726d7c819f5d14f378246c2befce2c3a1
Instruction ID: 39a341ca2cc1d2843ce1fab51c081c59ec1edb7b700641f0042311d721ae7fc3
Opcode Fuzzy Hash: aca96e77fa6d827c4df60529f69eccc726d7c819f5d14f378246c2befce2c3a1
Instruction Fuzzy Hash: 5A218672F002259FDB50DFA9D980AAEBBF9FB48710F208029E905E7384E731DC418B91

Function 060B4EE8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f61d7a29c7a1b6e97df1a051161099faf6c85c55b86d89286916730caa1fe3d
Instruction ID: 14e9a9bd30fcd623d44ca8adfde4b393129b897463169edaadf1140c773f3048
Opcode Fuzzy Hash: 8f61d7a29c7a1b6e97df1a051161099faf6c85c55b86d89286916730caa1fe3d
Instruction Fuzzy Hash: 1C218E347002159FDB44EB79D994B6E7BEAEBC8300F204829E509E3399DB36ED46C791

Function 00E3D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4158042601.0000000000E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e3d000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f33e0acd4dfc551f4882cce887065654a9cc32835ffc2b4c877dee8689be2a05
Instruction ID: 9d8eab647e55320901f515c652146eaa19aba9ea17dd40c81013564a2552c914
Opcode Fuzzy Hash: f33e0acd4dfc551f4882cce887065654a9cc32835ffc2b4c877dee8689be2a05
Instruction Fuzzy Hash: F521F271508204DFCB18DF14ED88B26BFA6FB84718F24C569E8095B296C37AD846CA62

Function 00E3D005 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4158042601.0000000000E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e3d000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2af2347e70bebb3961301ba7dd18c871f7b1aff66999ad2767a694a986eb2143
Instruction ID: 858f8c30afe554c935a20a51b09daf44d1b75df406f37ed0ce7480c4425b003c
Opcode Fuzzy Hash: 2af2347e70bebb3961301ba7dd18c871f7b1aff66999ad2767a694a986eb2143
Instruction Fuzzy Hash: 34216D7110D7C09FC707CB24D994711BF71AF46214F29C5DBD8898F2A7C23A980ACB62

Function 00E3D1F8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4158042601.0000000000E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e3d000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d972c7c93c686eb3f257e69b21eeb814e07155da359fc26b78905f59677db44
Instruction ID: 43f69d78e1617014d33b642ff1fdbce3f030c2370ba73b6fbabf9a78bebf532e
Opcode Fuzzy Hash: 1d972c7c93c686eb3f257e69b21eeb814e07155da359fc26b78905f59677db44
Instruction Fuzzy Hash: 5A2138B1508200DFDB15DF14EDC8B2BBF65FB84324F20C569E8095B266C376D846CAA1

Function 00E3D3A8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4158042601.0000000000E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e3d000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50ad0239f681805111272aa1dc54d3288dcaac1556d0e9b144bbb9507d01edfe
Instruction ID: c225567cf8b99290c27df989aad05848f102e389d7fdcbf0efd2ce7b84590269
Opcode Fuzzy Hash: 50ad0239f681805111272aa1dc54d3288dcaac1556d0e9b144bbb9507d01edfe
Instruction Fuzzy Hash: B42104B1608204DFCB05DF14E9C8B26BFA5FB84318F20C56DD9095B256C376E856CA62

Function 060B4A04 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca68927b22863e62f83cc85441f5c06cfe633c3fc95dfbeceea86d4705d8b14
Instruction ID: ff1b4e13ccc03289de629a8ea78f9859a97a1d475803d268e6e83f6876637a5c
Opcode Fuzzy Hash: bca68927b22863e62f83cc85441f5c06cfe633c3fc95dfbeceea86d4705d8b14
Instruction Fuzzy Hash: AA3104B0C402189FDB50CF99C985BDEBFF5AB48314F24802AE404BB354C7B55945CFA5

Function 060B43EC Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40819c333875c072be679b1b30d5f36a229b61fff3ecf8ee3402db41502705a5
Instruction ID: b24a3026aabb705664a30d24a6e8f4d4e64a5887cbec65c79c3820f45e9ee3af
Opcode Fuzzy Hash: 40819c333875c072be679b1b30d5f36a229b61fff3ecf8ee3402db41502705a5
Instruction Fuzzy Hash: 3C31F2B0D402189FDB60CF99C589BDEBFF4AB48314F20806AE404BB355C7B59944CFA5

Function 00E3D118 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4158042601.0000000000E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e3d000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ae3059f5530e0e8857358017a65b14e13be1980fd6c5127c2507ca6ba68ebfc
Instruction ID: ea2aa94c9015e5829cadd8c101c0231640c7a0911053c42c76a43031640cda96
Opcode Fuzzy Hash: 1ae3059f5530e0e8857358017a65b14e13be1980fd6c5127c2507ca6ba68ebfc
Instruction Fuzzy Hash: 04210471609300DFDB04DF14EDC8B26BFA5FB84318F20C56DD8095B251C336D846C6A1

Function 060B1050 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a20a7c7aaeab635b990eeb3b1715e5eeda7178214fda08ebb26ec021383a5232
Instruction ID: 0b51a7b9a448935a66fe5ee445b8f15241f55abeeb02edd351a8e28953858677
Opcode Fuzzy Hash: a20a7c7aaeab635b990eeb3b1715e5eeda7178214fda08ebb26ec021383a5232
Instruction Fuzzy Hash: 2211D632E402195BCB44EFA9DC05AEFBBBAEFC5314F14C566E515E7250DB30A9058B90

Function 06936E28 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0935a648b8b66ca8a13a402a5db68fed6aa12cfafe005631754bb8fcaa3da8d9
Instruction ID: 51ed54da017166242f6a86debeef60d215b7a217b4baa6f9e36aa5be271ade0f
Opcode Fuzzy Hash: 0935a648b8b66ca8a13a402a5db68fed6aa12cfafe005631754bb8fcaa3da8d9
Instruction Fuzzy Hash: 4721B131B10228AFDF94DBA9E8507AEB7F7EB84310F248425D809EB744DB31EC558B84

Function 060B28A8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4c4fa56c8e39858f0bd00f2a2506da837d0a8a9aaed004e7bdef72892649b4
Instruction ID: f685af3ee5ad11de52775d67037faa3d7367d9e5af806d682afd6f765ef0e810
Opcode Fuzzy Hash: ee4c4fa56c8e39858f0bd00f2a2506da837d0a8a9aaed004e7bdef72892649b4
Instruction Fuzzy Hash: 0311BE716402018FC359AB29D854A9BBBE6EB84355B20893CD11A9B394DB36ED09CB94

Function 069340D8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b133cf55d16e28d991e91d8c12176bb8050acd74306b08de95c2de7d430a6344
Instruction ID: 220238718c7eeb9c401c2c8bfa31c0aa4d0b78a23fdbaf025217518918131337
Opcode Fuzzy Hash: b133cf55d16e28d991e91d8c12176bb8050acd74306b08de95c2de7d430a6344
Instruction Fuzzy Hash: A8118B32B102299FDF549A68CC14AAE73EAEBC8710F11843AD40AE7344DE259C028BD2

Function 060B28B8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3211c3b0865f142079f6c00014d4ae9a5aeba41592485f777e23a2989099426
Instruction ID: d8903d8d5432612e9cb27a0dac8cec5e1695d8861220f52772e585348189c911
Opcode Fuzzy Hash: e3211c3b0865f142079f6c00014d4ae9a5aeba41592485f777e23a2989099426
Instruction Fuzzy Hash: 93119A703002058FC359AB39D454A9BBBE6EB84354720897CD11A9B394DB36AD09CB94

Function 060B0BCC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c239b9baef82242c715c6be276e5bb836e1e10167a60d604957d1d6669913d51
Instruction ID: 9116ed052d949631ba82c5a85db3975af8d15dbb5666e4a589320d4ba9dc02fe
Opcode Fuzzy Hash: c239b9baef82242c715c6be276e5bb836e1e10167a60d604957d1d6669913d51
Instruction Fuzzy Hash: B12112B5D00349AFCB50CF9AD984ADEBFF4FB48320F14846AE919A7210C375A954CFA1

Function 060B1111 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b974de5ff37aea88fa6ef7271fcbffb861a7cd0208d1b62911a16cd927d3b214
Instruction ID: 0f14d9808d80e5dcb982ab27b84020d67f2c01356c46b93348c17c77cd0d1744
Opcode Fuzzy Hash: b974de5ff37aea88fa6ef7271fcbffb861a7cd0208d1b62911a16cd927d3b214
Instruction Fuzzy Hash: DB2103B5D003499FCB10CF9AD984ADEBFF4FB48320F14841AE918A7210C379A944CFA1

Function 06934310 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25d5336491ec07d5b68e97947740f105a8b48f84bfbff12fee52e0e06bb32a5e
Instruction ID: aa8906643843c58d1e8c3a80e922a30a23ce2017d215c06632f3ad7e1c852c48
Opcode Fuzzy Hash: 25d5336491ec07d5b68e97947740f105a8b48f84bfbff12fee52e0e06bb32a5e
Instruction Fuzzy Hash: 4701DF31B141200BDB64D67DE85075FABDADBCAB20F24853AF10EC7791EE26CC028386

Function 0693F2B0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b4f967132da4aeec416e79e8773d05bec2e7722ad40a57f09cb34932e5f83a
Instruction ID: a7cd7e972a980253d49f5bc9fd57dccdb19fb786577906c86594f8403052de28
Opcode Fuzzy Hash: d0b4f967132da4aeec416e79e8773d05bec2e7722ad40a57f09cb34932e5f83a
Instruction Fuzzy Hash: 1901DF30F001204FCB619A7E955476F63CADBCA714F24882EE40AC7740EE20DC034786

Function 06933D93 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f7fbe3466575402aff5c1b56dafeeae5e5d6febee987c1acbec5d886da679b
Instruction ID: 1701d65d7df13d37b2f40ff773d2afd82e0f358d4c2653ade784b10ace63a3b3
Opcode Fuzzy Hash: f1f7fbe3466575402aff5c1b56dafeeae5e5d6febee987c1acbec5d886da679b
Instruction Fuzzy Hash: 2721C2B5D01259AFCB10DF9AD985ADEFFF4FB48314F10852AE518A7200C374A954CFA5

Function 06933578 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc02b1a3a08a1bcc130017b57695aadebfe6e2c9ba1efb7873b33a8d8f76a417
Instruction ID: ff362be5ecad0c3a3f528954b21049e15bdb2954aad75f93baffd90fb695544a
Opcode Fuzzy Hash: fc02b1a3a08a1bcc130017b57695aadebfe6e2c9ba1efb7873b33a8d8f76a417
Instruction Fuzzy Hash: 21016D71E402689FCB68DB79C8405DEF7BAEB89310F10896AD51AE7640EA31DE41CF91

Function 00E3D1F3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4158042601.0000000000E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e3d000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: 4dc4cfddc20cfc6e16761c032299c4560af663db92f8fec8241530696798a933
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: 8F11B275508280CFDB12CF14E9C8B16FF71FB94328F24C6AAD8495B656C33AD81ACB91

Function 00E3D3A3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4158042601.0000000000E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e3d000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 11724a3277f38bf66bb2282456fd7313a57d541712e3f5a468adc421c6da4171
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 3211D075508240CFCB01CF10D9C8B15BF72FB84318F24C6AED9494B256C33AE84ACB52

Function 069340C9 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 869b278f8471284a143bceb5ec974d5447742171a96424ae6f797904131a29a4
Instruction ID: f97a01a1bdc227e10a4a3de6619e0af052d411261ed3462c3bab6828e74f2b84
Opcode Fuzzy Hash: 869b278f8471284a143bceb5ec974d5447742171a96424ae6f797904131a29a4
Instruction Fuzzy Hash: 1A018436F105245BEBA49569DC107AB72EEEBD8714F11403AD50AD3744DE659C0247D2

Function 06933D98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c607f70ce73a457c2efe26e8603cc6e018f3cff42f7d616d7a42a2e90b2d48e
Instruction ID: a541e2e18fb79b22900457bbc933e92d7d5b7e7457727c43696c82402000fa7e
Opcode Fuzzy Hash: 4c607f70ce73a457c2efe26e8603cc6e018f3cff42f7d616d7a42a2e90b2d48e
Instruction Fuzzy Hash: 0E11D3B5D01259AFCB10DF9AD984ADEFFF4FB48310F10852AE518A7200C374A954CFA5

Function 00E3D113 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4158042601.0000000000E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e3d000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e676ac0fa395c9d78ad1373b251d500d35a058fc48d93c8ca3093ca1b2890539
Instruction ID: 44862ef66564707d6c2d92b0f7b010c31e72e6d6bc14db61bbbc103a1c747442
Opcode Fuzzy Hash: e676ac0fa395c9d78ad1373b251d500d35a058fc48d93c8ca3093ca1b2890539
Instruction Fuzzy Hash: 37119D75508284CFDB15CF14D9C8B15BFB2FB94318F24C6ADD8494B656C33AD84ACB91

Function 06934320 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd06e9884e7c8850b3d7e4354aab759bfe411e01f8b312f47e3d62ab2061cca3
Instruction ID: 3588c5864895379cafd448e6d87b833f9ae895b7189f90de4031802ace0fee39
Opcode Fuzzy Hash: bd06e9884e7c8850b3d7e4354aab759bfe411e01f8b312f47e3d62ab2061cca3
Instruction Fuzzy Hash: 91016D31B101201BDB64956DE55076FA7DEDBCAB10F248839E10EC7754EE66DC024395

Function 0693F2C0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a4fb766f333e15d1e2d7cb20d22de9f95777c6478c69215dab68a0ad71a4fb
Instruction ID: 0dd33b42ed4e74bed22c05cc26df45e678af26e856e7bf52e6a08bdd6d98ef25
Opcode Fuzzy Hash: 33a4fb766f333e15d1e2d7cb20d22de9f95777c6478c69215dab68a0ad71a4fb
Instruction Fuzzy Hash: 4D018C35F001215FCB64A67EA450B2E63DEDBCA724F24883AE50AC7740EE25DC034786

Function 060B3EC8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0549f9c87db528d16a05ee3bddd228383a32c2d8e085b2652a1d8fe5f4fb654a
Instruction ID: bcbd106a820f3fc10623d7b88f64b43033c0ddd4a8c638fc51c58ee548804984
Opcode Fuzzy Hash: 0549f9c87db528d16a05ee3bddd228383a32c2d8e085b2652a1d8fe5f4fb654a
Instruction Fuzzy Hash: A0110036A04288AFCB068F64DC149DABFB1EF06200B0984AAF554DB262C735D819CB61

Function 0693FCC1 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f69223c213297b3ab670ac7b4085fac96a296b7b931da076d764bc748e11911
Instruction ID: d96e5eb7a5fc0f1bf6c012304cc12c0f3ca364983fb0150f4a449599d501400a
Opcode Fuzzy Hash: 8f69223c213297b3ab670ac7b4085fac96a296b7b931da076d764bc748e11911
Instruction Fuzzy Hash: CF019234A00225AFDB64DF65E94C76E7BB6EF89310F204929E516E77A0DB309C45CBC0

Function 060B3104 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37a070a5a958e304ff2f36ba4806b91010b715054961367ede5a81a108ef3623
Instruction ID: 5aa95519ef2009206620e42df4edc6db0baec7503fce0df6fb771b0999205c1b
Opcode Fuzzy Hash: 37a070a5a958e304ff2f36ba4806b91010b715054961367ede5a81a108ef3623
Instruction Fuzzy Hash: 76019E70680720DFD3AC8B6AD4845A7BFE6BB84700B24DD19E447C6615C771E845CB94

Function 0693A428 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf30555f91a51c0b43e58fae8c6f3b101f4a8a17fff23196ce71955a144ba37
Instruction ID: a01880b7fb44a09e88b19755d0fad75815f316e67bc5376e5ecd950de6a8e9b6
Opcode Fuzzy Hash: bcf30555f91a51c0b43e58fae8c6f3b101f4a8a17fff23196ce71955a144ba37
Instruction Fuzzy Hash: 4301A430B101244FCB50EA7EE858B2AB7DADB89714F608838E14EC7754EE22DC428785

Function 0693C900 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a06ff78725869e631d0c09c9140486ddee6837e842b4a7e54e48aafaa3ca6a
Instruction ID: 4638df860a6f45356b05f07cf47885e0716edcbe068a4a620a8d3f58def709a1
Opcode Fuzzy Hash: 34a06ff78725869e631d0c09c9140486ddee6837e842b4a7e54e48aafaa3ca6a
Instruction Fuzzy Hash: C401A431B112349BCF54AA6AE940A9EB77AF785354F104539E905EB344DB31AC05CB90

Function 060B1041 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c65833606375a7e86f7b1563795f2d0cd47047773501ba1d7d8f9da43bd405b0
Instruction ID: 476c1eeb72564b7f5518fba068ce3d211a1fc45b0c857eff5227dc00f8e32232
Opcode Fuzzy Hash: c65833606375a7e86f7b1563795f2d0cd47047773501ba1d7d8f9da43bd405b0
Instruction Fuzzy Hash: 24F06272A401086FDB85EB6ADC01E9BBBEAEBC4354B04C165E919DB214D631D9018B90

Function 060B1A88 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e06820bc7ef92629d55a9c1971131a1159d8fa71df973fc1e586d901c88c70e7
Instruction ID: 5a2c7cda71953ddb683751e625b022173856aa14283815f8cdf10559c8fc46aa
Opcode Fuzzy Hash: e06820bc7ef92629d55a9c1971131a1159d8fa71df973fc1e586d901c88c70e7
Instruction Fuzzy Hash: 76F09072D511085FCFA0DE99D9C4ADEFFF5EB45210F549876E505D2200D220E9488B50

Function 060B1BB8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0296f1dd454b1b518e1d78037bd382127dede7496d6bdb77ad49d89d12d9a5
Instruction ID: 842894b2192ad7de5666639324cfc4155c657a0568937845c8ed6b0e82f90152
Opcode Fuzzy Hash: 5f0296f1dd454b1b518e1d78037bd382127dede7496d6bdb77ad49d89d12d9a5
Instruction Fuzzy Hash: B901A775D4020A8BDF40DBA0CC506EEBBB5AF88214F149975C412B7391EB745D06CBA5

Function 060B3E79 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0337d3ba7190686cc9b2144957c14215291d4ed40bb6222bfece7afe2ad1740
Instruction ID: 87f68ca7acc05439f3e2b6365486cf3569c189a2ab6f41fd604c2d0ebe7fe250
Opcode Fuzzy Hash: f0337d3ba7190686cc9b2144957c14215291d4ed40bb6222bfece7afe2ad1740
Instruction Fuzzy Hash: 6BF03A72E10714ABCB24CEA9D80169BBBF9EF48610F04896AE455D2240E731E904CB90

Function 060B2D79 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05caf0e78bbaabcc04e3eeb8a1542c8424d6a86f6797568655be95633d843d6a
Instruction ID: 1796a51c1e3604080e92b54ac7382ca0c46d4e4a38e6a9dec5add0d93c866d96
Opcode Fuzzy Hash: 05caf0e78bbaabcc04e3eeb8a1542c8424d6a86f6797568655be95633d843d6a
Instruction Fuzzy Hash: 82E02B367401409FC744CA6AE844A6BBFDAFFC922176A41B8E10ED3351DE21DC028790

Function 060B3E88 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a60431d95c15f243d59937b57c5aa27e103f73c024816a4c4f200cbe58aae03e
Instruction ID: 1af97d901a2ee9f13ae9858e4610f05a6e3da11304b5acc4b11ef5493bbecd73
Opcode Fuzzy Hash: a60431d95c15f243d59937b57c5aa27e103f73c024816a4c4f200cbe58aae03e
Instruction Fuzzy Hash: B1F03075E00714EF8B34CFA9D80449EBBF9FF48710B40896AE55593640D731E918CB90

Function 06936580 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32a0146844c2aa680dcc4e3f4bad2d1c9881c29b616614178d8a77e70fb6a393
Instruction ID: f7450177ce13eb27256cc5a60a5e7cc30f289dd8df8c8f33e30ba36e5608a3a6
Opcode Fuzzy Hash: 32a0146844c2aa680dcc4e3f4bad2d1c9881c29b616614178d8a77e70fb6a393
Instruction Fuzzy Hash: 69E0D872D151186FDF90CF74CA1535B77A99B42204F3048F6C804CB546E136CE058741

Function 06936590 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbdc51fb53645a6523892bb5479baa6c78d81e1bc7dcc723c2926803fef69f91
Instruction ID: 02e3b46cd4b8214d48e15d09af5e3c7e3fddbaa9ae6189481ca21d43a85ed0a5
Opcode Fuzzy Hash: bbdc51fb53645a6523892bb5479baa6c78d81e1bc7dcc723c2926803fef69f91
Instruction Fuzzy Hash: 2DE01271E10118BBDF50DEB4C94575B77EDD746214F3088B5D409C7606E576DE018781

Function 060B11C0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b15060630e1abf1eb1d74424574b0a929cd1e1d8fb0c76c46e81eb1be9db5f
Instruction ID: 478c35f60f5bc5402efcf417aaddebb147bcb62e55ce2dbc655be1f0502b355e
Opcode Fuzzy Hash: 44b15060630e1abf1eb1d74424574b0a929cd1e1d8fb0c76c46e81eb1be9db5f
Instruction Fuzzy Hash: 5EE06578A40205DFC700EBB4EA427AD7BF6EB44304B1446A4E806E7306DA362E02AB50

Function 060B11D0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b028a04d9691c95691915e648c24515933e83bd3fb209227ca46e4500827491
Instruction ID: 74430263e9fefb5df9d6c6509d25051e8a3bda13ae8a3a92fdb9f6222b353b08
Opcode Fuzzy Hash: 8b028a04d9691c95691915e648c24515933e83bd3fb209227ca46e4500827491
Instruction Fuzzy Hash: 26E0E674950209EFC700EFB5E94295D7BF6FB44304B104654E906D7715DB326F04DB55

Function 060B3C00 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 073162327c85b688aed3e9875724d0d0dfba223a88623b5cd0303d06d076bb23
Instruction ID: 31327b0dd145daa9a4e52f4c621d538a62ee590aec2ef14279b2381668ee88e6
Opcode Fuzzy Hash: 073162327c85b688aed3e9875724d0d0dfba223a88623b5cd0303d06d076bb23
Instruction Fuzzy Hash: 9BC0122335016103DB5952A87D217EE5A494786216F1C6167911D96781CC49895246D5

Function 060B2540 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 389e6a432a9304965d7c23b982a61661f80998afe0e72d737ee99781993eb251
Instruction ID: 3834150799df4563ee4240c057e1eab9f2db6ff23228f51cec659b86c1aaba12
Opcode Fuzzy Hash: 389e6a432a9304965d7c23b982a61661f80998afe0e72d737ee99781993eb251
Instruction Fuzzy Hash: D5D06C3214021DBB8F41AE85EC01DDB3B2AEB896A0B148115FA2416221C272AD61ABE0

Function 060B3C10 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4609514201780ea1b218cf72e5a0d778c33918a7f8720b1b0c63680d7ff6fcf
Instruction ID: f3f80309c1cad1fd452840815295ae23b4616dff2e263aeeaf25f1f76fa61b55
Opcode Fuzzy Hash: b4609514201780ea1b218cf72e5a0d778c33918a7f8720b1b0c63680d7ff6fcf
Instruction Fuzzy Hash: 61B09B2135413513DA4C719D68105FD768D87C5565F144067D51D977418CC59C4106DE

Function 060B2E57 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34b1e4ae6d81222d30cd9e12049a5758e10f083b3332b81ae6838c427f33d712
Instruction ID: d422a14a16b9eb01fce2ff471f546ee405181fa1af914474cddd657808fa2d26
Opcode Fuzzy Hash: 34b1e4ae6d81222d30cd9e12049a5758e10f083b3332b81ae6838c427f33d712
Instruction Fuzzy Hash: 55C08C34750A608B8AE1AF35A0100ECBBF0AB49720300491AE12A83740CB36DA164784

Function 060B278B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c6b1e2e5f09b3fc899e45a1f256986a2105fdf96516d21e88a0ad2dd41bbcce
Instruction ID: 6526bf6bbcf493ae12185c6ad30da762a1744a22e07b363dd55399f1323edbd3
Opcode Fuzzy Hash: 0c6b1e2e5f09b3fc899e45a1f256986a2105fdf96516d21e88a0ad2dd41bbcce
Instruction Fuzzy Hash: EBD092748C421ACFEBA08F91C828BFEBBB0FB04315F009419C101A6290CBBD064ACF95

Function 060B287F Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3abf639147ee1380ab42802d44bf2ce9283182802654dd9d45c74e3b1f78490e
Instruction ID: ca96121cd3e75309595867edb36e061710e3ba0f9d6085813e69d40af49c6bca
Opcode Fuzzy Hash: 3abf639147ee1380ab42802d44bf2ce9283182802654dd9d45c74e3b1f78490e
Instruction Fuzzy Hash: 9BD0C9B18816408ADF488F14DC082453F61AB65328B35029994598A2D3E37AC543CB91

