Edit tour

Windows Analysis Report
Xmz1XDgtah.exe

Overview

General Information

Sample name:	Xmz1XDgtah.exe renamed because original name is a hash value
Original sample name:	2600cbb9ad38c10aca6ac4a91900cc84.exe
Analysis ID:	1430594
MD5:	2600cbb9ad38c10aca6ac4a91900cc84
SHA1:	f670e02edea5048e57c089ae4042f1f00a5790f0
SHA256:	e62d890d90cb121e7fb678dea021786d5558ba433bc1499580b3e327bc85e847
Tags:	DCRatexe
Infos:

Detection

DCRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Yara detected DCRat

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Creates processes via WMI

Drops PE files to the user root directory

Drops executable to a common third party application directory

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: System File Execution Location Anomaly

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Xmz1XDgtah.exe (PID: 3192 cmdline: "C:\Users\user\Desktop\Xmz1XDgtah.exe" MD5: 2600CBB9AD38C10ACA6AC4A91900CC84)

schtasks.exe (PID: 2460 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5424 cmdline: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5544 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5784 cmdline: schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\Framework\uPlspWkqijAQ.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7032 cmdline: schtasks.exe /create /tn "uPlspWkqijAQ" /sc ONLOGON /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\Framework\uPlspWkqijAQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5556 cmdline: schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\Framework\uPlspWkqijAQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3876 cmdline: schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 8 /tr "'C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\uPlspWkqijAQ.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6004 cmdline: schtasks.exe /create /tn "uPlspWkqijAQ" /sc ONLOGON /tr "'C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\uPlspWkqijAQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1868 cmdline: schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 6 /tr "'C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\uPlspWkqijAQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1096 cmdline: schtasks.exe /create /tn "SystemSettingsS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\SystemSettings.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5572 cmdline: schtasks.exe /create /tn "SystemSettings" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\SystemSettings.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2920 cmdline: schtasks.exe /create /tn "SystemSettingsS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\SystemSettings.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3524 cmdline: schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 7 /tr "'C:\Users\Default\uPlspWkqijAQ.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 408 cmdline: schtasks.exe /create /tn "uPlspWkqijAQ" /sc ONLOGON /tr "'C:\Users\Default\uPlspWkqijAQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1568 cmdline: schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 13 /tr "'C:\Users\Default\uPlspWkqijAQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2128 cmdline: schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 7 /tr "'C:\Recovery\uPlspWkqijAQ.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2132 cmdline: schtasks.exe /create /tn "uPlspWkqijAQ" /sc ONLOGON /tr "'C:\Recovery\uPlspWkqijAQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1788 cmdline: schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 14 /tr "'C:\Recovery\uPlspWkqijAQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 576 cmdline: schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\windows mail\uPlspWkqijAQ.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2724 cmdline: schtasks.exe /create /tn "uPlspWkqijAQ" /sc ONLOGON /tr "'C:\Program Files (x86)\windows mail\uPlspWkqijAQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4436 cmdline: schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\windows mail\uPlspWkqijAQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

RuntimeBroker.exe (PID: 2848 cmdline: "C:\Users\All Users\RuntimeBroker.exe" MD5: 2600CBB9AD38C10ACA6AC4A91900CC84)

RuntimeBroker.exe (PID: 5660 cmdline: "C:\Users\All Users\RuntimeBroker.exe" MD5: 2600CBB9AD38C10ACA6AC4A91900CC84)

RuntimeBroker.exe (PID: 4040 cmdline: "C:\Users\All Users\RuntimeBroker.exe" MD5: 2600CBB9AD38C10ACA6AC4A91900CC84)

SystemSettings.exe (PID: 3448 cmdline: "C:\Program Files\Windows Portable Devices\SystemSettings.exe" MD5: 2600CBB9AD38C10ACA6AC4A91900CC84)

SystemSettings.exe (PID: 4616 cmdline: "C:\Program Files\Windows Portable Devices\SystemSettings.exe" MD5: 2600CBB9AD38C10ACA6AC4A91900CC84)

uPlspWkqijAQ.exe (PID: 6596 cmdline: "C:\Program Files (x86)\windows mail\uPlspWkqijAQ.exe" MD5: 2600CBB9AD38C10ACA6AC4A91900CC84)

uPlspWkqijAQ.exe (PID: 6552 cmdline: "C:\Program Files (x86)\windows mail\uPlspWkqijAQ.exe" MD5: 2600CBB9AD38C10ACA6AC4A91900CC84)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: DCRat

{"SCRT": "{\"z\":\">\",\"h\":\"_\",\"0\":\"%\",\"J\":\"!\",\"M\":\"@\",\"y\":\"^\",\"W\":\";\",\"m\":\".\",\"a\":\"&\",\"d\":\"|\",\"Z\":\"(\",\"9\":\")\",\"w\":\"#\",\"i\":\"$\",\"6\":\" \",\"R\":\"-\",\"U\":\"*\",\"I\":\"`\",\"e\":\"~\",\"b\":\"<\",\"5\":\",\"}", "PCRT": "{\"2\":\"&\",\"0\":\".\",\"t\":\"%\",\"m\":\")\",\"F\":\"~\",\"z\":\"^\",\"l\":\";\",\"1\":\"|\",\"O\":\"!\",\"U\":\"$\",\"W\":\"(\",\"Y\":\">\",\"b\":\"`\",\"5\":\",\",\"Z\":\" \",\"I\":\"@\",\"d\":\"*\",\"J\":\"-\",\"Q\":\"_\",\"y\":\"#\",\"V\":\"<\"}", "TAG": "", "MUTEX": "DCR_MUTEX-oHyGiBm2BnEtQkC1Sx7R", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false, "H1": "http://fghjdtgujkjdgkdettygdbnbbn.000webhostapp.com/@zd3bk5Wa3RHb1FmZlR0X", "H2": "http://fghjdtgujkjdgkdettygdbnbbn.000webhostapp.com/@zd3bk5Wa3RHb1FmZlR0X", "T": "0"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000001C.00000002.2189528760.0000000002801000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000001D.00000002.2176112255.00000000031B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.2063649768.000000000309B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000001A.00000002.2165029559.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000017.00000002.2544259948.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.2063649768.0000000003080000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000018.00000002.2163434123.00000000034A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000019.00000002.2175393903.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000019.00000002.2175393903.00000000026BB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000001A.00000002.2165029559.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000001C.00000002.2189528760.000000000283F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000001B.00000002.2154907035.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.2063649768.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.2068660844.0000000012BEF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: Xmz1XDgtah.exe PID: 3192	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: RuntimeBroker.exe PID: 2848	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: RuntimeBroker.exe PID: 5660	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: RuntimeBroker.exe PID: 4040	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: SystemSettings.exe PID: 3448	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: SystemSettings.exe PID: 4616	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: uPlspWkqijAQ.exe PID: 6596	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: uPlspWkqijAQ.exe PID: 6552	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 17 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\Xmz1XDgtah.exe, ProcessId: 3192, TargetFilename: C:\Users\All Users\RuntimeBroker.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\All Users\RuntimeBroker.exe" , CommandLine: "C:\Users\All Users\RuntimeBroker.exe" , CommandLine|base64offset|contains: , Image: C:\ProgramData\RuntimeBroker.exe, NewProcessName: C:\ProgramData\RuntimeBroker.exe, OriginalFileName: C:\ProgramData\RuntimeBroker.exe, ParentCommandLine: "C:\Users\user\Desktop\Xmz1XDgtah.exe", ParentImage: C:\Users\user\Desktop\Xmz1XDgtah.exe, ParentProcessId: 3192, ParentProcessName: Xmz1XDgtah.exe, ProcessCommandLine: "C:\Users\All Users\RuntimeBroker.exe" , ProcessId: 2848, ProcessName: RuntimeBroker.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /f, CommandLine: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Xmz1XDgtah.exe", ParentImage: C:\Users\user\Desktop\Xmz1XDgtah.exe, ParentProcessId: 3192, ParentProcessName: Xmz1XDgtah.exe, ProcessCommandLine: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /f, ProcessId: 2460, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Xmz1XDgtah.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\ProgramData\RuntimeBroker.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	Avira: detection malicious, Label: TR/Dropper.Gen

Found malware configuration

Source: 00000000.00000002.2068660844.0000000012BEF000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"SCRT": "{\"z\":\">\",\"h\":\"_\",\"0\":\"%\",\"J\":\"!\",\"M\":\"@\",\"y\":\"^\",\"W\":\";\",\"m\":\".\",\"a\":\"&\",\"d\":\"|\",\"Z\":\"(\",\"9\":\")\",\"w\":\"#\",\"i\":\"$\",\"6\":\" \",\"R\":\"-\",\"U\":\"*\",\"I\":\"`\",\"e\":\"~\",\"b\":\"<\",\"5\":\",\"}", "PCRT": "{\"2\":\"&\",\"0\":\".\",\"t\":\"%\",\"m\":\")\",\"F\":\"~\",\"z\":\"^\",\"l\":\";\",\"1\":\"|\",\"O\":\"!\",\"U\":\"$\",\"W\":\"(\",\"Y\":\">\",\"b\":\"`\",\"5\":\",\",\"Z\":\" \",\"I\":\"@\",\"d\":\"*\",\"J\":\"-\",\"Q\":\"_\",\"y\":\"#\",\"V\":\"<\"}", "TAG": "", "MUTEX": "DCR_MUTEX-oHyGiBm2BnEtQkC1Sx7R", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false, "H1": "http://fghjdtgujkjdgkdettygdbnbbn.000webhostapp.com/@zd3bk5Wa3RHb1FmZlR0X", "H2": "http://fghjdtgujkjdgkdettygdbnbbn.000webhostapp.com/@zd3bk5Wa3RHb1FmZlR0X", "T": "0"}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	ReversingLabs: Detection: 81%
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	ReversingLabs: Detection: 81%
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\uPlspWkqijAQ.exe	ReversingLabs: Detection: 81%
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	ReversingLabs: Detection: 81%
Source: C:\ProgramData\RuntimeBroker.exe	ReversingLabs: Detection: 81%
Source: C:\Recovery\uPlspWkqijAQ.exe	ReversingLabs: Detection: 81%
Source: C:\Users\Default\uPlspWkqijAQ.exe	ReversingLabs: Detection: 81%

Multi AV Scanner detection for submitted file

Source: Xmz1XDgtah.exe

ReversingLabs: Detection: 87%

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Xmz1XDgtah.exe

Joe Sandbox ML: detected

Source: Xmz1XDgtah.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\uPlspWkqijAQ.exe	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\33d07815358cfe	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Directory created: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Directory created: C:\Program Files\Windows Portable Devices\9e60a5f7a3bd80	Jump to behavior

Source: Xmz1XDgtah.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \Desktop\DCLIB-master\obj\Debug\DCLIB.pdbU.o. a._CorDllMainmscoree.dll source: Xmz1XDgtah.exe, 00000000.00000002.2105547548.000000001BEA0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: \Desktop\DCLIB-master\obj\Debug\DCLIB.pdb source: Xmz1XDgtah.exe, 00000000.00000002.2105547548.000000001BEA0000.00000004.08000000.00040000.00000000.sdmp

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://fghjdtgujkjdgkdettygdbnbbn.000webhostapp.com/@zd3bk5Wa3RHb1FmZlR0X

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 145.14.145.191:80

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: fghjdtgujkjdgkdettygdbnbbn.000webhostapp.com

Source: RuntimeBroker.exe, 00000017.00000002.2544259948.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fghjdtgujkjdgkdettygdbnbbn.000webhostapp.com
Source: RuntimeBroker.exe, 00000017.00000002.2544259948.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000017.00000002.2580563093.0000000013745000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fghjdtgujkjdgkdettygdbnbbn.000webhostapp.com/
Source: RuntimeBroker.exe, 00000017.00000002.2544259948.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fghjdtgujkjdgkdettygdbnbbn.000webhostapp.com/_Defaultwindows.php?AhHKH=fcLr25XP3&5CesUO1hd=uc
Source: Xmz1XDgtah.exe, 00000000.00000002.2063649768.00000000030A3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000017.00000002.2544259948.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Code function: 0_2_00007FF848F52C60	0_2_00007FF848F52C60
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Code function: 0_2_00007FF848F42C20	0_2_00007FF848F42C20
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Code function: 0_2_00007FF848F4A553	0_2_00007FF848F4A553
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Code function: 0_2_00007FF848F42C20	0_2_00007FF848F42C20
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Code function: 0_2_00007FF848F42C18	0_2_00007FF848F42C18
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Code function: 0_2_00007FF848F42C20	0_2_00007FF848F42C20
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Code function: 0_2_00007FF848F42C20	0_2_00007FF848F42C20

Source: Xmz1XDgtah.exe	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: SystemSettings.exe.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: uPlspWkqijAQ.exe.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: uPlspWkqijAQ.exe0.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: RuntimeBroker.exe.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: Xmz1XDgtah.exe, 00000000.00000002.2068660844.0000000012BEF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename$ vs Xmz1XDgtah.exe
Source: Xmz1XDgtah.exe, 00000000.00000002.2068660844.0000000013927000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename$ vs Xmz1XDgtah.exe
Source: Xmz1XDgtah.exe, 00000000.00000002.2105215938.000000001BC70000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamePerformanceCounter.dclib4 vs Xmz1XDgtah.exe
Source: Xmz1XDgtah.exe, 00000000.00000002.2063481655.0000000002A90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename$ vs Xmz1XDgtah.exe
Source: Xmz1XDgtah.exe, 00000000.00000002.2105654245.000000001BED0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename( vs Xmz1XDgtah.exe
Source: Xmz1XDgtah.exe, 00000000.00000002.2105276018.000000001BC80000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename4 vs Xmz1XDgtah.exe
Source: Xmz1XDgtah.exe, 00000000.00000002.2063529505.0000000002AB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename( vs Xmz1XDgtah.exe
Source: Xmz1XDgtah.exe, 00000000.00000002.2063418340.0000000002A70000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename( vs Xmz1XDgtah.exe
Source: Xmz1XDgtah.exe, 00000000.00000000.2024246200.0000000000994000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs Xmz1XDgtah.exe
Source: Xmz1XDgtah.exe, 00000000.00000002.2105547548.000000001BEA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameDCLIB.dll, vs Xmz1XDgtah.exe
Source: Xmz1XDgtah.exe, 00000000.00000002.2105625648.000000001BEC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameUserPingCounter.dclib4 vs Xmz1XDgtah.exe
Source: Xmz1XDgtah.exe, 00000000.00000002.2105578894.000000001BEB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameUSBSpread.dll4 vs Xmz1XDgtah.exe
Source: Xmz1XDgtah.exe, 00000000.00000002.2062394348.0000000000E8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs Xmz1XDgtah.exe
Source: Xmz1XDgtah.exe, 00000000.00000002.2105479249.000000001BE90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename( vs Xmz1XDgtah.exe
Source: Xmz1XDgtah.exe	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs Xmz1XDgtah.exe

Source: Xmz1XDgtah.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: Xmz1XDgtah.exe, NW2uKWEl2voJx3P2MlX.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Xmz1XDgtah.exe, NW2uKWEl2voJx3P2MlX.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Xmz1XDgtah.exe, gNbkyc3Fb5IEmr2OunU.cs	Cryptographic APIs: 'TransformBlock'
Source: Xmz1XDgtah.exe, gNbkyc3Fb5IEmr2OunU.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@30/25@1/1

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe

File created: C:\Program Files (x86)\reference assemblies\Microsoft\Framework\uPlspWkqijAQ.exe

Jump to behavior

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe

File created: C:\Users\All Users\RuntimeBroker.exe

Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Mutant created: NULL
Source: C:\ProgramData\RuntimeBroker.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\f254ab210b6257ca012cb1502a65f787fee1c0f8

Source: Xmz1XDgtah.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Xmz1XDgtah.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ProgramData\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Xmz1XDgtah.exe

ReversingLabs: Detection: 87%

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe

File read: C:\Users\user\Desktop\Xmz1XDgtah.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Xmz1XDgtah.exe "C:\Users\user\Desktop\Xmz1XDgtah.exe"
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /f
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\Framework\uPlspWkqijAQ.exe'" /f
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "uPlspWkqijAQ" /sc ONLOGON /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\Framework\uPlspWkqijAQ.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\Framework\uPlspWkqijAQ.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 8 /tr "'C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\uPlspWkqijAQ.exe'" /f
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "uPlspWkqijAQ" /sc ONLOGON /tr "'C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\uPlspWkqijAQ.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 6 /tr "'C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\uPlspWkqijAQ.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SystemSettingsS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\SystemSettings.exe'" /f
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SystemSettings" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\SystemSettings.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SystemSettingsS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\SystemSettings.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 7 /tr "'C:\Users\Default\uPlspWkqijAQ.exe'" /f
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "uPlspWkqijAQ" /sc ONLOGON /tr "'C:\Users\Default\uPlspWkqijAQ.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 13 /tr "'C:\Users\Default\uPlspWkqijAQ.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 7 /tr "'C:\Recovery\uPlspWkqijAQ.exe'" /f
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "uPlspWkqijAQ" /sc ONLOGON /tr "'C:\Recovery\uPlspWkqijAQ.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 14 /tr "'C:\Recovery\uPlspWkqijAQ.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\windows mail\uPlspWkqijAQ.exe'" /f
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "uPlspWkqijAQ" /sc ONLOGON /tr "'C:\Program Files (x86)\windows mail\uPlspWkqijAQ.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\windows mail\uPlspWkqijAQ.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\ProgramData\RuntimeBroker.exe "C:\Users\All Users\RuntimeBroker.exe"
Source: unknown	Process created: C:\ProgramData\RuntimeBroker.exe "C:\Users\All Users\RuntimeBroker.exe"
Source: unknown	Process created: C:\ProgramData\RuntimeBroker.exe "C:\Users\All Users\RuntimeBroker.exe"
Source: unknown	Process created: C:\Program Files\Windows Portable Devices\SystemSettings.exe "C:\Program Files\Windows Portable Devices\SystemSettings.exe"
Source: unknown	Process created: C:\Program Files\Windows Portable Devices\SystemSettings.exe "C:\Program Files\Windows Portable Devices\SystemSettings.exe"
Source: unknown	Process created: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe "C:\Program Files (x86)\windows mail\uPlspWkqijAQ.exe"
Source: unknown	Process created: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe "C:\Program Files (x86)\windows mail\uPlspWkqijAQ.exe"
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process created: C:\ProgramData\RuntimeBroker.exe "C:\Users\All Users\RuntimeBroker.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: wldp.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: wldp.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\uPlspWkqijAQ.exe	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\33d07815358cfe	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Directory created: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Directory created: C:\Program Files\Windows Portable Devices\9e60a5f7a3bd80	Jump to behavior