Function 060B2E20 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92b1609c532dce4a49370e5aa8cb4e9fb50891f6e50ab94a7e830a65e7076c33
Instruction ID: ed55bb05f4ca65b802c41cf3a628eece015961e276f3c5d0245ffc6212f072f3
Opcode Fuzzy Hash: 92b1609c532dce4a49370e5aa8cb4e9fb50891f6e50ab94a7e830a65e7076c33
Instruction Fuzzy Hash: 6DA0124B98104081D5E110A0DC813CB94019780021F089110000D91509CC1C93000232

Function 060B0F20 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4189706558.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60b0000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 121e28461cae01551a22b1110b623628a864458228952941fa0fc3263c59bdf8
Instruction ID: 895ddfbe81fbccf0a072f1efbafa5bf27298b6fcd7fcfdc3bb45849ba4555a9a
Opcode Fuzzy Hash: 121e28461cae01551a22b1110b623628a864458228952941fa0fc3263c59bdf8
Instruction Fuzzy Hash: 05C012704C12008ACF189F1899481267F51EB90324B3056489419491D1C371C583C7C1

Non-executed Functions

Function 069377B0 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 06937D1E
$^q, xrefs: 069378A0
$^q, xrefs: 069378D1
$^q, xrefs: 06937CFC
$^q, xrefs: 06937D08
$^q, xrefs: 069378AC
$^q, xrefs: 06937D12
$^q, xrefs: 06937C5D
$^q, xrefs: 06937C69
$^q, xrefs: 069378DD

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: 02492e4790ca3535f54cb702ea72e2a9ca10b1f3c789a2225284727f775606e8
Instruction ID: 805747dfc0a2eb22b020213c3c2f230ec69e7c8c0f5de6052906f077848a762e
Opcode Fuzzy Hash: 02492e4790ca3535f54cb702ea72e2a9ca10b1f3c789a2225284727f775606e8
Instruction Fuzzy Hash: 72123C70E002298FDB68DFA5C954AAEB7F6BF84304F208969D009AF754DB309D85CF85

Function 0693AA48 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 0693ABD0
$^q, xrefs: 0693ABFA
$^q, xrefs: 0693AB99
$^q, xrefs: 0693AC06
$^q, xrefs: 0693AB3E
$^q, xrefs: 0693ABC4
$^q, xrefs: 0693AB4A
$^q, xrefs: 0693ABA5

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: aa2d19118a3e81c9cb77e98f62f3db2bf226b1fc7ae49a0afcdca68e111f4fb7
Instruction ID: d4b24c524fe486f62c3cb0e2fcc33ca2662c3affa53835f1eeb1048b8f23f4c6
Opcode Fuzzy Hash: aa2d19118a3e81c9cb77e98f62f3db2bf226b1fc7ae49a0afcdca68e111f4fb7
Instruction Fuzzy Hash: F1915B30A102199FDB68DF65D944BAEBBF6BF84300F208929D452DB694DB749C45CB90

Function 069371B0 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$^q, xrefs: 069376B8
$^q, xrefs: 06937492
$^q, xrefs: 069376C4
$^q, xrefs: 069374EC
$^q, xrefs: 0693764C
$^q, xrefs: 069374F8
.5vq, xrefs: 0693720B

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: bd74f4af406b1d321e5e25653e02d08becedd46b443bee7858c4db689ddb93d5
Instruction ID: 09b203daa52bafe07bd941e035f1ee66122130057d6c42f1cb02556b0cbd4349
Opcode Fuzzy Hash: bd74f4af406b1d321e5e25653e02d08becedd46b443bee7858c4db689ddb93d5
Instruction Fuzzy Hash: 79F13C70A00219CFDB58EBA5D594B6EB7B7FF84300F248568D4069B768DB31EC86CB85

Function 069384E8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 069387A7
$^q, xrefs: 06938742
$^q, xrefs: 069387B3
$^q, xrefs: 0693874E

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: b2416bca6e7acd12268e4f55d2f0f68ec1163b79cdd6234ffc05a415f0241b92
Instruction ID: c59f6e3e1af9eb962562585bd4379323caa381cae6c2192c91626600a349859e
Opcode Fuzzy Hash: b2416bca6e7acd12268e4f55d2f0f68ec1163b79cdd6234ffc05a415f0241b92
Instruction Fuzzy Hash: 50B12A30E102188FDB54EB69D68466EB7B6BF84300F248829E416EB755DB75DC86CB81

Function 0693ADD0 Relevance: 5.2, Strings: 4, Instructions: 172COMMON

Download Yara Rule

Strings

$^q, xrefs: 0693AFAC
$^q, xrefs: 0693AF01
$^q, xrefs: 0693AF54
$^q, xrefs: 0693AF83

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 084bb72397be1e963ba4555b51362fa4274750ba9566a8015ddd1e0626b85def
Instruction ID: c239791402dcff815ba3e6cd2b3ccd3030b623cecc084894851003c71e6cb99a
Opcode Fuzzy Hash: 084bb72397be1e963ba4555b51362fa4274750ba9566a8015ddd1e0626b85def
Instruction Fuzzy Hash: 65519D30E102258FDFA5EB64E9806AEB7B6FF84300F24892AD456DBB54DB34DC45CB81

Function 06938900 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$^q, xrefs: 0693897F
LR^q, xrefs: 06938A42
LR^q, xrefs: 069389F3
$^q, xrefs: 0693898B

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: 129f12c7fd93adcb51756cbd9f692aa642e857593933e5d0a8c94a12b4a3cef9
Instruction ID: 35c908e679479b7810de9c0ff4d6766a3d93df9164bd965c50d294f771f6eadf
Opcode Fuzzy Hash: 129f12c7fd93adcb51756cbd9f692aa642e857593933e5d0a8c94a12b4a3cef9
Instruction Fuzzy Hash: 9D518030B102159FDB58EF29DA50B6AB7E6BF84310F248968E406DF7A5DB30EC45CB91

Function 0693AE5C Relevance: 5.1, Strings: 4, Instructions: 117COMMON

Download Yara Rule

Strings

$^q, xrefs: 0693AFAC
$^q, xrefs: 0693AF01
$^q, xrefs: 0693AF54
$^q, xrefs: 0693AF83

Memory Dump Source

Source File: 00000008.00000002.4193884443.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6930000_rQuotation3200025006.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 608a42a350119bb839af15f21d9a66096558dd7d56f1f03e875e2397366d8428
Instruction ID: 05bf410a1ee36dd493e6b58807b75851d7c3fc6cc6e61b3e2973ebf69ef8f2e8
Opcode Fuzzy Hash: 608a42a350119bb839af15f21d9a66096558dd7d56f1f03e875e2397366d8428
Instruction Fuzzy Hash: 0B416A34B102158FCF65EB64E680AAEB3F6FF84310B248A29D456DBB58DB34DC45CB80

Analysis Process: pBBqGOzrz.exePID: 7260, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	10.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	150
Total number of Limit Nodes:	15

Executed Functions

Function 00D2D7F0 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00D2D87E
GetCurrentThread.KERNEL32 ref: 00D2D8BB
GetCurrentProcess.KERNEL32 ref: 00D2D8F8
GetCurrentThreadId.KERNEL32 ref: 00D2D951

Memory Dump Source

Source File: 00000009.00000002.1840078036.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_pBBqGOzrz.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b23eb805d5216263ff410192c356ee629000415bdd08a7f6d49a982d30d4eeed
Instruction ID: f28c9b7e24837d36fb8631c041742f93561f8f70092c3459a8b9764bd37e8f3a
Opcode Fuzzy Hash: b23eb805d5216263ff410192c356ee629000415bdd08a7f6d49a982d30d4eeed
Instruction Fuzzy Hash: A35155B0D00349CFDB14DFA9D588B9EBBF1AF88304F248469E449A73A1DB749984CF65

Function 00D2D800 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00D2D87E
GetCurrentThread.KERNEL32 ref: 00D2D8BB
GetCurrentProcess.KERNEL32 ref: 00D2D8F8
GetCurrentThreadId.KERNEL32 ref: 00D2D951

Memory Dump Source

Source File: 00000009.00000002.1840078036.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_pBBqGOzrz.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: e393747daca1d160398effdf40dec0fe9d80e891fd5bdb85ce324efe0f704711
Instruction ID: 61cc389c548d91df3f7c303d8d2857ccc678a7e41b757d10dae4a45ad136a471
Opcode Fuzzy Hash: e393747daca1d160398effdf40dec0fe9d80e891fd5bdb85ce324efe0f704711
Instruction Fuzzy Hash: 155125B0D00349CFDB14DFAAD588B9EBBF1AB88314F24C459E419A73A0DB749984CF65

Function 06AC15E5 Relevance: 1.8, APIs: 1, Instructions: 251
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06AC1826

Memory Dump Source

Source File: 00000009.00000002.1844645407.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ac0000_pBBqGOzrz.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 0e0691afa6edf0486728065bd386b11bc9b018ff5f23a12bde3ad75805a18a09
Instruction ID: ee6a6b679f297ea8d2475cdd88f876587aa2e3315b758611abac345347fa4747
Opcode Fuzzy Hash: 0e0691afa6edf0486728065bd386b11bc9b018ff5f23a12bde3ad75805a18a09
Instruction Fuzzy Hash: 69A19C71E00219DFDB60EF69C841BEEBBB2FF48314F1485A9E808A7241DB749981CF91

Function 06AC15F0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06AC1826

Memory Dump Source

Source File: 00000009.00000002.1844645407.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ac0000_pBBqGOzrz.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 723b1a7ed89e26508cef86180b0fd4543d867fc0059db744d741102d37208423
Instruction ID: 51714d7ea2e66dff38a4e80b4663d578ec508d4670a379c1d322d4bb909d06c0
Opcode Fuzzy Hash: 723b1a7ed89e26508cef86180b0fd4543d867fc0059db744d741102d37208423
Instruction Fuzzy Hash: 87918B71E00219CFDB50EFA9C841BEDBBB2FF48324F1485A9E808A7251DB749981CF91

Function 00D2B159 Relevance: 1.7, APIs: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00D2B3BE

Memory Dump Source

Source File: 00000009.00000002.1840078036.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_pBBqGOzrz.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6fca2e06a960980418bb233144a6a4c3bf0374874a1ee269c4daf539319206ee
Instruction ID: bd3d489456ea5621b3db64da0d955d299de828e4c8347241cffb41d95fe0f496
Opcode Fuzzy Hash: 6fca2e06a960980418bb233144a6a4c3bf0374874a1ee269c4daf539319206ee
Instruction Fuzzy Hash: 2C817370A00B148FD724DF29E44575ABBF1FF98318F048A2ED48ADBA40D7B4E845CBA4

Function 00D25E75 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00D25F31

Memory Dump Source

Source File: 00000009.00000002.1840078036.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_pBBqGOzrz.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8d5747aeaaf8624d4d9fd0ce9da8a14b2ebea3d5c12053da5ba8b3b2ab6f6ea4
Instruction ID: 130696a62866d9bb2bd85df0500431028b7a870de37591bbd5047d71756b2f78
Opcode Fuzzy Hash: 8d5747aeaaf8624d4d9fd0ce9da8a14b2ebea3d5c12053da5ba8b3b2ab6f6ea4
Instruction Fuzzy Hash: 1F41E3B0C00719CFDB24CFA9D984BDEBBB5BF49304F24806AD409AB255DB756946CFA0

Function 00D249D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00D25F31

Memory Dump Source

Source File: 00000009.00000002.1840078036.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_pBBqGOzrz.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c760cd90431a5e66f327277783de7e2921c76438ff1c0bce452cc7b706d97830
Instruction ID: 3ce0e4961d52b9f16d2d7a19105d408fb77b0e1e2d3a6a71906bd5d37f0776e4
Opcode Fuzzy Hash: c760cd90431a5e66f327277783de7e2921c76438ff1c0bce452cc7b706d97830
Instruction Fuzzy Hash: FD41E2B0C00B19CFDB24CFA9D944B9EBBF5BF49304F2480AAD409AB255DB756945CFA0

Function 06AC1361 Relevance: 1.6, APIs: 1, Instructions: 74
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06AC13F8

Memory Dump Source

Source File: 00000009.00000002.1844645407.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ac0000_pBBqGOzrz.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0a4eaabe12f7cc89d3323645a49856e862e613138f76492f1c2ee00e7b86f338
Instruction ID: 1ed3c3535a38af52b93f2001409fc17011c02c5acc840fcf5776675d1f2c6134
Opcode Fuzzy Hash: 0a4eaabe12f7cc89d3323645a49856e862e613138f76492f1c2ee00e7b86f338
Instruction Fuzzy Hash: 992155B19002499FCB10DFAAC881BDEBBF5FF48324F10842AE918A7241C7789945CBA0

Function 06AC1450 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06AC14D8

Memory Dump Source

Source File: 00000009.00000002.1844645407.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ac0000_pBBqGOzrz.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 7460c5759d1d0b811bd1b5c0473e9f743e678302a81def75c7190fdbef8d9176
Instruction ID: e7024be00d70bd911c99aff1796299e4deea005246aa12c2a114323b7c4bb93f
Opcode Fuzzy Hash: 7460c5759d1d0b811bd1b5c0473e9f743e678302a81def75c7190fdbef8d9176
Instruction Fuzzy Hash: B32136B19003499FCB10DFAAC941ADEFBF5FF48324F10842DE958A7251C7389941CBA5

Function 06AC1368 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06AC13F8

Memory Dump Source

Source File: 00000009.00000002.1844645407.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ac0000_pBBqGOzrz.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: bd862a859a383c7b5695837c153f4b64f4e73e980495c8f32ced29509b6a0b55
Instruction ID: 42088bf236b90d55c8207796881de0975c8bdb39a46de95564c751c4e59fe965
Opcode Fuzzy Hash: bd862a859a383c7b5695837c153f4b64f4e73e980495c8f32ced29509b6a0b55
Instruction Fuzzy Hash: 5F2155B19003499FCB10DFAAC881BDEBBF5FF48324F10842AE918A7351C7789944CBA4

Function 00D2DA40 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00D2DACF

Memory Dump Source

Source File: 00000009.00000002.1840078036.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_pBBqGOzrz.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 78efe10e083fac0e9b0c6a9e1adc646a38fa0ba4d5a66217ce3fb80c65c44ded
Instruction ID: b29bcde97331f1348606021ae307ba129beeae4d7a65ce26162121236f4b64a4
Opcode Fuzzy Hash: 78efe10e083fac0e9b0c6a9e1adc646a38fa0ba4d5a66217ce3fb80c65c44ded
Instruction Fuzzy Hash: B321D2B59002589FDB10CFAAD584AEEBFF5EB48324F14846AE954A7311D374A940CFA4

Function 06AC1458 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06AC14D8

Memory Dump Source

Source File: 00000009.00000002.1844645407.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ac0000_pBBqGOzrz.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 6e3c0982707f499b5714c0de50c22252e6f4ffbba687073fa423e59793d35980
Instruction ID: ea1269b23f075e3648359b337083413d410f996dfd4e66e76e67eef22d2e8fd1
Opcode Fuzzy Hash: 6e3c0982707f499b5714c0de50c22252e6f4ffbba687073fa423e59793d35980
Instruction Fuzzy Hash: 612128B19002599FCB10DFAAC941ADEFBF5FF48320F10842DE558A7251C7349944CBA4

Function 06AC0960 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06AC09DE

Memory Dump Source

Source File: 00000009.00000002.1844645407.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ac0000_pBBqGOzrz.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: b110081e4e42b7e61a7efaf8736e0e3454742b4f14480005ea69c8034da640c0
Instruction ID: 4fbfe825aa8906718a77a30fae1ae8d123a42b50a464c1175a1dbcd548e8f60d
Opcode Fuzzy Hash: b110081e4e42b7e61a7efaf8736e0e3454742b4f14480005ea69c8034da640c0
Instruction Fuzzy Hash: 242107B19002098FDB10DFAAC4857EEBBF4AB89324F14842DD459A7241CB789985CFA5

Function 06AC095B Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06AC09DE

Memory Dump Source

Source File: 00000009.00000002.1844645407.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ac0000_pBBqGOzrz.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e036a26fd66b9738a65812e21be983d7cd60b5529f540c4d209dd43daaefc5a0
Instruction ID: 3d5695c65777868c8bef2d55d46121ce8f1f5eff3ebbf91ef674cc5f9a200b18
Opcode Fuzzy Hash: e036a26fd66b9738a65812e21be983d7cd60b5529f540c4d209dd43daaefc5a0
Instruction Fuzzy Hash: D02107B19002098FDB50DFAAC4857EEFBF4AF48364F14842ED459A7241C7789985CFA4

Function 00D2DA48 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00D2DACF

Memory Dump Source

Source File: 00000009.00000002.1840078036.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_pBBqGOzrz.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 33c7015e82ab619a466eb30bd7366b88e1bd20f1ee22802e2add618749c98e19
Instruction ID: 8871f43a65d5860ff4c0d7d86b5b69d6574e1fecd2b626f3ffc1f71cfe5ce05d
Opcode Fuzzy Hash: 33c7015e82ab619a466eb30bd7366b88e1bd20f1ee22802e2add618749c98e19
Instruction Fuzzy Hash: 7B21F3B59002589FDB10CFAAD984ADEFFF9FB48320F14801AE918A3310D374A940CFA4

Function 06AC12A7 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06AC1316

Memory Dump Source

Source File: 00000009.00000002.1844645407.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ac0000_pBBqGOzrz.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2cd6e67163ad928886b1b90b8f2504c98858f514e17153623d90f579a73c2723
Instruction ID: 1bcf3ef424d468a7b1c64fe5fe86973d219b1d7b9386fd2f1f41520dee906b49
Opcode Fuzzy Hash: 2cd6e67163ad928886b1b90b8f2504c98858f514e17153623d90f579a73c2723
Instruction Fuzzy Hash: A31156759002489FCB10DFAAC845ADEFFF5EB88324F208419E519A7250C735A940CFA4

Function 06AC12A8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06AC1316

Memory Dump Source

Source File: 00000009.00000002.1844645407.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ac0000_pBBqGOzrz.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 381ed6525e104fd653fbcff4c97995c10adeacf00af96815eb9800bc8847ad04
Instruction ID: da00cd2ca2b066270045f4206ae4380a3aa7525633bb0d1c88c521a2ffde4507
Opcode Fuzzy Hash: 381ed6525e104fd653fbcff4c97995c10adeacf00af96815eb9800bc8847ad04
Instruction Fuzzy Hash: 5C1164B29002488FCB10DFAAC844BDEFFF5EF88324F208419E519A7250C735A940CFA4

Function 06AC08AB Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06AC0912

Memory Dump Source

Source File: 00000009.00000002.1844645407.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ac0000_pBBqGOzrz.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0e4c53ba3863bf97bede323e2e3d6e853ac253cb7141d5193d9d6fa66116c025
Instruction ID: 22c971474384f74ee9e409fd5e15139f6de3db9c1a08ccde875fffb51ace5a24
Opcode Fuzzy Hash: 0e4c53ba3863bf97bede323e2e3d6e853ac253cb7141d5193d9d6fa66116c025
Instruction Fuzzy Hash: 481128B19002488FDB20DFAAC8457DFFBF9EB88324F24841DD459A7250CB79A944CBA5

Function 06AC4FE8 Relevance: 1.6, APIs: 1, Instructions: 50windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06AC504D

Memory Dump Source

Source File: 00000009.00000002.1844645407.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ac0000_pBBqGOzrz.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 511aadd64900e059562d242722bd1d1b3a5ed6bbed11cd5c33c77b8ae878354e
Instruction ID: 5f33f3341c2fda19cb85ab0cef614635ad43d3eb22100e6643883c6c24ec72d7
Opcode Fuzzy Hash: 511aadd64900e059562d242722bd1d1b3a5ed6bbed11cd5c33c77b8ae878354e
Instruction Fuzzy Hash: 0711F5B98002489FDB20DF9AD845BDEFBF8EB48324F108419E558A7611C375A584CFA1

Function 06AC08B0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06AC0912

Memory Dump Source

Source File: 00000009.00000002.1844645407.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ac0000_pBBqGOzrz.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 208c1abd686f87cc633dd287155138a6b9dab87511b03347da3f2df102033c8a
Instruction ID: 5bb484253323002be0df29345efcc51bb0305d10375d5a35de6c085d3247ed8f
Opcode Fuzzy Hash: 208c1abd686f87cc633dd287155138a6b9dab87511b03347da3f2df102033c8a
Instruction Fuzzy Hash: 2D1136B1D002488FDB20DFAAC4457EEFBF4EB88324F20842DD459A7250CB75A944CFA4

Function 06AC3264 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06AC504D

Memory Dump Source

Source File: 00000009.00000002.1844645407.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ac0000_pBBqGOzrz.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ce12e75a07fdba06fa770b545dfeb5baee8961ce7a9207e87072a94e8d5c384b
Instruction ID: 264d2ec532e43cb0afc75bc1583da9967224269e1506fef6362e98506fdccdf6
Opcode Fuzzy Hash: ce12e75a07fdba06fa770b545dfeb5baee8961ce7a9207e87072a94e8d5c384b
Instruction Fuzzy Hash: 7D11F5B58003499FDB10DF9AD889BDEBBF8EB48324F108419E555A7250C375A944CFE5

Function 00D2B358 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00D2B3BE

Memory Dump Source

Source File: 00000009.00000002.1840078036.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_pBBqGOzrz.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 644c1036fd2de326dc9b031d61480b9c9773da36669ce9e6e3df6da12a5874d1
Instruction ID: 0de08a860dc229b7f44b58fb76e71e9a90d5beb0fcd3bb2da66bee8ab85ad560
Opcode Fuzzy Hash: 644c1036fd2de326dc9b031d61480b9c9773da36669ce9e6e3df6da12a5874d1
Instruction Fuzzy Hash: 3111E0B5C002598FCB10DF9AD444ADEFBF4AF88324F14846AD459A7610C3B5A545CFA5

Function 0092D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1839775530.000000000092D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_92d000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d035acc6dd1e44ca8db808c0d7715a04445e56668ff6e77ee87b93a8a6e1f9f6
Instruction ID: 90365531e2f31c869ba5f1f4236b0ed2c020c5c74db1161701701f49e4562448
Opcode Fuzzy Hash: d035acc6dd1e44ca8db808c0d7715a04445e56668ff6e77ee87b93a8a6e1f9f6
Instruction Fuzzy Hash: 9B210371504240DFDB05DF14E9C4B2ABF69FB88314F20C569ED194B25AC33AD816CBA1

Function 0093D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1839862207.000000000093D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_93d000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69d5a7294cf00ce3248ad916411ce25743b9baab3957838f0442c0bb0d3b4548
Instruction ID: f2f8f8aa0c3dab5dd7159a058ef86b1fac5c9bccc4129195345cf59cf7077ec5
Opcode Fuzzy Hash: 69d5a7294cf00ce3248ad916411ce25743b9baab3957838f0442c0bb0d3b4548
Instruction Fuzzy Hash: B1210775504200DFDB18DF14E5D4B26BFA5FB84714F20C96DD8494B256C33AD847CE61

Function 0093D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1839862207.000000000093D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_93d000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4da8e6faaf913d6cf277a410e8c71385abbc514630f9bc3597f65cc33c4945cf
Instruction ID: ae9632d955f4a0db7e1a830027a01e1835b3838b9a15dcae1d4849ee289ff2cd
Opcode Fuzzy Hash: 4da8e6faaf913d6cf277a410e8c71385abbc514630f9bc3597f65cc33c4945cf
Instruction Fuzzy Hash: CC218E755093808FCB06CF24D9A4715BF71EB46314F28C5EAD8498F2A7C33A980ACB62

Function 0092D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1839775530.000000000092D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_92d000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction ID: 5f568a84108fc4ed895fb234962345ed9a43d078fafc4dbc2df52b7fa1b1c46b
Opcode Fuzzy Hash: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction Fuzzy Hash: 8221B176504240DFDB06CF50D9C4B56BF72FB94314F24C5A9DD090B65AC33AD82ACBA1

Analysis Process: pBBqGOzrz.exePID: 7616, Parent PID: 7260COMMON

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	20
Total number of Limit Nodes:	4

Executed Functions

Function 07083578 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 07083CA7
$^q, xrefs: 07083C9B
$^q, xrefs: 07083C83
$^q, xrefs: 07083C4E
$^q, xrefs: 07083C77
$^q, xrefs: 07083C5A

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 9fde80074ef808c3b44b1d6f698a51d5348587594223521daed4992ed92b4b06
Instruction ID: 6cc73d537c9756a8fba56e378c56c7b3aa1fefa440230f561494f05d5d193aa9
Opcode Fuzzy Hash: 9fde80074ef808c3b44b1d6f698a51d5348587594223521daed4992ed92b4b06
Instruction Fuzzy Hash: CC322E71E1071A8FCB54EF69C89459DF7B5FFC9700F1086AAD449AB224EB309D85CB81

Function 07087E90 Relevance: 3.0, Strings: 2, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0708842B
$^q, xrefs: 07088437

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 72633ce853905cc8b49b2554d9fe71c947a0207b2da436b24591c8045c03ef7d
Instruction ID: f329adae5e9cd26f1e1574ddc718859cb80bd0a42dbd689e477a99181315bff1
Opcode Fuzzy Hash: 72633ce853905cc8b49b2554d9fe71c947a0207b2da436b24591c8045c03ef7d
Instruction Fuzzy Hash: B902AE70B102068FCB94EB68D590A6EB7E6FF84304F64C629D449DB395DB35EC86CB81

Function 070856A8 Relevance: 1.8, Strings: 1, Instructions: 594COMMON

Download Yara Rule

Strings

$, xrefs: 070859FB

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: a494568a08f40fa12a87bb72539fb856bcfa4850b3a40ccca425e5f48e145f88
Instruction ID: f565d1df552d368c962d89e715893523aab9dfc72578d32f6ec57cce20c7a39c
Opcode Fuzzy Hash: a494568a08f40fa12a87bb72539fb856bcfa4850b3a40ccca425e5f48e145f88
Instruction Fuzzy Hash: 7D22C4B1E002168FDBA0EB64C8846AEB7F2FF85324F108569D899AB344DB31DD55CB91

Function 0708274B Relevance: 1.0, Instructions: 1050COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 989bc8fc558b01a65bbce7c9531d84ebda67723bd1c43eb031f2cef866061645
Instruction ID: 04c680bbc14f265cc28445ed6c5479e782b5bc54f93b23481d369e88e112be2b
Opcode Fuzzy Hash: 989bc8fc558b01a65bbce7c9531d84ebda67723bd1c43eb031f2cef866061645
Instruction Fuzzy Hash: C7A23674A002098FDBA4EB68C584B5DBBF2FF89314F1486A9D4899B361DB35EC85CF41

Function 07086700 Relevance: .8, Instructions: 822COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b646ea6ad233c66f212f3b7536d76242e4eda1acdc0eba53f33b57ca4a2145c
Instruction ID: e68eb44be9e6c4af36e398928ce0da04e1b4f785621717bb54fcf33d6c287de6
Opcode Fuzzy Hash: 9b646ea6ad233c66f212f3b7536d76242e4eda1acdc0eba53f33b57ca4a2145c
Instruction Fuzzy Hash: D462B070A002058FCB94EBA8D594BADB7F2FF84314F258569D44ADB391DB36EC46CB81

Function 0708B343 Relevance: .6, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 798364ba4b3bd4e7f65d9017fcf82f8bfe032bc788b1f332b4bdae3219a00a2c
Instruction ID: c92650620f44c56d13b3462b08fe18b23f5adbbf3b201db0a01e840d7d463d92
Opcode Fuzzy Hash: 798364ba4b3bd4e7f65d9017fcf82f8bfe032bc788b1f332b4bdae3219a00a2c
Instruction Fuzzy Hash: D32251F0A0020A9FDFA4EB6CD4807ADB7F5EB45310F248626E495EB395DA34DC85CB51

Function 0708ADE0 Relevance: 10.4, Strings: 8, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0708AF60
$^q, xrefs: 0708AF54
$^q, xrefs: 0708AFAC
$^q, xrefs: 0708AF0D
$^q, xrefs: 0708AF83
$^q, xrefs: 0708AF01
$^q, xrefs: 0708AFB8
$^q, xrefs: 0708AF8F

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: d730d59e5e98f4a450943b171cdcacfcf2929929ed9931822b799c9ddfc069ad
Instruction ID: 0ec5ddadeafb05253e307bbd9a6818d85a78e3347d1e0ee6a39392b85f575e48
Opcode Fuzzy Hash: d730d59e5e98f4a450943b171cdcacfcf2929929ed9931822b799c9ddfc069ad
Instruction Fuzzy Hash: 74E14EB0B0020A8FCB65EFA8D4806AEB7F2FF85314F10862AD455DB355DB35DC4A8B91

Function 0708B760 Relevance: 8.0, Strings: 6, Instructions: 473COMMON

Download Yara Rule

Strings

$^q, xrefs: 0708BCC1
$^q, xrefs: 0708BCF5
$^q, xrefs: 0708BD01
$^q, xrefs: 0708BD35
$^q, xrefs: 0708BCCD
$^q, xrefs: 0708BD29

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: b2a1898c8f233d1eb48e714992ad33a02a7d4ccb44fa85f1dcc7ce75951e39df
Instruction ID: d39073f66040310b55ca9f49f5591d1be98472577d8cabbe7e5a5bb7387f522c
Opcode Fuzzy Hash: b2a1898c8f233d1eb48e714992ad33a02a7d4ccb44fa85f1dcc7ce75951e39df
Instruction Fuzzy Hash: F6026BB0A0020A8FDBA4EF68D4806ADB7F2FF45310F24866AD495DB355DB75DC85CB81

Function 07089260 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 070892D0
$^q, xrefs: 0708930B
$^q, xrefs: 07089317
$^q, xrefs: 070892DC

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: c1c26dc4886cfca812af4fb0a931f5603dea169509b7cf1eb096c7887f85b7ec
Instruction ID: cc13f2b5b335fc736ada1421ed256295d66cd5562ba450ac6fedb719b92c785d
Opcode Fuzzy Hash: c1c26dc4886cfca812af4fb0a931f5603dea169509b7cf1eb096c7887f85b7ec
Instruction Fuzzy Hash: 07916E70B1020A9FDB94EB69D9507AEB3F6FBC9204F108569C40DEB354EE70EC468B91

Function 0708D068 Relevance: 4.6, Strings: 3, Instructions: 801
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0708D473
$^q, xrefs: 0708D45F
$^q, xrefs: 0708D467

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q
API String ID: 0-831282457
Opcode ID: 361c44b65fc03a39a187b8a54655bd0ba6eb650f68bcf997ec1449f59fcad766
Instruction ID: 17d72d73c8500c0b16251bcbaaa1336d7e976069d7ba13c7e110c4bcfbc917e3
Opcode Fuzzy Hash: 361c44b65fc03a39a187b8a54655bd0ba6eb650f68bcf997ec1449f59fcad766
Instruction Fuzzy Hash: B4624C7070020A8FCB55EF68D580A5EB7F2FF84304B248A69D4499F369DB75ED4ACB81

Function 07084C78 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Ocq, xrefs: 07084E53
fcq, xrefs: 07084CA3
XPcq, xrefs: 07084DC9

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: 1b7995c6a3b50cc1ff171d6ac6dda46692ec2f41ca228e325ed809235206205a
Instruction ID: c0b6cda9b689e48a1ad76e31ef7a14ba8ea253d501ee9354be458e4836af98a0
Opcode Fuzzy Hash: 1b7995c6a3b50cc1ff171d6ac6dda46692ec2f41ca228e325ed809235206205a
Instruction Fuzzy Hash: 02619370F002199FDB54AFA8C8547AEBBF6FF88300F20852AE549EB394DB754D458B91

Function 07089253 Relevance: 2.7, Strings: 2, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 070892D0
$^q, xrefs: 0708930B

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 388fcd8eed1a650a3a71571c01e5c1ce181ee62eced9b74c3c805ad6df4543d9
Instruction ID: 9a76547f1bf28092125e83594f95adeee64533e0138874a72b3ced6be66653bc
Opcode Fuzzy Hash: 388fcd8eed1a650a3a71571c01e5c1ce181ee62eced9b74c3c805ad6df4543d9
Instruction Fuzzy Hash: 98514170B101069FDB94EB78D990BAEB3F6EBC9208F148569C409DB394DE34EC468B95

Function 07084C69 Relevance: 2.6, Strings: 2, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 07084CA3
XPcq, xrefs: 07084DC9

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: fcq$XPcq
API String ID: 0-936005338
Opcode ID: 8a07b56174e931d70c6ce65943564f5f7456355c42632ebbd7c29e11d05c8527
Instruction ID: c3216a62cf39b920a29850523a93c22ce1cb17aeb24c7b9977b2c842b4f28665
Opcode Fuzzy Hash: 8a07b56174e931d70c6ce65943564f5f7456355c42632ebbd7c29e11d05c8527
Instruction Fuzzy Hash: F351A170B002099FDB559FB8C8547AEBBF6FF88700F20852AE145EB395DB758C058B91

Function 018CEE90 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.4162175608.00000000018C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_18c0000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9698b6680beb716d44a7824c817a8d678b98af8e9587199c7c1f3ca35992e3
Instruction ID: 1bffca6faa1537f874912c7f04b9940fdd78a4e99d6860e47208f17f9ad153c1
Opcode Fuzzy Hash: 3c9698b6680beb716d44a7824c817a8d678b98af8e9587199c7c1f3ca35992e3
Instruction Fuzzy Hash: E6412372D043969FCB05DF79C80429ABFF1EF8A310F1485AAE549EB251DB349845CBD1

Function 018C8038 Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000), ref: 018C80B0

Memory Dump Source

Source File: 0000000E.00000002.4162175608.00000000018C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_18c0000_pBBqGOzrz.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: bcf5dd44b8d81373bac079aa2efcf97c72cf757016befdbf18cd69115f219882
Instruction ID: 3859ad44ddf8e8884d93287a04886d09b18d1a207de66e5329054888e03473a9
Opcode Fuzzy Hash: bcf5dd44b8d81373bac079aa2efcf97c72cf757016befdbf18cd69115f219882
Instruction Fuzzy Hash: 4B2138B1C006198FCB24CF99C4857DEFBB0FF48320F148169D858A7250D378A944CFA5

Function 018C8040 Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000), ref: 018C80B0

Memory Dump Source

Source File: 0000000E.00000002.4162175608.00000000018C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_18c0000_pBBqGOzrz.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: f2bf9054640171792696f9cc8a5586373f6f1be5953dc1be422e100f14f9ee44
Instruction ID: 1223ea7aa11486e0ba268527521f810755324d1c13dc7669d5f831a22282417f
Opcode Fuzzy Hash: f2bf9054640171792696f9cc8a5586373f6f1be5953dc1be422e100f14f9ee44
Instruction Fuzzy Hash: DC1136B1C006599BCB14CF9AC44479EFBB4BF48720F10812AD958A7250D378AA44CFA5

Function 018CEF78 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 018CEFDF

Memory Dump Source

Source File: 0000000E.00000002.4162175608.00000000018C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_18c0000_pBBqGOzrz.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 31d092a206fdf023ea887bf2d51e2c423827a7281bbcbe7962d6f65761d75d43
Instruction ID: a001f4e93e600630afb357e3d916f2fd10604802406158032de8974c34b5348b
Opcode Fuzzy Hash: 31d092a206fdf023ea887bf2d51e2c423827a7281bbcbe7962d6f65761d75d43
Instruction Fuzzy Hash: BB11E2B1C0066A9BDB10DF9AC544BDEFBF4AF48320F14816AE918A7250D778A944CFA5

Function 0708DBDD Relevance: 1.4, Strings: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0708DD39

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: e2cffffcd36568d0cf7e88d95395df8a15d940cea0e70b58e526282671d98d56
Instruction ID: 96f8cc460a0252aea69a82f688879e4529a64a6cba16761fa04cf89113975e81
Opcode Fuzzy Hash: e2cffffcd36568d0cf7e88d95395df8a15d940cea0e70b58e526282671d98d56
Instruction Fuzzy Hash: 0041B3B0B0030A9FDBA5EF65D45469EBBF2FF89304F104629D445DB280EB71D946CB91

Function 070821D0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0708230B

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 7a207dd09eade4a08a29f25c4264632dedc3a59851bc6d48381b2bd145ddee85
Instruction ID: 06f9e53184751e049c727161240555ece0d82575e2c29a546d3338a65d91a370
Opcode Fuzzy Hash: 7a207dd09eade4a08a29f25c4264632dedc3a59851bc6d48381b2bd145ddee85
Instruction Fuzzy Hash: B531E470B002029FCB95AB78C55466E7BE2FF89310F244528D446DB394EE35DD46CBA2

Function 0708A418 Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

t, xrefs: 0708A420

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: t
API String ID: 0-2238339752
Opcode ID: ecb66ceb71b66a1155fdc5c23c21166a20d761008a747160a43d692a6e89f50e
Instruction ID: dc3a6724bbe29f97c6478d74b3f21835b1ea816f7b2597234c4dadb8680d8d54
Opcode Fuzzy Hash: ecb66ceb71b66a1155fdc5c23c21166a20d761008a747160a43d692a6e89f50e
Instruction Fuzzy Hash: F901F5B07001155FCFA1EA7CA41472A77D9EBCA314F18962AE509CB360DA66DC468382

Function 070883E0 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$^q, xrefs: 0708842B

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: 00e28a0ee6df465991ac06fefb9f194d81f883bfdd1efa4108bbb2c1a044a948
Instruction ID: 3a678d70f447b7b24e6605173b2e551003e17c54aa05d24c51df6cf109f85a05
Opcode Fuzzy Hash: 00e28a0ee6df465991ac06fefb9f194d81f883bfdd1efa4108bbb2c1a044a948
Instruction Fuzzy Hash: 08F0F4B26211028FDFE4AE98EA8066CB3A5FB41314F58D625C845CB2D0CBB5DD0AC752

Function 07086580 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

;, xrefs: 07086580

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: ;
API String ID: 0-1661535913
Opcode ID: a2be01d242c183395fcbb5896777d24131ced8c2658e712cda46b80ad50d29df
Instruction ID: c313cc7b7d95e4c8090e1738c2cc76ad9745c1805a813a5c3b0610d638c3525d
Opcode Fuzzy Hash: a2be01d242c183395fcbb5896777d24131ced8c2658e712cda46b80ad50d29df
Instruction Fuzzy Hash: 79E068B0D05209AFCF60EE70980578B7BEC9702214F1147E6D844CB106E137CD018782

Function 07084B61 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Ocq, xrefs: 07084B6D

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: \Ocq
API String ID: 0-2995510325
Opcode ID: 5ba8871ff683b39d7d8a071a0c8f055b2b99bc4fcf3b4967eb1477b81966e876
Instruction ID: 56b688acd6f2778cd60a69770fb2cae05449e52a8b1651dbe5d8881e1b2a15eb
Opcode Fuzzy Hash: 5ba8871ff683b39d7d8a071a0c8f055b2b99bc4fcf3b4967eb1477b81966e876
Instruction Fuzzy Hash: 94F0DA70A1022ADBDB14DF94E899BAEBBB2FF88700F204219E402A7394CB741D05CB81

Function 0708C2A8 Relevance: .6, Instructions: 640COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a486ece3840bf8919c9af982fb2261aa99230b160115d5cef495a503961ec72a
Instruction ID: 44dbb6bcb47e4b4f3a6e85ce3edd865f0e79879bc22f4a67390f4a3bb73aaaec
Opcode Fuzzy Hash: a486ece3840bf8919c9af982fb2261aa99230b160115d5cef495a503961ec72a
Instruction Fuzzy Hash: DA32A570B002069FEB94EB68D480BAEB7F2FB89310F148665D445EB355DB35DC46CBA1

Function 07086300 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e596bb9172b1b2800ec8c6e7b9766dad51e1db1676108323fb98eb3372773e61
Instruction ID: dc3c59c052ea0bc38b00fde7494e7d11b125b0181c611d397d537207554b4bce
Opcode Fuzzy Hash: e596bb9172b1b2800ec8c6e7b9766dad51e1db1676108323fb98eb3372773e61
Instruction Fuzzy Hash: 1A61D3B1F000124FCF51AA7DC88466FBAD7AFC5620B16453AD80EDB361DE66DD0287C6

Function 070843B3 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03a6bba31d01563559e0aa34c1b407234bc10f90cefece7a9e2d6fc3ac8de910
Instruction ID: e486e9d8654e9cafb01106d87ab9a285a9a774905696eb0daaca4c106e723b85
Opcode Fuzzy Hash: 03a6bba31d01563559e0aa34c1b407234bc10f90cefece7a9e2d6fc3ac8de910
Instruction Fuzzy Hash: 42815FB0B0020A9FDB94EFA8D55065EB7F6EF89304F108525E449DB394DF74DC468B92

Function 070846CC Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38cfe76722640ae5da4c7053d4dbcc08198237d33011d0fc54b3ebc2cf77eb4c
Instruction ID: 5eb363db73844085af0afbe0e5f6a6b7f84b0ce7ef157b9ce430f16303bfb96f
Opcode Fuzzy Hash: 38cfe76722640ae5da4c7053d4dbcc08198237d33011d0fc54b3ebc2cf77eb4c
Instruction Fuzzy Hash: E4913E74E0021A8BDF60DF68C890B9DB7B1FF85310F208699D589AB255DB70AA85CB91

Function 070846E0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d14319ef61cf8dec8639e555417d89646c3d9ba58463d85505be6b44f5bcb9
Instruction ID: 25b0460117f9980634ba888804e0a90bc9e23da4c6f33153e29b7b82863a119b
Opcode Fuzzy Hash: 55d14319ef61cf8dec8639e555417d89646c3d9ba58463d85505be6b44f5bcb9
Instruction Fuzzy Hash: D0912E74E0061A8BDF60DF68C880B9DB7B1FF89310F208699D54DAB355DB70AA85CF91

Function 0708F031 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87abe5d8da459aa1b3c48b8115b67b1c8faab434a18388de7d95d2645b28de78
Instruction ID: 0d4997ebb1c04e961c6dbff16e76ff6ee28f6d444c95e39586194aacd5e92c24
Opcode Fuzzy Hash: 87abe5d8da459aa1b3c48b8115b67b1c8faab434a18388de7d95d2645b28de78
Instruction Fuzzy Hash: F7711A70A0020A9FDB54EFA9D980A9DBBF6FF88300F248529D449EB355DB30ED46CB51

Function 0708F040 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bf49b68a72d1779ee0ba88b23b9dc4060cb6f5988dc56b9b0de96beed1d1e53
Instruction ID: be6d222e69966102a1bc7b3a5365f8739d1fa7691791eef75ac976b0f8d3b838
Opcode Fuzzy Hash: 9bf49b68a72d1779ee0ba88b23b9dc4060cb6f5988dc56b9b0de96beed1d1e53
Instruction Fuzzy Hash: 7A711970A0020A9FDB54EFA9D980A9DBBF6FF88300F248529D449EB355DB70ED46CB51

Function 0708FCC1 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ca1548abc5208a052dca4304b3b5514795490d76bd6cc412c234061a8057b4
Instruction ID: 86d4f7cfdc2098362c3cd562aea90d4f7e4da44b46603f5ac14a802a8a19fe10
Opcode Fuzzy Hash: 33ca1548abc5208a052dca4304b3b5514795490d76bd6cc412c234061a8057b4
Instruction Fuzzy Hash: BF51F5B1A00206CFDF64FB78E4442ADB7B2FF88315F104A7AD14AD7251DB359955CB81

Function 0708FA70 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21522ce75fe34d36c53c94b9ea3a6db65b28f6a30233497a9e8e6a6c998ab0c6
Instruction ID: 063e5a1ae75fdb86bde507e11437fa71f6583d3908ae67ffcb5c3e4973607666
Opcode Fuzzy Hash: 21522ce75fe34d36c53c94b9ea3a6db65b28f6a30233497a9e8e6a6c998ab0c6
Instruction Fuzzy Hash: D05138B07102068FFFA06A7CD99476F2B9AE789310F20492AE54ED7394C97DDC4583E2

Function 0708FA80 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5822b7d7581c165f0c0e5e21f469046399def97fcb8795ab236e7e8553a097e3
Instruction ID: a65e3b33a7aa5a73bc5ac46f387cf92e2e2e4ce690c896ddc599796008361db9
Opcode Fuzzy Hash: 5822b7d7581c165f0c0e5e21f469046399def97fcb8795ab236e7e8553a097e3
Instruction Fuzzy Hash: DA5115B07102069FFFA06A7CC99472F269EE789310F20492AE54ED7394D96DDC4583E2

Function 07085523 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af011b720525e6aba5f31c62ee49cdb3a170b7653b0c69895376ea3135de6521
Instruction ID: 549c6f3464e1af10cd61c5900db713c1effd32aea32917fa7af42d5c964e6bc7
Opcode Fuzzy Hash: af011b720525e6aba5f31c62ee49cdb3a170b7653b0c69895376ea3135de6521
Instruction Fuzzy Hash: B34154B1A006068FDF70DF99DC806AFFBF2EB54310F104A2AE156D7654D330E9658B91

Function 0708DA90 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c7067c1f26fc83b08a68b9398dab620c0539f8ab552012150b988b864bd3395
Instruction ID: 2ad2d964c6b42268c68bfdd9433a5bd309a74b501fffea6cbfa12fe6c2bbeeb4
Opcode Fuzzy Hash: 2c7067c1f26fc83b08a68b9398dab620c0539f8ab552012150b988b864bd3395
Instruction Fuzzy Hash: 7A318370A1020A9FCF55DF68C48069EF7F6FF89314F244629D445EB340EB71A9468B81

Function 07082081 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcef44709049d80b0f3f94b4316e6d9972279a980036982ba84d8bba093cee36
Instruction ID: 2637b1d88755ba9072d3ed8c7f299a453b90cc9972729e2df62087df6c04ae5a
Opcode Fuzzy Hash: dcef44709049d80b0f3f94b4316e6d9972279a980036982ba84d8bba093cee36
Instruction Fuzzy Hash: 96319E71E0060A9BCF94DFA4D89469EB7F6FF89300F208529E946E7350DB70AD42CB91

Function 07082090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce8ccac98d2101ec6fec78eb0d48ae61541d1a38d7a1b4f21efb28652acff0ff
Instruction ID: 1b8d51dbd22e365d50f327d6d8f3ab0943de7b98de88058ce8a904a6e059bb0d
Opcode Fuzzy Hash: ce8ccac98d2101ec6fec78eb0d48ae61541d1a38d7a1b4f21efb28652acff0ff
Instruction Fuzzy Hash: 34317C71E0060A9BCF49DFA4D85469EB7F6FF89310F208529E946EB350DB70AC42CB91

Function 07083FB9 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a76572f275f78d684e2da240e8f061a01020a57beca3ee5986568c90804f9bae
Instruction ID: e69a38696924feef1c493c82637a1e2d88756016096e628c3cbd2d33dba49934
Opcode Fuzzy Hash: a76572f275f78d684e2da240e8f061a01020a57beca3ee5986568c90804f9bae
Instruction Fuzzy Hash: CA318CB1B002169FCB50DF68E840AEEBBF1FB48710F108026E954EB390E735E9018B91

Function 07083FC8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e28fa25cdbd9ee7ff08763a8cd11a1e5ad6f05e498efc545387251723f81782e
Instruction ID: c290395793b50f09fbf06e4c02995b761c7d0ea191a7b395a33e17aa7ffdaf16
Opcode Fuzzy Hash: e28fa25cdbd9ee7ff08763a8cd11a1e5ad6f05e498efc545387251723f81782e
Instruction Fuzzy Hash: F2218BB5F002069FDB50DFA8D980EAEBBF5FB48610F108129E955EB390E735ED018B91

Function 0187D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4161655851.000000000187D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0187D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_187d000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f66c167a9419baeba1d9a5329b2da6c16f7cbc5f52e9efddbbedee6dd07cdec1
Instruction ID: e1d1f0a0b65d224df441d4769e03bb0fd42b066731e0ff873323104e32a63120
Opcode Fuzzy Hash: f66c167a9419baeba1d9a5329b2da6c16f7cbc5f52e9efddbbedee6dd07cdec1
Instruction Fuzzy Hash: E1213471504204DFCB12DF58D9C0B26BBA5FF84318F24C66DD80A8B256C33AD547CA62

Function 0187D1F8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4161655851.000000000187D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0187D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_187d000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cdaa895bfcd1d30c5d9a174a3b28efcd09eeac3df4106e8aaf112d9668d89
Instruction ID: 405d0970e19cc2ef66f77b055ad721c25006e7aa0477ea28df755e99095feb30
Opcode Fuzzy Hash: ae9cdaa895bfcd1d30c5d9a174a3b28efcd09eeac3df4106e8aaf112d9668d89
Instruction Fuzzy Hash: 99214671514204DFDB01DF98D9C4B2ABB65FF84334F24C669E8098B246C33AE547CAA1

Function 0187D3A8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4161655851.000000000187D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0187D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_187d000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c5eb14e04480d49ff4ff416d30a37de562a201c40e7272c1020d1dca7866ef4
Instruction ID: e861545a4160bc6c542cd690db17ddb33b63f45e94eb99850eb8d69fab78d13f
Opcode Fuzzy Hash: 9c5eb14e04480d49ff4ff416d30a37de562a201c40e7272c1020d1dca7866ef4
Instruction Fuzzy Hash: FA2137B1504204DFDB05DF58D5C0B26BFA5FF84318F20C66DD9098B256C336E546CA61

Function 07084310 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c2539a8dea8c9153a767bc518045b616ba2ad839346fd984e5d45f9ec5dd160
Instruction ID: ce7fdd92a2ae6928fb0d1d835d1d6217c94f7016cae4422f19cc1e984d95cc8f
Opcode Fuzzy Hash: 0c2539a8dea8c9153a767bc518045b616ba2ad839346fd984e5d45f9ec5dd160
Instruction Fuzzy Hash: 8C1145703041521FDBA19A7CD45031EBBEACFCA350F24843AF08ACB382DA65CC024382

Function 070840D8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 635acc775b2c20ff8380513b9f73104f6e5319b72df4d185447e8f459dae42e5
Instruction ID: cf0d7b0db254d7a00b103f41ff95c521f6d84c359661f5f453a29d0d0b557c13
Opcode Fuzzy Hash: 635acc775b2c20ff8380513b9f73104f6e5319b72df4d185447e8f459dae42e5
Instruction Fuzzy Hash: C6115E72B1012A5BDF94AA68CC14AAF73EBEBC8215F104539D50AE7344DE699C068B92