Source: Xmz1XDgtah.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Xmz1XDgtah.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Xmz1XDgtah.exe

Static file information: File size 3149312 > 1048576

Source: Xmz1XDgtah.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x27cc00

Source: Xmz1XDgtah.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \Desktop\DCLIB-master\obj\Debug\DCLIB.pdbU.o. a._CorDllMainmscoree.dll source: Xmz1XDgtah.exe, 00000000.00000002.2105547548.000000001BEA0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: \Desktop\DCLIB-master\obj\Debug\DCLIB.pdb source: Xmz1XDgtah.exe, 00000000.00000002.2105547548.000000001BEA0000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: Xmz1XDgtah.exe, NW2uKWEl2voJx3P2MlX.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: Xmz1XDgtah.exe, Ov44rBW9BqExLVkWHXs.cs	.Net Code: PxkZDnMADx System.AppDomain.Load(byte[])
Source: Xmz1XDgtah.exe, Ov44rBW9BqExLVkWHXs.cs	.Net Code: PxkZDnMADx System.Reflection.Assembly.Load(byte[])
Source: Xmz1XDgtah.exe, Ov44rBW9BqExLVkWHXs.cs	.Net Code: PxkZDnMADx

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Code function: 0_2_00007FF848F400BD pushad ; iretd	0_2_00007FF848F400C1
Source: C:\ProgramData\RuntimeBroker.exe	Code function: 23_2_00007FF848F100BD pushad ; iretd	23_2_00007FF848F100C1
Source: C:\ProgramData\RuntimeBroker.exe	Code function: 24_2_00007FF848F400BD pushad ; iretd	24_2_00007FF848F400C1
Source: C:\ProgramData\RuntimeBroker.exe	Code function: 25_2_00007FF848F000BD pushad ; iretd	25_2_00007FF848F000C1
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Code function: 26_2_00007FF848F400BD pushad ; iretd	26_2_00007FF848F400C1
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Code function: 27_2_00007FF848F200BD pushad ; iretd	27_2_00007FF848F200C1
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Code function: 28_2_00007FF848F000BD pushad ; iretd	28_2_00007FF848F000C1
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Code function: 29_2_00007FF848F400BD pushad ; iretd	29_2_00007FF848F400C1