Function 0708F2B0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 677b6e6b5a9f85283b13a01430e16c4932a2047d8f9463cd3afd52873c9a25b0
Instruction ID: fb8e52bd97b03f88627394e9260291200383369cb81cc8a93a56273bb116cadf
Opcode Fuzzy Hash: 677b6e6b5a9f85283b13a01430e16c4932a2047d8f9463cd3afd52873c9a25b0
Instruction Fuzzy Hash: AB0128717001121FCBA2A67CE4547BE77E6DBCA320F24456AE44ACB341DA24DC078785

Function 07083D93 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aa04faabcd7e3ec91c67b7a6e42adb7294c1db84a84fe96f06767da4cb656be
Instruction ID: 552c433df54242a9a1fb078a9ee1cf8b22bb5b35d6244fed6f8c7eeafe2a03fc
Opcode Fuzzy Hash: 9aa04faabcd7e3ec91c67b7a6e42adb7294c1db84a84fe96f06767da4cb656be
Instruction Fuzzy Hash: 8E21C0B5D01259AFCB10DF9AD885ACEFFB8FB48314F10812AE518A7240C374A954CFA5

Function 070840C9 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c48f5f70ee875ee873e0ed792782ee217f49ec8b09cd6f8f40514b1191a38b79
Instruction ID: 86971326e94f34e31d4514bfe8f3757d9bb985d32d6ec78b6dfaadf2bb0c41d8
Opcode Fuzzy Hash: c48f5f70ee875ee873e0ed792782ee217f49ec8b09cd6f8f40514b1191a38b79
Instruction Fuzzy Hash: 0701D476B0006A5BDFA4AA68DC10AEF73FBEBC8310F10413AE54AD7344DE649C064BD1

Function 0187D1F3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4161655851.000000000187D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0187D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_187d000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: a58aedd98d03f39bd77940cfc52f3cc79386411a5ef44d070cf51cea20cd00c0
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: D9119D76504280DFDB12CF54D5C4B16BF61FB84324F28C6AADC494B656C33AE50ACBA2

Function 0187D3A3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4161655851.000000000187D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0187D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_187d000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: f14e8893e99c1ca0eb94a47f8f90ed87a0ae831d6f5328d25b81d5df0fa47780
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 5211BB75504280DFDB02CF54D5C4B55BFA2FB84314F28C6AAD9498B266C33AE44ACB62

Function 0187D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4161655851.000000000187D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0187D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_187d000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: f67c4f3a2420c359bc92cc34d9399fe7160d0b21c97cfb2fba8d0180edbe88da
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 1711BB75504280CFDB12CF58D5C4B15FFA1FB84314F28C6AAD8498B666C33AD44ACB62

Function 07083D98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2ec21dde80a027eb7af30b2ae555abee8d1dd32598a52ebda1c4196e0f21b74
Instruction ID: c2ed79b575fda41c091b4aeae9866de9c292662fb537fa32da9f4c5c5cd631e8
Opcode Fuzzy Hash: f2ec21dde80a027eb7af30b2ae555abee8d1dd32598a52ebda1c4196e0f21b74
Instruction Fuzzy Hash: 4B11A2B5D01259EFCB00DF9AD884ADEFBB4FB48314F10852AE518A7250C374A954CFA5

Function 07084320 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ab395dc4ad0992e8a594b43f873a8fb0729bd86865a21d7fb714ee023159c4b
Instruction ID: 82ed7b607a7447584b14db93bdc5b47601bc13e0beff5906df859600f75ce398
Opcode Fuzzy Hash: 5ab395dc4ad0992e8a594b43f873a8fb0729bd86865a21d7fb714ee023159c4b
Instruction Fuzzy Hash: 96016D717000165BDBA4EA6DE45072FB3DADBCA660F248539F14EC7350EA66DC024396

Function 0708F2C0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e1384c591117403ae07ca75852796138293ec42a27a7aa5e4e5e2ad1bfe0247
Instruction ID: cd3cc167a41d766e4f1c9b2eaf0e1427101bc7c316241616ae77611e26080086
Opcode Fuzzy Hash: 7e1384c591117403ae07ca75852796138293ec42a27a7aa5e4e5e2ad1bfe0247
Instruction Fuzzy Hash: C801A4717000121BDBA5E67DE45472EB3DADBC9620F148939E50ECB340DE25EC034785

Function 0708A428 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9699b30642b0612577c582e064424952e776dbb358ee51556d243b4b9037ee7
Instruction ID: e65a430f13281ca0b9be65faed86ad6abca5890d376d2219036e57e30ec406b5
Opcode Fuzzy Hash: f9699b30642b0612577c582e064424952e776dbb358ee51556d243b4b9037ee7
Instruction Fuzzy Hash: 3C01ADB07000154BCBA0EA6CE45472AB3DAEBCA724F149629E10ECB360DA66DC024782

Non-executed Functions

Function 070877B0 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 07087D12
$^q, xrefs: 07087CFC
$^q, xrefs: 07087D1E
$^q, xrefs: 07087C69
$^q, xrefs: 070878DD
$^q, xrefs: 070878AC
$^q, xrefs: 07087D08
$^q, xrefs: 070878D1
$^q, xrefs: 07087C5D
$^q, xrefs: 070878A0

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: 39749ee3f591edd31c092148493fc4fcde0cb8dcb44ac9afbabf5f847eb16596
Instruction ID: 1ec1f64f53cafc54c84af04989d73362e4348cd5264532e63852abf9e4364765
Opcode Fuzzy Hash: 39749ee3f591edd31c092148493fc4fcde0cb8dcb44ac9afbabf5f847eb16596
Instruction Fuzzy Hash: A8122070A00219CFDB68EFA9C854A9DB7F2BF85704F209669D449AB358DB30DD85CF81

Function 0708AA48 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 0708ABC4
$^q, xrefs: 0708AB4A
$^q, xrefs: 0708ABFA
$^q, xrefs: 0708AC06
$^q, xrefs: 0708ABA5
$^q, xrefs: 0708AB3E
$^q, xrefs: 0708AB99
$^q, xrefs: 0708ABD0

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 170b3debc6802ddd003bc3bd2e14993a83c52a9d6f6b36cbd54f65a0866bc96f
Instruction ID: 79e64c542cba76f65a8b2644c6bcc5a5daa3a2048af5f3f0672d2f78baf1c3a3
Opcode Fuzzy Hash: 170b3debc6802ddd003bc3bd2e14993a83c52a9d6f6b36cbd54f65a0866bc96f
Instruction Fuzzy Hash: D2915BF0B0020ADFDBA8EB68D554B6EB7F2BF84300F10862AD4429B755DB749D45CB91

Function 070871B0 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$^q, xrefs: 07087492
.5vq, xrefs: 0708720B
$^q, xrefs: 070876B8
$^q, xrefs: 070874EC
$^q, xrefs: 070876C4
$^q, xrefs: 0708764C
$^q, xrefs: 070874F8

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: be1ac49da690ee53eacc02d3b01387f6c4964c6f30a90a3680531b36217356df
Instruction ID: 85f31e9c222004dabbf1f3bec30bd9963997b6b0c46277dfa56c9c35df808a4d
Opcode Fuzzy Hash: be1ac49da690ee53eacc02d3b01387f6c4964c6f30a90a3680531b36217356df
Instruction Fuzzy Hash: 22F18D74B00209CFDB59EFA8D594A6EB7B2FF84340F248569D4459B3A8CB35DC86CB81

Function 070884E8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 0708874E
$^q, xrefs: 070887A7
$^q, xrefs: 070887B3
$^q, xrefs: 07088742

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 52a40a58cb7c14cb4a4b12f3f5f2bf9abf59b797ebf4a81814a2ae53139d32f5
Instruction ID: 11f72de10e5009fb03bea6e77ef64c3949a54dc3248d973f13023f7b554ae826
Opcode Fuzzy Hash: 52a40a58cb7c14cb4a4b12f3f5f2bf9abf59b797ebf4a81814a2ae53139d32f5
Instruction Fuzzy Hash: 5BB11670A10209CFDBA4EB68D58465EB7F2EF84304F64CA29D445DB395DB74DC86CB81

Function 07088900 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$^q, xrefs: 0708898B
$^q, xrefs: 0708897F
LR^q, xrefs: 070889F3
LR^q, xrefs: 07088A42

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: d551a9c33481b410150dbda870a1ce0d6f641a725c4397917f8220984c8f2a88
Instruction ID: 94a3c1cc208c293c9184bbdafd7a9d91461b7f74cee42a1c457e6adc68472bc5
Opcode Fuzzy Hash: d551a9c33481b410150dbda870a1ce0d6f641a725c4397917f8220984c8f2a88
Instruction Fuzzy Hash: 3C51D0707102068FDB58EB28C854A6EB7E6FF89304F148668E4469F3A1DF30EC45CB82

Function 0708ADDB Relevance: 5.2, Strings: 4, Instructions: 157COMMON

Download Yara Rule

Strings

$^q, xrefs: 0708AFAC
$^q, xrefs: 0708AF54
$^q, xrefs: 0708AF83
$^q, xrefs: 0708AF01

Memory Dump Source

Source File: 0000000E.00000002.4194887476.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7080000_pBBqGOzrz.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 00fc3051c18e60f0ee13b08bcf86c9c77a80118a76877b526f62b78b8574cd22
Instruction ID: ba27b1f8525a09b214d0372b6d585e45742072aa6569f512aebe5d95b642b596
Opcode Fuzzy Hash: 00fc3051c18e60f0ee13b08bcf86c9c77a80118a76877b526f62b78b8574cd22
Instruction Fuzzy Hash: 53517DF0B002069FCBA5EB68E58066EB3F2EB88314F148A2BD445DB755DB35DC45CB81

Analysis Process: sgxIb.exePID: 7844, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	148
Total number of Limit Nodes:	14

Executed Functions

Function 00B0D800 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00B0D87E
GetCurrentThread.KERNEL32 ref: 00B0D8BB
GetCurrentProcess.KERNEL32 ref: 00B0D8F8
GetCurrentThreadId.KERNEL32 ref: 00B0D951

Memory Dump Source

Source File: 00000010.00000002.1900405557.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b00000_sgxIb.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b4fe63ead1581510c1d400e54ee6ca2a5cee65bcdf45c322efe3cd8b444f73b5
Instruction ID: 51ea085e8df5feb9a9fef1b1a9d8f3fd07b67e12c1e8cfaa708d7ae3cbacdc48
Opcode Fuzzy Hash: b4fe63ead1581510c1d400e54ee6ca2a5cee65bcdf45c322efe3cd8b444f73b5
Instruction Fuzzy Hash: 375145B09007498FDB14DFAAC548B9EBFF1EF88314F20C469E409A72A0DB349984CF65

Function 066D15E5 Relevance: 1.8, APIs: 1, Instructions: 250
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 066D1826

Memory Dump Source

Source File: 00000010.00000002.1905183911.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_66d0000_sgxIb.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: edb8c010491192098a7e2bd3ba2089573b1cb9376a330de63287a15aaf3e07d4
Instruction ID: 9584c9f8a56ceb31361c77991f86b299008bf78a6f857182faad37795efe04b8
Opcode Fuzzy Hash: edb8c010491192098a7e2bd3ba2089573b1cb9376a330de63287a15aaf3e07d4
Instruction Fuzzy Hash: 76A17B71D00219DFDB50CFA9C841BEEFBB2BF45314F1485A9E848A7290DBB49A85CF91

Function 066D15F0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 066D1826

Memory Dump Source

Source File: 00000010.00000002.1905183911.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_66d0000_sgxIb.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: ce675b939a534b310547ef91e36349b9c32c2f2f268e1400374bd80dcfa8be31
Instruction ID: 3c92d8528a3d1bcde615a931a882ad04af11c7c7c666f2f0b95eec15b684dad8
Opcode Fuzzy Hash: ce675b939a534b310547ef91e36349b9c32c2f2f268e1400374bd80dcfa8be31
Instruction Fuzzy Hash: D4918B71D00219DFDB50CFA9C840BEDFBB2BF49314F1485A9E848A7290DBB49A85CF91

Function 00B0B159 Relevance: 1.7, APIs: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00B0B3BE

Memory Dump Source

Source File: 00000010.00000002.1900405557.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b00000_sgxIb.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 39893f70aba54c5fbb62e3e381a57cdaaff5de7189db1081bbe1c568546bdd21
Instruction ID: cd9249bd2e98123329766bfd3f233b85ed1b0e65fe10d5057b125f5c6ce361d5
Opcode Fuzzy Hash: 39893f70aba54c5fbb62e3e381a57cdaaff5de7189db1081bbe1c568546bdd21
Instruction Fuzzy Hash: A1814470A00B058FD724DF69D455B9ABBF1FF88304F008A6DD48ADBA90DB74E945CB91

Function 00B05E75 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00B05F31

Memory Dump Source

Source File: 00000010.00000002.1900405557.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b00000_sgxIb.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 1f5571552d25f585a41d2b4f8fadb087cb9d4f08c581ff24e61fd9cffc25a7fb
Instruction ID: 16a58e2128d5760cd6c0703a9599a1fe2be42577b2834cc9bfe4fdcdb53072ea
Opcode Fuzzy Hash: 1f5571552d25f585a41d2b4f8fadb087cb9d4f08c581ff24e61fd9cffc25a7fb
Instruction Fuzzy Hash: B54102B0C00619CFDB24CFA9C944BDEBBF5BF49304F2484AAD008AB295DB756986CF50

Function 00B049D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00B05F31

Memory Dump Source

Source File: 00000010.00000002.1900405557.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b00000_sgxIb.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 772951b633bde908ee1ae4040c80e5c586a4cf7a81104dc8ea37a538a9cd862a
Instruction ID: 9e9ed961a26d4ef1f06982a22467660ae6e1492183ef187e51a855830fdc0599
Opcode Fuzzy Hash: 772951b633bde908ee1ae4040c80e5c586a4cf7a81104dc8ea37a538a9cd862a
Instruction Fuzzy Hash: 8641DFB0C00619CBDB24DFA9C984BDEBBF5BF48304F2084AAD408AB695DB756945CF90

Function 066D5080 Relevance: 1.6, APIs: 1, Instructions: 80
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 066D504D

Memory Dump Source

Source File: 00000010.00000002.1905183911.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_66d0000_sgxIb.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: c14309cafe72e33791d3c7a7ec3c6679fd503b7d23b33b49e3f0897d2597e78f
Instruction ID: e20394b84ab50151d0f7c11720a148b832bcde6518d5810c190f712269ff3968
Opcode Fuzzy Hash: c14309cafe72e33791d3c7a7ec3c6679fd503b7d23b33b49e3f0897d2597e78f
Instruction Fuzzy Hash: 70219A72D052298BDB60DFA5D8047EEBBF4AF48348F14805AD802AB642CB395944CBE0

Function 066D1361 Relevance: 1.6, APIs: 1, Instructions: 73
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 066D13F8

Memory Dump Source

Source File: 00000010.00000002.1905183911.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_66d0000_sgxIb.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 045ae6b5faefc15f9c6f6b93f18bb0ccd2968b97de4a5aeb329e0520a8cbdeff
Instruction ID: 8b07d01b3db3c935ab5e5dff7e60ac2da6ec4fa6d90d2cd1dfadc0f8290bb0be
Opcode Fuzzy Hash: 045ae6b5faefc15f9c6f6b93f18bb0ccd2968b97de4a5aeb329e0520a8cbdeff
Instruction Fuzzy Hash: E32135B1D002599FCB10CFAAC881BDEBBF1FB48314F10842AE959A7241D7789955CBA0

Function 066D511B Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.1905183911.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_66d0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 633ef0b66054cb905f43c8199af235e92288cd074f04314b8f69a7683e327637
Instruction ID: aed2b43181194f223a8a58dc4e8336fd47be7b2aa83642ea3019ada43832561f
Opcode Fuzzy Hash: 633ef0b66054cb905f43c8199af235e92288cd074f04314b8f69a7683e327637
Instruction Fuzzy Hash: 66210232E063508FDB219B2AD8007AFBBF49F85254F19846BD846E7A81CB759904CBE1

Function 066D1368 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 066D13F8

Memory Dump Source

Source File: 00000010.00000002.1905183911.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_66d0000_sgxIb.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2c9e9109d70e9296cfee65a98bb617bbabca64d2d0d7290b697b60f8cbf1a1fa
Instruction ID: 057a1e194484695daddf4e4641a12218b2e6d3fc2a96b14675ad660f6420ae5d
Opcode Fuzzy Hash: 2c9e9109d70e9296cfee65a98bb617bbabca64d2d0d7290b697b60f8cbf1a1fa
Instruction Fuzzy Hash: 5C2113B19003599FCB10CFAAC885BDEBBF5FB48314F10842AE959A7250D778A954CBA4

Function 066D1450 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 066D14D8

Memory Dump Source

Source File: 00000010.00000002.1905183911.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_66d0000_sgxIb.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 7b800046f1225622988e55864c6cc4101c12182193b4900503086800f3ed4b6c
Instruction ID: f0064b2c713bf3500adce3728b8fec1a0b0f4aac9ed9d0db736dd532e189610d
Opcode Fuzzy Hash: 7b800046f1225622988e55864c6cc4101c12182193b4900503086800f3ed4b6c
Instruction Fuzzy Hash: 542136B1D002499FCB10DFAAC881ADEFBF5FF48314F108429E959A7250D7789545CBA1

Function 066D0958 Relevance: 1.6, APIs: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 066D09DE

Memory Dump Source

Source File: 00000010.00000002.1905183911.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_66d0000_sgxIb.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 8a4cef1a76aa3714ab17dce17da21632117e3d18547c31be250082c5ad26ebb2
Instruction ID: 8618cad481dd6664a8f3f54b08ffe9276bfceab84cd5b24de15447d292c78c6b
Opcode Fuzzy Hash: 8a4cef1a76aa3714ab17dce17da21632117e3d18547c31be250082c5ad26ebb2
Instruction Fuzzy Hash: D12125B1D003098FDB10DFAAC4857EEBBF4AB88324F14842AD459A7241DB789985CBA5

Function 066D1458 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 066D14D8

Memory Dump Source

Source File: 00000010.00000002.1905183911.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_66d0000_sgxIb.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: ef229f37139bbec50bc8d728b105aaef84c104a37e37eb652ee11d314770d2b9
Instruction ID: 2083b3867ce5aab76ffd5018fdd7b904dc33b588c110af399f139f8adc923445
Opcode Fuzzy Hash: ef229f37139bbec50bc8d728b105aaef84c104a37e37eb652ee11d314770d2b9
Instruction Fuzzy Hash: 192139B1D003599FCB10DFAAC880ADEFBF5FF48314F108429E559A7250C778A544CBA4

Function 066D0960 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 066D09DE

Memory Dump Source

Source File: 00000010.00000002.1905183911.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_66d0000_sgxIb.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 36af678df97474b5fdb6177badc8911bce11159937856a1d0fb0ecd23bf716f4
Instruction ID: c3f0928d5bbe8e4ed4fbd50d32bdd1137e706acfcfe7b0b5c37259d0579df826
Opcode Fuzzy Hash: 36af678df97474b5fdb6177badc8911bce11159937856a1d0fb0ecd23bf716f4
Instruction Fuzzy Hash: 6F2107B1D003098FDB50DFAAC4857EEBBF4AB88324F148429D459A7241DB78A985CFA5

Function 00B0DA48 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00B0DACF

Memory Dump Source

Source File: 00000010.00000002.1900405557.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b00000_sgxIb.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 91ba88b62a6e49315df9e61e6e0cda3ff68d529758e019b4c7807c7c92a78a63
Instruction ID: e46cfe50332960d5ba1ba409e1d08c9c7c31f07ecc33ee0d71de2acb44744a11
Opcode Fuzzy Hash: 91ba88b62a6e49315df9e61e6e0cda3ff68d529758e019b4c7807c7c92a78a63
Instruction Fuzzy Hash: 0E21E4B59002489FDB10CF9AD584ADEFFF4EB48310F14841AE914A3350D374A940CFA4

Function 066D12A6 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 066D1316

Memory Dump Source

Source File: 00000010.00000002.1905183911.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_66d0000_sgxIb.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 03191c5cf0e315363fa66a1e4529196fc1c8ebbe8ba2aaa89eb7f88fb78d15ca
Instruction ID: 0bfa40cb7fc9a96b7660fdb7729499f728bbe37e5957b9988893401e204e82e1
Opcode Fuzzy Hash: 03191c5cf0e315363fa66a1e4529196fc1c8ebbe8ba2aaa89eb7f88fb78d15ca
Instruction Fuzzy Hash: B81137719002499FCB10DFAAC845BDEFFF5EF88324F108429E559A7250C7759945CFA4

Function 066D12A8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 066D1316

Memory Dump Source

Source File: 00000010.00000002.1905183911.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_66d0000_sgxIb.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 01af7966a9ad65c00e0206eaa66642cbcbde6a5a0f47aa2f3c09ee0c92f0fff9
Instruction ID: e2d14ed7ade029a0432e0034af3d7061d9b7585778c64a3e0df3ee9b31c46f51
Opcode Fuzzy Hash: 01af7966a9ad65c00e0206eaa66642cbcbde6a5a0f47aa2f3c09ee0c92f0fff9
Instruction Fuzzy Hash: 801137719002499FCB10DFAAC844BDEFFF5EF88324F108419E559A7250C775A944CFA4

Function 066D08AB Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 066D0912

Memory Dump Source

Source File: 00000010.00000002.1905183911.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_66d0000_sgxIb.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e8336868ed87203dd108c761ed70316f7b11256efc0e059b473411ef91d59aad
Instruction ID: 80780187dcf2a5499cba04be66ddc65b8e60fb018dafc9efea68f090af311ef3
Opcode Fuzzy Hash: e8336868ed87203dd108c761ed70316f7b11256efc0e059b473411ef91d59aad
Instruction Fuzzy Hash: C6116AB1D002488FDB20DFAAC4457DFFBF4EB88324F208429D459A7240C738A945CFA4

Function 066D4FE8 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 066D504D

Memory Dump Source

Source File: 00000010.00000002.1905183911.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_66d0000_sgxIb.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 84914feb3920d09688e8c006facf1851dd4bc5316bb6d40579b1440ee717f839
Instruction ID: d7c1df8a9ff240d42a079bc991cc31833d7e8e7d435d6b11951381f3fa823e98
Opcode Fuzzy Hash: 84914feb3920d09688e8c006facf1851dd4bc5316bb6d40579b1440ee717f839
Instruction Fuzzy Hash: BB1122B58003489FCB10DF9AC884BDEFBF8EB48324F208419E419A7600C375AA84CFE0

Function 066D08B0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 066D0912

Memory Dump Source

Source File: 00000010.00000002.1905183911.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_66d0000_sgxIb.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: fc64ebfde10d740772554da8cf5c6237939d470c638fea6420401c847210864c
Instruction ID: af3812b8f61d3396e932c29637a533750f42d3a38262f5f370fc698fe82c5e18
Opcode Fuzzy Hash: fc64ebfde10d740772554da8cf5c6237939d470c638fea6420401c847210864c
Instruction Fuzzy Hash: 3F1136B1D003498FDB20DFAAC4457EEFBF5EB88324F208429D459A7250CB79A944CFA5

Function 00B0B358 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00B0B3BE

Memory Dump Source

Source File: 00000010.00000002.1900405557.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b00000_sgxIb.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 767c47a9d6ec5103dda248aebb7cd0a680ca52017b7da93ce953d8a22138760b
Instruction ID: f89029439b8e511b359d411d70e5f92388395eff39b990002db1dff30c8f51af
Opcode Fuzzy Hash: 767c47a9d6ec5103dda248aebb7cd0a680ca52017b7da93ce953d8a22138760b
Instruction Fuzzy Hash: 5A111DB6D003498FCB10CF9AD444ADEFBF4EF88324F20846AD829A7650C379A545CFA5

Function 066D3264 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 066D504D

Memory Dump Source

Source File: 00000010.00000002.1905183911.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_66d0000_sgxIb.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 82f1da9519ecfdab7dc6dadc6196054690192b6a9fd73c697e7aeeb4e9e863d8
Instruction ID: 985d5ca148c7f94010e51167c57d18872db344e8a2d4bbede063701c2f2e47c6
Opcode Fuzzy Hash: 82f1da9519ecfdab7dc6dadc6196054690192b6a9fd73c697e7aeeb4e9e863d8
Instruction Fuzzy Hash: 8B1122B58003499FCB10DF8AD888BDEFBF8EB48324F10841AE519A7600C375A984CFE0

Function 008FD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1899995922.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_8fd000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6dcbf7e2f617dbe0f21c44888504c7a367e02c53d0358a131398d123a8c88ce
Instruction ID: 81d38c3f18896c808748cd0f65849dd7ce79ca2ae874fb1728d3e92541ca035e
Opcode Fuzzy Hash: a6dcbf7e2f617dbe0f21c44888504c7a367e02c53d0358a131398d123a8c88ce
Instruction Fuzzy Hash: 74212871500308DFDB05DF24D9C4B26BF66FBA4314F20C169DB098B256C33AE856C6A2

Function 0090D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1900066194.000000000090D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_90d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f8bbd3dcd5483465b1576fd71d509527e041848ed3490e3bb5ab18fd93f0e90
Instruction ID: 2f4e5f8aabfe0e179bdef820aca091c914aa3523fa8a972e55983fd34740c202
Opcode Fuzzy Hash: 2f8bbd3dcd5483465b1576fd71d509527e041848ed3490e3bb5ab18fd93f0e90
Instruction Fuzzy Hash: C121F271604200DFDB14DF54D984B26BBB9EB84314F20C969D84E4B296C33AD847CA61

Function 008FD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1899995922.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_8fd000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 3d9f1fd82f135ad6a210ebbcd9074f035414b35025027bde1b7d40cefd290d3d
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: CC11E472404344CFCB01CF10D5C4B26BF72FBA4314F24C2A9DA094B656C33AD456CBA1

Function 0090D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1900066194.000000000090D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_90d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: a67ce7e774ca72e6cbf9bf8d38ebb9c5baeb5c4ce108db3b91c597253b5d2226
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: B6118B75504280DFDB15CF54D5C4B16BBB2FB84314F24C6AAD8494B696C33AD84ACBA2

Function 008FD731 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1899995922.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_8fd000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 697c830f6dca68c2ad48996e31a6bc968c5db25e11a3896d37b890cd46b3b284
Instruction ID: b75fa6550b8b56350bb31a40983991f48ed06785089873d6d6b7e661c105c272
Opcode Fuzzy Hash: 697c830f6dca68c2ad48996e31a6bc968c5db25e11a3896d37b890cd46b3b284
Instruction Fuzzy Hash: D201A7711093489AE7106A35CDC4777FF99FF41324F28C569EF098E196D2799840C671

Function 008FD730 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1899995922.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_8fd000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c053176b7c9288a964957bf457b2c9b687ca1389542e8392c81508537fe4ba70
Instruction ID: c7367ee92ecc027774da2d3e7c5380171785d13c936b7d50005c4597e8f973ab
Opcode Fuzzy Hash: c053176b7c9288a964957bf457b2c9b687ca1389542e8392c81508537fe4ba70
Instruction Fuzzy Hash: EFF06272408344AAE7109A26C9C4B66FFA9EF91734F28C55AEE085E296C2799844CA71

Analysis Process: sgxIb.exePID: 8012, Parent PID: 7844COMMON

Execution Graph

Execution Coverage:	14.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	4

Executed Functions

Function 06F13580 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06F13C7F
$^q, xrefs: 06F13CA3
$^q, xrefs: 06F13C56
$^q, xrefs: 06F13C8B
$^q, xrefs: 06F13CAF
$^q, xrefs: 06F13C62

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 63cd287647a087a48b4fa74859ded6ef90a92933fe2cf5549929797f8c352583
Instruction ID: 46b3f1ca4c8d24d81504996c9201ad723ea5e86a81de7271ffb63f5f4a5bd3fb
Opcode Fuzzy Hash: 63cd287647a087a48b4fa74859ded6ef90a92933fe2cf5549929797f8c352583
Instruction Fuzzy Hash: CE320D31E1071ACFCB54EF79D89459DB7B6FF89300F10C6A9D409AB264EB30A985CB81

Function 06F10040 Relevance: 2.0, Instructions: 1977COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e46b1ad34af453dd6243d27d46564a2b06487575262bd442db4ab4091b684a16
Instruction ID: 4845eecbc6ac2bec36db6e00d7a5342e6895a6474988ca5974f8c29546784081
Opcode Fuzzy Hash: e46b1ad34af453dd6243d27d46564a2b06487575262bd442db4ab4091b684a16
Instruction Fuzzy Hash: 0423EA31D10B198ECB15EB68C8905ADF7B1FF99300F15D79AE458BB221EB70AAC5CB41

Function 06F10006 Relevance: 2.0, Instructions: 1977COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c653aa963508afa4a38e005a3f3c9c1eaec671d5ae431cf4706cf44329750a
Instruction ID: c5a3705d2affb91e2c95b21a6c21d03ebf1ef636f7aec9be3156f67ee2b80798
Opcode Fuzzy Hash: 11c653aa963508afa4a38e005a3f3c9c1eaec671d5ae431cf4706cf44329750a
Instruction Fuzzy Hash: E823E931D10B198ECB15EB68C8905ADF7B1FF99300F15D79AE458BB221EB70AAC5CB41

Function 06F1ADE8 Relevance: 10.4, Strings: 8, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06F1AFB4
$^q, xrefs: 06F1AFC0
$^q, xrefs: 06F1AF09
$^q, xrefs: 06F1AF8B
$^q, xrefs: 06F1AF68
$^q, xrefs: 06F1AF15
$^q, xrefs: 06F1AF97
$^q, xrefs: 06F1AF5C

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 76d8b1ff3c82f0a6ed00949840d73bafe3a921b6a1b10a298ee60a16348357b7
Instruction ID: 9949f73b68d4ffae17a31c91a8a65c7f6201b619682bb66f1889be47cebeeb0e
Opcode Fuzzy Hash: 76d8b1ff3c82f0a6ed00949840d73bafe3a921b6a1b10a298ee60a16348357b7
Instruction Fuzzy Hash: 64E16B30E0130ACFDB69DF69D5946AEB7B2FB84340F108529D419AF354DB35DC868B81

Function 06F19268 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06F19313
$^q, xrefs: 06F192E4
$^q, xrefs: 06F192D8
$^q, xrefs: 06F1931F

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: c0275a9f343bc58315396f4e6bd9198bf2a43f19543b654446d2b2272e88adc5
Instruction ID: d58490889236255b99ca247dca6e5aa75ab428ea0a7935027b37aa697ffca3f8
Opcode Fuzzy Hash: c0275a9f343bc58315396f4e6bd9198bf2a43f19543b654446d2b2272e88adc5
Instruction Fuzzy Hash: 0F914E30F0020A9FDB54DB69D9607AEB3F6EBC9244F108569C409EB394EB74DD868F91

Function 06F1D070 Relevance: 4.6, Strings: 3, Instructions: 802
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06F1D467
$^q, xrefs: 06F1D46F
$^q, xrefs: 06F1D47B

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q
API String ID: 0-831282457
Opcode ID: 9c381caccf10efe06633e144a97acefd1290683ec895df0044e0c1534e0e4c4b
Instruction ID: 077f133a44631220cb2a3e0003e7fbf2b197bb7830f1b1c72c71488ffcaa48cf
Opcode Fuzzy Hash: 9c381caccf10efe06633e144a97acefd1290683ec895df0044e0c1534e0e4c4b
Instruction Fuzzy Hash: 21624130A002068FCB55EF69D590A5DBBF2FF84354F108A69D4099F369DB75ED8ACB80

Function 06F14C80 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Ocq, xrefs: 06F14E5B
XPcq, xrefs: 06F14DD1
fcq, xrefs: 06F14CAB

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: f4ed9b10f2a4c39463f6877633bdccab53d7a771d4481ac6a4c034ef0325cccb
Instruction ID: 3d32d4191a3020fa0099b0f0e23bf7937a68f05b1802d486000bfa34af108c84
Opcode Fuzzy Hash: f4ed9b10f2a4c39463f6877633bdccab53d7a771d4481ac6a4c034ef0325cccb
Instruction Fuzzy Hash: 14619D30F002099FEB55DFA9C8547AEBBF6FBC8750F208429D10AAB394DB758D458B91

Function 06F18190 Relevance: 2.7, Strings: 2, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06F1843F
$^q, xrefs: 06F18433

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 90a49d21e423748856d0c01fd1fc86d09b04114c36087b672a68c735dce09f3b
Instruction ID: ba7121169cc946f14a579be2851c97309228873e9cc8327a7669d0bc2ca86ae6
Opcode Fuzzy Hash: 90a49d21e423748856d0c01fd1fc86d09b04114c36087b672a68c735dce09f3b
Instruction Fuzzy Hash: 1D91AC31F002068FDB54DB79EA5066EB3E6FF84284F148428D81ADB394DF75EC868B81

Function 06F008D9 Relevance: 2.7, Strings: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 06F00AB2
(&^q, xrefs: 06F009F3

Memory Dump Source

Source File: 00000016.00000002.1975407526.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f00000_sgxIb.jbxd

Similarity

API ID:
String ID: (&^q$(bq
API String ID: 0-1294341849
Opcode ID: e938070a07280e2b161aa8749fec924ef5a3b08120361ce236b985a2b867f2e9
Instruction ID: 155dcecab276a7dde4d4e6ca9608d5b047daf6399468f729dae32aa308d82abb
Opcode Fuzzy Hash: e938070a07280e2b161aa8749fec924ef5a3b08120361ce236b985a2b867f2e9
Instruction Fuzzy Hash: 38517F31F002198FDB55EFB9C85069EBBF2AF84740F248569D405AB384DE34AD46CB91

Function 06F19267 Relevance: 2.7, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06F19313
$^q, xrefs: 06F192D8

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 19f1f6447fedbce45d932fcc3c147a49ecf517b3a4eb5a7e02ea8958ccbaa17d
Instruction ID: e2e62ef5bf544636250c3eeeec81cf06dad2258acb90f048bb9294990dd40ba1
Opcode Fuzzy Hash: 19f1f6447fedbce45d932fcc3c147a49ecf517b3a4eb5a7e02ea8958ccbaa17d
Instruction Fuzzy Hash: 7F514F70B00206DFDF54DB68E9A076EB3FAEBC8644F108469C409DB394DA74DC428B95

Function 06F14C7B Relevance: 2.6, Strings: 2, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPcq, xrefs: 06F14DD1
fcq, xrefs: 06F14CAB

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: fcq$XPcq
API String ID: 0-936005338
Opcode ID: 77bd25fa12c75d9a6a9a2d747896879663a5bbddcb7f5be4f550185fa95ac612
Instruction ID: 3b68fa1e89031d714a174cbb0cba3e2c3f3e8d8c8346974cd760af0f81244aae
Opcode Fuzzy Hash: 77bd25fa12c75d9a6a9a2d747896879663a5bbddcb7f5be4f550185fa95ac612
Instruction Fuzzy Hash: 26517F30F002199FEB55DFB9C854BAEBAE6FBC8710F208529D106AF395DA758C018B91

Function 06F159D8 Relevance: 1.6, Strings: 1, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06F15A03

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 099326586df2d6cb92efd3c09a96c2cdc9a294232d54e36159b1fb9e5a55b02e
Instruction ID: 46d54e28331b9813869e2192194632736c8bc442715f92fad4aadd5cdce968e0
Opcode Fuzzy Hash: 099326586df2d6cb92efd3c09a96c2cdc9a294232d54e36159b1fb9e5a55b02e
Instruction Fuzzy Hash: BFC1A975F002198FDB54EFA4C49869EB7F6FF88364F208469D806AB354DA31DD42CB91

Function 0302EE21 Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0302EEBF

Memory Dump Source

Source File: 00000016.00000002.1960997574.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_3020000_sgxIb.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: d7a3897c9995bce0023dc20ee3042eb56363ba005898c097353ad8fe6f97fae7
Instruction ID: 4cd0cb0233666440e9fb8027f0a96d0ccc0ceff2a7fc99fcc743727a869197d4
Opcode Fuzzy Hash: d7a3897c9995bce0023dc20ee3042eb56363ba005898c097353ad8fe6f97fae7
Instruction Fuzzy Hash: CF2178B1C006698FDB10DFAAD4447DEBBF5EF48320F148A6AD458A7290D7789981CBA1

Function 0302EE58 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0302EEBF

Memory Dump Source

Source File: 00000016.00000002.1960997574.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_3020000_sgxIb.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: a41e5872f8cbeb975674f727eefed502c9d582a696d4b0e088e5e85aac994cdc
Instruction ID: 83c7942ecdaa0aabd2be333466f5a1b14b3e56333d1678ae235290cf84f42cca
Opcode Fuzzy Hash: a41e5872f8cbeb975674f727eefed502c9d582a696d4b0e088e5e85aac994cdc
Instruction Fuzzy Hash: DD11F0B1C006699BCB10DF9AC544BDEFBF4AF48320F14816AD858B7251D778A944CFA5

Function 06F159D7 Relevance: 1.5, Strings: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06F15A03

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: fd761be782946720f12f110c1cd7e85bc8e82e647316b96052995f67d4425dc8
Instruction ID: 664d5e00f12181662cbb85d1008e27b79867052ba87701158d2638154b42dfd1
Opcode Fuzzy Hash: fd761be782946720f12f110c1cd7e85bc8e82e647316b96052995f67d4425dc8
Instruction Fuzzy Hash: D5815775E002199FDB05DFA4C994ADEBBF2BF88724F208169D406BB354DA31AD42CB91

Function 06F159CF Relevance: 1.4, Strings: 1, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06F15A03

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: a809bd6f61669f2e957867c8b3a41e331debad93eb5d4b0a5501d4e656535175
Instruction ID: 76f3613b7f0248149db89ff701d7623b3b3d51e4f09d7d5575c69169b5d0a7ba
Opcode Fuzzy Hash: a809bd6f61669f2e957867c8b3a41e331debad93eb5d4b0a5501d4e656535175
Instruction Fuzzy Hash: 1F715975E002199FDB05DFA4C954ADEBBF2BF88724F208169D405BB394DB31AD42CB91

Function 06F00108 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06F00254

Memory Dump Source

Source File: 00000016.00000002.1975407526.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f00000_sgxIb.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: d4b8ae742e600933926827bc4bdb1bbddf58d41e121d936616ad9a8ec7f2a30e
Instruction ID: 80581e1d3826d5766a0ba338d7f61be4511e243dd717afeace9c28cc9f813929
Opcode Fuzzy Hash: d4b8ae742e600933926827bc4bdb1bbddf58d41e121d936616ad9a8ec7f2a30e
Instruction Fuzzy Hash: 1241C031F102058FEF956AB494647AE77A2EBC8224F24486AD406EB3C4EE34DD82D791

Function 06F1DBE5 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06F1DD41

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: a2a969f3dabca2d2bcd73eff19d293277ee834f20c6e19eb9d37a2d7f2e7eb99
Instruction ID: 7a4d570d4245304ca11c293e750313f6e22923ed02a9ef23a8669fef4df1b227
Opcode Fuzzy Hash: a2a969f3dabca2d2bcd73eff19d293277ee834f20c6e19eb9d37a2d7f2e7eb99
Instruction Fuzzy Hash: CE419F71E0030A9FDB65DF65C89469EBBB2FF85280F144929D405EB240DB75E946CB81

Function 06F121BD Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06F1230B

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 7c80778be5f3a02835f01f24628a0e025cfd5e4a910371de24641b9c3f267c19
Instruction ID: 5d8d65263541c2372f91bd1d07ac9d1cad45fde7473cca551fba83354bb577a4
Opcode Fuzzy Hash: 7c80778be5f3a02835f01f24628a0e025cfd5e4a910371de24641b9c3f267c19
Instruction Fuzzy Hash: E641E230F042419FDB559BB4C52866E7BE2EF89290F144568D406DF395DF35CE82CBA1

Function 06F02661 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06F02772

Memory Dump Source

Source File: 00000016.00000002.1975407526.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f00000_sgxIb.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 2ad898565ce31f03c7dfa0f4a95ee183661cc63c5f02626cdfff9fb8f2602a67
Instruction ID: 881fe608e36b2d485c934070f4cf3f86726c335275d1a002a7b0a6bc989c71f0
Opcode Fuzzy Hash: 2ad898565ce31f03c7dfa0f4a95ee183661cc63c5f02626cdfff9fb8f2602a67
Instruction Fuzzy Hash: 7B311231F002058FEB55AB74D95826EBBE2EBC9214F208868D406DB394DF35DE46DBA1

Function 06F1DBF1 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06F1DD41

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 6f95350b47ccc526d5293b29769673f95e0d52b460a88d69cb4c2733d4897177
Instruction ID: 839d1f4422aa295fa643966229625a06073289b937e573578c9bcc50770dc8d7
Opcode Fuzzy Hash: 6f95350b47ccc526d5293b29769673f95e0d52b460a88d69cb4c2733d4897177
Instruction Fuzzy Hash: 7141C030E0060A9FDF65DFA5C49469EFBB2FF85340F144929E805EB240DBB0E946CB81

Function 06F121D0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06F1230B

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: cbb9adc8dd409311aa887dc3832c66543e6533712919f48ec238353c5e2c59d1
Instruction ID: 3859850efd6f4a977af29a847576cc880aa6ff9c9b72c41abff3e1b6e18efdfd
Opcode Fuzzy Hash: cbb9adc8dd409311aa887dc3832c66543e6533712919f48ec238353c5e2c59d1
Instruction Fuzzy Hash: B131D230F002018FDB599BB4D52866E7BE2AB89250F148828D406DF394DF35DE86CBA1

Function 06F183E8 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$^q, xrefs: 06F18433

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: fd33d1a95cd2e4a4d97e52189febba42ac546be74c417c89e3aadd45d800d8ef
Instruction ID: 5280b2bba85ed6463c1935a364754b8358512e37c27f4b29624ee69756dad13c
Opcode Fuzzy Hash: fd33d1a95cd2e4a4d97e52189febba42ac546be74c417c89e3aadd45d800d8ef
Instruction Fuzzy Hash: C6F08C36F00215DFEFA48A59FB802A877ADFB802D0F144466D914CF265CF76D946CB91

Function 06F14B69 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Ocq, xrefs: 06F14B75

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: \Ocq
API String ID: 0-2995510325
Opcode ID: ee5d839b8195d7f7a9fb87b348d52a95afe505d6640d7f44346ffa64351d35ff
Instruction ID: 936bfcc6595c56835d779193148c6c52d3806a9ba4e6c5707f8f5b5d649835ff
Opcode Fuzzy Hash: ee5d839b8195d7f7a9fb87b348d52a95afe505d6640d7f44346ffa64351d35ff
Instruction Fuzzy Hash: 65F0B730E10129DFDB14DF94E9697AEBBF2FF88744F204519E402AB294CB741D01CB80

Function 06F1B3E7 Relevance: .6, Instructions: 560COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9656151070d9f8a10a8ee6f40534208097d3a7d59d804788cf65045cc119e91
Instruction ID: 7258ca97dbe0374c21ee414e77a57186f2ed907d4d08df0c7e3d47cea4bf2e0e
Opcode Fuzzy Hash: c9656151070d9f8a10a8ee6f40534208097d3a7d59d804788cf65045cc119e91
Instruction Fuzzy Hash: 53224B30E10209CFEF64CB68D5947ADB7B6EB85350F248866E409EF395DA35DC828B51

Function 06F16E30 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 359a2463cceba3bac208226dcf80fcea7e98f17a30328821d9c60becd013b35a
Instruction ID: 7f6d7558be7e1dd76ec946a800b6b8c6f7edba91d2dc907897abfe84f9130472
Opcode Fuzzy Hash: 359a2463cceba3bac208226dcf80fcea7e98f17a30328821d9c60becd013b35a
Instruction Fuzzy Hash: ACA16930A00205CFCB64EB68D594A5EB7F2FB84394F548569E81AAF361DB35ED85CB80

Function 06F156B0 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f7d0fc298063f6db418808ff135ff655543216489cc0195f010826aff9a8d8d
Instruction ID: be301f5998be325667f96cb8998a951e2c9b73b18c77e13810b6d5a273e9df60
Opcode Fuzzy Hash: 3f7d0fc298063f6db418808ff135ff655543216489cc0195f010826aff9a8d8d
Instruction Fuzzy Hash: 3191D1F1E142198FDF708A69C49036EBBA2EBC5370F14897AD4ADDF285C635D841CB91

Function 06F16308 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6b60354ee378dc1e79c387431a552fccab51b3ff4c74655c8920be0437702c9
Instruction ID: 38751b0198c500d944b2512847fa611173e455fc6917b2a20ac0563d8c6432ba
Opcode Fuzzy Hash: c6b60354ee378dc1e79c387431a552fccab51b3ff4c74655c8920be0437702c9
Instruction Fuzzy Hash: 8561C071F001214FDB559A7EC88466FBAD7AFC4620B25443AD80EDB364DE66ED0387D2

Function 06F143C7 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 570e334142b3b75210fa2c87f28bc3859a9142572aec55d2b876036a4846cbf2
Instruction ID: f9e49bf422641bb1d8623170980e8ab62cc1db6553d0873e97cc21913cb89afc
Opcode Fuzzy Hash: 570e334142b3b75210fa2c87f28bc3859a9142572aec55d2b876036a4846cbf2
Instruction Fuzzy Hash: 4D812B70F0020A9FDF44DFA9D55466EB7F6ABC9344F108529D40ADB394EB35EC828B91

Function 06F146D4 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 154d787c202e0427614a686970003b46fee1fffc36e754333714409630185321
Instruction ID: 636e2e57ac038500736cedd547ac684a0aa851e5fe81ff591c6aba7cab0d3b81
Opcode Fuzzy Hash: 154d787c202e0427614a686970003b46fee1fffc36e754333714409630185321
Instruction Fuzzy Hash: 6F914D34E1021A8FDF60DF68C890B9DB7B1FF89310F208599D549AB255EB70AA85CF91

Function 06F146E8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e3f5388f3c56cf9060c8c73a4ba8f0f89eeea05467f8ab0334631bc4c347cc7
Instruction ID: bb263bbe40ddfa8ca81ef0080ca54553be5d53b15555c1ce08aa8aa85d1c07cd
Opcode Fuzzy Hash: 9e3f5388f3c56cf9060c8c73a4ba8f0f89eeea05467f8ab0334631bc4c347cc7
Instruction Fuzzy Hash: 9E915D34E1021A8BDF60DF68C890B9DB7B1FF89310F208599D549BB355EB70AA85CF91

Function 06F01209 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975407526.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f00000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42957f9f83fa62070ce1c34bb7394b2447852b25c7bf5e49c929be9450fd20b
Instruction ID: caae8d3ec039b4a35da6c1cd334d6671544fe962829fdc2fa90a44a2b354f3b0
Opcode Fuzzy Hash: b42957f9f83fa62070ce1c34bb7394b2447852b25c7bf5e49c929be9450fd20b
Instruction Fuzzy Hash: B1819C30E002199FEF65DBA4C890BAEBBB6FB85310F104969D509EB2D0CB34DD45DB92

Function 06F1F048 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b23d7a11f7abaf261a48268803643aea5068f03dd691ddc8af871f9b3c86f2f
Instruction ID: 53bcda0690352e1a14bfda7066c5d637741c53360566f998a20ed9e5ed4619ee
Opcode Fuzzy Hash: 8b23d7a11f7abaf261a48268803643aea5068f03dd691ddc8af871f9b3c86f2f
Instruction Fuzzy Hash: 07714874A012499FDB44DFA9D990A9EBBF6FF88350F248429D409EB364DB30EC46CB50

Function 06F1F041 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ccc58eb60c972c579c6686f0e8e4d4b0d13ba7478f3126d206cbbed46fd7f8b
Instruction ID: 35d3ff4b25f43303c972758d531c59fdbe1b38d5fe2a89e665796b4401a606e3
Opcode Fuzzy Hash: 5ccc58eb60c972c579c6686f0e8e4d4b0d13ba7478f3126d206cbbed46fd7f8b
Instruction Fuzzy Hash: BE714774E012099FDB44DBA9D990A9EBBF6FF88310F248529D419EB364DB30ED46CB40

Function 06F01500 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975407526.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f00000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f90757595b84d4fcf8d10efcad1c79f794cef0db093891dc9fbeea84cdb8274a
Instruction ID: 94b83d5ef8b3ff8b4d8460a13f38c5beac59a351a163185c8f6458499ad02e38
Opcode Fuzzy Hash: f90757595b84d4fcf8d10efcad1c79f794cef0db093891dc9fbeea84cdb8274a
Instruction Fuzzy Hash: 55519F75E002159FDBA0DFA9C8807AEBBF5FB89320F148529D81AEB390C734D941CB90

Function 06F1FA78 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ea0d5193ceb8370450deeba237ef9afc2032e8d9e04a96bdd93b2aad2380816
Instruction ID: 61b822d57d701770c73f4da8aeed07cbf5d78bc8d1536ae93b443a3a3e12eeef
Opcode Fuzzy Hash: 5ea0d5193ceb8370450deeba237ef9afc2032e8d9e04a96bdd93b2aad2380816
Instruction Fuzzy Hash: 4551E770F212059FEF64A67CD95473F269ED7C9360F20482AE40ADB395C96DCC8687E2

Function 06F02831 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975407526.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f00000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b228cc172dbb8a4c917cd5ef9557b1b2ba58a35d481dd9613ce92b790851d4
Instruction ID: 5fe3338e48b036dce35be51efe0c4b0a8bfc2405610552d7f009dd2ba5968263
Opcode Fuzzy Hash: f3b228cc172dbb8a4c917cd5ef9557b1b2ba58a35d481dd9613ce92b790851d4
Instruction Fuzzy Hash: 6251AE74B103058FDB55EF75D9906AEBBE3FFC8200B208529D406A7394DF34AD8A9B91

Function 06F1FCD5 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8db3e9b7908bdfe3a5ceb544f2afe00591b80aba5489c8f47625d008f3196b9
Instruction ID: 65226428e760865bb07e90e98446c16f90f1f3315fdaa34567b9923264d54e68
Opcode Fuzzy Hash: e8db3e9b7908bdfe3a5ceb544f2afe00591b80aba5489c8f47625d008f3196b9
Instruction Fuzzy Hash: A2510231E02105CFCF64AB78E4542ADBBF2FB84364F108879E11ADB251DB358A45CB81

Function 06F1FA88 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb54b1820cd1253e39383b9764659195807c6290cde99c61151684fe2754172c
Instruction ID: fe69e9485010cf574f625dafcfaec3255e4e77613795c5cc0a5e76405aeff50a
Opcode Fuzzy Hash: fb54b1820cd1253e39383b9764659195807c6290cde99c61151684fe2754172c
Instruction Fuzzy Hash: 4251F870F212059FEF64A66CD95472F269ED7C9360F204829E40ADB3D4C96DCC8647D2