Source: Xmz1XDgtah.exe, VXBxhTWkknLJAuRG00l.cs	High entropy of concatenated method names: 'ojoRG1oq7p', 'NYdRAN2WIU', 'TtWRmJRxcl', 'tyFR1kc00L', 'Uq8RqnmxSH', 'GsI9I34B9oHpeM2VOnl', 'zhinfL4H5KoPLmYkpWa', 'W28q93P7w4Duh1voJgm', 'wRveyDPzaOkTgcJqTe2', 'H3NqiY4TUM3naYEJDtB'
Source: Xmz1XDgtah.exe, EMywaPgxSSdhKWLTgKp.cs	High entropy of concatenated method names: 'P8M3huFjPP', 'Iia0HipcxuEDE7awxqX', 'XjClmmpmVIh1S858sw5', 'yjH0H3pqibvyKiItHJM', 'vxGQqkpokYhLuNOS2hl', 'lb9T3Ep7uU03g0N1TdU', 'IPGx9XpzUtWYs2jMDcW'
Source: Xmz1XDgtah.exe, LlAVDgWxaoIBr1yPNyw.cs	High entropy of concatenated method names: 'fdhEn7TQOQ', 'GVmgdjfoWX58HaIjTof', 'yFGt6Hf74yNWhbD8oZm', 'MX8eBXfqIalINYeDqbd', 'LCi7YDfcGNKduxN8GiQ', 'rNJRHQfzJLFj5YYkEBG', 'Pn7E3kCBC698SA8chKk', 's5H3iJCHTNs2Lap3rp4', 'skf0uNCTFbyff3Un7G8', 'HfcXkbCkRQIXaRvF80M'
Source: Xmz1XDgtah.exe, bEW0lMw96pSFmjvn8vD.cs	High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: Xmz1XDgtah.exe, ODtqL8OMhuX0B2co77.cs	High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'w6op1KdPoWBWRwPaVao', 'Dot8xYd4lF62WvOs6GJ', 'S1ZrLkdfMl2UdgOUEgV', 'qooEEkdCp0s47bWewPQ', 'FweVkUdxVLPs4pt8u3m', 'J2mnDJdUhMIbYfl5ou4'
Source: Xmz1XDgtah.exe, ondnecCOsv07kjb6nlF.cs	High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'dmctRWyVHSHr2cJNClA', 'BQNvAOyIAjhRg8TGwtX', 'uZHPyhyuJK37RWeX11k', 'JBZHOPyYsqnwtRlojis', 'jp1fueybDG6WHggvfOI', 'bLkxcgypASQnqGP90j6'
Source: Xmz1XDgtah.exe, rx7tx0g9lQUiZ9vd8Ux.cs	High entropy of concatenated method names: 'BcVqwRLn5C', 'oY5qGgg0NU', 'WKkxY7bjpoSV2fq6ySK', 't7ihY9bmNwC3SYTxGHF', 'FCPmbMbqLxlnUy2bfco', 'jLTS2obcITFcVJwmWZd', 'bZEwi9boEkVUYEHu4mB', 'N1mnbvb71Oy1Ed7FZkp', 'S7s4gDbzuEbCBrpl30k', 'VdgMXYpBUihGionJl8G'
Source: Xmz1XDgtah.exe, q9UJ2doyb6apuvdmeF9.cs	High entropy of concatenated method names: 'sg9', 'V2Vcd0Cxbn', 'UCRiP3bVIP', 'ndYcyfVS68', 'L3gG2eE1R1YRpt7rAxJ', 'zV97GKEtXEtko8UPu4W', 'd9KUTBEer9p3Tn72Vv7', 'tio4OpELHRqg0FPgOqp', 'WO75ygEswJcUKFqRHJZ', 'hJp23REamoURqLo1UEQ'
Source: Xmz1XDgtah.exe, R7A2ImwMGE7muJq6Xk0.cs	High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'VWK8hIjcQJ', '_3il', 'Lh88dOKVkP', 'erV8yIMhuN', '_78N', 'z3K'
Source: Xmz1XDgtah.exe, OXua05wgmekh6IUMpym.cs	High entropy of concatenated method names: 'ERZeXonxBw', 'cu9CraZxXian5oJIo1C', 'nxTu3TZUXJmNLGWlwEd', 'bkUD2vZfy7bKdp0Bgxj', 'BAVqoMZCxC017LqdIqw', 'cMBpHZx2HU', 'JR7p073GDg', 'k5NpcIdhKd', 'g8RpBpfPGn', 'DFbpK59lZK'
Source: Xmz1XDgtah.exe, IYdOBW3mEtEbOfmCjM1.cs	High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: Xmz1XDgtah.exe, pGoeHZkf4LVcx0ZnOp.cs	High entropy of concatenated method names: 'V0yqFHk3Q', 'b7X3gVBml', 'SDVNnXY60', 'eSgvr1Hdt', 'SjXtY1dWo', 'eKbVE5IMj', 'wfGnLAuZ3', 'IUukUMH9amNwxupPIEs', 'LNWU2YHNVWXG5VZHMfc', 'bSlqrnHgdThASj74b8N'
Source: Xmz1XDgtah.exe, CQn6PAocx9LqdpwGFFY.cs	High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'SRE6rjEF5lZ6N01UmIF', 'zuiKWWEXhY9cqFg0dSM', 'jkiPVVEPl9X75FFYh56', 'ej6cv2E4j7PrXvETUbt'
Source: Xmz1XDgtah.exe, xaLNJfwjavLw8SWQTbE.cs	High entropy of concatenated method names: 'ERNb3u4uOq', 'vidbvKos4h', 'QORb8h0x3O', 'iHqbD56CS8', 'hOSbb2M9QL', 'EY3buUDoCI', 'NBobXMHh1U', 'Vcqbl9vRiP', 'pPfbgTDjUY', 'ut6bopZwrK'
Source: Xmz1XDgtah.exe, pQIVxDC68AZYDvyxXup.cs	High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'g0lxFWAGKeddEyZTAuF', 'jTOIKdArgxRwrVdjWVo', 'bxf6qCAwptZAFUFdLYR', 'XeAkPHASdH8XWqMqrhj', 'G98rqnAvAYkyVXn12PA', 'Uh4GQmAVymB5JTtjVGR'
Source: Xmz1XDgtah.exe, sMff8i3i9iaY2ctCIAi.cs	High entropy of concatenated method names: 'VZgviiqugI', 'xRQvpP7WPO', 'phZvQJE4AS', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'RpZveFdYhN'
Source: Xmz1XDgtah.exe, fIACd0CTUMpPcQS3bEK.cs	High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'g1K4JvA3qPUFiUgnygk', 'YnQq2tAJU59ip1iRIJO', 'xJc6lUA8hMg2ZoeJ7F1', 'JP2LJRADNZaeVE2NqEo', 'bmPpKgA2YOkPHVYPaEB', 'McxxpYARLgFEEas44tZ'
Source: Xmz1XDgtah.exe, opdMwhvE0DlkMwLHIx.cs	High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'eGWlD3O2fTMKcCHhYLb', 'G2rcGVORZtamRlTfeIM', 'O7Ke2sOLp5D3h9LytD3', 'PwUJpYOsgXWfJZD0qck', 'wj4uRgO1pTs04OEHblt', 'qFK2B6Otg6TGjEjeyQQ'
Source: Xmz1XDgtah.exe, DRjnXP3qRK73qvhslxe.cs	High entropy of concatenated method names: 'Owhpuo2OtLGfB43s5D2', 'b7Ttid2dSKwKGctEhpv', 'aVfYjk2T9bxjYqjLEVm', 'rWnQsh2kD35bphLUZHK', 'rBNvKQeOF4', 'WM4', '_499', 't1ev48cCNv', 'bSxvjuKEI3', 'BCsv9uvpxo'
Source: Xmz1XDgtah.exe, OpuC6PC5FAy3VaeLOhe.cs	High entropy of concatenated method names: 'zDudIsi06Z', 'LDiSZjgTnIdUY79bvnA', 'TbqrKLgkXjB0lSWu66p', 'iZLNmvgBsYCMJyI1mR4', 'I91oghgHkEqKQDexTU5', 'm1kgltgOM7RdQZXvEJf', 'FPPTFPgdw1pFwMauPJ3', 'yLplKxgiVHZaPNmQfJg', 'Y6xdJbmx0x', 'PlOytAgNKZhCBmaUuEB'
Source: Xmz1XDgtah.exe, Oo6LuSCeeA3wP7nR2y5.cs	High entropy of concatenated method names: '_2WU', 'YZ8', '_743', 'G9C', 'qMVQOEyioc47rJSqx1x', 'h4wM0byAUA6KgGWIKVN', 'D1DpSjy9QgTHvxk8BrB', 'zysfT6yNBHV3mHolbBC', 'S0iqreyOBQ5ocaVk3m0', 'KeXls0ydkxSfB4rdsiI'
Source: Xmz1XDgtah.exe, Xi8XwX3WQNGhT76LFas.cs	High entropy of concatenated method names: 'cMFNUCKXs9', 'm6MNiVciCT', '_8r1', 'rT0NpNmoah', 'Ww7NQ5u9vW', 'apXNey35it', 'y4fNOZgVi5', 'KnRqksJ4jMG45a8dnXv', 'g27lcCJfni9vnp3ceXh', 'EP50LvJCkTlOMiQZiTJ'
Source: Xmz1XDgtah.exe, K46a08zqiqXlhdQigQ.cs	High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'U0MiKfikj1QMfG7Gjyy', 'BarfBtiO74qWdlXw084', 'HJ32AbidOtNPV6tJlkZ', 'No5rhEii0H2Bg4T3VJD', 'D6KZHEiA7oskFckOKV7', 'GTGruZi9wRuAL649ejb'
Source: Xmz1XDgtah.exe, nHWBEeoQQFBMEcVipQH.cs	High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'ugOcpOaVEI', '_168', 'pKK1JuMZ477ZwbDHNyX', 'EY8K5hMKKb9Fxnpt59R', 'OibyDLMGQYj1CQcjM3K', 'r0mj2VMrS0VTmknbsmI', 'OF2IVuMwn2EreW54xw5'
Source: Xmz1XDgtah.exe, j0trJYJwd8f6lv5iUQ.cs	High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'XJraZNkqcjSQew1Etso', 'XLVHnlkc2b3iwYOBXrC', 'ISlc0NkoqOPJN6QxG3k', 'twNIysk7EFVApiZQRmM', 'fDcNsIkzH82onNVioVF', 'nTMTB3OBO9XNFl1KrSh'
Source: Xmz1XDgtah.exe, FIqHVHCoSF1ZFOIEpFm.cs	High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'IrQmPHiSrDloegM0je1', 'empS9GivseApZuwQTpD', 'LL0tAtiV8BlsUPvjNFt', 'zygv84iIQhKUehMVX7a', 'cZypbiiuTTi2qsjvh4t', 'Yvdmp2iYWlaY34cxOFZ'
Source: Xmz1XDgtah.exe, nSR75jCcCwq2jhNES7t.cs	High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'F4ldfm9hTyOynvdCkcC', 'avur6j9ZBCP6tqmIIdP', 'CniStg9KAvHWRMY0vy5', 'jvbmu79G3oJJye94fQg', 'IxMsyt9r06XopymMpGg', 'X4qdne9wA2EGLwyEk2n'
Source: Xmz1XDgtah.exe, TVHPM1ozxoSnPbis6iD.cs	High entropy of concatenated method names: 'HVeptXG98e', 'jtRpVv6blF', 'qxfpnbf8mg', 'T3Or0Qh84GgAFvpnT6E', 'qWpkVAhD4XrrWjyO3VS', 'sCboqQh3Oa2JIHnlqjP', 'k6oXXohJj3T8X917UVe', 'SjnPqih2rj3dLWqQNCs', 'iVMmbghRU4g6GqOAbu2', 'B2UPQbhLDQDLDwMhERq'
Source: Xmz1XDgtah.exe, B95CnkownlptRU4FTbJ.cs	High entropy of concatenated method names: 'nEhfx4LqvJ', 'qitfCT4OfP', 'E8vfa2UKnu', 'MSVfIDbldd', 'MX7fsCtOpl', 'A8efJjuYaf', 'IiqV31UwE7V5IVwlKt5', 'TeZBj6UGjjsAw3eJQSA', 'AL76xcUrJr5mehbHAgk', 'uQg30HUSLdLbWotB4JO'
Source: Xmz1XDgtah.exe, pJX8ioWZIH2XtLxQNCq.cs	High entropy of concatenated method names: 'pMyZzipBp7', 'fXyRhrXpyl', 'UHPRdA2MIm', 'v4MRyblU1m', 'DrCRZybCD7', 'OJjRRp87GI', 'vx3REUMTAh', 'euXRkYHDGE', 'GflRfkrmFi', 'onDRUWWORZ'
Source: Xmz1XDgtah.exe, pR7kXx3UJtpoxFN0QeO.cs	High entropy of concatenated method names: 'IGD', 'CV5', 'QA3NqwIUgt', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: Xmz1XDgtah.exe, SVNUDvC83tMX2oQw2EN.cs	High entropy of concatenated method names: 'lc3dnmQhHY', 'HLLoqF9CrUtvbSUXJWL', 'dAMiMT9xhaVC44thZjP', 'uj7wlC94VtmWUjv3Zv9', 'pa56EB9flMFqPfGyWuL', 'ACwbju9Uac5Sl1ixynf', 'pWDBbQ9lRdaPq0t5qgf', 'Rjs2cQ96DEaoFh2Txsc', 'PdLJuU95ERoZII6nxp1', 'f28'
Source: Xmz1XDgtah.exe, YkbDrFyyStdM2VBiEB.cs	High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'EFi9ekOyD8mVfEPfnZH', 'BTHWLYO0JZnTGBP8586', 'CUjULKOQoq44Am7S2IZ', 'L6frcQOFQBnTNKM9RlX', 'SDAHsnOXurotZo2kBeA', 'OPlmB1OP8Cpem2YoSDZ'
Source: Xmz1XDgtah.exe, ouHgy3o6trn0gZOiEFF.cs	High entropy of concatenated method names: '_223', 'btU6GK6C7dHmmIt3rim', 'MYbXCg6xHbw91Mbk6BC', 'LlbBZ56UNX7AYK85L2n', 'WpEJOW6leEAO0LYHUKT', 'bX31mG66slUJU4D6v36', 'eAqmQ9659N9e9lUnbHt', 'MuJn3n6EvAwMIcdoVy5', 'EuPeH06MUIT3DKwtmdW', 'NA6E9M6hgRA2lM3GAng'
Source: Xmz1XDgtah.exe, VhFK08oeCSA8xAhKEUP.cs	High entropy of concatenated method names: '_5u9', 'cxIcRHGmwy', 'AbCph3IL99', 'NulcEY2WEa', 'JSitMBEcrufH6tfJg1V', 'wnfal1EohAV3uqsFcR8', 'gaaCX9E7ClogACPefC7', 'b67DFYEmMeJLYS6rKoD', 'CEVt85Eqc5hZiomQ8md', 'yEM0lYEz2KkcB2pexh1'
Source: Xmz1XDgtah.exe, IlOY9MwHAxDGpUteZ7w.cs	High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: Xmz1XDgtah.exe, E9APIHtfj9IWVJdN7k.cs	High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'kSDTNMfjx', 'eEasioTURKU4HbDXSvG', 'MtKymhTlOEjE12IVkin', 'y9mSHLT6WaSNPul2egj', 'vQOZtlT5edLFybFFWO5', 'FuCK8bTEO2fvZZtOojA'
Source: Xmz1XDgtah.exe, eoGxSGCE5g9Feb68bfL.cs	High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'e6eCRhimt0O4lfYfoHX', 'c7puKAiqxCqTA7fMoc7', 'pO86REicfiFQvUvKXAH', 'in2w1Jioqr4kkQEBlZe', 'p0N7LKi7PBsxB3Gow2I', 'u2U6mLizfoVau6pCaa4'
Source: Xmz1XDgtah.exe, yTps8eC2B4m1iQdPp2r.cs	High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'nkHlNk9BIttm7o5Sxq5', 'cCFU4G9HA3Klt28Tc7n', 'jC5XvW9T9EpVxxprZVR', 'mmg97Q9kbZxiCbcxXXR', 'YpteOd9OhQgLL1VjvTa', 'vKZKvL9d5XFeOrH8bC3'
Source: Xmz1XDgtah.exe, M31ykgWTatOQZ2hdCKu.cs	High entropy of concatenated method names: 'LN5ZYLwkIo', 'YnM4dKXko1vmDFUjrP6', 'So5kmiXOVJUGPwRv4y5', 'ff2crNXHmtkZyJqeNZ9', 'UtlT6TXT0SbTyiNlvqU', 'VFn8HPXdaOu1qqgXC9s', 'WEiS9qXixFv10bu8juc', 'mAhaubXAmXK8M1xOXRU', 'RkVU42X93EB8qrSpHhv', 'bDgwnOXNxbCGglAyDKF'
Source: Xmz1XDgtah.exe, j3jDSkg5UDA4hIK0cSb.cs	High entropy of concatenated method names: 'DZ3qJD1Gbv', 'FvBqWTJh8N', 'g2bq5hNLVP', 'zx52RlpJxQT4JLLJ32b', 'wwrNsMpWYKJ64vbvQqW', 'sxkhdjp3jXWlClk1UEB', 'FjoEi3p8SFBa3rukjiF', 'tcnIoEpDbRDXd2g0vAV', 'Pa9YFAp2AV77HZ4n9TN', 'edSmgKpRiDuDaWgwYtf'
Source: Xmz1XDgtah.exe, NW2uKWEl2voJx3P2MlX.cs	High entropy of concatenated method names: 'j2TlWELK80U3fmFd8us', 'Ba2WH6LGVNRVb16OQ43', 'YUMJTrLhVfkNiKtuC40', 'aqTBgULZE51TnJOtnrA', 'iw10DCA4Mq', 'k1nE4wLS8t7n6ynavrn', 'MaKrTrLvIsywaEHGID9', 'xiFuDNLVcF1J9LtXFZo', 'bEMqEVLI2bf9yTdbScf', 'y4O1K4LuuZNgUYS4Epo'
Source: Xmz1XDgtah.exe, ifYcopaJKpaGbfgM1c.cs	High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'xpuWpYkbaIW9BuHI4Cf', 'IS3c5bkpd4Un7rTDKPU', 'hHIPsXkWpBV9R9yogxR', 'WNYIJck3UfIMCBE0kXk', 'lYBuBgkJpWrJ7Ao5aj9', 'DLS2RMk8MoiBobLQqj7'
Source: Xmz1XDgtah.exe, AdhmTuwRtvZsUEfxSvq.cs	High entropy of concatenated method names: 'bX3ORee9Hg', 'HWZOEckNvh', 'D0hOk9qLMx', 'I3aWmnKfAnB6UHdXBFh', 'ts05VbKCy8tgobjgcj5', 'gNYsqWKPvwwdOn3tRfc', 'xxQ7HaK4AYpUSiTfYor', 'n9dwsxKxpgyfdcy3qiZ', 'RAFWGSKUj4BcUjVI0Lq', 'TB3MTiKlcCmLucQhMDo'
Source: Xmz1XDgtah.exe, iH96oGovhK1TS8iXnMl.cs	High entropy of concatenated method names: 'oYo', '_1Z5', 'HGGcfWEVn1', 'XWqpRSJfVB', 'pBYcU26vUb', 'x4JqiVMFRXdtnggZNQU', 'LELoQlMXRt0NuXAXip6', 'Pibgk2MPqKrTSSqgDv8', 'Vos2tYM48WJVD6qNZ07', 'cjXsqKMf71LuuRtkhxt'
Source: Xmz1XDgtah.exe, MJAyirwZLFxSCcvr6H0.cs	High entropy of concatenated method names: '_7zt', 'cHjOogrouJ', 'hM6OwNW3Lc', 'RCiOG5njmt', 'shOOAMTbIg', 'gUhOm8iSF4', 'J8oO1nuOuQ', 'WRoe5OKEo5IAbNVRCQB', 'ARe6aDKMOf4qxau424R', 'M3Pdb2K6F0hpwgjUb4l'
Source: Xmz1XDgtah.exe, B0gnOQoC0SxpYEmyg11.cs	High entropy of concatenated method names: 'FHefngjrMo', 'vPDfHTVk3I', 'OTNf012ruK', 'PfYfcHRACh', 'BkgrsvxzBvi4DgZBFFN', 'EUGhdIxoFYWMeZbWpke', 'jlbpcNx7Gsh1ycHlbfj', 'OLvH4oUBHcOXFbv0AdA', 'hrcOJ1UHWMDHVyS8EnA', 'rosXefUTCrZxT5mXtcC'
Source: Xmz1XDgtah.exe, YGY5Pyo21S7SSERU64v.cs	High entropy of concatenated method names: 'yMtUMDCRBx', 'kU0UrWthep', 'AooU62PKDs', 'C0YUYEkQtn', 'CUMUF9oWoc', 'wHsNJP5i1ucGDpMwAbe', 'hVVUoN5ApJnHyKBNAc9', 'awaiID5OD9PjkuwIK5c', 'VqmnPS5dSTqrYS0NMyx', 'kF68ke59ltvxpjdIH5j'
Source: Xmz1XDgtah.exe, AIvHJ8CjdlG0mxtqiLl.cs	High entropy of concatenated method names: 'H8Gyo3pQre', 'hSw6sV0i09U9pkE8gj0', 'vp66PX0A5HcELfSnQXV', 'dGQR2c0Ob45LcFWviTB', 'rYHd4R0drZrPhT7oQhs', 's8t7yd09PdXiPIEgIAO', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: Xmz1XDgtah.exe, kVukJswufJjeN6Q2t2J.cs	High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: Xmz1XDgtah.exe, Me9J1bWJ110Pv8yn3Br.cs	High entropy of concatenated method names: 'BuZkUwkiSQ', 'IqXkiNeifl', 'pbXeQNCmRlWQTu6YIw0', 'gVFTKdCqgHx9wwGpBVj', 'gLti92CnZCIVhwrSFsl', 'tH24ElCjGI3hj8WwgEs', 'KaukXOLEyh', 'Q8GNi6xBn86sRuj2q8Q', 'PBOiaIxH2U9S8sqMVS2', 'DC0rnGC7mGeJi3mDBBO'
Source: Xmz1XDgtah.exe, pgb5pA3eK6wOSiMr4Q9.cs	High entropy of concatenated method names: 'PJ1', 'jo3', 'pR2nirWStl', 'XaMnpRNnph', 'dgsnQCQN6i', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: Xmz1XDgtah.exe, Obgqifw6bCPZo00DCTD.cs	High entropy of concatenated method names: 'utHe4okqKp', 'R5nejvuZVa', 'vxEe9RO3eE', 'wR2eSMNyxJ', 'UdieTPGlsy', 'MQEsIAZ7P1Rl9AJteKf', 'FjxUdMZzWLWATEfS72T', 'Lj0TDhZcOuOi1jGLywy', 'H6VGueZoCyhyxLKaCDq', 'U4LfwTKBSHZiOOiUbKr'
Source: Xmz1XDgtah.exe, D6gLt83S3B9WFjDEZDQ.cs	High entropy of concatenated method names: 'EIcV99jDWy', 'Y0VbSf2SmIW2aKuTcUL', 'TLbdN02vsS9XxvNjklO', 'zB1rF22rjBvaHk26sny', 'RWaF3a2wmHOHcMKYg7b', '_1fi', 'V3itLgHtvL', '_676', 'IG9', 'mdP'
Source: Xmz1XDgtah.exe, ujH7EjWWPThNqvJAJWE.cs	High entropy of concatenated method names: 'QqdyJgBIvt', 'nL2yWhfTe1', 'P5qy5Zs0f1', 'TiXyLs9LIj', 'dVFyMEBWMg', 'mglyrksSUW', 'P51JrxQC6mWtTHc70Ky', 'UNxOlSQxeSU4cVM4vPi', 'a4pjOyQ48GZwd43onaB', 'K0txknQf5NntfRA9XfA'
Source: Xmz1XDgtah.exe, DMh4lNosPyJ75rS9yL3.cs	High entropy of concatenated method names: 'BUjUWMeaAQ', 'EA5U56wF1r', 'qRnULukO5e', 'L4DaQU6LjdrOJMWCqhw', 'H8Ap3w6sRTxxvcE63mQ', 'iybHkw61kQctA6Nx9vB', 'OahFxR6tkHeMeYSEGLL', 'mw0AXg6er6sAw3WxBix', 'tq3S0h6aOunogcXcSOI', 'II2qaY6nOLCJLiaVOyS'
Source: Xmz1XDgtah.exe, xI4qWHCsxHhA3sW0l3F.cs	High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'yGF3ErAn8TUpX0gtr1E', 'zFNjLvAjTwJvUDWGQ8d', 'oODXuoAmDZfXvkcGi6q', 'iRP9F1AqJiCMMLboliX', 'lmqKOiAc8PpWJ3nh5EL', 'rADp0PAovWmbX3umMos'
Source: Xmz1XDgtah.exe, R5cryb3fgU3RblKtF34.cs	High entropy of concatenated method names: 'U8FnmDofN6', '_1kO', '_9v4', '_294', 'HK1n1wjnN4', 'euj', 'kpenqrSKIt', 'xs2n3sbJ4V', 'o87', 'w8ZnN0ZtnR'
Source: Xmz1XDgtah.exe, WIiIHKg4DIpNNIvh2tg.cs	High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'YCX31y9NKk', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: Xmz1XDgtah.exe, sjDdXRoMLE7ilCKfZtH.cs	High entropy of concatenated method names: 'OaricAqrCb', 'ejoiBK59sD', 'UGWYkoExCg2x9urjL37', 'G8MANOEUHMo8PBbdUQh', 'VQlBmDEflZgKRNDPx7n', 'hyJiFhECmyB82mDGK6F', 'd3wZCOElLmgiqPbL7Bo', 'OrUetwE6EtyvgHBnqT4'
Source: Xmz1XDgtah.exe, gNbkyc3Fb5IEmr2OunU.cs	High entropy of concatenated method names: 'SSA3ItXaJt', 'laH3svn9wQ', 'Boq3JU0Qbb', 'zpN3W2ZUvb', 'vy435U4EDk', 'KwX3LUUrnH', '_838', 'vVb', 'g24', '_9oL'
Source: Xmz1XDgtah.exe, mwfabDWarpK451SmPhu.cs	High entropy of concatenated method names: '_0023Nn', 'Dispose', 'mvlEKYhLuV', 'SSgE4s7p2w', 'DO8EjkWZhK', 'OI9E92G04V', 'fY4ESvV86G', 'wBLr8tCN2OYZJ3i9pvb', 'wd951qCgEnWBFfX71Xp', 'OllXiQCAH0vNWtqNxiC'
Source: Xmz1XDgtah.exe, sGgb6lDXCFMQhsOP13.cs	High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'Nrc50ZdriyxBFyclUwG', 'VS3bKTdwMwYLkOBFho4', 'WSGIOfdSROZJ3IMhWh0', 'DqOyledvpna1O7u3SRF', 'HvV17NdVXJL04JAP4kR', 'wjUjvEdIEJypimvaPhy'
Source: Xmz1XDgtah.exe, HhVrxv33aal6xCrxK2F.cs	High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: Xmz1XDgtah.exe, fXC3MNgp1seKCyk2w86.cs	High entropy of concatenated method names: 'rVB3RBx1A6', 'AF73ENMu8H', 'OZ23kJwkuA', 'cga3fyEfWZ', 'HQl3UfsY02', 'fIp3i0O3oM', 'dQU3ptumKV', 'OvQ3QMDKxZ', 'jSy3euwFUr', 'xIf3OOYDu6'
Source: Xmz1XDgtah.exe, lHG7TtwXwHgkdWC9JB0.cs	High entropy of concatenated method names: 'Y3FOBPcOja', 'dnsOKgAreY', 'bJeO4hvnA2', 'fG3OjA0Hxl', 'rbBO9WwkMK', 'T8mWvlKYMPd6dfknEV9', 'pM6LmHKbK41H1BYpR8K', 'VTob6eKInPu9hrgsn61', 'QfgENHKuvSmbcUx8386', 'VvufliKpP69DHCrqacB'
Source: Xmz1XDgtah.exe, Lw9nRcWhlwm9SRX1rEX.cs	High entropy of concatenated method names: 'UkSR8wuqcV', 'RYbRDkEiXG', 'ULBFVyPhohm5siIOjvL', 'sM6OWDPZo8083Wvawdh', 'rVBWqkPE9icR4CsTval', 'hyG41SPMJpSTPCMQE8s', 'j0lYgHPKSYhcybI1DKU', 'UPbt4dPGdUeA3qcmoP1', 'GxTVtKPrxqSBDQM3CXg', 'gvIiXTPw2gQMh8Yensh'
Source: Xmz1XDgtah.exe, ew8DItgoNSZR99qKhWk.cs	High entropy of concatenated method names: 'DSGvrdIEtaDlm9qoyJf', 'veYjoZIMmCop9u5jOws', 'DQPnkiI6nhKW2kHqyiw', 'J3g2pPI5MsoXkIndCgn', 'SyVwqKMPLQ', 'O39DobIKZSfEfAHY8Yd', 'NieSbDIGJZNURsoQf5U', 'hKR1X1Ih1ZZa82pGO9C', 'NykPw1IZQIZIPsvdhtX', 'RlqtKPIrYXZ3jkv8eUv'
Source: Xmz1XDgtah.exe, AZ718mgm4rM6h9Q7BUq.cs	High entropy of concatenated method names: 'WfpqS0LOFF', 'exwqTb8N94', 'hFOq72pJZ7', 'k0yqxZjoWP', 'O6lqCqG1KB', 'MEjtwYprtsTfTVRpEQU', 'uTfkwEpKFnGHx0qMyPD', 'ATpAH3pGYnZUVLfLwTA', 'UeXvoVpwhKphIrgf0PY', 'Sek4GfpSQijKhWDvg73'
Source: Xmz1XDgtah.exe, AJkNgoCBBh9fhitKckV.cs	High entropy of concatenated method names: 'lfKyde1yRx', 'mHHyydt4Cu', 'dAYyZFlKNu', 'XQP60mgaJPs75aGG2Ys', 'FWcdDqgnkUei0lliKRS', 'nlK2FGgtTRhR5BYQMnA', 'atMPdwgemeKajcgeres', 'REUODXgjHkpwtnWXoYP', 'WgAaGwgmtSj7jNVbGUL', 'TjaxM3gqScSydsmuOYA'
Source: Xmz1XDgtah.exe, xaLyAce140I22S6FbY.cs	High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'BiGCh5OCCVge4lhhscd', 'Qj7q0rOxCZG1T88N93K', 'UMfcLqOUe4pm4C17o1w', 'lXqsXxOlb12GD5dOrRR', 'htDce4O6CjCuKrIRCTw', 'XreddTO58xlsfMCWCoV'
Source: Xmz1XDgtah.exe, o2pE1IWRUpqiShZB8f7.cs	High entropy of concatenated method names: 'TMWZPFb2nt', 'IiHZ2AqE4I', 'wUD5thXUlbq6h5klvyL', 'AlKCHZXlsy33Bf3s8SD', 'WQalo9X6EM3R90woD13', 'OT2NJUX5HswJ99uXdL7', 'Oq7GfXXEGobjXDKBoFm', 'JPnprfXM0WLqfaU7BGg', 'WZMDNCXhyhbFPBDghHf', 'O9di7tXZyjcUJbhdPF1'
Source: Xmz1XDgtah.exe, lCptlDq2ZQPVK2Ntjq.cs	High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'KKGCcJm0D', 'Xm1N9wTYBSI29JD5y2o', 'NROtPyTbK9gEXZGCT0u', 'ltcHJ4TpJWWjomrdX09', 'M90uVcTW9jnWgc4IAja', 'uA8BhXT3V8juqfZXf3b'
Source: Xmz1XDgtah.exe, CFi1lQYsd1eKeFRQSO.cs	High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'lUrmQtToUpdkEKQ7gIN', 'ajDdHnT7r6wpjacLX8l', 'YVVwAFTzR9jI0uX6oji', 'zhuTmFkBBERcv0eV1xr', 'wd2gCHkHtXsydp3Wj26', 'AuCPmakTaTq171MESJO'
Source: Xmz1XDgtah.exe, xPNY6WgPDVY3aAxtGtQ.cs	High entropy of concatenated method names: 'oBn3tTlr2x', 'G8i3V6V8Js', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'SRN3ntLVnQ', '_5f9', 'A6Y'
Source: Xmz1XDgtah.exe, Cyk737CvAkUhf6DysSq.cs	High entropy of concatenated method names: 'yHFyQf3Ehx', 'OPKyeY0xtT', 'J0WYh3y08C9O4GrACrl', 'UvqPWeygx1eH3TaN1Xf', 'NrLVSPyyN6gCflKxHMu', 'e4QgmMyQgpgu2Xj2pJc', 'NQaIMNyF2amentYnNwu', 'y7LgopyXGuAdy2AE54l', 'AFnsEDyPJHogZUyxuiw', 'YwbcoHy4SE7POEVJF9h'
Source: Xmz1XDgtah.exe, sTh1UR3c9CyquVh1BdU.cs	High entropy of concatenated method names: 'lmENwbxH4h', 'qsrNG1lDIs', 'U2CNANnqxo', 'KRDNmBhN6x', 'KLDN10vnwp', 'mwNt2XJc02CRtcISgjO', 'rdpoWLJogUIg78fnWnV', 'FLqdpjJ7SVfulSd0KD4', 'BhQJMCJzGiPlFpfo2Pp', 'nsEwDB8BPta288v46WS'
Source: Xmz1XDgtah.exe, fCouIVCCB6lQUrEJNPW.cs	High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'fyAO4OiUjWOw4GS54ja', 'IUVdtPilWyPcTLMaubr', 'CAaH2ci6MPi2au2O4C1', 'DdKGyAi5DFc5Q8ybJPM', 'pMuLsviEmxqxn39FI78', 'OXkj17iMmv4G3GA5u1E'
Source: Xmz1XDgtah.exe, WRKVPAQJcxXInQXOLt.cs	High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'u78JHadirDmnveMtTFc', 'fMSdHDdACmibfYcOKwx', 'fbmMufd9rqdBg7cIZBf', 'k3lbsNdNVYbp1jIvL4j', 'RvGcWBdgLPtyXnVXpQZ', 'tGOQw6dyt8rhyo0G42V'
Source: Xmz1XDgtah.exe, kfNUuwoDnSZPpSnmeNj.cs	High entropy of concatenated method names: '_269', '_5E7', 'eSgcDr1Hdt', 'Mz8', 'eKbcuE5IMj', 'ydR1E2MaPyy4BxhdGUW', 'iWHcxAMn3B2s38K882s', 'VJVDqjMjHZvqTmyXe4f', 'NOXRTkMm3cV70knsvm5', 'Dp4okhMq9PKZjH1f6GW'
Source: Xmz1XDgtah.exe, zBiGeBWPA84XVIMuAnm.cs	High entropy of concatenated method names: 'jZmf3fXvop', 'xM9STlxeBnSdmivZ8E8', 'd6icNgx19vavVIwV1OH', 'ktxc8AxtX8ZeUleuLi7', 'InaJTYxaZDFVBVfFNnL', 'Tg0bo8xndpNqpvbYtjS', 'rLQfgEATh8', 'bHFforK3OK', 'y61fwDIwux', 'T4pfGdqtuH'
Source: Xmz1XDgtah.exe, STuIlCCmwaqhSJsa3fo.cs	High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'y33O9d97rYOWsXJPfqG', 'NpOicx9zOd7JMcjZ0OI', 'UCeBJANBdmFnNqLVPi3', 'h4oa1RNHFuQtT9PdOCc', 'Ij6sduNTsMA1TOMPFaZ', 'GMG4MFNk2p7VdSurwyD'
Source: Xmz1XDgtah.exe, B76DWIojeWE25NR1ra9.cs	High entropy of concatenated method names: 'dnZ62MhpgScAIJY6NUy', 'iNchyGhWAcZOkt1ou8k', 'qegpv7hYPZwfL76x4Uf', 'PLFNkwhbeNr9bCphel8', 'IWF', 'j72', 'DrPpXHsLb8', 'tLxplwNZiV', 'j4z', 'KmkpgKLQN0'
Source: Xmz1XDgtah.exe, mBRdeFEKZmxWZsLRnMR.cs	High entropy of concatenated method names: 'awm0qUunJc', 'JTN03cuYW4', 'uSj0NEtmWe', 'E1E0veiDb8', 'Eaw0tRqfHi', 'jvo0V9jwy7', 'm880n7IXoK', 'FnQ0HuejJg', 'x5t00mpkHI', 'x1u0cekBDt'
Source: Xmz1XDgtah.exe, NRRREk3KFXQSk6auUrq.cs	High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: Xmz1XDgtah.exe, YjRBshgA8ZYlnLFbElg.cs	High entropy of concatenated method names: 'FigPw0Wdaybrcnd7o6X', 'dNhsF9WirNhoJDROkgu', 'S42oXcWkZFSEPMhRcUP', 'qx7GmPWOD1cJA2Hifel', 'phKuVXWArcqflkoiww6', 'q2s4vIW9ZlBOgRVvbLE', 'wYOtCRWNPXLTx092klR'
Source: Xmz1XDgtah.exe, dtYtpogiGnnSGZRuEID.cs	High entropy of concatenated method names: 'MD6qaylAL8', 'Bq9qIqTNRb', 'v5BqsgJIic', 'gLPD4ApY6vfk52WKrSt', 'jdO2qlpI2Qs9n6von8C', 'geNnsRpuc1pq17KBE3S', 'n5OGripbokH5WMRsAoM', 'zMPVu6ppi87PqhWoJsQ'
Source: Xmz1XDgtah.exe, tKmh6owDdVsHu8xsQfH.cs	High entropy of concatenated method names: 'GcoDP4AiQR', 'JEHDKvQeda', 'sYCD40jUgI', 'ymsDj72mWV', 'UqVD9TChpw', 'o0lDS5T3Uc', 'bf7DTAoPf9', 'vZsD7E4Ivw', 'qpTDxCgpX2', 'VSRDCwebxX'
Source: Xmz1XDgtah.exe, pixbG4CxUadCD6IuiJ5.cs	High entropy of concatenated method names: 'EvfdrxG1Vo', 'RIiCkAgheI6h0UoukVt', 'S5t10kgZtK04NOWyxeM', 'bWRxL4gEabPQjatTrY7', 'l5p9NPgMfoXPo5cpC9V', 'Uob1NNgKE3AdxCv8mVL', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: Xmz1XDgtah.exe, tZ0n2MN0WkNFLD3wqm.cs	High entropy of concatenated method names: 'NUuK1E378', 'EIO4H6sbK', 'XF3jguW6U', 'QDQ9oqHWcCf7h2PYCGK', 'M3MRPsHbW5YgDWlmvTW', 'x6VOheHpFCcyEbEhH7w', 'fjoGBgH3ZYTcBYUbc4d', 'p2ti4jHJBMwtt8iMnlt', 'xVMBoeH8clE8GUqiXfx', 'J65VZbHD3FDAE9sP7Tf'
Source: Xmz1XDgtah.exe, k8GxMiWF1ujtlSnSoF0.cs	High entropy of concatenated method names: 'iFfy3vFyGy', 'At5yNZUFIA', 'GULyv9PeTB', 'kue6m40I49enSnmF3hp', 'p6c4yT0uhZmlKBNVl6S', 'o2kUpO0YFYrZoJQg535', 'iuR6xq0bGgDvHxnDvKY', 'GBSEp00pfmiq7ZMO3XM', 'CSOB3j0WkJY3JjSh9jS', 'OkbZ7d0vliC6KToH217'
Source: Xmz1XDgtah.exe, Q3NB1eCiooSOnpdWeeI.cs	High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'p4wlBqNb4F7Hjiug7YV', 'CMKEK4NpAxYZilPJWps', 'xjYjBLNWlDKd1rNqejP', 'Ep1aPiN3sqg9PqSdKYK', 'FLhlW4NJ6eQ0F3K1yNG', 'hQ589XN8932hMTL8IDr'
Source: Xmz1XDgtah.exe, O5ZfY3LJAACZAnXIak.cs	High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'KQgd0aTyrMEAIXVpFaK', 'u27083T0gwYcgrE14sc', 'SgwiDpTQCqGFYjkgtdT', 'qrVMtwTFQcWkNkPQJXI', 'XgfxJcTXv0mJBiPk2Kc', 'aYEXEtTPYN5UcPCGrnJ'
Source: Xmz1XDgtah.exe, GDuDGlH3WlMay2ZWl3.cs	High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'NBdMqcdjUavBmG5IKI0', 'wTaUCgdmfkYw47jp4hc', 'ji7A4vdqlcJlvPCYUrc', 'nJjA89dclvWtik2P186', 'LR5TL6dogUHuNp6wkMW', 'q7x71kd7d3JINIdeopg'
Source: Xmz1XDgtah.exe, GMXPLcWi61q3w7hqBqR.cs	High entropy of concatenated method names: 'bfqRP7YG9U', 'iS6R2dJx4p', 'VY8RzLhoqa', 'xstEhTgh8s', 'Vr0EdCX6GW', 'fAwEy22PBo', 'QseEZpHQSR', 'na2ERZ0TbV', 'moNEEtFJXu', 'fL3jOX4mgAgdE1IebLG'
Source: Xmz1XDgtah.exe, tmYIkBo8hLy9wME2pBE.cs	High entropy of concatenated method names: 'B1mibOKDO2', 'A1hiuKkr95', 'oU2iXinfol', 'Pv9JJQ52MdR6KUNqDbv', 'BhRjeg58VtAG2XDCA64', 'AiqBxu5DVdsZZb14wRY', 'ywAETT5RgmPvtj9ydPM', 'a9EikjA4wG', 'PoiifBxxry', 'Vf1iUe4Kfp'
Source: Xmz1XDgtah.exe, gCNrrrCgDsQDlucMCK1.cs	High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'DmT6HNiL0rSbTAHFGyZ', 'TqXaBjisfNyTNaENveB', 'aQL88Xi1qU5G4UfbNlC', 'M0aF6Qit0sQQ3gPQEiZ', 'BGV8xVieqsr92gCtw5n', 'p6D1DMiax1tDUZLR35p'
Source: Xmz1XDgtah.exe, lYy90fo1eowpq3NN10Q.cs	High entropy of concatenated method names: 'iV1UBGEv7S', 'UDtUKixqRb', 'l38U4u5ZjW', 'N8sYe46XNFe8U52r66m', 'KXfIo66QGV5PT16cOPc', 'moeY0I6FJxZM9BMaEWu', 'RU33sc6Pa4UqVqmEYq0', 'INwUbWgMBb', 'DCdUu3Z3pA', 'RnEUXxqgRg'
Source: Xmz1XDgtah.exe, RUsfCD3teIdfvEYJ330.cs	High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'T6jv3ONJv8', 'kT6vNcW62a', 'T1Evvbw6lr', 'J5FvtujT3x', 'r0GvVBmEki', 'orqvn1G8YK', 'LVhZxSDpde7k7SRRBG1'
Source: Xmz1XDgtah.exe, M0F2EECaBDQwDitQQ1h.cs	High entropy of concatenated method names: 'XAhdPjukUj', 'bR97KOgpi2KWcEmFXSd', 'BNSCMfgW2X9YRdLtDJv', 'DZMn6ygYjonBfSFbSdr', 'rwIu5VgbCnq3UXiVFo1', 'D8SRxUg3Wg5sDdUeXc8', '_3Xh', 'YZ8', '_123', 'G9C'
Source: Xmz1XDgtah.exe, QxTUpcoOZqZRtHo6BDF.cs	High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'LyBpQQumHs', 'b7XcOgVBml', 'r49peGi0tR', 'SDVc8nXY60', 'v97gcYMWi7DjMiHFJjA', 'uRLxLIM39S91IR6ITfQ', 'pypKS9MbWw0HA4XNYvB'
Source: Xmz1XDgtah.exe, zvfDiaoTaErm7sjyNXp.cs	High entropy of concatenated method names: 'b2FUCO3o74', 'uiSUa63pKC', 'YGEUIelXTT', 'SM9UsdbjUp', 'DPsydI6udicyddklMnk', 'G9g0Y76YUfbmD61iOtv', 'QIIlCU6b8JHVwG7sXAP', 'mQfZAs6VTM7c7q3uaNw', 'jO2Eif6I9dmhs9cvu8S', 'gcWpUO6pIgZWp1FRAcL'
Source: Xmz1XDgtah.exe, Ov44rBW9BqExLVkWHXs.cs	High entropy of concatenated method names: 'X7gZcAiR2i', 'YpTZBOeSbK', 'N1eZKoYACw', 'UkrZ42re6b', 'qubZjq62Nf', 'mHTZ9fYcHf', 'lJNZSuOmjf', 'PYK1ElFhhQYeTUDwoYG', 'iGNyI6FERJB6xdCKMW0', 'PHS0hXFMyL2AVawMOpH'
Source: Xmz1XDgtah.exe, JBIpSujjeWOHpjycqK.cs	High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'xfBcWCdR59KHxkVOanp', 'UCbwCWdLJON6nEjP2ER', 'GLJLxfdsHf3HiqacdLR', 'woXumnd1eyUGaWuyn2w', 'rBY3e6dtF68KuFr2X74', 'XtdsYjdeNGKnlSdsbk0'
Source: Xmz1XDgtah.exe, LP7vXPEuhkbvxISE2b4.cs	High entropy of concatenated method names: 'MITC7Fssa3oeA', 'GC4uqYLPrN3RKjJTZB2', 'K3ATh2L4QJpLWZ3BBv6', 'ho5Eq2LfD3BvajKdn3I', 'CLRBg9LCIeAaaaQgQKG', 'qWD4OOLxVy0x1M09sXp', 'EwLbXKLFQtUpSjUlh1g', 'GX8Ta5LXGuklGaYDNJv', 'L8KqmCLUAI1MFEa7hOF', 'PV1hg8LlDaDf5dX8mD2'
Source: Xmz1XDgtah.exe, bHYsElCQINFAZN3tR8f.cs	High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'JvdXpKy60qkUQUMytTL', 'wuKoeCy5K48iBrxOFSx', 'vPMSnVyEwtmKTsOKwJr', 'Jaq4BKyMKTeEtohxaUW', 'DP9KFqyh7PH1sh7He2C', 'UdV5MiyZc1isc4IgsWM'
Source: Xmz1XDgtah.exe, qcHiR2CPb52CIEwCOqh.cs	High entropy of concatenated method names: 'HTdymtL1mj', 'TAFy1TnDki', 'DakyqI5b2R', 'PR0Ng80yRqh2c7shauU', 'QfqHv80NIfL5x0uTHfC', 'u1MjCl0gbIG3PFD2HQU', 'JHK2Zy00GDBq5yGXBcc', 'Qt3ZyL0QrxiglxMDrte', 'HCVU5F0FKZsfPJEKm5C', 'bVahcG0Xe4kT7hSEKrr'
Source: Xmz1XDgtah.exe, tSqQvqCUkYidDfRV2Qp.cs	High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'jo7xxq9Y4Nnu1ncE0fJ', 'CkBWVM9bEPT8wpX7HFM', 'nhl0Xe9pOOBIO9g28Uy', 'ice1U49WY5HJnHEUt0w', 'xUHaJs9393bj4FHnINs', 'Exwyf09JonLTdidemKf'
Source: Xmz1XDgtah.exe, QkaFTOwmRMAbihVGPUs.cs	High entropy of concatenated method names: 'vWm8BZp7jm', 'Tig8K9Txkf', 'IHF84bHFOK', 'Mgx8jsL5Fa', 'HGD89eq4P4', 'myW6JoGUFjI9qpw66w4', 'bfT7F9GC0mjvSprhkuj', 'A4JkAtGxbA1MvN7NbPx', 'JebgrvGlfkjECrmAsbH', 'Wi36oLG6xJokPXGr6E6'
Source: Xmz1XDgtah.exe, O7CXwVgbtb6Nmf1K2uB.cs	High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: Xmz1XDgtah.exe, rHrg37Cuk51NuplUb96.cs	High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'YnDHSBAU7S3gqedQws6', 'VGIparAlbhDUA9BW990', 'J6mYhMA6htqr3y718pn', 'EJXQFXA5OsrCl2CWDT0', 'dQm8h5AEGIwQsibOkJd', 'GbSqnPAMkND2OxSgrya'
Source: Xmz1XDgtah.exe, twmPbTwfxtbjN1rjWxC.cs	High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'CfHDbvf1pC', 'UTYDuXge5f', 'r8j', 'LS1', '_55S'
Source: Xmz1XDgtah.exe, FGD8Fpgdt4tuhV7KcCX.cs	High entropy of concatenated method names: 'XKgqMZXAx0', 'bLZqrPjOFQ', 'Vs6q65NoPR', 'wdYqY7T5d0', 'LkrqFiQxyV', 'wI9qP6f0ww', 'UN29B3p1ewAoV2GDiTp', 'yliK4ipLEa3OeR7gQhB', 'imUUCJpsSeS5WHuKDQW', 'XfLTRQptu32J5a24OAW'
Source: Xmz1XDgtah.exe, vJH19KEL4eITuFjYcY.cs	High entropy of concatenated method names: 'MKP8b489e', 'dvwGMqIrYkZLyidr1B', 'o2X5ybvIaDVD6d5hH0', 'MCS8oSVTrUvoFyWRMU', 'EylGMIu1s7Tb1JEKsq', 'Eg6UuQYP0Ua7OW6WJs', 'dc1ytTX8o', 'QJ2ZQhX7T', 'r3URERiML', 'OteEGELCl'
Source: Xmz1XDgtah.exe, vtmuxmC9hlqUPYcRtq5.cs	High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'YqElKbAAcmG13NhsEsE', 'I9hJT0A9uplOUFVk5R3', 'hSvrTkANp2JMsBB4OEO', 'T7NVQsAgUlnBdRliFwg', 'yQhI7jAymahsckQnhAD', 'bZ8A99A0kwZm4mybLRd'
Source: Xmz1XDgtah.exe, KDnBpsCKb6MnYJo9ltf.cs	High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'P3Sod49s6cfHKRqeuLh', 'mvWXKn91AS69rWebad6', 'RZEkK99tfZL3FSVIPvN', 'cYjIPH9e6QP3AiadhOC', 'RlOK4J9aXVaJLUXm0ae', 'JDllIa9ntmrVNR70K72'