Function 06F1C908 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ede54da0c85d0085f187c45cc5b3a2ef14c5f9790779e1c6f9861cc7afd867f3
Instruction ID: 3f35db6390b5caebf79278bb398fbd4d7f148dc8a7f3184f623eeaae94f12cb8
Opcode Fuzzy Hash: ede54da0c85d0085f187c45cc5b3a2ef14c5f9790779e1c6f9861cc7afd867f3
Instruction Fuzzy Hash: 12517E35B112188FCB45EB79E990A9EBBF2FB88354B108569D405EF354DB35EC86CB80

Function 06F0244D Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975407526.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f00000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb4e5acac0bef263eae7e4859bff8571b7766fd729d94412883c075f43630f6f
Instruction ID: bb5c9f95c06c54a6680b43e842d1f13f01da05624c7332898eaed898636a263a
Opcode Fuzzy Hash: bb4e5acac0bef263eae7e4859bff8571b7766fd729d94412883c075f43630f6f
Instruction Fuzzy Hash: 26519E30E0020A9FEB54DFA4C59865EB7F2FF85304F248529D80A9B395DB70ED86CB91

Function 06F02450 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975407526.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f00000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 949cd6dfef41f9016ac4a1fa642af1733d1e7fef236f133995c70ee94a3a74a2
Instruction ID: a5d22a91dcb12f289cd965fae2a32ed704a492c03c7f372680bb988c476cb8b8
Opcode Fuzzy Hash: 949cd6dfef41f9016ac4a1fa642af1733d1e7fef236f133995c70ee94a3a74a2
Instruction Fuzzy Hash: D3519D30E0020A9FEB54DFA4C59865EB7F2FF85304F248529D80A9B395DB70ED86CB91

Function 06F15537 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6823766b593efc2aabacfc17b9cf25f4275ee5bbd5fe93fbcf79356329c00733
Instruction ID: 2e052e0d8e388622e9a7f3f2e863cff5621080b8646fda1c91abcdeb2ed0dcdb
Opcode Fuzzy Hash: 6823766b593efc2aabacfc17b9cf25f4275ee5bbd5fe93fbcf79356329c00733
Instruction Fuzzy Hash: D2414DB1E006098FDF70CEAAD880AAFFBB2FB85354F10492AD156DB644D731E8458B90

Function 06F00FFD Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975407526.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f00000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f5b82897da06171e55b2dd23c13f76da403ef20b12d511d018289be18c5ba7a
Instruction ID: e1446840cfb550a76d7274f3ce59712111549a23113734c586ec5ce09f23f66d
Opcode Fuzzy Hash: 2f5b82897da06171e55b2dd23c13f76da403ef20b12d511d018289be18c5ba7a
Instruction Fuzzy Hash: FE318331B001055BEB54ABA98D90B9FBAE6FBC8720F208529E159EB3C4CA719C119790

Function 06F01000 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975407526.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f00000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db51dc2c942754382a66294d173d96481923b8a77656e68b5e9b6c507276792
Instruction ID: cdc2b8347a413d03114ad3fa89ffcbdf8cedb1645f99b8aaced48d468114e59d
Opcode Fuzzy Hash: 8db51dc2c942754382a66294d173d96481923b8a77656e68b5e9b6c507276792
Instruction Fuzzy Hash: F7319431F001055FEB54AFADC990B9FBAE6FBC8720F208529E159EB3C4CA719C119790

Function 06F12080 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64f5a3c04839911a4991098c7a663a8df8cba9bd92b8e2713ff6fd1eaa4700a2
Instruction ID: 78243b0899b721e3e2e565df05eb90890465abab4fa6ec532ab950ccc8cd4ae9
Opcode Fuzzy Hash: 64f5a3c04839911a4991098c7a663a8df8cba9bd92b8e2713ff6fd1eaa4700a2
Instruction Fuzzy Hash: 07318431E0060A9FCB55DFA5D85469EB7B2FF89350F108519E90AEB350DB71ED82CB50

Function 06F1DAA1 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf0b20f4f8b89da83d5b0bccc105fda33af4c902ad05e204c70cde770c86291
Instruction ID: f19ab23f48a1dbe44cfe6e3792eb9934b2a583c8529e04746ce95ea74c1deef4
Opcode Fuzzy Hash: 5bf0b20f4f8b89da83d5b0bccc105fda33af4c902ad05e204c70cde770c86291
Instruction Fuzzy Hash: 0931A230E1020A9FCF65DF69D89069EBBF2FF85354F104929E405EB354EB70E9868B80

Function 06F02AA0 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975407526.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f00000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abd506c9ea2faf5557e46e61abaadc1c65a6b7dcbbe48d8849663b5d1d7b6fec
Instruction ID: 7955a263de6d2f95f5b8e26f288d78cbdb3673553e6b88566aad693957b8d216
Opcode Fuzzy Hash: abd506c9ea2faf5557e46e61abaadc1c65a6b7dcbbe48d8849663b5d1d7b6fec
Instruction Fuzzy Hash: 6F415D74B002098FDB54DF69C598A9ABBF1FF88310F144469E4029B3B4DB75ED85DB60

Function 06F13508 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed57a9ec80ffd0777092292da222229cb1416594c063407e2dd416dbe341a6f2
Instruction ID: 6891ba7015cc9a31a66bb0629a158bb101a6976fae593d70057ec31db71cd450
Opcode Fuzzy Hash: ed57a9ec80ffd0777092292da222229cb1416594c063407e2dd416dbe341a6f2
Instruction Fuzzy Hash: 98315572D003254FC710ABBD8C008CEBBA1AF85734F1447AAC165EF2E4D9319942CBE1

Function 06F12090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04273cacbba38627d82c0664cd8d9ebc4368581928dadf68b6a5b36c774f5b33
Instruction ID: 71e269e3b65e69a9ac409311adca697494dbb84ab4831e32b6108efa31982105
Opcode Fuzzy Hash: 04273cacbba38627d82c0664cd8d9ebc4368581928dadf68b6a5b36c774f5b33
Instruction Fuzzy Hash: 7D313E31E1060A9FCB55DFA5D85469EB7B2FF89300F108529E90AEB350EB71ED86CB50

Function 06F13FD0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3ccaae41a4d6cb09b08a5283a04597ed7d11b8ee4ac117f9d2417f1a8667019
Instruction ID: 8dd318711b5e95af9a31d02c36c9a085ece639183c42458b1083e8750f007446
Opcode Fuzzy Hash: f3ccaae41a4d6cb09b08a5283a04597ed7d11b8ee4ac117f9d2417f1a8667019
Instruction Fuzzy Hash: 0F217C75F002159FDB50DF6AE944AAEBBF9EB88750F108025E905EB340EB35DD41CB91

Function 06F13FCF Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdc3c3c0a49fd462fc17a28ff8b3911d987e494c7daa11dfd2dcd2d7b3f24975
Instruction ID: 941afb2bf220fdf0932a0a7f0dc339c9cb0c39b891c7512e1ee78cd383a27329
Opcode Fuzzy Hash: fdc3c3c0a49fd462fc17a28ff8b3911d987e494c7daa11dfd2dcd2d7b3f24975
Instruction Fuzzy Hash: A2216D75F002159FDB50DF7AE944AAEBBF9EB88750F108025E905EB380EB35DD418BA1

Function 06F1B038 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d6305c7743d4f32d257c8717251e66e3d6e120a255d7a9f13964d062f3e9674
Instruction ID: 1bf8bffaaaa21472c6f3339176642019de1ed37566b03618f7e2186b8996c080
Opcode Fuzzy Hash: 4d6305c7743d4f32d257c8717251e66e3d6e120a255d7a9f13964d062f3e9674
Instruction Fuzzy Hash: D0215E71D1075ACBDF65CFA9C84069EBBB5FF85350F10492AE809EF250E7719846CB81

Function 06F16E2F Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4c608d4d16e17c46c3c88df4503744e7fa41f1be219646a24c8459886758c13
Instruction ID: 627940f2075fdad1004ec9208a280aa7430801b870b0491e90fdc7ea77c37631
Opcode Fuzzy Hash: a4c608d4d16e17c46c3c88df4503744e7fa41f1be219646a24c8459886758c13
Instruction Fuzzy Hash: FD21AF30F101099BDF94DB69E85469EBBB7EBC4390F148535E409EB340DB31ED828B85

Function 06F005E0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975407526.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f00000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e04c8e5cfbe852c1bbc3ad949baae8745c3f7a409c7d2d0548b2a454190e7b2
Instruction ID: 7b03bfce858cb1e748122510b8c9c728189a55f7d3d5a1339b5e2077d555ffe0
Opcode Fuzzy Hash: 9e04c8e5cfbe852c1bbc3ad949baae8745c3f7a409c7d2d0548b2a454190e7b2
Instruction Fuzzy Hash: 982124B1D01218DFCB50DF99D884BDEFBF4EB49320F14806AE808AB251D3749A44CFA4

Function 06F13570 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87436c064333aeb20c92ef31be7902e4a1f6f41eb0bc277ebce7ba8f2829ad7
Instruction ID: 46aac7c8a586ebab60a574eae820f97a0f187bb3eda25224e361f7dc483d6ca7
Opcode Fuzzy Hash: d87436c064333aeb20c92ef31be7902e4a1f6f41eb0bc277ebce7ba8f2829ad7
Instruction Fuzzy Hash: 75110272E002185FCF64DB79C8405DEFBB6EF89750F1445AAD406EB240EA31DA42CBE1

Function 06F140E0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e35dcd6898573bc2b990c8c5909344ab2ea1649c951a35e902eb9e1abe64e9
Instruction ID: bbd0b188466d6bd9443aada99f5ff8911a53f4118e3a441d7dfa9a1e693501d9
Opcode Fuzzy Hash: 74e35dcd6898573bc2b990c8c5909344ab2ea1649c951a35e902eb9e1abe64e9
Instruction Fuzzy Hash: 66118E32B041289FDB559668DC146AE73FBEBC8350B008439C50EEB340EE35DC028B91

Function 06F13D99 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9adb3588d92273d2669da8d0da7a13d22b5c2ae8e7b9490bd8de85e535fff49a
Instruction ID: 4c6e6c8c65547a0885bc7adc3c135283b106eda7537f3781626eaca01b4cecb4
Opcode Fuzzy Hash: 9adb3588d92273d2669da8d0da7a13d22b5c2ae8e7b9490bd8de85e535fff49a
Instruction Fuzzy Hash: 652103B5D01219AFCB00DF9AD884ACEFFB8FB49320F10812AE518B7200C374A954CFA5

Function 06F14318 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cfca82bdbd7e6da2dcd8de44d06b0a1493bdaad236cb2d3bbeac36ddb1ee997
Instruction ID: 43f0d4c750eab5e4e92a74529af7e1fbca1051f3d59887fb3b6b21bfc70f3dcd
Opcode Fuzzy Hash: 0cfca82bdbd7e6da2dcd8de44d06b0a1493bdaad236cb2d3bbeac36ddb1ee997
Instruction Fuzzy Hash: B901FD31F100111FDB6486AEA411B6FA3DBDBCA764F20883AE50ECB384D925DC0303A5

Function 06F00550 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975407526.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f00000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 997b20001844d46ce1f06689d94bea414614ac5fc011fc8c8d4a098ef0622b2f
Instruction ID: c083ad918d21f638d6f64556808144cdff63bb21eb71809d5aa340c1573f5449
Opcode Fuzzy Hash: 997b20001844d46ce1f06689d94bea414614ac5fc011fc8c8d4a098ef0622b2f
Instruction Fuzzy Hash: C31153B2800249DFDB10DF99C849BEEBFF5EB48320F148419E958A7250CB39A950DFA1

Function 06F140D1 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f8221b8afef1d28eae48f7819d8a7f77a7161e222c7793bd5423fdf444a3d45
Instruction ID: c59c6eda00156c99774c1d805df37917552ad21a95254f25d3139cf239070527
Opcode Fuzzy Hash: 4f8221b8afef1d28eae48f7819d8a7f77a7161e222c7793bd5423fdf444a3d45
Instruction Fuzzy Hash: 0601D432B141145BDB999578DC146EF32EB9BC8350F004636D41EEB280EE248C0247D1

Function 06F13DA0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c19cc5882ed53ccd5b5f8c368f76680e40a7a213b7607dc5db2718d9afaad38
Instruction ID: d87ac9ff53b9f54050fd5605d31bbfde57f6394b394c2c209c935d6abf2115eb
Opcode Fuzzy Hash: 6c19cc5882ed53ccd5b5f8c368f76680e40a7a213b7607dc5db2718d9afaad38
Instruction Fuzzy Hash: 6011B0B5D01659AFCB00DF9AD884ADEFFB4FB49320F10812AE918B7240C374A954CFA5

Function 06F14328 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f414a5e898a01b3c223406dc09046d6fa3117c456a0f4a370faddbe6cf55162a
Instruction ID: 30d9893f5927dfffacbf2b3eb24350c0210db7d6230a4c11f85ac0af03e733cc
Opcode Fuzzy Hash: f414a5e898a01b3c223406dc09046d6fa3117c456a0f4a370faddbe6cf55162a
Instruction Fuzzy Hash: 2F01DC30F100111FDB6496AEA411B2FA3DBDBCA764F20883AE50ECB394DA65DC0343A5

Function 06F1F2C8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07ddd757ec7115707329ab226aee633b6fd2860c6a4f3b4b102f8294436cc95e
Instruction ID: 88fffa3ec188d8a52a5c19093263971ab54f63d41f61356fae36ddd99b1f3448
Opcode Fuzzy Hash: 07ddd757ec7115707329ab226aee633b6fd2860c6a4f3b4b102f8294436cc95e
Instruction Fuzzy Hash: 9001FF30F100101BCB65DABDE45072FA7DADBC9624F108839E40ECB340EE21DC034396

Function 06F1A422 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523caac14452cab331e7a326a87213baaf2c4a3471a1d6ba81ec46299940d323
Instruction ID: 4dd0adbf572671eb6fe921ae43bd707feac2b08108a7e597d80620b4709df9d7
Opcode Fuzzy Hash: 523caac14452cab331e7a326a87213baaf2c4a3471a1d6ba81ec46299940d323
Instruction Fuzzy Hash: 7401AD30B01115AFDB60DA7DF858B6AB3DAFB89664F108439E10ECB360EE25DC4287C1

Function 06F1A430 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b297546c1097d5db1ecdc219bab7fd30a9983fbb3659037bc0b9875ead32e44c
Instruction ID: a2936a699cc6ce17ada55cb2b683756d8a89c586278e5b98aaaf81489417f9e4
Opcode Fuzzy Hash: b297546c1097d5db1ecdc219bab7fd30a9983fbb3659037bc0b9875ead32e44c
Instruction Fuzzy Hash: C6018130B011159FDB64D67DE45475AB3DAFB89664F108439E10ECB360DE25DC428785

Function 06F1A427 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14e6b809a7b8ded83b57c96d48e656a1d7a3b4f4e5791a44e7c5f92db4c9d0ce
Instruction ID: 56f279c0697680112e1825079042cb7d27a440066097ad33be322b7234ded2d7
Opcode Fuzzy Hash: 14e6b809a7b8ded83b57c96d48e656a1d7a3b4f4e5791a44e7c5f92db4c9d0ce
Instruction Fuzzy Hash: A5018B30B011119FDB60DA7DA45875AA7DAEB89224F108939E11ADB3A0DE25DC428781

Function 06F1C8FF Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 447b3dfe8b42fdf320acae92c20a1f9f7bdb58545efc90dab0772c641556dbaa
Instruction ID: ab41ca399c7ac3ae43d00094a8ee85fea05fbc82c571a3d82556f6ffac1868bd
Opcode Fuzzy Hash: 447b3dfe8b42fdf320acae92c20a1f9f7bdb58545efc90dab0772c641556dbaa
Instruction Fuzzy Hash: 4A012631F102249BCF54DA79EC5069EBB76FB80364F000639E811EF284DA2A9C45CBC0

Function 06F0026D Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975407526.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f00000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a69cd213fa437f3c41eaeb433d4c19043e8e046b3b118200fbf7cb2b171bfda
Instruction ID: 91c36297b6dd32d16df598065487d2718bf15154ea3aecf52d8f74d3d7319ba1
Opcode Fuzzy Hash: 2a69cd213fa437f3c41eaeb433d4c19043e8e046b3b118200fbf7cb2b171bfda
Instruction Fuzzy Hash: 69F08135B011199FDB00DBA9D840BDE77F1FB88322F148561E519A72D4C634D8118BA0

Function 06F00B28 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975407526.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f00000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddf11dfc0567400d437dfc0d7414ad6981a7c2878eb801fcf92f05d96db9122e
Instruction ID: 6e5a2ce2787324cc9ed1fbad469fd54a03cb1766251b78410841f1a91ef63432
Opcode Fuzzy Hash: ddf11dfc0567400d437dfc0d7414ad6981a7c2878eb801fcf92f05d96db9122e
Instruction Fuzzy Hash: 8AF082363002197F9F45AE999C159AF7FABFBC8360B004429FA0DD7290DB31892197A5

Function 06F16588 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b888c06bc6d8e82615bb55d8557f5cc33668630eea32e24c6d0ed471c2f6d66
Instruction ID: b0f09d1c482ad59e5f2a634b0403a41f0856f37fe531e181e903d6f74791cc0d
Opcode Fuzzy Hash: 8b888c06bc6d8e82615bb55d8557f5cc33668630eea32e24c6d0ed471c2f6d66
Instruction Fuzzy Hash: 8BE092B1D15248AFDF60CA78CD0579A7BA99B06244F1144A6D804DF24BE175CE018792

Function 06F00348 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975407526.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f00000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2898320219df3c1182aeab215189d6953e411df2ecbb36bedb785bddfd084a6
Instruction ID: a2d5d3c3dae2bf7aca79ee5b26bec24cd8b52dae81cb27dd12cdd81e7cede26b
Opcode Fuzzy Hash: c2898320219df3c1182aeab215189d6953e411df2ecbb36bedb785bddfd084a6
Instruction Fuzzy Hash: 35E04FB2E003199FAB90DFBA9D016AE7BF9EB49650F108475D909E3240FA71C6009BD1

Function 06F02A2B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1975407526.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f00000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7a68a8a01b5c4d92d246bc8f27fdf0baac86b9df0d82260f1bc68d40d7dbd7
Instruction ID: 3bb5e544bdeb5aa912f7b27a53ea625a3ba3c72caf90c28af91170be52c08128
Opcode Fuzzy Hash: dc7a68a8a01b5c4d92d246bc8f27fdf0baac86b9df0d82260f1bc68d40d7dbd7
Instruction Fuzzy Hash: B0E0C23AF102319F2EA0E66964A41ADB781E7C816432041A6CA19CB244DE268E0347D1

Non-executed Functions

Function 06F177B8 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 06F178B4
$^q, xrefs: 06F178E5
$^q, xrefs: 06F17C71
$^q, xrefs: 06F17D10
$^q, xrefs: 06F17D26
$^q, xrefs: 06F178D9
$^q, xrefs: 06F17C65
$^q, xrefs: 06F17D04
$^q, xrefs: 06F17D1A
$^q, xrefs: 06F178A8

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: 53cce3fef84aa084743ebe8d93106039c171635186f682b70500afc9e668f873
Instruction ID: 10da2f8d95051102de76db03fcf973bb873d3e5e84957494bdf82674e08e4a48
Opcode Fuzzy Hash: 53cce3fef84aa084743ebe8d93106039c171635186f682b70500afc9e668f873
Instruction Fuzzy Hash: E2120D30E002198FDB68EF69D954A9EB7F6BF88344F2085A9D409AF354DB319D85CB81

Function 06F1AA50 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 06F1AB52
$^q, xrefs: 06F1AC0E
$^q, xrefs: 06F1ABAD
$^q, xrefs: 06F1ABA1
$^q, xrefs: 06F1ABCC
$^q, xrefs: 06F1ABD8
$^q, xrefs: 06F1AC02
$^q, xrefs: 06F1AB46

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 593036de47e32530b2ef7c0682ffbf0eaf4807d18051bc620674a685ba970263
Instruction ID: c2c5dcfb4a83050df027d805ce0c5f847905a723390ea336003fcd693b396ba8
Opcode Fuzzy Hash: 593036de47e32530b2ef7c0682ffbf0eaf4807d18051bc620674a685ba970263
Instruction Fuzzy Hash: EA913C30E02309DFEB68DB69D558BAEBBB2EF84341F108529D8019F294DB759D85CB90

Function 06F171B8 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$^q, xrefs: 06F1749A
$^q, xrefs: 06F176CC
$^q, xrefs: 06F17500
$^q, xrefs: 06F176C0
$^q, xrefs: 06F174F4
$^q, xrefs: 06F17654
.5vq, xrefs: 06F17213

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: 2f12a5b46d16c386cb8c2fad4e092a1d7841e9e6b0a51fb0fd6376eb47006986
Instruction ID: e9b9f65f5525ff676888482007f298407c6036771c473921c89533f254779a41
Opcode Fuzzy Hash: 2f12a5b46d16c386cb8c2fad4e092a1d7841e9e6b0a51fb0fd6376eb47006986
Instruction Fuzzy Hash: 63F14A34B01309CFDB58EB69D594A6EBBB6FF84340F208569D4099F368CB359C86CB81

Function 06F1BB30 Relevance: 7.7, Strings: 6, Instructions: 197COMMON

Download Yara Rule

Strings

$^q, xrefs: 06F1BCC9
$^q, xrefs: 06F1BCFD
$^q, xrefs: 06F1BD31
$^q, xrefs: 06F1BCD5
$^q, xrefs: 06F1BD3D
$^q, xrefs: 06F1BD09

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: d9bf76219fcdb0789fcc030480097fc60d95caf9a39d8ddfa5ae88759e8375b7
Instruction ID: 632d7176c2d3b8c68b7fb63b0aba0b21ba3c51cd1ae26b626c72352aeeaa0648
Opcode Fuzzy Hash: d9bf76219fcdb0789fcc030480097fc60d95caf9a39d8ddfa5ae88759e8375b7
Instruction Fuzzy Hash: 5A716A31E0020ACFDBA8DFA9D5546AEB7F2FF84350B108969D40ADF294DB719D46CB81

Function 06F184F0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 06F187BB
$^q, xrefs: 06F18756
$^q, xrefs: 06F1874A
$^q, xrefs: 06F187AF

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 31bc43511d43985c457d13a9f2e64b7b58b4b28bdf77d79f7bf7bebb36a0a08d
Instruction ID: a379a67725928edc5e3de10043c467ad6c272fe28c2c653ac34a96be490d3190
Opcode Fuzzy Hash: 31bc43511d43985c457d13a9f2e64b7b58b4b28bdf77d79f7bf7bebb36a0a08d
Instruction Fuzzy Hash: D2B12730F012198FDB54EB69D69469EBBB2FF84390F248929D4169F394DB35DC86CB80

Function 06F18908 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR^q, xrefs: 06F18A4A
$^q, xrefs: 06F18993
$^q, xrefs: 06F18987
LR^q, xrefs: 06F189FB

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: 03a4274c2ee41426b55c9bd86a94b44c8a9774bc253ddccc540daf0fcbbd9c7b
Instruction ID: 94977e64d6976a39996750d83f83b0d3332d7c5992a72ca115ae3977c1845a1d
Opcode Fuzzy Hash: 03a4274c2ee41426b55c9bd86a94b44c8a9774bc253ddccc540daf0fcbbd9c7b
Instruction Fuzzy Hash: 0151E530B002029FDB54DB28DA94A6E77E6FF88780F148569D415DF3A9DB35EC41CB91

Function 06F1ADD8 Relevance: 5.2, Strings: 4, Instructions: 167COMMON

Download Yara Rule

Strings

$^q, xrefs: 06F1AFB4
$^q, xrefs: 06F1AF09
$^q, xrefs: 06F1AF8B
$^q, xrefs: 06F1AF5C

Memory Dump Source

Source File: 00000016.00000002.1975544177.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6f10000_sgxIb.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: bac9412e43d400d3db169d08810434f34a708ec975d9cb4c7838e730eba55194
Instruction ID: 3f9fff95929da9b5a66f5902d6daaad2b5fe92b15a6a9fabf67e0bc78b97716f
Opcode Fuzzy Hash: bac9412e43d400d3db169d08810434f34a708ec975d9cb4c7838e730eba55194
Instruction Fuzzy Hash: 4851BD34F12304DFCBA5DA68E5806AEB7B2EB88390F10852AD415DF354DB31DC86CB90

Analysis Process: sgxIb.exePID: 7096, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	11.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	291
Total number of Limit Nodes:	16

Executed Functions

Function 05421D31 Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05421EE2

Memory Dump Source

Source File: 00000019.00000002.1987546993.0000000005420000.00000040.00000800.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_5420000_sgxIb.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 4a207d1a3bca50bd5a3a6ea520dbe18e8b82517d6576c0233e8ad475ba2d3aa0
Instruction ID: c6dae0d20d49a7d4b89ec538be3c1e895da484c51688e62feb66c89b343281ea
Opcode Fuzzy Hash: 4a207d1a3bca50bd5a3a6ea520dbe18e8b82517d6576c0233e8ad475ba2d3aa0
Instruction Fuzzy Hash: F06112B2C00259EFDF01CFA9C980ADEBFB2BF48350F15916AE818AB260D7759945CF50