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops executable to a common third party application directory

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe

File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\uPlspWkqijAQ.exe

Jump to behavior

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	File created: C:\ProgramData\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	File created: C:\Recovery\uPlspWkqijAQ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	File created: C:\Users\Default\uPlspWkqijAQ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	File created: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\uPlspWkqijAQ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	File created: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	File created: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Jump to dropped file

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe

File created: C:\ProgramData\RuntimeBroker.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe

File created: C:\Users\Default\uPlspWkqijAQ.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe

File created: C:\Users\Default\uPlspWkqijAQ.exe

Jump to dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /f

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\ProgramData\RuntimeBroker.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Memory allocated: 11C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Memory allocated: 1ABE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Memory allocated: 2BB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Memory allocated: 1ABB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Memory allocated: 15A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Memory allocated: 1B4A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Memory allocated: 7C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Memory allocated: 1A6A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Memory allocated: 1000000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Memory allocated: 1AAB0000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Memory allocated: 1410000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Memory allocated: 1AEE0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Memory allocated: 2700000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Memory allocated: 1A800000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Memory allocated: 1650000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Memory allocated: 1B1B0000 memory reserve \| memory write watch

Source: C:\ProgramData\RuntimeBroker.exe

Code function: 23_2_00007FF848F1A62D sldt word ptr [eax]

23_2_00007FF848F1A62D

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 599782	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 599311	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 599081	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 598950	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 598624	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 598352	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 598249	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 598141	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 598011	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 596730	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 596478	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 596157	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 596032	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 595907	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 595782	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 595657	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 595438	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Window / User API: threadDelayed 1815	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Window / User API: threadDelayed 3371	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Window / User API: threadDelayed 6267	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Window / User API: threadDelayed 364	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Window / User API: threadDelayed 364	Jump to behavior
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Window / User API: threadDelayed 367
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Window / User API: threadDelayed 365
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Window / User API: threadDelayed 368
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Window / User API: threadDelayed 362

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe TID: 5036	Thread sleep count: 1815 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe TID: 5312	Thread sleep count: 325 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe TID: 2788	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 5248	Thread sleep count: 3371 > 30	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 6152	Thread sleep count: 6267 > 30	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 2892	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 3140	Thread sleep count: 50 > 30	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -599782s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -599657s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -599311s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -599203s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -599081s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -598950s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -598844s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -598734s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -598624s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -598352s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -598249s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -598141s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -598011s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -596730s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -596625s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -596478s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -596375s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -596266s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -596157s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -596032s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -595907s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -595782s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -595657s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -595547s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -595438s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -595313s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -595188s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -595063s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -594938s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -594828s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -594719s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -594594s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4816	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 5364	Thread sleep count: 364 > 30	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 4592	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 6180	Thread sleep count: 364 > 30	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe TID: 1772	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe TID: 5424	Thread sleep count: 367 > 30
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe TID: 6184	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe TID: 6092	Thread sleep count: 365 > 30
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe TID: 6532	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe TID: 6696	Thread sleep count: 368 > 30
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe TID: 5480	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe TID: 6768	Thread sleep count: 362 > 30
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe TID: 5784	Thread sleep time: -922337203685477s >= -30000s

Source: C:\ProgramData\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\ProgramData\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\ProgramData\RuntimeBroker.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\ProgramData\RuntimeBroker.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 599782	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 599311	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 599081	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 598950	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 598624	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 598352	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 598249	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 598141	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 598011	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 596730	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 596478	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 596157	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 596032	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 595907	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 595782	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 595657	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 595438	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Thread delayed: delay time: 922337203685477

Source: Xmz1XDgtah.exe, 00000000.00000002.2107725407.000000001C833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}bN
Source: Xmz1XDgtah.exe, 00000000.00000002.2107510629.000000001C816000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: RuntimeBroker.exe, 00000017.00000002.2603159404.000000001CE0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process token adjusted: Debug
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe

Process created: C:\ProgramData\RuntimeBroker.exe "C:\Users\All Users\RuntimeBroker.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Queries volume information: C:\Users\user\Desktop\Xmz1XDgtah.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Xmz1XDgtah.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Queries volume information: C:\ProgramData\RuntimeBroker.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Queries volume information: C:\ProgramData\RuntimeBroker.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\RuntimeBroker.exe	Queries volume information: C:\ProgramData\RuntimeBroker.exe VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Queries volume information: C:\Program Files\Windows Portable Devices\SystemSettings.exe VolumeInformation
Source: C:\Program Files\Windows Portable Devices\SystemSettings.exe	Queries volume information: C:\Program Files\Windows Portable Devices\SystemSettings.exe VolumeInformation
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Queries volume information: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe VolumeInformation
Source: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	Queries volume information: C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe VolumeInformation

Source: C:\Users\user\Desktop\Xmz1XDgtah.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\ProgramData\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\ProgramData\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 0000001C.00000002.2189528760.0000000002801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2176112255.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2063649768.000000000309B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2165029559.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2544259948.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2063649768.0000000003080000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2163434123.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2175393903.00000000026A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2175393903.00000000026BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2165029559.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2189528760.000000000283F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2154907035.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2063649768.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2068660844.0000000012BEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Xmz1XDgtah.exe PID: 3192, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 2848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 5660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 4040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SystemSettings.exe PID: 3448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SystemSettings.exe PID: 4616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: uPlspWkqijAQ.exe PID: 6596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: uPlspWkqijAQ.exe PID: 6552, type: MEMORYSTR

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 0000001C.00000002.2189528760.0000000002801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2176112255.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2063649768.000000000309B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2165029559.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2544259948.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2063649768.0000000003080000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2163434123.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2175393903.00000000026A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2175393903.00000000026BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2165029559.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2189528760.000000000283F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2154907035.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2063649768.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2068660844.0000000012BEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Xmz1XDgtah.exe PID: 3192, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 2848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 5660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 4040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SystemSettings.exe PID: 3448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SystemSettings.exe PID: 4616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: uPlspWkqijAQ.exe PID: 6596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: uPlspWkqijAQ.exe PID: 6552, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	241 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	213 Masquerading	OS Credential Dumping	231 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	161 Virtualization/Sandbox Evasion	Security Account Manager	161 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	34 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Xmz1XDgtah.exe	88%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
Xmz1XDgtah.exe	100%	Avira	TR/Dropper.Gen
Xmz1XDgtah.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	100%	Avira	TR/Dropper.Gen
C:\ProgramData\RuntimeBroker.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files\Windows Portable Devices\SystemSettings.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	100%	Joe Sandbox ML
C:\ProgramData\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Program Files\Windows Portable Devices\SystemSettings.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe	81%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe	81%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\uPlspWkqijAQ.exe	81%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files\Windows Portable Devices\SystemSettings.exe	81%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\ProgramData\RuntimeBroker.exe	81%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Recovery\uPlspWkqijAQ.exe	81%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\Default\uPlspWkqijAQ.exe	81%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat

Name	IP	Active	Malicious	Antivirus Detection	Reputation
us-east-1.route-1.000webhost.awex.io	145.14.145.191	true	false		unknown
fghjdtgujkjdgkdettygdbnbbn.000webhostapp.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://fghjdtgujkjdgkdettygdbnbbn.000webhostapp.com/@zd3bk5Wa3RHb1FmZlR0X	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://fghjdtgujkjdgkdettygdbnbbn.000webhostapp.com	RuntimeBroker.exe, 00000017.00000002.2544259948.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://fghjdtgujkjdgkdettygdbnbbn.000webhostapp.com/	RuntimeBroker.exe, 00000017.00000002.2544259948.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000017.00000002.2580563093.0000000013745000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Xmz1XDgtah.exe, 00000000.00000002.2063649768.00000000030A3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000017.00000002.2544259948.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
145.14.145.191	us-east-1.route-1.000webhost.awex.io	Netherlands		204915	AWEXUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430594
Start date and time:	2024-04-23 23:06:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Xmz1XDgtah.exe renamed because original name is a hash value
Original Sample Name:	2600cbb9ad38c10aca6ac4a91900cc84.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@30/25@1/1
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target RuntimeBroker.exe, PID 2848 because it is empty
Execution Graph export aborted for target RuntimeBroker.exe, PID 4040 because it is empty
Execution Graph export aborted for target RuntimeBroker.exe, PID 5660 because it is empty
Execution Graph export aborted for target SystemSettings.exe, PID 3448 because it is empty
Execution Graph export aborted for target SystemSettings.exe, PID 4616 because it is empty
Execution Graph export aborted for target Xmz1XDgtah.exe, PID 3192 because it is empty
Execution Graph export aborted for target uPlspWkqijAQ.exe, PID 6552 because it is empty
Execution Graph export aborted for target uPlspWkqijAQ.exe, PID 6596 because it is empty
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Xmz1XDgtah.exe

Simulations

Behavior and APIs

Time	Type	Description
23:06:59	Task Scheduler	Run new task: RuntimeBroker path: "C:\Users\All Users\RuntimeBroker.exe"
23:06:59	Task Scheduler	Run new task: RuntimeBrokerR path: "C:\Users\All Users\RuntimeBroker.exe"
23:06:59	Task Scheduler	Run new task: SystemSettings path: "C:\Program Files\Windows Portable Devices\SystemSettings.exe"
23:06:59	Task Scheduler	Run new task: SystemSettingsS path: "C:\Program Files\Windows Portable Devices\SystemSettings.exe"
23:06:59	Task Scheduler	Run new task: uPlspWkqijAQ path: "C:\Program Files (x86)\windows mail\uPlspWkqijAQ.exe"
23:06:59	Task Scheduler	Run new task: uPlspWkqijAQu path: "C:\Program Files (x86)\windows mail\uPlspWkqijAQ.exe"
23:07:26	API Interceptor	224x Sleep call for process: RuntimeBroker.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
us-east-1.route-1.000webhost.awex.io	msedge_elf.dll	Get hash	malicious	Unknown	Browse	145.14.144.129
	claro.596166.msi	Get hash	malicious	Unknown	Browse	145.14.144.17
	czfsby2aHY.exe	Get hash	malicious	AZORult	Browse	145.14.144.104
	SecuriteInfo.com.Trojan.KillProc2.16811.26778.27406.exe	Get hash	malicious	Unknown	Browse	145.14.145.70
	SecuriteInfo.com.Trojan.KillProc2.16811.26778.27406.exe	Get hash	malicious	Unknown	Browse	145.14.144.29
	JZtRlvNAAe.exe	Get hash	malicious	PureLog Stealer, Remcos	Browse	145.14.144.130
	file.zip	Get hash	malicious	PureLog Stealer, Remcos	Browse	145.14.145.72
	PO20152024.scr.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	145.14.145.149
	0VOqFZVzzg.exe	Get hash	malicious	DCRat	Browse	145.14.145.16
	4UAZX1SV1S.exe	Get hash	malicious	DCRat	Browse	145.14.145.112

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AWEXUS	4fjy5gB1w6.elf	Get hash	malicious	Mirai	Browse	153.93.11.255
	msedge_elf.dll	Get hash	malicious	Unknown	Browse	145.14.144.129
	claro.596166.msi	Get hash	malicious	Unknown	Browse	145.14.144.17
	xcBienFkvE.elf	Get hash	malicious	Mirai	Browse	153.93.242.119
	DaN5NG0bt8.elf	Get hash	malicious	Mirai	Browse	153.93.154.136
	czfsby2aHY.exe	Get hash	malicious	AZORult	Browse	145.14.144.104
	SecuriteInfo.com.Trojan.KillProc2.16811.26778.27406.exe	Get hash	malicious	Unknown	Browse	145.14.145.70
	SecuriteInfo.com.Trojan.KillProc2.16811.26778.27406.exe	Get hash	malicious	Unknown	Browse	145.14.144.29
	JZtRlvNAAe.exe	Get hash	malicious	PureLog Stealer, Remcos	Browse	145.14.144.90
	L8z5Pz9mcx.elf	Get hash	malicious	Mirai	Browse	153.93.11.252

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	5.597924056320811
Encrypted:	false
SSDEEP:	3:hXUzg9hoDcBVRpXEZIBQzsBIwQxNOXsJWILKs8mQbEvNqpXSPmHr9v/ORJR:1UMDoAdpXlQA+lL74tTmQbEvCSPY/yb
MD5:	F041D89EC28C7F288D72C6DBD6A076A4
SHA1:	AB3F6FB8D7AE98C52EA96A7E4D71622FBB4AF6A6
SHA-256:	D8EF2D1D679BD8905953CEA5FAFAE2BAB33D5707A0056EE90E8F7BD545A8D906
SHA-512:	BCBDE2551B93D6B75FFF234565382D28F03DA97C45A25FC8D609A8C4846C1A58266C16ACF9A336D43F29B69B16E125BE110BD79598337DB8FD3A6B37F52A7CBA
Malicious:	false
Preview:	oFZ4rVUSGGARqLlVEFdDMf9TbpL2hKILlcqDrh6Hb7ZRRhFJ94hduG5IGGdBKbu58zqOfhngJVmOGsC3kB3mnoaegh7kE57AMdSc11obQBUZerCXEjaJhISTYLr7jCbNXmCnZkCtWbVlUA

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe

Download File

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3149312
Entropy (8bit):	6.817816398302041
Encrypted:	false
SSDEEP:	49152:0f2OK9jJIoFe/S7zrfL3pmRk/5JaANZr/LHFTYUjy3/q3KgW:19jlw8rfjpmRc3/ZvlTtjVj
MD5:	2600CBB9AD38C10ACA6AC4A91900CC84
SHA1:	F670E02EDEA5048E57C089AE4042F1F00A5790F0
SHA-256:	E62D890D90CB121E7FB678DEA021786D5558BA433BC1499580B3E327BC85E847
SHA-512:	06DA17684E3D84105B9872D1B74AF780D0FFCBF80C2E2AAE08ECDE9C7991372FEB4498594EC62468049E739EC71C11DDC3BF3AA05EA1875178E235441819A00B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb..................'..6......^.'.. ....(...@.. ........................(...........@...................................'.K....@(......................`(...................................................... ............... ..H............text...d.'.. ....'................. ..`.sdata.../....(..0....'.............@....rsrc........@(.......(.............@..@.reloc.......`(.......(.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files (x86)\Windows Mail\33d07815358cfe

Download File

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	167
Entropy (8bit):	5.702282514810241
Encrypted:	false
SSDEEP:	3:DtmjJmKkdQ+orVNu9RKXmIyzWvfQczOx3s+HUsKu+D05uXcYUxiWTQNBKn:WJJLBNu98XmIum4czOJs+HUPu20cBvDK
MD5:	6377D0A4A23777FE0A59EAA5C72C82B7
SHA1:	E5F63058F58A56C9A9512AAD726DD08131328123
SHA-256:	4D3E3D83C3C6D64731F72A5062749816EE38021AEBD135D9CFF548690DF59186
SHA-512:	9818FAD515A559FD0AADA0E911DB9B51A6163E4A51B21476CB757F80BB99019281622846B89DC779E6347276184A67EA9B3AE3415FF163F526E20183BD6C5687
Malicious:	false
Preview:	WpcbpQ17pOi5TEP2bEy2CDfEsPc7LxM7i2RTVzhGyXyHxN325g4N0sHSKXtax3w2CkWbw6hlgrEoPXRfVkCp38Hzu9I7GHT4l5FM0cG89SqIocDwGOEN1H9DcgqxxjfZYJDUSEo3dDqkR9LS5W12DGDe6BuTvTLZwRueZtd

C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe

Download File

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3149312
Entropy (8bit):	6.817816398302041
Encrypted:	false
SSDEEP:	49152:0f2OK9jJIoFe/S7zrfL3pmRk/5JaANZr/LHFTYUjy3/q3KgW:19jlw8rfjpmRc3/ZvlTtjVj
MD5:	2600CBB9AD38C10ACA6AC4A91900CC84
SHA1:	F670E02EDEA5048E57C089AE4042F1F00A5790F0
SHA-256:	E62D890D90CB121E7FB678DEA021786D5558BA433BC1499580B3E327BC85E847
SHA-512:	06DA17684E3D84105B9872D1B74AF780D0FFCBF80C2E2AAE08ECDE9C7991372FEB4498594EC62468049E739EC71C11DDC3BF3AA05EA1875178E235441819A00B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb..................'..6......^.'.. ....(...@.. ........................(...........@...................................'.K....@(......................`(...................................................... ............... ..H............text...d.'.. ....'................. ..`.sdata.../....(..0....'.............@....rsrc........@(.......(.............@..@.reloc.......`(.......(.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\33d07815358cfe

Download File

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	ASCII text, with very long lines (874), with no line terminators
Category:	dropped
Size (bytes):	874
Entropy (8bit):	5.901225585415867
Encrypted:	false
SSDEEP:	12:ncTs73gXZrlrOZ5/Bme7fP7zj2pZ+JgiI0HYpDUfdbbo9UchWC9aleBc7a1:I7FgCwfj2pZ8gh0HYpDUfK7keQa1
MD5:	0A9353BDA6DCA3E61669AFD37A5FF473
SHA1:	7B0F1B1141FF46F7B739B20D0A8AF9C47B489CA1
SHA-256:	E28D67C68C61316A7858FB001734A7543CCF78C4AA451B129091EF2184DD82F1
SHA-512:	14C750AFD77E55CFB0F77AFC2ACBBBD162A220944D5A3710F776CD1361EBC2B9DB09903E18BDD61A0E194F4B822E8BE337BC9424EA778568B6BAC33397B52899
Malicious:	false
Preview:	NjHC2pY8dhrwGwr9YL2cAf6siJ7cZgWjqjICN8HKGlD8xCWSdApeQO2rnYdsr5i7KIGgnovZDsVYc85gxo9Z11SbraZyfYcKCFxp6zoyOPbi2dOod65D6JFTzozNP74oQKVWLQk89LKlZujNLuVidZO3AdzRAbjRVwSrH1dMW7Dv9d3EElBflWK06cWraS8il2Qnc1GTQILgWd4gjvNYZEq8lbvofwwD8eJGNQmNerOcKoecizHpFjIhMRBAFbyeWIh1UxTTI94rzNy77TGpoG8ZWl35OmHC3tFCGnIugygFpas9dEDwVI0QJIfs4XEg21yGHv0TKVI0j2u534cKiUqu3z28HZ0ItANyml1rNtlA99qRXjzA538hKDMR32LvfAGjp6TRCu7zsqv4JlkikzNzCpnjZkyVh0f92GmbQh8L6IzeSSIRRnLpwRhASt1b5mR2KvBC8JSC1B330JQHbgD3o0MljmIgqgPU16TgRFTHVJxvXoKJdu9ZiXOUiZdWAvVUwiC3zu0WN6ifCbN4c9D5gzwdr981l6Gjxc8zmQTs3nLmztRHLi4BsZy6wiL0w8uRz8rjdYSLqUC3oJn8r1qDBF1XoCCDEc6534x1BrowPsVXX5Sm4NJ5SrPtGT5bWPHNXG9tWw79M3xSte9ttZI0TBnLoDurwNaAlI9Q5jQHQJsY479mUMr6GQ4WdyESCPN9dwrlesyKJBkKTORrDIXkfd4UNnxHe7FA5s4HPXHlYgxFpuDOgXP41ne91XX15qqL5kOlUKcqAwM8qzodkilHsKISN4P29Qpr0lJFfc4V4i4FbfTCt4RXFidvb6XZ4kqtHeHEqi8HnPMJQD0rlNJF9RlRHYojEfbU2K76YP

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\uPlspWkqijAQ.exe

Download File

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3149312
Entropy (8bit):	6.817816398302041
Encrypted:	false
SSDEEP:	49152:0f2OK9jJIoFe/S7zrfL3pmRk/5JaANZr/LHFTYUjy3/q3KgW:19jlw8rfjpmRc3/ZvlTtjVj
MD5:	2600CBB9AD38C10ACA6AC4A91900CC84
SHA1:	F670E02EDEA5048E57C089AE4042F1F00A5790F0
SHA-256:	E62D890D90CB121E7FB678DEA021786D5558BA433BC1499580B3E327BC85E847
SHA-512:	06DA17684E3D84105B9872D1B74AF780D0FFCBF80C2E2AAE08ECDE9C7991372FEB4498594EC62468049E739EC71C11DDC3BF3AA05EA1875178E235441819A00B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb..................'..6......^.'.. ....(...@.. ........................(...........@...................................'.K....@(......................`(...................................................... ............... ..H............text...d.'.. ....'................. ..`.sdata.../....(..0....'.............@....rsrc........@(.......(.............@..@.reloc.......`(.......(.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\uPlspWkqijAQ.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Windows Portable Devices\9e60a5f7a3bd80

Download File

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	ASCII text, with very long lines (442), with no line terminators
Category:	dropped
Size (bytes):	442
Entropy (8bit):	5.840788510627229
Encrypted:	false
SSDEEP:	12:EaIF4wAh8D1luL66esZZnEwB1z/IrSd6ezX:Ea84wV1lA69cZEaAM6ezX
MD5:	9D65A7219E7A742B748E133E3F8AB8A4
SHA1:	26A7E19E0D5A633E9781CBC1D7BDFD7330DA313D
SHA-256:	6A0C2FC02039404EAC37278EFB77C365C8BA2303DE29D3C28DAC920697370ECB
SHA-512:	B8D08C8CEE7A2F73DBF8B99969A8113BF4FD1DA7EA619EA873639F8CCF40DBFE696FC88B8BCA1D5516AD7AD44208C10DD98925221A03CD67DE39950066489422
Malicious:	false
Preview:	kuz3z6S4YDHy1QFF4TW08Jzhu5x3QeZrt3SaIDiSDPhGmCeDYRKVc0ca4RI4JYo3oaE78p71vDwtmt5satf8TDP2b1f04nIplnbM7hEtUTkYEsyLWZeZ3qkkKMgHJG6H5HI9Rsu3pvnAc1ysDUeeJsv4D1BvA7jOWcc6ky3nokuHCjHTYxDzlb8MVN5ar92rMZnAY1IOb0zi8o2dtsWN3tm5eQlX3c6psD4n6H4hpzXvlZOqUcr8npxcwsgIPvV84K05tPhlyzhEW1TEB4Cav7BCPb0NlvR4dZ0ajS7F4FKxHtG5YbGVs4N7IxqRYTAChmk6B2et76fpxO5fV5zKp6LjL3RwmprlFHQfIK4f6XXwYhJ42K6dezXlbBuIlsGSP4jp7ZXKATNRiYKntW4csNHPuoDHZw4NRFhe8e7cwvcKmFCC0GYOynjBwT

C:\Program Files\Windows Portable Devices\SystemSettings.exe

Download File

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3149312
Entropy (8bit):	6.817816398302041
Encrypted:	false
SSDEEP:	49152:0f2OK9jJIoFe/S7zrfL3pmRk/5JaANZr/LHFTYUjy3/q3KgW:19jlw8rfjpmRc3/ZvlTtjVj
MD5:	2600CBB9AD38C10ACA6AC4A91900CC84
SHA1:	F670E02EDEA5048E57C089AE4042F1F00A5790F0
SHA-256:	E62D890D90CB121E7FB678DEA021786D5558BA433BC1499580B3E327BC85E847
SHA-512:	06DA17684E3D84105B9872D1B74AF780D0FFCBF80C2E2AAE08ECDE9C7991372FEB4498594EC62468049E739EC71C11DDC3BF3AA05EA1875178E235441819A00B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb..................'..6......^.'.. ....(...@.. ........................(...........@...................................'.K....@(......................`(...................................................... ............... ..H............text...d.'.. ....'................. ..`.sdata.../....(..0....'.............@....rsrc........@(.......(.............@..@.reloc.......`(.......(.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Windows Portable Devices\SystemSettings.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\9e8d7a4ca61bd9

Download File

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	296
Entropy (8bit):	5.747055317921149
Encrypted:	false
SSDEEP:	6:h1V/seXDZ9oa/MfYhiNzMzzh85hHpYjWKuCagMfNz0k82Zmgg/gOKrNm:hPNzoa/MQhiFMS5hHpYvlagMfNzl8Sgf
MD5:	6163C83B9C52D77556FE241C059B1C28
SHA1:	7DE95B8017A47CC74396DD3DF771DCEDF5206F68
SHA-256:	9FB1785AC64AF61C9D72AF7D2CB406B57FE75D342CD87A53327756F953B6AE01
SHA-512:	036749095C9E86BC49AD3CA651A8574D7EAE205E5C8DBCF4902126248501BB8B600F3173E8B7548B3C82D5CAFCEF3F75D67FB2A250D8D96E6B3FF8870E0805A6
Malicious:	false
Preview:	K5xNayu2kb5XWBcJ3HnsjYZvhYadrfuxuqwfwIb6lgUUcLYm01npZiswfBqCYQLErInqP7WuqrHCDFSV9xnz2EYL799ucZiVVPmUhsX2f29sbpsatUCkmVMnucsP7mSRIwqxc7yQZuU9FpuSQjBHW7sAD9kF9I42kskp847vgwL1BMhEsa8YlK5KDqudXsRR0bZXEETVmPlkw090bfXjJgRZwZlSKdYxe3BjwK9nHnwVjUYNr3C1UrHTKAkpdALI1xF2zZEQfubgt6zcBXlQbgdxwsZwkUJGcodvPfYR

C:\ProgramData\RuntimeBroker.exe

Download File

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3149312
Entropy (8bit):	6.817816398302041
Encrypted:	false
SSDEEP:	49152:0f2OK9jJIoFe/S7zrfL3pmRk/5JaANZr/LHFTYUjy3/q3KgW:19jlw8rfjpmRc3/ZvlTtjVj
MD5:	2600CBB9AD38C10ACA6AC4A91900CC84
SHA1:	F670E02EDEA5048E57C089AE4042F1F00A5790F0
SHA-256:	E62D890D90CB121E7FB678DEA021786D5558BA433BC1499580B3E327BC85E847
SHA-512:	06DA17684E3D84105B9872D1B74AF780D0FFCBF80C2E2AAE08ECDE9C7991372FEB4498594EC62468049E739EC71C11DDC3BF3AA05EA1875178E235441819A00B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb..................'..6......^.'.. ....(...@.. ........................(...........@...................................'.K....@(......................`(...................................................... ............... ..H............text...d.'.. ....'................. ..`.sdata.../....(..0....'.............@....rsrc........@(.......(.............@..@.reloc.......`(.......(.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\RuntimeBroker.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Recovery\33d07815358cfe

Download File

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	5.0809390457270505
Encrypted:	false
SSDEEP:	3:X+T+q2jx+QufGvAIVdYyZQ:OTQ+HevAWYyZQ
MD5:	5C4FE06B61ECEDD0D6EE060FAAAE9DCA
SHA1:	B1AB1510BF33E271DA85C28B89F7997FEBB179B0
SHA-256:	FD1D47BC409EAE6151263FDBDAF952EF05AC113D68E4F027968433F1254858D6
SHA-512:	B8ADE2CC6C4BB0913FDFF45D72480D7B068F6869002F82AB2F1595E841F735E1D1F172B14F2C861103066D6EC719FB068F702E242D7200D9BD9F5E27789064EA
Malicious:	false
Preview:	dTjjhqlUCp2TFgOjpaFFj0Jh4i2THpAhztKFVsOqtRLiXi2a1cZIjJemKCo9xRMWpVeWVI

C:\Recovery\uPlspWkqijAQ.exe

Download File

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3149312
Entropy (8bit):	6.817816398302041
Encrypted:	false
SSDEEP:	49152:0f2OK9jJIoFe/S7zrfL3pmRk/5JaANZr/LHFTYUjy3/q3KgW:19jlw8rfjpmRc3/ZvlTtjVj
MD5:	2600CBB9AD38C10ACA6AC4A91900CC84
SHA1:	F670E02EDEA5048E57C089AE4042F1F00A5790F0
SHA-256:	E62D890D90CB121E7FB678DEA021786D5558BA433BC1499580B3E327BC85E847
SHA-512:	06DA17684E3D84105B9872D1B74AF780D0FFCBF80C2E2AAE08ECDE9C7991372FEB4498594EC62468049E739EC71C11DDC3BF3AA05EA1875178E235441819A00B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb..................'..6......^.'.. ....(...@.. ........................(...........@...................................'.K....@(......................`(...................................................... ............... ..H............text...d.'.. ....'................. ..`.sdata.../....(..0....'.............@....rsrc........@(.......(.............@..@.reloc.......`(.......(.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\uPlspWkqijAQ.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\Default\33d07815358cfe

Download File

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	ASCII text, with very long lines (995), with no line terminators
Category:	dropped
Size (bytes):	995
Entropy (8bit):	5.910028753564332
Encrypted:	false
SSDEEP:	12:InFmSnP+FmRwE3reqI3m8zrJpzo3IfOJfntdd7I3pxJ6CxPv9tWy4m2TvWoH02ti:blj5pzlebnwbnLWrioU2nKwbOxGaO136
MD5:	114377AADEA34D672D890AA92A939929
SHA1:	17F5D69081BEB0478CE54A004EC6908BAAB31B5D
SHA-256:	39EA07797DFC84508AC1DF80BAB23F2F2DA6B7A1F670BE1D198AD32694A46FD6
SHA-512:	161918110249531D6542B3F9E8CF48380ABDD4037855A970D66B1BA1D504E2BA599CC12058DDF0E95F2B8B33D9E4B40767B90A65F7FA6BCFF845BE14CF03F406
Malicious:	false
Preview:	Ad1qpOZcq6u6nomBRSXqZogfrojnGhANvmFjLJbKyW7mQzqQqU8d1skW6V9BpvWI6gLAjC0H1M2Dq3P18S7vjhWCCsmzKZeCAyqtopqoe0lo0gpDGHDWykjZKI80ZA7bszD2NfNSmSQs5rMfDjtDWINZOQjfqzOd2K6Adxzk4uufU0dc6cxzR4Ejlon66rlwEw0vvLCPuIJmYrEXwGjOCYM8FXYyJ2nMI7bhAsruZhFIvcL4jQJ0IXupk1pYwNG1e6eaPhWEZyyeSEMnLeP2txEuNw7ICT7MaOny8uoC3FbTiPWgpCMS8NIr2tMdjOBF1mDEaYpa0N9nWuM8abdAGpNMG66OiKcpDVc6LRFQWvbuOeUHgODIuB9LY08eba2pvTjBSPxIVMnVNd8lmysTHT5CWQhUTly62w844SyRa4xhXo752W1nsihcYhpCscytXrcbeDqT9b3NfXprSmb6tLNTOgfXnwi8GEJpLgaypinRpU6B17tFA19MeIM8hTpN25HbOAgwLnRLh6n4jefqCc7OE7LCTcQW3aZuNfw1a73XkyoifSYCx9KZ72WQydctW4RHg2qDsoPFijnQSnhBDOj3Q9xUJgC7fKBqggBmlVUIuF0YOG7L6aqIUY1hFW4LlRjYi7tvl5ar3aJLJYFCi1AEd3VHpegPbIhcfb0RWLjAA8O4PpXrQ1nuRf5omlGHZKQu2qpriyqWRADeoa2AGz8jfxL9gLouFcl0sdBiAqIbKRdQca9LtFAkLrPFfpLWJ5QyYNwLZT9aqhYOU4hFLdB9bBoBO5DUfvSPAo2OoywZGk3oSBvkIFKq4QXWjv6dPp54OJNpCSaXql30I9sMKdLZklVtRfp32TJap9ZIxFizoxASXgOkCtSwdfTnydYgnhfWbdLJjjYE5WuxlCWuRF0IAX6KpwUTrCMGSn03VFAcUO1HugCvHnPhrWVEgAdwPEW2Koe7McZLEXxwgzZJujMDwoZ5SwXUlON

C:\Users\Default\uPlspWkqijAQ.exe

Download File

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3149312
Entropy (8bit):	6.817816398302041
Encrypted:	false
SSDEEP:	49152:0f2OK9jJIoFe/S7zrfL3pmRk/5JaANZr/LHFTYUjy3/q3KgW:19jlw8rfjpmRc3/ZvlTtjVj
MD5:	2600CBB9AD38C10ACA6AC4A91900CC84
SHA1:	F670E02EDEA5048E57C089AE4042F1F00A5790F0
SHA-256:	E62D890D90CB121E7FB678DEA021786D5558BA433BC1499580B3E327BC85E847
SHA-512:	06DA17684E3D84105B9872D1B74AF780D0FFCBF80C2E2AAE08ECDE9C7991372FEB4498594EC62468049E739EC71C11DDC3BF3AA05EA1875178E235441819A00B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb..................'..6......^.'.. ....(...@.. ........................(...........@...................................'.K....@(......................`(...................................................... ............... ..H............text...d.'.. ....'................. ..`.sdata.../....(..0....'.............@....rsrc........@(.......(.............@..@.reloc.......`(.......(.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Default\uPlspWkqijAQ.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Download File