Function 0727095A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNELBASE(?,00000000), ref: 072709DE

Strings

W, xrefs: 0727095D

Memory Dump Source

Source File: 00000019.00000002.1989903821.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7270000_sgxIb.jbxd

Similarity

API ID: ContextThreadWow64
String ID: W
API String ID: 983334009-655174618
Opcode ID: 82f362168dbc618de80577ae0cb0ecee6e2ada3784a3e3e4897f3baeda8adb82
Instruction ID: 639a8d0c05f12d95a0a529853ce56b3f91cf14465e1664482cd5cd567d4f63d8
Opcode Fuzzy Hash: 82f362168dbc618de80577ae0cb0ecee6e2ada3784a3e3e4897f3baeda8adb82
Instruction Fuzzy Hash: DB2118B1900209CFDB10DFA9C5857EEBBF4AF48364F14842AD499A7241CB789A85CF94

Function 072715E5 Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07271826

Memory Dump Source

Source File: 00000019.00000002.1989903821.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7270000_sgxIb.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a01a4f5770fc08a632edde98aa2a03a03a05050ad3308984195a19461e4158f5
Instruction ID: 35888ad1df6626165f0c6373d223591e5c88e88a60f713d0ae6109c7037bdc36
Opcode Fuzzy Hash: a01a4f5770fc08a632edde98aa2a03a03a05050ad3308984195a19461e4158f5
Instruction Fuzzy Hash: 52A15EB1D1021EDFDB10CF68C9417DDBBB6BF88314F1481A9E848A7250DB749995CF92

Function 072715F0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07271826

Memory Dump Source

Source File: 00000019.00000002.1989903821.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7270000_sgxIb.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 0d0314c20f165679a543a9cc2d6a6309672f112034d48e9a215b12454e114731
Instruction ID: e1951d44f8794fce6747263c806d8d5ecee0f43b35853638f1c8287fe89fffc7
Opcode Fuzzy Hash: 0d0314c20f165679a543a9cc2d6a6309672f112034d48e9a215b12454e114731
Instruction Fuzzy Hash: 5A916DB1D1021EDFEB10CF68C941BDDBBB6BF88314F1481A9E848A7240DB749995CF92

Function 02CDB159 Relevance: 1.7, APIs: 1, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02CDB3BE

Memory Dump Source

Source File: 00000019.00000002.1978392701.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2cd0000_sgxIb.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: fb0e57e2483d7af6e560b818fdf3a48975b3dd059fecd0b91b94629ebd57d6a2
Instruction ID: bcb7e6cd070852112ed76332752b3ebe06cf552bc8f2a5f8da95f7a137d903b2
Opcode Fuzzy Hash: fb0e57e2483d7af6e560b818fdf3a48975b3dd059fecd0b91b94629ebd57d6a2
Instruction Fuzzy Hash: 1A812271A00B058FD724DF6AD54575ABBF1FF88308F008A2DD58ADBA50DB34E945CB90

Function 05421DD0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05421EE2

Memory Dump Source

Source File: 00000019.00000002.1987546993.0000000005420000.00000040.00000800.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_5420000_sgxIb.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 55869695bc4323d4b03bcc0514a2ac8fd6d3765f8417343a2a0c19f6e211c96c
Instruction ID: 414a6a89ed6dc1f0924840d822a694bf496e94722673f4ee1368ac2ef52190b9
Opcode Fuzzy Hash: 55869695bc4323d4b03bcc0514a2ac8fd6d3765f8417343a2a0c19f6e211c96c
Instruction Fuzzy Hash: B441BEB1D00359DFDB14CFA9C884ADEBBB5BF48310F64812AE819AB214D771A885CF91

Function 02CD49D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02CD5F31

Memory Dump Source

Source File: 00000019.00000002.1978392701.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2cd0000_sgxIb.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ea34191b73b27736b86c344cd64a3bafee640c5ff9d8f3e4fbed54d0367c64ae
Instruction ID: cf5ebd3ca17459d9ce45ba2fb2afd619673ef4b815ff89ce396b7c11f55e5ffb
Opcode Fuzzy Hash: ea34191b73b27736b86c344cd64a3bafee640c5ff9d8f3e4fbed54d0367c64ae
Instruction Fuzzy Hash: 2B41EFB0C00619CADB24CFA9C884B9EBBF5BF88304F60806AD408AB255DB756945CF91

Function 02CD5E75 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02CD5F31

Memory Dump Source

Source File: 00000019.00000002.1978392701.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2cd0000_sgxIb.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7dd9aaaf7543900e830cbcdb49a5ae7b4664987eda24ed0cfaa1b7ddb42e8dd1
Instruction ID: 010c032dc4c4e9051dd661991c03682d7f1cdf0931c286e0fd3db69923234348
Opcode Fuzzy Hash: 7dd9aaaf7543900e830cbcdb49a5ae7b4664987eda24ed0cfaa1b7ddb42e8dd1
Instruction Fuzzy Hash: 9C41DFB0C00619CADB24CFA9C984B9EBBF5FF49304F64806AD408AB255DB756945CF91

Function 05424530 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 054245F1

Memory Dump Source

Source File: 00000019.00000002.1987546993.0000000005420000.00000040.00000800.00020000.00000000.sdmp, Offset: 05420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_5420000_sgxIb.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 9e76bb4f29a121090623ba2ee6b4715cb5e2a968495fa011f900f57bb7d5294c
Instruction ID: 782f2739c4f456604fb166751f3c70cf6aec954459a5ae8943605901dd75410e
Opcode Fuzzy Hash: 9e76bb4f29a121090623ba2ee6b4715cb5e2a968495fa011f900f57bb7d5294c
Instruction Fuzzy Hash: 5B4118B8900215CFCB14CF99C488AAABBF5FB88314F24C45DE559AB321D775A841CFA0

Function 07271361 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 072713F8

Memory Dump Source

Source File: 00000019.00000002.1989903821.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7270000_sgxIb.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 537e2ecffbf9c1f6b82e254b1fd3d357f0e9808a0783b4b9ed39d768eb27ad03
Instruction ID: 328003aef4ae2457ad38fc2cbf18cd03ef59e689bb1ea7365b36dee255e91082
Opcode Fuzzy Hash: 537e2ecffbf9c1f6b82e254b1fd3d357f0e9808a0783b4b9ed39d768eb27ad03
Instruction Fuzzy Hash: 222157B1900359DFDB10CFA9C980BEEBBF1FF88310F10842AE959A7250D7789954CBA4

Function 07271368 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 072713F8

Memory Dump Source

Source File: 00000019.00000002.1989903821.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7270000_sgxIb.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fda9f0952b11bfe44130721cb4da7d9179427204fbded5db73e31bc7b2fee004
Instruction ID: 74bfe8883b152823a7b4cf94843a898f7154228c3adaaabf8fb2a040c3e96fd2
Opcode Fuzzy Hash: fda9f0952b11bfe44130721cb4da7d9179427204fbded5db73e31bc7b2fee004
Instruction Fuzzy Hash: 692155B190035D9FCB10CFAAC981BDEBBF5FF88310F10842AE959A7240D7789954CBA4

Function 07271450 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 072714D8

Memory Dump Source

Source File: 00000019.00000002.1989903821.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7270000_sgxIb.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 2d2119d888cf6edba43a20d2ef3f73008f070b910a4122f763e1a829be0344a2
Instruction ID: c6a403fa5faf08c5c2557efd567e9d96ce1f99efcefe06c6489f942a3d70366a
Opcode Fuzzy Hash: 2d2119d888cf6edba43a20d2ef3f73008f070b910a4122f763e1a829be0344a2
Instruction Fuzzy Hash: 5B2136B1900259DFCB10DFAAC981BEEBBF1FF48310F10842AE958A7250D7789955CFA4

Function 02CDD39C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02CDDA0E,?,?,?,?,?), ref: 02CDDACF

Memory Dump Source

Source File: 00000019.00000002.1978392701.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2cd0000_sgxIb.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3cd02eadc631dd4182c317d1e0001a33f9b76807b46b250d1bffe64abbfd3460
Instruction ID: 9408acb877a9dc14d313d44dfd3170713f60da893095390c0e44f3db509f251c
Opcode Fuzzy Hash: 3cd02eadc631dd4182c317d1e0001a33f9b76807b46b250d1bffe64abbfd3460
Instruction Fuzzy Hash: E521E3B5D002499FDB10CFAAD584ADEBFF4FB48310F14801AE959A7310D374A950CFA4

Function 07271458 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 072714D8

Memory Dump Source

Source File: 00000019.00000002.1989903821.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7270000_sgxIb.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 8417846faf190d17ecf6679b1689fa27a9985c289a8caaac2bb267ccf50ac31a
Instruction ID: 80a5f04e4f24390cf31247c9705213923d2b52c2e088d82e8d3e2bbee1293d3e
Opcode Fuzzy Hash: 8417846faf190d17ecf6679b1689fa27a9985c289a8caaac2bb267ccf50ac31a
Instruction Fuzzy Hash: B92139B190035D9FCB10DFAAC941ADEFBF5FF48310F508429E559A7250D7349554CBA4

Function 07270960 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNELBASE(?,00000000), ref: 072709DE

Memory Dump Source

Source File: 00000019.00000002.1989903821.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7270000_sgxIb.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 0f0bececc2b78ba14527dd8808e68c06ca684a8d761284d6835a122824d983b1
Instruction ID: f9475f8cab4c3d30761f16adaac630af432616bee34d6ed0c115ece6aba02d15
Opcode Fuzzy Hash: 0f0bececc2b78ba14527dd8808e68c06ca684a8d761284d6835a122824d983b1
Instruction Fuzzy Hash: EE212CB1900309CFDB10DFAAC5857EEBBF4EF49324F148429D459A7240D7789945CFA5

Function 02CDDA40 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02CDDA0E,?,?,?,?,?), ref: 02CDDACF

Memory Dump Source

Source File: 00000019.00000002.1978392701.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2cd0000_sgxIb.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 62431fbe92e4e5fdbee0c6297fa19120dc065dcc39a723d6a02b7ea0cff4e015
Instruction ID: a9ac2667f000344d631113c1b478193173ed299fa7988df831e83a290a186bd7
Opcode Fuzzy Hash: 62431fbe92e4e5fdbee0c6297fa19120dc065dcc39a723d6a02b7ea0cff4e015
Instruction Fuzzy Hash: 9121F3B6D00218DFDB10CFA9D584AEEBBF4FB48310F14841AE958A7350D378AA50CF64

Function 072712A8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07271316

Memory Dump Source

Source File: 00000019.00000002.1989903821.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7270000_sgxIb.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e6dcba322725dde2dfc7126fbd7ab53e9c312bb4f5a2541f39d0c04459d7b0c7
Instruction ID: 08992c5329120839024b78cb7d541aaeac17bad432c40826c9ce12ed1cd83b43
Opcode Fuzzy Hash: e6dcba322725dde2dfc7126fbd7ab53e9c312bb4f5a2541f39d0c04459d7b0c7
Instruction Fuzzy Hash: 931164B28002499FCB10DFAAC844BDFBFF5EF88320F208819E559A7250C735A950CFA4

Function 072712A7 Relevance: 1.6, APIs: 1, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07271316

Memory Dump Source

Source File: 00000019.00000002.1989903821.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7270000_sgxIb.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 36cedcaaa6add800505677e2b751e9ac1ef07051a5a4292864b962a77c125e17
Instruction ID: f3501ed72d7ad079d715c7053f3e9c54cb58029cc91aa0a9d65b0695781f4572
Opcode Fuzzy Hash: 36cedcaaa6add800505677e2b751e9ac1ef07051a5a4292864b962a77c125e17
Instruction Fuzzy Hash: 481164B6800249CFCB10DFA9C945BEEBFF5EF88320F24881AE559A7250C7359550CFA0

Function 072708AA Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07270912

Memory Dump Source

Source File: 00000019.00000002.1989903821.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7270000_sgxIb.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5a0b32410514c9c0f08e73ae5d63e2a9794ceb01039e0889ea22edba8d6ce69a
Instruction ID: d59eb9aa1e2f0734de20c971909530e71b4d0a46c8fb037b2335b2e07750d3ac
Opcode Fuzzy Hash: 5a0b32410514c9c0f08e73ae5d63e2a9794ceb01039e0889ea22edba8d6ce69a
Instruction Fuzzy Hash: F81128B1900259CFDB20DFA9C5447EFFBF5EB88324F24842AD459A7250C7755944CF94

Function 072708B0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07270912

Memory Dump Source

Source File: 00000019.00000002.1989903821.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7270000_sgxIb.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 3ff100878ed0d78498693b0fa56d2692f14010238875de11266b39f14c6c7a6d
Instruction ID: f74dfb83f6ba74db3ecff06b05462071041a03c9cb5f3ebb2cbfe2fc98c26278
Opcode Fuzzy Hash: 3ff100878ed0d78498693b0fa56d2692f14010238875de11266b39f14c6c7a6d
Instruction Fuzzy Hash: 8A1136B1900249CFDB20DFAAC4457EFFBF4EB88324F248429D459A7250CB75A944CFA4

Function 07273230 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07274F8D

Memory Dump Source

Source File: 00000019.00000002.1989903821.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7270000_sgxIb.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1184ded7182a8b5a27471801a584467443c8569ba4c9484631c486959bf1392f
Instruction ID: 8f3c83fcb75267832a814909afe423bde689ffd965eff6d4d6416a53dd1af515
Opcode Fuzzy Hash: 1184ded7182a8b5a27471801a584467443c8569ba4c9484631c486959bf1392f
Instruction Fuzzy Hash: AA1103B5810349DFDB10DF9AD989BDEBBF8FB48320F20841AE558A7210C375A944CFA5

Function 02CDB358 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02CDB3BE

Memory Dump Source

Source File: 00000019.00000002.1978392701.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_2cd0000_sgxIb.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b0bd4bfa5890ced4b7bc3f38a29cf9f5a11a2fc17d7e9866531e1b13038b611b
Instruction ID: d22c54e290559489b655b73504fd1bacbe4ad438472eff4d0d6aadc00363e515
Opcode Fuzzy Hash: b0bd4bfa5890ced4b7bc3f38a29cf9f5a11a2fc17d7e9866531e1b13038b611b
Instruction Fuzzy Hash: 791110B5C002498FCB10CF9AC444ADEFBF4AF88328F11842AD559A7210C375A545CFA1

Function 07274F28 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07274F8D

Memory Dump Source

Source File: 00000019.00000002.1989903821.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7270000_sgxIb.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e95cc8cf1d1562ff3ea02afac6ff787337d7547248a540f3261582cd983b6843
Instruction ID: ecdcb51ffd80290b373ed22b06e8835d48e4e14b03d56226225d55341c4c30db
Opcode Fuzzy Hash: e95cc8cf1d1562ff3ea02afac6ff787337d7547248a540f3261582cd983b6843
Instruction Fuzzy Hash: B011FEB5800249DFDB10DF9AD585BEEBBF8FB48320F20841AE558A7210D375A984CFA5

Function 0135D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.1978028705.000000000135D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0135D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_135d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52bd5b2d2fe796e3a15039347b645bb4f94c2e7b75edff74aa1ddae65db6ce64
Instruction ID: 24768dfe764fadd9fb25fbc7600a5ef30a4e5c14ae70ec1366f301134e304ba4
Opcode Fuzzy Hash: 52bd5b2d2fe796e3a15039347b645bb4f94c2e7b75edff74aa1ddae65db6ce64
Instruction Fuzzy Hash: 34210071604204DFDB55DF58D984F26BBA5EB84B18F20C569DC0A4B256C33AD447CA61

Function 0135D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.1978028705.000000000135D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0135D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_135d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb27c22c867705799f94c7498fe7f29a1ba2199b25176884e95cc5e95bc00ad6
Instruction ID: c3ee4896247a0d76e1554c2fd648679fa2710ddf1dc6ba8c48687fbf5a3d59c6
Opcode Fuzzy Hash: bb27c22c867705799f94c7498fe7f29a1ba2199b25176884e95cc5e95bc00ad6
Instruction Fuzzy Hash: 7A21A1755093808FDB03CF24D994B15BF71EB45218F28C5EAD8498F2A7C33AD40ACB62

Function 0134D731 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.1977944695.000000000134D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0134D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_134d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b9e57387a81f6bb4db03f4544a3af26ff7625a87f615c9ff7be36323084e3d
Instruction ID: dbdd08610396583ffeb6c064379dfc9fcd40aa923c453d23212beddbecb8a914
Opcode Fuzzy Hash: 13b9e57387a81f6bb4db03f4544a3af26ff7625a87f615c9ff7be36323084e3d
Instruction Fuzzy Hash: 3A01F7310083849BE710CE69CDC4B67FFDCEF51368F18C42AED094A292C239E840C671

Function 0134D730 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.1977944695.000000000134D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0134D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_134d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0830e88f6e910df7858afc4c9c82673908195ac2c7f8bb0fcf08eeddd7420e50
Instruction ID: edf4d79ee8153987b2cf9a4a238a12dfad871e6b6d2ff136aae7b4ec9a27ba0d
Opcode Fuzzy Hash: 0830e88f6e910df7858afc4c9c82673908195ac2c7f8bb0fcf08eeddd7420e50
Instruction Fuzzy Hash: 60F0C2710043849FE7108E1ACCC4BA2FFE8EB91338F18C45AED080E282C279A840CA70

Analysis Process: sgxIb.exePID: 7188, Parent PID: 7096COMMON

Execution Graph

Execution Coverage:	12.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	194
Total number of Limit Nodes:	25

Executed Functions

Function 071B6708 Relevance: .8, Instructions: 822COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4195241370.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_71b0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ec273c7a52c02d8105db08300178169bba36419def3be9763e5b9b2f7d41cc
Instruction ID: 66106be9c3fdfa097d754ac709c7a84c4ada437d0428eb79fa604526fb73b69d
Opcode Fuzzy Hash: 55ec273c7a52c02d8105db08300178169bba36419def3be9763e5b9b2f7d41cc
Instruction Fuzzy Hash: 1462AE74B002059FDB25DB68D584AADB7F2FF89314F148469E809EB390DB35ED86CB90

Function 068F2148 Relevance: 4.1, Strings: 3, Instructions: 350
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 068F22ED
(bq, xrefs: 068F22C2
(bq, xrefs: 068F247F

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq
API String ID: 0-2716923250
Opcode ID: 0e3b0bb3ac7e969bf47f0c8c1196849e4e762c4eeb488b2e977e71881e9be8c7
Instruction ID: 4ab5845a5c7b13eadaeec68a1e04d5519bc3fe2318b933ca8299006dfb707734
Opcode Fuzzy Hash: 0e3b0bb3ac7e969bf47f0c8c1196849e4e762c4eeb488b2e977e71881e9be8c7
Instruction Fuzzy Hash: A3D1BE70E102099FCB54DFA9C8646AEBBF2FF89310F148569D505EB390DB74AD41CB91

Function 032CED70 Relevance: 1.6, APIs: 1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4162490899.00000000032C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_32c0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c691155e7c3dfb8da79a1702d75461a43aa4b89eb59e7c74ae9be4cb9cb3b71f
Instruction ID: 1a209947cbbdbd70c697ee80611052a390a90563d7cd2b27940b6104c07877f3
Opcode Fuzzy Hash: c691155e7c3dfb8da79a1702d75461a43aa4b89eb59e7c74ae9be4cb9cb3b71f
Instruction Fuzzy Hash: 85414471D1479A9FC710CF79D8002EEBBF5EF89310F15866AD804A7281DB749882CBD0

Function 071A5C92 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 071A5DAA

Memory Dump Source

Source File: 0000001C.00000002.4194879620.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_71a0000_sgxIb.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f6a19abb0d61a5658c250b67dc9b5b6f9e8c65cce27b00380789783746279816
Instruction ID: fe9b2533bcb1a6f0d2332b75f714a21222fc11d8161c5adf0fd815277834bda7
Opcode Fuzzy Hash: f6a19abb0d61a5658c250b67dc9b5b6f9e8c65cce27b00380789783746279816
Instruction Fuzzy Hash: 9851C0B5D10349AFDB14CFA9D984ADEBFB5FF48310F24812AE418AB250D7719845CF91

Function 071A5C98 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 071A5DAA

Memory Dump Source

Source File: 0000001C.00000002.4194879620.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_71a0000_sgxIb.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: dea22d5d75ee4dffc600f7c8fbe13f3a04ad34631b6dec85cd1351f7de8853e0
Instruction ID: 46567a270dc43535b2d20455b365dedfc1e0864c7ff2c09a144c78c51904ec80
Opcode Fuzzy Hash: dea22d5d75ee4dffc600f7c8fbe13f3a04ad34631b6dec85cd1351f7de8853e0
Instruction Fuzzy Hash: 0041E0B5D10309EFDB14CFA9C984ADEBBB6FF48310F24812AE818AB250D7719845CF90

Function 071A4B5A Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 071A4C56

Memory Dump Source

Source File: 0000001C.00000002.4194879620.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_71a0000_sgxIb.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 269500fa55af3d672306237a9acead623c7db207cd5d305a6408998877b340f2
Instruction ID: 59f7db7e38309ca04c23060c1f9d6bd0a9b5773525355d17d36d270df87b13c1
Opcode Fuzzy Hash: 269500fa55af3d672306237a9acead623c7db207cd5d305a6408998877b340f2
Instruction Fuzzy Hash: F43186B4A007858FCB05CFB9C05429EFBF1AF89314F24846EC459AB291DB74A906CFA5

Function 071A974C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 071AAAE9

Memory Dump Source

Source File: 0000001C.00000002.4194879620.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_71a0000_sgxIb.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 44380adb8483b1ac4bec0b8f48c64673297debae1b5c6a6bd3e3f8559da25500
Instruction ID: fbfcb754e198136e1e8717c0420dccb2b7e0f36ec5c3e49092626ae2dd2d2ce1
Opcode Fuzzy Hash: 44380adb8483b1ac4bec0b8f48c64673297debae1b5c6a6bd3e3f8559da25500
Instruction Fuzzy Hash: 664159B8A00305DFCB14CF99C588AAABBF5FF88314F24C459E519AB361D734A941CFA0

Function 071AB765 Relevance: 1.6, APIs: 1, Instructions: 75comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 071AB7F8

Memory Dump Source

Source File: 0000001C.00000002.4194879620.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_71a0000_sgxIb.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 8e82a6c1fe57cd43671dbdafab7a5fdf29bc72a219c3c736c729fad61784271c
Instruction ID: f73fb1bd68551d71c48fe251fed38fc9c03bf1d1fd52bc2ec0160c052f3ba8c6
Opcode Fuzzy Hash: 8e82a6c1fe57cd43671dbdafab7a5fdf29bc72a219c3c736c729fad61784271c
Instruction Fuzzy Hash: 643132B4D05289EFDB24CFA9C984BCEBBF1AF48314F208419E004BB294D7B46885CB55

Function 071AB160 Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 071AB7F8

Memory Dump Source

Source File: 0000001C.00000002.4194879620.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_71a0000_sgxIb.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: cbc6e5f3627f0b4ed0c4b8d348e0fe5237441513aeb1e8c8cba210d8d2ca0804
Instruction ID: f37fac975699da02426c441ae44fb19b126833d60a691115f7a4e66fafdd0d6d
Opcode Fuzzy Hash: cbc6e5f3627f0b4ed0c4b8d348e0fe5237441513aeb1e8c8cba210d8d2ca0804
Instruction Fuzzy Hash: BD3132B4D05348EFDB24CFA9C984BCDBBF5AF08304F208019E404BB294D7B4A884CB95

Function 071A9B90 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 071A9C1F

Memory Dump Source

Source File: 0000001C.00000002.4194879620.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_71a0000_sgxIb.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8aa6445e069f458a93d376c85df3363821cc9dbb439562fc0c905b4bf4b99377
Instruction ID: f34418cc13c59de40cf77f340e1931295df34979df4eca83a4225b32ee24b30e
Opcode Fuzzy Hash: 8aa6445e069f458a93d376c85df3363821cc9dbb439562fc0c905b4bf4b99377
Instruction Fuzzy Hash: 082116B5900259AFDB10CFA9D584ADEFFF4EB48310F14845AE958A7350D374A940CFA5

Function 071A9B98 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 071A9C1F

Memory Dump Source

Source File: 0000001C.00000002.4194879620.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_71a0000_sgxIb.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 183ecb4832ae5904a6b6e350bea5ec18a452122b7b238e7c21cbae354a776131
Instruction ID: 138fc2e5b68d601772d60205c108ed7016726c74423d0198978b62b22a6bc650
Opcode Fuzzy Hash: 183ecb4832ae5904a6b6e350bea5ec18a452122b7b238e7c21cbae354a776131
Instruction Fuzzy Hash: 3321E4B5900259AFDB10CFAAD584ADEFBF8EB48310F14841AE918A7350D374A940CFA4

Function 071A9788 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,071AAD35), ref: 071AADBF

Memory Dump Source

Source File: 0000001C.00000002.4194879620.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_71a0000_sgxIb.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 34786221b67ab9627a03e19ce08bdcc8d68bfb52420caee87f737bfcb4ae0f3a
Instruction ID: 947b08bc58338d662fa6b42da3d6c67c98f873fb35a4b1f9c56293e0d9a542bc
Opcode Fuzzy Hash: 34786221b67ab9627a03e19ce08bdcc8d68bfb52420caee87f737bfcb4ae0f3a
Instruction Fuzzy Hash: 3121CAB5805398CFCB10DFA9D4447DEBFF4EF49320F14809AD494A7251C374A944CBA8