Process:	C:\ProgramData\RuntimeBroker.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1673
Entropy (8bit):	5.358592927981826
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkrJHVHpHNpv:iq+wmj0qCYqGSI6oPtzHeqKkt1Jtpv
MD5:	3FA79285624FEE3EDA6CADAE6686B2D7
SHA1:	B4FCD984A014AF609AA60902FAB53EFE05F72D26
SHA-256:	941DC770C2B1ECCBFE753CE22846C885C111EEBF38B74991B54B2D32D5D46466
SHA-512:	2E5B2FC80CAEFCB6D615CC50E4A9250F2A46AFD406720DF016A55AAB09B2EE63A2AED9E7C6832DD6B93318FEFE99EC21D7264207467A764BE078B2226A9002B2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SystemSettings.exe.log

Download File

Process:	C:\Program Files\Windows Portable Devices\SystemSettings.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Xmz1XDgtah.exe.log

Download File

Process:	C:\Users\user\Desktop\Xmz1XDgtah.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1915
Entropy (8bit):	5.363869398054153
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkrJHVHpHNpaHKlT4x:iq+wmj0qCYqGSI6oPtzHeqKkt1Jtpaq2
MD5:	E6E3A2B5063C33228E2749DC291A1D3D
SHA1:	F3F32E2F204DE9AFA50D5DE1C132A8039C5A315C
SHA-256:	2F6BA7ECDDEF02B291DEA6E03ADD8A30A67B8DE1B7E256FA99B14A28AB9BE831
SHA-512:	15EF30345C2F08AD858A9E5C10CD309F00D1951E4A4902CE8F8700A2B0A25FCFADCFCDA6D13EC7B215B0AF1AB24C8956033E93A403178ED7A98138476D4F9967
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\uPlspWkqijAQ.exe.log

Download File

Process:	C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.817816398302041
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	Xmz1XDgtah.exe
File size:	3'149'312 bytes
MD5:	2600cbb9ad38c10aca6ac4a91900cc84
SHA1:	f670e02edea5048e57c089ae4042f1f00a5790f0
SHA256:	e62d890d90cb121e7fb678dea021786d5558ba433bc1499580b3e327bc85e847
SHA512:	06da17684e3d84105b9872d1b74af780d0ffcbf80c2e2aae08ecde9c7991372feb4498594ec62468049e739ec71c11ddc3bf3aa05ea1875178e235441819a00b
SSDEEP:	49152:0f2OK9jJIoFe/S7zrfL3pmRk/5JaANZr/LHFTYUjy3/q3KgW:19jlw8rfjpmRc3/ZvlTtjVj
TLSH:	A5E5C0017E84CE12F0191633C2EF854887F4A991B6A6E32B7DBA376D55123A73C1D9CB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....rb..................'..6......^.'.. ....(...@.. ........................(...........@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x67eb5e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6272A3D7 [Wed May 4 16:03:35 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x27eb10	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x284000	0x218	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x286000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x27cb64	0x27cc00	54169588d92038e23d541f4022230875	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.sdata	0x280000	0x2fdf	0x3000	deaefd21dfe29307767e9bfd447640cc	False	0.3102213541666667	data	3.2431704133285773	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x284000	0x218	0x400	d4389e129ba57fb8abd243c1b37af13c	False	0.263671875	data	1.8390800949553323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x286000	0xc	0x200	c1991430fbc472813023d7997b67640b	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x284058	0x1c0	ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970	English	United States	0.5223214285714286

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 23:07:06.423299074 CEST	49704	80	192.168.2.5	145.14.145.191
Apr 23, 2024 23:07:07.412499905 CEST	49704	80	192.168.2.5	145.14.145.191
Apr 23, 2024 23:07:09.415286064 CEST	49704	80	192.168.2.5	145.14.145.191
Apr 23, 2024 23:07:13.412483931 CEST	49704	80	192.168.2.5	145.14.145.191
Apr 23, 2024 23:07:21.412502050 CEST	49704	80	192.168.2.5	145.14.145.191
Apr 23, 2024 23:07:27.432713985 CEST	49713	80	192.168.2.5	145.14.145.191
Apr 23, 2024 23:07:28.443741083 CEST	49713	80	192.168.2.5	145.14.145.191
Apr 23, 2024 23:07:30.443998098 CEST	49713	80	192.168.2.5	145.14.145.191
Apr 23, 2024 23:07:34.443905115 CEST	49713	80	192.168.2.5	145.14.145.191
Apr 23, 2024 23:07:42.459409952 CEST	49713	80	192.168.2.5	145.14.145.191

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 23:07:06.287410975 CEST	58601	53	192.168.2.5	1.1.1.1
Apr 23, 2024 23:07:06.416436911 CEST	53	58601	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 23, 2024 23:07:06.287410975 CEST	192.168.2.5	1.1.1.1	0x74ae	Standard query (0)	fghjdtgujkjdgkdettygdbnbbn.000webhostapp.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 23, 2024 23:07:06.416436911 CEST	1.1.1.1	192.168.2.5	0x74ae	No error (0)	fghjdtgujkjdgkdettygdbnbbn.000webhostapp.com	us-east-1.route-1.000webhost.awex.io		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:07:06.416436911 CEST	1.1.1.1	192.168.2.5	0x74ae	No error (0)	us-east-1.route-1.000webhost.awex.io		145.14.145.191	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	23:06:55
Start date:	23/04/2024
Path:	C:\Users\user\Desktop\Xmz1XDgtah.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Xmz1XDgtah.exe"
Imagebase:	0x710000
File size:	3'149'312 bytes
MD5 hash:	2600CBB9AD38C10ACA6AC4A91900CC84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.2063649768.000000000309B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.2063649768.0000000003080000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.2063649768.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.2068660844.0000000012BEF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:06:57
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /f
Imagebase:	0x7ff6474a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:06:57
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6474a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:06:57
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6474a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:06:57
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\Framework\uPlspWkqijAQ.exe'" /f
Imagebase:	0x7ff6474a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:06:57
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "uPlspWkqijAQ" /sc ONLOGON /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\Framework\uPlspWkqijAQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6474a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:06:57
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\Framework\uPlspWkqijAQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6474a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:06:57
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 8 /tr "'C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\uPlspWkqijAQ.exe'" /f
Imagebase:	0x7ff6474a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:06:57
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "uPlspWkqijAQ" /sc ONLOGON /tr "'C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\uPlspWkqijAQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6474a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:06:58
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 6 /tr "'C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\uPlspWkqijAQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6474a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	23:06:58
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SystemSettingsS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\SystemSettings.exe'" /f
Imagebase:	0x7ff6474a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:06:58
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SystemSettings" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\SystemSettings.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6474a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	23:06:58
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SystemSettingsS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\SystemSettings.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6474a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	23:06:58
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 7 /tr "'C:\Users\Default\uPlspWkqijAQ.exe'" /f
Imagebase:	0x7ff6474a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	23:06:58
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "uPlspWkqijAQ" /sc ONLOGON /tr "'C:\Users\Default\uPlspWkqijAQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6474a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	23:06:58
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 13 /tr "'C:\Users\Default\uPlspWkqijAQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6474a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	23:06:58
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 7 /tr "'C:\Recovery\uPlspWkqijAQ.exe'" /f
Imagebase:	0x7ff6474a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	23:06:58
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "uPlspWkqijAQ" /sc ONLOGON /tr "'C:\Recovery\uPlspWkqijAQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6474a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	23:06:58
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 14 /tr "'C:\Recovery\uPlspWkqijAQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6474a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	23:06:58
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\windows mail\uPlspWkqijAQ.exe'" /f
Imagebase:	0x7ff6474a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	23:06:58
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "uPlspWkqijAQ" /sc ONLOGON /tr "'C:\Program Files (x86)\windows mail\uPlspWkqijAQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6474a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	23:06:58
Start date:	23/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "uPlspWkqijAQu" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\windows mail\uPlspWkqijAQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6474a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	23:06:59
Start date:	23/04/2024
Path:	C:\ProgramData\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\All Users\RuntimeBroker.exe"
Imagebase:	0x580000
File size:	3'149'312 bytes
MD5 hash:	2600CBB9AD38C10ACA6AC4A91900CC84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000017.00000002.2544259948.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 81%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	23:06:59
Start date:	23/04/2024
Path:	C:\ProgramData\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\All Users\RuntimeBroker.exe"
Imagebase:	0xe10000
File size:	3'149'312 bytes
MD5 hash:	2600CBB9AD38C10ACA6AC4A91900CC84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000018.00000002.2163434123.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	23:06:59
Start date:	23/04/2024
Path:	C:\ProgramData\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\All Users\RuntimeBroker.exe"
Imagebase:	0x30000
File size:	3'149'312 bytes
MD5 hash:	2600CBB9AD38C10ACA6AC4A91900CC84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000019.00000002.2175393903.00000000026A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000019.00000002.2175393903.00000000026BB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	23:06:59
Start date:	23/04/2024
Path:	C:\Program Files\Windows Portable Devices\SystemSettings.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Portable Devices\SystemSettings.exe"
Imagebase:	0x550000
File size:	3'149'312 bytes
MD5 hash:	2600CBB9AD38C10ACA6AC4A91900CC84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001A.00000002.2165029559.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001A.00000002.2165029559.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 81%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	23:06:59
Start date:	23/04/2024
Path:	C:\Program Files\Windows Portable Devices\SystemSettings.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Portable Devices\SystemSettings.exe"
Imagebase:	0x960000
File size:	3'149'312 bytes
MD5 hash:	2600CBB9AD38C10ACA6AC4A91900CC84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001B.00000002.2154907035.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	23:06:59
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\windows mail\uPlspWkqijAQ.exe"
Imagebase:	0x390000
File size:	3'149'312 bytes
MD5 hash:	2600CBB9AD38C10ACA6AC4A91900CC84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001C.00000002.2189528760.0000000002801000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001C.00000002.2189528760.000000000283F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 81%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	23:06:59
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\windows mail\uPlspWkqijAQ.exe"
Imagebase:	0xcb0000
File size:	3'149'312 bytes
MD5 hash:	2600CBB9AD38C10ACA6AC4A91900CC84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001D.00000002.2176112255.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Function 00007FF848F52C60 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63aaee4919363ce1e24bce54c00a06b92a3c1644dd2b3ae552ff2c841e79ac6b
Instruction ID: 5529519ec25d0c70cc7585b48c60a854573773cbd1d7a6e70656ff0b3c857fb0
Opcode Fuzzy Hash: 63aaee4919363ce1e24bce54c00a06b92a3c1644dd2b3ae552ff2c841e79ac6b
Instruction Fuzzy Hash: A0C18B3090D68A8FEB49EF64C4596BEBBE0FF59340F1446BAD40AC71D6DB38A544CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F42C18 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5a930476497c068e8e7e2b077e8a2b56f2587abbe9af5783f6de9769765faaf
Instruction ID: b670fed6c76c17c0c6a4a547ee5b59da97c18125c184bc74b60625bb20a7add6
Opcode Fuzzy Hash: c5a930476497c068e8e7e2b077e8a2b56f2587abbe9af5783f6de9769765faaf
Instruction Fuzzy Hash: A9A1893091D64A8FEB85EF6888596BD7BF0FF29341F0405BBE409E7192DB38A584CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F41150 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

hyH, xrefs: 00007FF848F411AD

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID: hyH
API String ID: 0-3369426750
Opcode ID: 1562380bd980c808ba1817866c69afd698574dc4f8022b79003fb0f8b916bbc4
Instruction ID: 3e8a6d24fb33384149ca30e5e5042c241b7a2289f26b27b6a5332f9d9f3cc840
Opcode Fuzzy Hash: 1562380bd980c808ba1817866c69afd698574dc4f8022b79003fb0f8b916bbc4
Instruction Fuzzy Hash: 8F31B030D1CA6E4EEB98AB64D4192FE77E0FF65741F00057BD00AE21C2EF286584C754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F40A01 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

0vH, xrefs: 00007FF848F40A70

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID: 0vH
API String ID: 0-2857910901
Opcode ID: 2543a3587f00947cac1d1faca97db5303cb8ad4fca72baa5184e652f148a700f
Instruction ID: c18231edfd1c96e6571897ef50b899d9d48db8a1c86a4722eca3cfe668591327
Opcode Fuzzy Hash: 2543a3587f00947cac1d1faca97db5303cb8ad4fca72baa5184e652f148a700f
Instruction Fuzzy Hash: B6115B3191894E9EE780FB68C8491BA7BE1FFA8780F4005B6D819E6192EF78A5448740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F42910 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89a454cdda97892a269c275570e817916dc11d1f8ee61b505ac2346e54a7c5e1
Instruction ID: 5c2e5f58271ea540f4e436fa4f824bd7de083202996bc2dc6c3f685585e3679d
Opcode Fuzzy Hash: 89a454cdda97892a269c275570e817916dc11d1f8ee61b505ac2346e54a7c5e1
Instruction Fuzzy Hash: B0E1DC3191E65A8FEB41FBA8E8492EEBBB0FF05355F04457AD048CA183DF386444CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F42C70 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 723b0de8eeb8eb1fa446abf47ec67f69d4c3da3479d94b8f2ae9c8e1e94e7646
Instruction ID: 7f2eb091bae32c1d1c6254a0434db128cb6450bb0f18b5bc2ab10f6398420ad8
Opcode Fuzzy Hash: 723b0de8eeb8eb1fa446abf47ec67f69d4c3da3479d94b8f2ae9c8e1e94e7646
Instruction Fuzzy Hash: D3D1CD3191D68A8FE742FBB888595E97BE0FF29791F0405B7D408DB0E2EF38A5448754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4B465 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5410ddf474d6b1d2b6dacb14fc16c6191e43f1de0bfdc5edb227df6c551835d0
Instruction ID: 045e56cc3b2047f6f09a8f5afd7e50bc573c6e3d8f685fd8ecc97878bacdee62
Opcode Fuzzy Hash: 5410ddf474d6b1d2b6dacb14fc16c6191e43f1de0bfdc5edb227df6c551835d0
Instruction Fuzzy Hash: F3D10630D1965ACFDBA8EB68C4946BDB7B1FF59345F1000B9D00EE3692CB39A881CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F41BE5 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b489c0a4bf1a21631f191f406a84ffb3153f30889bb769a4d27fe0316118e89e
Instruction ID: ed75a71e296393bb77f59152419f74417de737e00f74388dcc0b14bb0c766002
Opcode Fuzzy Hash: b489c0a4bf1a21631f191f406a84ffb3153f30889bb769a4d27fe0316118e89e
Instruction Fuzzy Hash: E191E131A0CA9A8FDB59EF2888551BA7BE1FFA5700F0401BFD449D72D2DB34A846C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F42145 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 964797e7d309a08e6f15dab80863e622aa01dc6909c92abfdd99ba80e095d5fa
Instruction ID: 4e064c2b59dccf949b40d36d7c033497f062eb91ab75108d85c02f7c832c9238
Opcode Fuzzy Hash: 964797e7d309a08e6f15dab80863e622aa01dc6909c92abfdd99ba80e095d5fa
Instruction Fuzzy Hash: B7A11130D0D65A8FEB65EBA488553B8B7A0FFA5780F0401BBC04EE71D2DF3869458B59

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F405F0 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e3a62eb092ca005237eb386b6db8acdafcfe7275c7ce6764ac228a56e59f5bf
Instruction ID: 8a03bd0517142149433b57f7f725c2d669c1f2181d9a0ae745bd46787c755e63
Opcode Fuzzy Hash: 9e3a62eb092ca005237eb386b6db8acdafcfe7275c7ce6764ac228a56e59f5bf
Instruction Fuzzy Hash: 8691AF30A1CA9A8FDB58EF1888555BA77E1FFA8740F14457FD40AD3282DF34A8828785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4CDF0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cadb9e097c9ebfdf55576d3f709c030448972b277b2f2276819f5f4ac0ab0779
Instruction ID: b961051ccc5bd1fc86a8d969e4c2de6536a45c6327bb921fd1e4c157da885c8b
Opcode Fuzzy Hash: cadb9e097c9ebfdf55576d3f709c030448972b277b2f2276819f5f4ac0ab0779
Instruction Fuzzy Hash: B7A14830909A4D8FEB95EF68C858AE97BF0FF29341F1005BBD409D7192EB38A944CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F43098 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48492613628b3433351f2109a822954cf57d9b679bc95a7b4189b42f31bc6b6f
Instruction ID: 4593bee7e60c1de64efd6b707146230599e441832587a48cbf8e20ff7758cabd
Opcode Fuzzy Hash: 48492613628b3433351f2109a822954cf57d9b679bc95a7b4189b42f31bc6b6f
Instruction Fuzzy Hash: B3A16930D0D64D8FEB55EBA8C859AADBBF0EF69340F0401BBD409E7192DB38A944CB15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F416A8 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffd16496fb24554c58776adb74fa6e7933345ce9c32c5f0cc6b648181ddca60b
Instruction ID: 07db7a3bed99063152670ce1c6d96e1e9328f05133533426c4cb56a69f25b00c
Opcode Fuzzy Hash: ffd16496fb24554c58776adb74fa6e7933345ce9c32c5f0cc6b648181ddca60b
Instruction Fuzzy Hash: 21719D31A0CA5A8FDB58EF1888515B977E2FFA8B40F14457AD44ED32C2DF34A842C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4338C Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60756b5422971dda98733585e39ff5bb75b916e0683b63c0da2ee375b8748c64
Instruction ID: 5f7b342f6a64a125203337073e0394827648aae88b15f5d3feaf434a62fe66d9
Opcode Fuzzy Hash: 60756b5422971dda98733585e39ff5bb75b916e0683b63c0da2ee375b8748c64
Instruction Fuzzy Hash: FF818E3090D68A8FEB46EB6888596F97BE0FF29741F0404BBD409D71E2EB39A545C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F435BE Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cba5b684af92d9756b267e82e7976b89beae2305423ad3f494e4cf36054aa1ad
Instruction ID: 41d2fc90340d1db8c5af8cc49ceaa0474616fe2e16ad078af6078c3994707164
Opcode Fuzzy Hash: cba5b684af92d9756b267e82e7976b89beae2305423ad3f494e4cf36054aa1ad
Instruction Fuzzy Hash: 8871BD71E1D90E8FE794EB6CD8557ADBFE1FB99350F50027AC009D32C6EBA819058B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F405D0 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f35975b78127bb7762266def7ba915c8917b5d77d0b5f6487320c03fe85cd832
Instruction ID: 600c249b5abc2bb045df551732dc1b5ddc70004fbfb1bdabbc7d970d77fd3674
Opcode Fuzzy Hash: f35975b78127bb7762266def7ba915c8917b5d77d0b5f6487320c03fe85cd832
Instruction Fuzzy Hash: B361C130A1CA9A8FDB48EF1888545BA77E2FFA8744F14457ED44AD3282DF35A842C785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F52D40 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5438b11531bd4f841eea4deaa6d3e1c0118a65c25cb01d3bb317fe0e22f3e002
Instruction ID: 657e43dde08fc0d33b2928590abec332a9f25239c7201cccb8b96c316c25d925
Opcode Fuzzy Hash: 5438b11531bd4f841eea4deaa6d3e1c0118a65c25cb01d3bb317fe0e22f3e002
Instruction Fuzzy Hash: B4518B3091D68A8FEB58EF64D8551FABBE0FF19350F04027AE809C21C6DB78A554CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4AE88 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 686532ef9769acfe580a881c0e84e1f680f04f2779576620f9a88322232902a3
Instruction ID: 63f4789f173d84dc6b8f68972e64bffa5117f90e82623b60d31b0ab6b96e959a
Opcode Fuzzy Hash: 686532ef9769acfe580a881c0e84e1f680f04f2779576620f9a88322232902a3
Instruction Fuzzy Hash: 9E51BF71C1E68A8FEB55AF6488191FD7BA0FF25751F0404BBE808E61D2EB38A544C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F43140 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f64130edbb43c8d2d561fe61d6a90325a9ef070abfd30474f1d36f6a8a1dbdb
Instruction ID: ede3ea68db2cac3395a23dda9218ce97af2b823be3cf63a77c171834df658c47
Opcode Fuzzy Hash: 4f64130edbb43c8d2d561fe61d6a90325a9ef070abfd30474f1d36f6a8a1dbdb
Instruction Fuzzy Hash: 8E511570D1C61A8EEB54EBA8C499AEDBBB1EF68750F00003AD40AE72D1DB386944CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F41D69 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca47746b4b3d01a11e07d0b5a8be1560a81b38fac9287f92b094093a049323e1
Instruction ID: 8ae4e1bf49036c37018530881b4959f9ef2398f8969c7092f85bfda6def26588
Opcode Fuzzy Hash: ca47746b4b3d01a11e07d0b5a8be1560a81b38fac9287f92b094093a049323e1
Instruction Fuzzy Hash: D141AE30A18A5A8FDB4CEF1888555BA73E2FBE8744F10453EE44ED3281DF30E8428B84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F42E19 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2676a0e98c4ceaa6cfe4bbaefbe3b713f51256baa286f398e275575e255dc5d5
Instruction ID: 9fec236d5fc4796fb71ca1b7a49e1b4a0a1d25737d989b45ffbb331a231c2800
Opcode Fuzzy Hash: 2676a0e98c4ceaa6cfe4bbaefbe3b713f51256baa286f398e275575e255dc5d5
Instruction Fuzzy Hash: 2441D03191D38A8FE752ABB488182FA7BE0FF26750F4509BBC408D60D2EB78A548C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4084D Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 543c30d015acedbae35c85589a50300daa06fa4085821bd9228fd3a171b3128c
Instruction ID: d8de482619038b79cc95d4a8c81d2cd771ede9cab76478622a48a211fd109451
Opcode Fuzzy Hash: 543c30d015acedbae35c85589a50300daa06fa4085821bd9228fd3a171b3128c
Instruction Fuzzy Hash: 8E411F31C0D6898FE792BB7888491E97BE0FFAA740F1504B7D808D70D3EB28A448C755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4D580 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fabd47cde07a1f36bfa5cf6cf8f894b931256b331a2b73e3cf3f838d9acae83d
Instruction ID: d6a1af8cb5d297eac37d2c6768f6b4f53e8052de99d1198964b6b4b4d26df53d
Opcode Fuzzy Hash: fabd47cde07a1f36bfa5cf6cf8f894b931256b331a2b73e3cf3f838d9acae83d
Instruction Fuzzy Hash: BE41E372D0E6D55FE352B73C68291FABFE0FF12254F4805F7D088CA097EA1869488356

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4B2BA Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77c9505dfd25f642c21deede0746de8f6734bd23bd546ccf3f4f640e780f8f18
Instruction ID: 4019b85a242868c7b96b408d5252b6fbec23dfa72d6b11be7a3c16e1630dc2f4
Opcode Fuzzy Hash: 77c9505dfd25f642c21deede0746de8f6734bd23bd546ccf3f4f640e780f8f18
Instruction Fuzzy Hash: 0241DD3191E6899FE342FB7888891E97BF0FF5A305F0946F7D008CB0A3EB28A4458755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4AF18 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dc5a3d5ba96819d2c696bcf0a99fee14ab3586386f0c1d34f10c3ce8da480f4
Instruction ID: 8334c78cb6d8f59750a680f71a08656ec516a8f604b0ebdf020383acc5a39681
Opcode Fuzzy Hash: 0dc5a3d5ba96819d2c696bcf0a99fee14ab3586386f0c1d34f10c3ce8da480f4
Instruction Fuzzy Hash: FA41C070C1E68A8FEB46BB7498151F9BBB0FF29750F0505BBE408E21D2EF286848C715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4269D Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aef3d7bde65cc1f9788af1bf10a9d5f410077107e171031237e72e446c186525
Instruction ID: 049726afff3433687bdec5c1c87e9ed3744a51981ef4e4dee19c1439e386f1fa
Opcode Fuzzy Hash: aef3d7bde65cc1f9788af1bf10a9d5f410077107e171031237e72e446c186525
Instruction Fuzzy Hash: 1031903080D7CA8FEB56AB7488182A97FB0FF26741F0945BBD448C60D2EB38A454C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F40500 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 984639c45f651ecb2d5b95a9fbd15d108c7b81cb325fd20135863e0e076397e2
Instruction ID: e35e16e2d06e66eecd8ecabbf72a957f7decd71ed32f5f4eab8c1011d76e07ab
Opcode Fuzzy Hash: 984639c45f651ecb2d5b95a9fbd15d108c7b81cb325fd20135863e0e076397e2
Instruction Fuzzy Hash: EE41BF3080D68E8FEB56EF7888182A97BF0FF29741F1404BBE408C60E2EB38A544C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F42EA8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b2fd59c0d6fdbcb0d5514c525b2dc516001f56c6a6702b0c1f372637afa8130
Instruction ID: 2451b5e3aa8ba89c0ada8d2e81bf9245825e976b6e49545d44eefefa9beec8b8
Opcode Fuzzy Hash: 1b2fd59c0d6fdbcb0d5514c525b2dc516001f56c6a6702b0c1f372637afa8130
Instruction Fuzzy Hash: F831E13091D38A8FE752BB748C182BA7BA0FF25760F4409B7C408D60D2EF78A504C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F404F8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7d2958dd56dc7e1c7b56911c5622985170bef325fbf4b68ae8b7c106f4fe6cb
Instruction ID: d170fd167a4ba8ae3c7ea921bde81b7c33394c214c37e8debcc419afe6c2f0dc
Opcode Fuzzy Hash: a7d2958dd56dc7e1c7b56911c5622985170bef325fbf4b68ae8b7c106f4fe6cb
Instruction Fuzzy Hash: 9A317A3091D64E8FEB85FB6888586B97BE1FF29741F2409BBD409D61E1EF38A584C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4AF88 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f2aef17642f182fc203ace8e42ed959b9eae66f281996d4e51eeb5673b1ba8
Instruction ID: c16dc769afce828a362aa5bdc6f9dbce27c36d7bbb3f95766f40b41d57568003
Opcode Fuzzy Hash: 85f2aef17642f182fc203ace8e42ed959b9eae66f281996d4e51eeb5673b1ba8
Instruction Fuzzy Hash: 6821D271D1D64E8FEB45BBA498252FDBBA0FF28750F04057BE409E21C2EF3864488719

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F411B6 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4e6afbd8140d87e78843cd0be9b41be5505d95ae465d964d11740ed1f1bf4d7
Instruction ID: 524f0f8456c64e322a4091840efe546f09b7a09e37dd339e3e4e197dc876635b
Opcode Fuzzy Hash: a4e6afbd8140d87e78843cd0be9b41be5505d95ae465d964d11740ed1f1bf4d7
Instruction Fuzzy Hash: 5A115C30D19A5E8FEB49EB6484292FEB7A1FF68740F40047AD40AE21D2EF2969418694

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F42729 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739562d755c1d990e116196be3927fd93fd0db39fe09923891a3389f56072764
Instruction ID: aea93cc09db6579156fb3d40c8d867a516bc35ae0fc42926a036ffd66bf7cea9
Opcode Fuzzy Hash: 739562d755c1d990e116196be3927fd93fd0db39fe09923891a3389f56072764
Instruction Fuzzy Hash: 8311AF3180D68E8FEB95AF3888582A93BA0FF25741F1404BBE808C61D1EB38A454C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F40F24 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23fce0d88b2531c6154784703cc2be602d57acbfaa34b1c5741202db178273ed
Instruction ID: 42e17f7b17fa8e236e9c6aaa47c8aafd796c629f29eff73f3c47227408f3658f
Opcode Fuzzy Hash: 23fce0d88b2531c6154784703cc2be602d57acbfaa34b1c5741202db178273ed
Instruction Fuzzy Hash: 6F11903090990A8FEB94FB54D845BAE77B1FB94351F104276D40AE72D6CF38A981CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4286D Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17085bc2285b7842696777599daf92f3e5a74addd405e349fae3c4a99ed71a22
Instruction ID: bd784f4914c8522cc85dc7d06a7aa212e8de2d4f6f1031a558643cc93bb55abf
Opcode Fuzzy Hash: 17085bc2285b7842696777599daf92f3e5a74addd405e349fae3c4a99ed71a22
Instruction Fuzzy Hash: 37117C3080E7898FE352AB7488585A97FB0EF6A740F1645F7D444DB0E3EB38A449C715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F405D8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 075bdec4cb4b6b3babc2239c965df8f3d121b28e68deb4ce13bede605e58fc97
Instruction ID: 24cfaf4f7d0a07414d10ebab5244afdb1f3ff1b60001512c40cd71cb2be8f4c6
Opcode Fuzzy Hash: 075bdec4cb4b6b3babc2239c965df8f3d121b28e68deb4ce13bede605e58fc97
Instruction Fuzzy Hash: 1E012C30918A1E8EEB88EF24C4596BA77E1FF68345F10447ED40AE21D0DB36A591CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F40610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9662785ff6bedc192821ace8d95291ee05f2a680b74f62243d8f88eeaf5ddcd
Instruction ID: 2376acde085e6912167d74d80d32fc9eeaf851cb85c1023334476e2053f2dd02
Opcode Fuzzy Hash: b9662785ff6bedc192821ace8d95291ee05f2a680b74f62243d8f88eeaf5ddcd
Instruction Fuzzy Hash: ED016930818A0E9FEB48EF6484592BDB7A0FF28345F60087FE80ED21D1EF36A594C604

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F427FD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c6ee47fd75e13c688365059f52afe2062518881ca93ad5fa7ac7d790b53f2a5
Instruction ID: cd46051c86f3e0c3b4d270792330758a6c4110588c9c8accfcb8560ca5bd9272
Opcode Fuzzy Hash: 2c6ee47fd75e13c688365059f52afe2062518881ca93ad5fa7ac7d790b53f2a5
Instruction Fuzzy Hash: FFF0907180E68D8FEB59AF6488591BD7BA0FF25241F5504BFD809C51D2EB399454C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F40608 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07e49094bfd5d743e02f247ecaa339439d7bdf2d61fec4344544296521284bb
Instruction ID: 3a7176182a075163ed98b870a73040aa593a9ba2066e3abffbd7b4d7f9e659c3
Opcode Fuzzy Hash: f07e49094bfd5d743e02f247ecaa339439d7bdf2d61fec4344544296521284bb
Instruction Fuzzy Hash: FAF06D3081D64E9EEB58BF7488082BA72A5FF24745F50093FE81ED11C0EF38A554C654

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F42798 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a258bf2e72c793ea023cd5a0fd4c441ca30899d2c21349cc7c8e31c9d7522a5b
Instruction ID: c6b564ee6796d94edbee1b82b0eca24a8a6ce5acae1cd699c6f014f96709fc0b
Opcode Fuzzy Hash: a258bf2e72c793ea023cd5a0fd4c441ca30899d2c21349cc7c8e31c9d7522a5b
Instruction Fuzzy Hash: 90F0A03080D64E8EFB59BF7888192FA3AA1FF64781F10087EE81DD10C1EF78A4548740

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF848F4A553 Relevance: .6, Instructions: 551COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecb8af9edddd87a3ee91e7995be5d1cf01161ebe342ab77231bcb85de5cb143d
Instruction ID: 0ac37b949967724c89e023d90b650f3b3542e7d0706115de24466804ed555609
Opcode Fuzzy Hash: ecb8af9edddd87a3ee91e7995be5d1cf01161ebe342ab77231bcb85de5cb143d
Instruction Fuzzy Hash: FA12817180D7C98FD747AB3488695A93FB0EF27340F0A05EBD485CB1E3E6289959C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F42C20 Relevance: .5, Instructions: 532COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108838353.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Xmz1XDgtah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b50ee5db6fe4b879587a63a9e964e34f69106fef0a5b6cf3dc71ac65b85d64c1
Instruction ID: e843deb763ba4dead61fcc1c05da72780591c1f214c4b1373ab14c04b035438a
Opcode Fuzzy Hash: b50ee5db6fe4b879587a63a9e964e34f69106fef0a5b6cf3dc71ac65b85d64c1
Instruction Fuzzy Hash: 09024A3090D68D8FDB86EF2888586BA7BF0FF29341F1504BBD409D71A2EB35A584CB55

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 2848, Parent PID: 3192COMMON

Executed Functions

Function 00007FF848F11150 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

hyH, xrefs: 00007FF848F111AD

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: hyH
API String ID: 0-3369426750
Opcode ID: 20390e1cd4e7f3cfec1b14e09783a8d6acd672c25855498102dbfebab2e724a7
Instruction ID: 594d2441ac2aa8de5bf085e530602f7bfda4888e7343499757c174f5b6c4bd3e
Opcode Fuzzy Hash: 20390e1cd4e7f3cfec1b14e09783a8d6acd672c25855498102dbfebab2e724a7
Instruction Fuzzy Hash: 78319C30D1CA9E8EEB99EB68C4696BEB7E0FF59341F00157ED00AD21C2EF256984C754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F10A01 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

0vH, xrefs: 00007FF848F10A70

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: 0vH
API String ID: 0-2857910901
Opcode ID: 678315d5c5e8ade921344b160e6d3c90f15bc279fe59bcf11d8943e4f79235d9
Instruction ID: ee4b45e42ff81834ed1bc795ae0fc49b4402f0c4e53f8c10d2ff2bc65e90ada4
Opcode Fuzzy Hash: 678315d5c5e8ade921344b160e6d3c90f15bc279fe59bcf11d8943e4f79235d9
Instruction Fuzzy Hash: 58116A31D1C55E9EE780FB68D8492BA7BE1FF98381F4405B6D809C6192EF38A9448740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1B465 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41db633a9e1e3b4a5e6fe6d620f12b7b75b9ac312cf9f3bce42cc639df7893df
Instruction ID: 52205142876ec8bf223fafe18b70bfb9a2ea956ecc9999e11ed1d824b932f067
Opcode Fuzzy Hash: 41db633a9e1e3b4a5e6fe6d620f12b7b75b9ac312cf9f3bce42cc639df7893df
Instruction Fuzzy Hash: 8ED11930D19659CFEBA8EBA8D4546BDB7B1FF5A341F5000B9D00DE3291CB396881CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F116A8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b5e47e3fcf6bc216a54adc974de8d1ade3b87347758f5b435d884f7bcd0a17
Instruction ID: 3bc3412128a9d0144792230305b87265cea0fcf1f7a19c163ee47cff49f50ad7
Opcode Fuzzy Hash: 26b5e47e3fcf6bc216a54adc974de8d1ade3b87347758f5b435d884f7bcd0a17
Instruction Fuzzy Hash: E6819B31A1CA4A8FDB59EF1888656B977E2FF99740F14457AE44EC32C2CF24AC428785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F135BE Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4beed55188eaccba644910f0b2187baad1ccce97b6b22b2af02049538540bda2
Instruction ID: dc0b34cdeafce7c16b01623c3b004941fabdc7d6c63e0bdf65065b7c09dd1f1c
Opcode Fuzzy Hash: 4beed55188eaccba644910f0b2187baad1ccce97b6b22b2af02049538540bda2
Instruction Fuzzy Hash: 67718B71E1C90A9FE795EB6CE8293ADBFE1FF99350F50017AC009C32C6DBA818058