Function 071AD2A8 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 071AD32B

Memory Dump Source

Source File: 0000001C.00000002.4194879620.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_71a0000_sgxIb.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 95badc89e6b47657c7a288c6d98a9ebabb9e92f9c7bdf17d558229db08b56ceb
Instruction ID: 70d405bc760dbc2cdbee1b0afeb8adacee8d8fe02d43a322e713d75f3b9bfe38
Opcode Fuzzy Hash: 95badc89e6b47657c7a288c6d98a9ebabb9e92f9c7bdf17d558229db08b56ceb
Instruction Fuzzy Hash: A32135B5D002099FCB14CF9AD944BDEFBF4BF88320F108429E459A7250C774A940CFA5

Function 071AD2B0 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 071AD32B

Memory Dump Source

Source File: 0000001C.00000002.4194879620.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_71a0000_sgxIb.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: f0393c6de12a1a5d00ed388d1cc4822545350624f14c100c545844abf062efc9
Instruction ID: bad31c7cdba80a506c5ac97714ce49450b2c076408170aad0bbdf136e6b85fec
Opcode Fuzzy Hash: f0393c6de12a1a5d00ed388d1cc4822545350624f14c100c545844abf062efc9
Instruction Fuzzy Hash: 892124B5D002199FCB14CF9AD944BEEFBF5AF88320F10842AD459A7290C774A944CFA5

Function 032CEE58 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 032CEEBF

Memory Dump Source

Source File: 0000001C.00000002.4162490899.00000000032C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_32c0000_sgxIb.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 6f939e8cab27c5fab5bdef834e6dfb928979ef93015586d48ea9745f53cbadff
Instruction ID: aefe1b96bbe62c8fd5219f9e335a24509430560532f8c953da918ab33b746559
Opcode Fuzzy Hash: 6f939e8cab27c5fab5bdef834e6dfb928979ef93015586d48ea9745f53cbadff
Instruction Fuzzy Hash: 3111F3B2C1066A9BCB10DF9AC544BDEFBF4AF48320F15816AD818B7250D378A944CFE5

Function 071A4BEA Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 071A4C56

Memory Dump Source

Source File: 0000001C.00000002.4194879620.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_71a0000_sgxIb.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 748f9946087355b91e0c6d6cbdc395e53466cc60e8feb32835e42ac781688e9c
Instruction ID: d17a1ab00fc6cb0875c0085499140acae22ea2cc52a50ae01902ff22f1de4182
Opcode Fuzzy Hash: 748f9946087355b91e0c6d6cbdc395e53466cc60e8feb32835e42ac781688e9c
Instruction Fuzzy Hash: 871112B58002499FCB10CFAAC544ADEFBF4EF48310F10841AD868A7204D374A545CFA5

Function 071A3714 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 071A4C56

Memory Dump Source

Source File: 0000001C.00000002.4194879620.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_71a0000_sgxIb.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2693e607df1fe1eca5c20f02d36b1eb3adeadecbeb3eefc0e1716f02e65e5d99
Instruction ID: 95dcd4d6bd77968e9910da5f7b0f73907a17c42121dd69b724e6326dbe65563e
Opcode Fuzzy Hash: 2693e607df1fe1eca5c20f02d36b1eb3adeadecbeb3eefc0e1716f02e65e5d99
Instruction Fuzzy Hash: C21120B9C003499BCB10CF9AC444ADEFBF4AB88210F10842AD829B7250C3B5A645CFA5

Function 071AB621 Relevance: 1.6, APIs: 1, Instructions: 50comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 071AB67D

Memory Dump Source

Source File: 0000001C.00000002.4194879620.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_71a0000_sgxIb.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ec7c5136f496d28de7c3e4a36b5aeb560a88dfd501ddb18f6815b0279b92abda
Instruction ID: d59e171a8be7142bf17c71eee557b5f4c8481386ea63f4eb92031503c4150259
Opcode Fuzzy Hash: ec7c5136f496d28de7c3e4a36b5aeb560a88dfd501ddb18f6815b0279b92abda
Instruction Fuzzy Hash: 021155B58043899FCB20DFAAD448BDEFFF4EB48320F148469D458A7210C375A580CFA5

Function 071AB03F Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 071AB67D

Memory Dump Source

Source File: 0000001C.00000002.4194879620.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_71a0000_sgxIb.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: fd6ace014df095a42b87e1fc0750fc04992a1b0f3aa40a2352b0b643bac1b165
Instruction ID: 51280831378f92584d84995356b1235e545add0d725f71f3fa5684bb76b84570
Opcode Fuzzy Hash: fd6ace014df095a42b87e1fc0750fc04992a1b0f3aa40a2352b0b643bac1b165
Instruction Fuzzy Hash: 051133B58103499FCB20DF9AD549BDEBBF8EB48320F20841AD558A7350D375A944CFA5

Function 071AAD58 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,071AAD35), ref: 071AADBF

Memory Dump Source

Source File: 0000001C.00000002.4194879620.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_71a0000_sgxIb.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 4aa6e9c5031530a724e2a929ec7bbb0458f29bf492a3d6ec2dac48284296882a
Instruction ID: d564aa2cd99115dd19dfd978452f9a25e3044547a496381dd56b51f21f3c3f1a
Opcode Fuzzy Hash: 4aa6e9c5031530a724e2a929ec7bbb0458f29bf492a3d6ec2dac48284296882a
Instruction Fuzzy Hash: 311133B5800259CFCB20CF9AD448BDEBFF4EB48324F20845AD558B7650C775A944CFA5

Function 071A97A4 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,071AAD35), ref: 071AADBF

Memory Dump Source

Source File: 0000001C.00000002.4194879620.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_71a0000_sgxIb.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 2d6389985ea62caac3cd9edde163c81294bbf800722a2e9379b76ae6b955f169
Instruction ID: ec4b7ae7caddad5955c24249474479b389c97cede556a2368b110e682051218c
Opcode Fuzzy Hash: 2d6389985ea62caac3cd9edde163c81294bbf800722a2e9379b76ae6b955f169
Instruction Fuzzy Hash: 881133B5800359DFCB20DF9AC544BDEBBF8EB48320F208419E558B7240C374A944CFA4

Function 071AB048 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 071AB67D

Memory Dump Source

Source File: 0000001C.00000002.4194879620.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_71a0000_sgxIb.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 2624f7690b16cac2e4cf27f9df80aaff57c0b591dfea30d750c3857c990ccfe7
Instruction ID: 67c35f1d7ba35286a8375bb07ac1cc7b51c99005060393d1a38731e035c3ae49
Opcode Fuzzy Hash: 2624f7690b16cac2e4cf27f9df80aaff57c0b591dfea30d750c3857c990ccfe7
Instruction Fuzzy Hash: 3B1130B58043489FCB20DF9AD588BDEBBF8EB48320F208419D518A7250D374A940CFA8

Function 071B6308 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4195241370.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_71b0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9c91334cda6d33473c35e1e4b763204cbd3cddbe828b829d09c2d532a0d2dd8
Instruction ID: ab737dc7cf456fe4294426b645c420753ed2408f3b689784899645d360d002c8
Opcode Fuzzy Hash: d9c91334cda6d33473c35e1e4b763204cbd3cddbe828b829d09c2d532a0d2dd8
Instruction Fuzzy Hash: AD61C4B1F001124FCB259A7EC8845AFBAD7AFD5620B25443AD80EDB364DF65ED0287D2

Function 068F2139 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18b8260277487e71113213d060f75a889db5b75d9ee87a2e85430f3c26eb965
Instruction ID: 4f9b1b1a24550e46142116e0f7ac8efa138e66fd9c04aed78a3d51e18010b0e9
Opcode Fuzzy Hash: b18b8260277487e71113213d060f75a889db5b75d9ee87a2e85430f3c26eb965
Instruction Fuzzy Hash: E5417030D207099FCB14DFA9C85469DFBB1FF88300F14C659D545BB254EB71AA85CB91

Function 068F0C30 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9504141e65688eb4656c23759fd88f1e4286cfccd6ce79ed89dca805db436b70
Instruction ID: fa09bd77e334770dd1d288e12f9ac53dc1a2aea91adeab2d76928d8a7f4b4816
Opcode Fuzzy Hash: 9504141e65688eb4656c23759fd88f1e4286cfccd6ce79ed89dca805db436b70
Instruction Fuzzy Hash: 43314B70A10606DFD754CF6AC588A6EFBF2EF88710B14C969D659D7714E730E841CB90

Function 068F1B3A Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff966453001fd8b999c42c0e9c4be4f8dccd3df8e6ef2a8b2b41ab7ca480d1da
Instruction ID: d28b17637b6f140049b7f1ef4f448874041c354d6456a66a844aa7feeba0ecca
Opcode Fuzzy Hash: ff966453001fd8b999c42c0e9c4be4f8dccd3df8e6ef2a8b2b41ab7ca480d1da
Instruction Fuzzy Hash: 21315270A11A05DFC754CF2AC548A6EB7F2BF88710B14896CD699D7714E730E842CB90

Function 068F2990 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84d56eb215b86a42747bf20304b2d7de380c884b3d9df861abe2b561806f7f6a
Instruction ID: 36d77b3c260e038d919bf06240c46ef719b03195731a7b57a9665634aceaad49
Opcode Fuzzy Hash: 84d56eb215b86a42747bf20304b2d7de380c884b3d9df861abe2b561806f7f6a
Instruction Fuzzy Hash: 9321D134700206CFCB15EB78D854A6F7BAAEF88300F208469D509E73A5DB359D42CB92

Function 068F24BC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8bd2845f6c10163da9c8bff79357955f6f7de4faace86320f11086534e13444
Instruction ID: 8cef3cddadaeff1aa21bbf09d239bd9cdcf4f2286c35a447d9af0cfc07899a26
Opcode Fuzzy Hash: c8bd2845f6c10163da9c8bff79357955f6f7de4faace86320f11086534e13444
Instruction Fuzzy Hash: 283111B0D11218DFDB60CFA9C9A4B8EBBF4AF48314F24805AE544AB344C7B49985CFA4

Function 068F29A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf3b6e957930596b539a1799225e7c5db7f4f1883efa525430338a3ef5db95a9
Instruction ID: 031e197d0e9c9573547e4c5256d99da3deba7ba91ee4b677a74fa1ba1a6580e4
Opcode Fuzzy Hash: cf3b6e957930596b539a1799225e7c5db7f4f1883efa525430338a3ef5db95a9
Instruction Fuzzy Hash: 76217F74710206DFCB54EB78D954B7F77AEEB88710F208429D509E3394DA36DD418792

Function 0177D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4158167785.000000000177D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0177D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_177d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60b1f9306193fb22886fc3f367c36672ec1c8d805d86d667bc9f87cd8b1c6e49
Instruction ID: 476e197fe6c89a0d2894ed316281949842618cc4747cb8ebf36ec350285dbf7c
Opcode Fuzzy Hash: 60b1f9306193fb22886fc3f367c36672ec1c8d805d86d667bc9f87cd8b1c6e49
Instruction Fuzzy Hash: E4212271604204DFCF22DF58D9C4B26FBA5FF84314F24C5ADD80A4B256C33AD446CA62

Function 0177D1F8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4158167785.000000000177D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0177D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_177d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 611172a2bb7f2794d9b908121379a02f7a91b619188e7cc71887ac11cc4d160c
Instruction ID: 1d995e6513457f4350c0675bde84db77ac2ee740047f16a890e05a24ca172541
Opcode Fuzzy Hash: 611172a2bb7f2794d9b908121379a02f7a91b619188e7cc71887ac11cc4d160c
Instruction Fuzzy Hash: 952126B1508200DFDF21DF98D984B2AFB65FF84334F24C569E9494B246C376D447CAA1

Function 0177D3A8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4158167785.000000000177D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0177D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_177d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c1fb2de18b0892d80a580af79cd36ab89edd746078a8479a9d1de50162381ee
Instruction ID: 41a0891ab74f7036f5a8b77d33c3b0123391a7670e77c7ba105e954a91cf5fab
Opcode Fuzzy Hash: 2c1fb2de18b0892d80a580af79cd36ab89edd746078a8479a9d1de50162381ee
Instruction Fuzzy Hash: 3F21F2B1604204DFDF15DF58D9C4B26FBA5EF88314F20C5ADED0A4B256C376E846CA61

Function 068F1E44 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4729196e2d5b3dfba23f24f1c4734f3d0ba28a129612bf5306581a30b779c47
Instruction ID: c585a91c92105d77383607f816241d115ca13533d188445247ccc0f8cbf063b3
Opcode Fuzzy Hash: e4729196e2d5b3dfba23f24f1c4734f3d0ba28a129612bf5306581a30b779c47
Instruction Fuzzy Hash: F83102B0C11218DFDB60DFD9C5A9B8EBBF4AB08314F20801AE608BB354C3B49945CFA0

Function 068F0770 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12c2a1e576630690a45c5b6065b9a9aa39a791f40dfe065e020c7679b820fadd
Instruction ID: e497d90bafe6873f10e8029c4c940c4156a06249df14a2edcc5e78cb844bdbd5
Opcode Fuzzy Hash: 12c2a1e576630690a45c5b6065b9a9aa39a791f40dfe065e020c7679b820fadd
Instruction Fuzzy Hash: C1119AB02013058FC356AF68D85855ABBA2FF85344B208A7DD25ACB755DB32DC0ACBA4

Function 068F1988 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f4b47a86649c54c32472a543954c1b5ebaa5eb5a14450cbde5b8bd3ca176542
Instruction ID: 97b356963acf801fdbb37e8298d2ad432054497797794b7b8a900b71f222290a
Opcode Fuzzy Hash: 2f4b47a86649c54c32472a543954c1b5ebaa5eb5a14450cbde5b8bd3ca176542
Instruction Fuzzy Hash: 0D11C431605349DFCB128F68D8488D9BFF1FF4A310B0589E6E5D4DB262DB319855CBA1

Function 071B4318 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4195241370.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_71b0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ea2a1eb951d801679c3d0be05d008ea93d199002537ef87cbd2f21b0c33a1e9
Instruction ID: 3a205e2a8a6e5e3d16cf0734a4faa35e87fe1e7b954154ae1881470270f56030
Opcode Fuzzy Hash: 2ea2a1eb951d801679c3d0be05d008ea93d199002537ef87cbd2f21b0c33a1e9
Instruction Fuzzy Hash: 5011C0317001665FCB22966CD85076EB7EADFCA754F28842AE44DC73A2EA24DC468391

Function 068F0780 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2a4c6ba04b03428523f97cc79a6882bd0d09064d2cc9f57dc5da85d40b9026d
Instruction ID: 6a34896ef28522c2c5c5c26a67c08f6939cb0c64ef67b940098da483a387b9d5
Opcode Fuzzy Hash: c2a4c6ba04b03428523f97cc79a6882bd0d09064d2cc9f57dc5da85d40b9026d
Instruction Fuzzy Hash: EF118CB07003058FC359AF69D85865AB7A7FB85354B20897CC21A8B754DF32DC09CBA4

Function 0177D1F3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4158167785.000000000177D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0177D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_177d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: b52db0e9240987ec7885708b20621ab0b4cb2fe468c34f6645810c97a7ad51cf
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: CE119075508280DFDB12CF54D5C4B15FF61FB84324F24C6AAD8494B656C33AD40ACBA1

Function 0177D3A3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4158167785.000000000177D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0177D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_177d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 58ace665a91b08deba2c47715aa1d127dd69af7cb1bea7294705a6c562994c6c
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 6111BB75504280DFDB12CF54D5C4B55FFA2FB84314F24C6AADD494B266C33AE44ACB62

Function 0177D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4158167785.000000000177D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0177D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_177d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 3dfacf18e590c8a7b6acc5b9fbec4e4ca42329671f6b6afd47766d0d66061843
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: DA11BB75504284CFDB22CF58D5C4B15FFA1FB84314F28C6AAD8494B656C33AD45ACB62

Function 068F16F1 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eaf02082127164f2c8ce3f421892031571364286e5a4f0d44384377916c0faa
Instruction ID: 066b8eae6ba6a6466b60b6904490d473a2262f75e434aff8675e6b7f660053ba
Opcode Fuzzy Hash: 5eaf02082127164f2c8ce3f421892031571364286e5a4f0d44384377916c0faa
Instruction Fuzzy Hash: D611C674614340CFD3A48B28D48C52ABBB2BB49704B04899ED5CBC3649D771E801CB80

Function 068F0C04 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0080e404485e06bf7bc6f7a2dc2ec13f14b4f8d0f11e2662683a5fa796601510
Instruction ID: 5cdd13a92f150575e693c3e2a6fc000b162ff820729c69cb4ac50633b8e6b642
Opcode Fuzzy Hash: 0080e404485e06bf7bc6f7a2dc2ec13f14b4f8d0f11e2662683a5fa796601510
Instruction Fuzzy Hash: 8301B574624700CFD3A48B29C58C53BBBF6FB88B14F04891DE68BC2608DB71E801CB90

Function 068F193A Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5b8b8b8f67e46fa8fd930ca5040d19d1f9de4b79e91ee0a9312823426e0fb0
Instruction ID: 02aa1e9864a16157e88d02fec112eb80232ff5bf526dc420a57377007809d0f8
Opcode Fuzzy Hash: 0e5b8b8b8f67e46fa8fd930ca5040d19d1f9de4b79e91ee0a9312823426e0fb0
Instruction Fuzzy Hash: 58F06D70E04704EFCB318FA8980449AFBF5EF4971075489AAE5D5C3200DB319918CBD1

Function 068F0838 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc37050ea5ff3026b5a8bdb5139445b8bfee03252ed7136da64ff3161802b024
Instruction ID: a5d18e8343a8a2dc35fe0dfea28e0ef82ca79f2a35fcbd3b80d2800f066f0c21
Opcode Fuzzy Hash: fc37050ea5ff3026b5a8bdb5139445b8bfee03252ed7136da64ff3161802b024
Instruction Fuzzy Hash: B4F0A7317542008FC3559F19985845ABBB6FFC961031544EEE18DC7312DF21DC068391

Function 068F1948 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91d44f721df9124c064e31073bec3bba640f24a5bc8f365834aaa3a2f917da6d
Instruction ID: 967ed53e5c043df72017b33a9f06ef6cd3a9dae3acb14058bbcf0111402fc90b
Opcode Fuzzy Hash: 91d44f721df9124c064e31073bec3bba640f24a5bc8f365834aaa3a2f917da6d
Instruction Fuzzy Hash: 2AF03075E10714EF8B34CFA9D80449EFBF9EF48620B40856AE695D3600D771E914CBD0

Function 068F0E52 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 820726a23cdc8e548130a685dc377c49c0e93c76a6568a47fa39771c6ad3a088
Instruction ID: 7dd8a1f7030c71df24756e1f4fcc3468f80420eec56c8425f6123fd51ac93507
Opcode Fuzzy Hash: 820726a23cdc8e548130a685dc377c49c0e93c76a6568a47fa39771c6ad3a088
Instruction Fuzzy Hash: AEF08C74244346CFE3059F60EA59A683BA7EB4A305F0444A6DA814B3C5E63A4C10CF12

Function 068F1C60 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab8450fe3db039607d99c85ef8b39e0592fd8fcd60b70f734647f8c0a97414d7
Instruction ID: c725d1c20a9108af7b8fd0e07ce5139c3339de3611e9e116569d77e5b2bd48db
Opcode Fuzzy Hash: ab8450fe3db039607d99c85ef8b39e0592fd8fcd60b70f734647f8c0a97414d7
Instruction Fuzzy Hash: FBE0863605924C8FC7929F6CD840891BFF8AF1570034548A7D2C0CF112E6259865D791

Function 068F0E60 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1201ea824d06516a566a640eface70a555f7631d5ed3a8b696c317bb1d805ccc
Instruction ID: 9878e138630ee31446a292b1f82f76b824ffec32692f3f6cd3a9a4c04c806c2a
Opcode Fuzzy Hash: 1201ea824d06516a566a640eface70a555f7631d5ed3a8b696c317bb1d805ccc
Instruction Fuzzy Hash: BEE01A7424020ACFE708AF51FB1EB6937ABE788305F008035DA15473C4E67A5811CF12

Function 068F16C0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cea6d0ea3d424583b289d9eb2c5335255ffe5c3eb98a15154a748dc0d5fab2d
Instruction ID: 502fb4bcc3c4e94d0cfa5bf5e561d5e339ff7e31bc57b80c1c9e872330994480
Opcode Fuzzy Hash: 4cea6d0ea3d424583b289d9eb2c5335255ffe5c3eb98a15154a748dc0d5fab2d
Instruction Fuzzy Hash: C8D0222125912417E70433E8A0212ED268A8F81618F0104A7C19CCB282CC8B8C8247EB

Function 068F1B12 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48f833bf4cbf9f9baeb3baf594a334dbcb74ccd40480936975df1f2b5f9e4585
Instruction ID: 5d802a12ade51d946eb5116980448fe036e8d7ad1ab6fa2a59b0f4f94b5d90fe
Opcode Fuzzy Hash: 48f833bf4cbf9f9baeb3baf594a334dbcb74ccd40480936975df1f2b5f9e4585
Instruction Fuzzy Hash: E9C0803236052813D614225C74205FD739E47C4575F500057D14C87A418D814C8302EF

Function 068F16D0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69348b1ecd25a265ed9cf26f8389ac4f779188e1c937efec0bc852fb7e1edce3
Instruction ID: ceb810dbf675686b7465798c4aac54e30ea2c9a6277ebe56d1e16740c70b0f72
Opcode Fuzzy Hash: 69348b1ecd25a265ed9cf26f8389ac4f779188e1c937efec0bc852fb7e1edce3
Instruction Fuzzy Hash: DAB09B6131413517DA48719D64205BE728D47C5665F100067D61DC7741CCD59C4142EF

Function 068F1B18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5a89945cea1ab417cf2b2b4729e0da2638e685a0b846c5860c83ed76f0e3085
Instruction ID: 1867f8ec9188d57ba03018ca49d9835e5ec9d071fcf8f9dbaaf1eb32377de951
Opcode Fuzzy Hash: f5a89945cea1ab417cf2b2b4729e0da2638e685a0b846c5860c83ed76f0e3085
Instruction Fuzzy Hash: B8B09B2233423917D648319D68305BE728D47C5565F510067961DC77418CC59C4202EF

Function 068F0253 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be3b93aae5fbba2448c8a8656eba385e87b03ac4b0af42429c934f9a7568f59f
Instruction ID: 30a3aacbf2c80d4a1f40f69f3823fa54aac3c09ed33f508abba24fc4062e8c4d
Opcode Fuzzy Hash: be3b93aae5fbba2448c8a8656eba385e87b03ac4b0af42429c934f9a7568f59f
Instruction Fuzzy Hash: 07D0C970D5421ECFEFA28F80C8697EEBBB1BB08319F100419D101E6196CBBE0549CFA0

Function 068F0917 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76a4455803fac150361223fc98ee09bab5264966ec74f5c585d09c6dae259d17
Instruction ID: fbaae749b289117296908b31e8284ef412145c0e7c8463dd875cae9563cdd176
Opcode Fuzzy Hash: 76a4455803fac150361223fc98ee09bab5264966ec74f5c585d09c6dae259d17
Instruction Fuzzy Hash: C3C08C30711A208F8BB0EF28A0600ADB3F0BB48120300190AE26AC2680CB3199058782

Function 068F08E0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42f2263303bc1b7103d0d80780a084c3faae39645c668fd72608df1b15058bf
Instruction ID: 922d14452697551d7d79d3fb1311f1b8cb4ec6f329ce18aa4a2bb56f14b884f4
Opcode Fuzzy Hash: b42f2263303bc1b7103d0d80780a084c3faae39645c668fd72608df1b15058bf
Instruction Fuzzy Hash: DCB092A290A2408BEB0656348C0B2482592AFE210075AE6A9828286159ED2B88868386

Function 068F0D52 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82bf0cf34f046b3ccea898644a1c8af9537838994a806bf076345cd7d61c5a1b
Instruction ID: 36ab4c107406f60d20a5d45e8c88c4f52d2704735f0caf8c98ddd8f2ef66f0d0
Opcode Fuzzy Hash: 82bf0cf34f046b3ccea898644a1c8af9537838994a806bf076345cd7d61c5a1b
Instruction Fuzzy Hash: F7C04CB46007109F8370DF29E4488577BF5FB886103004E19F456C2608C770E8458A90

Function 068F0349 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4190477887.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_68f0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30a303dd466e1d60cb691fd0f0b68446006a3ce5fa136262088e545e4229ed44
Instruction ID: 371a63c68461f18373d4de3538a3dcffc76b26d55640ad2d8158bf9e62a500b7
Opcode Fuzzy Hash: 30a303dd466e1d60cb691fd0f0b68446006a3ce5fa136262088e545e4229ed44
Instruction Fuzzy Hash: 4BC012B04006008EDF18DF54C4482207AA0AB08328B30028CD16A0A2D2C332C183CBD0

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rQuotation3200025006.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\pBBqGOzrz.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rQuotation3200025006.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sgxIb.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5yxvmcso.vcw.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cvroevrq.yjr.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ef5osgc1.1rh.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f2mf5iym.s1p.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hmntbso3.xpb.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hnualhbp.jmy.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iu1bd2vm.grk.psm1

Windows Analysis Report
rQuotation3200025006.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre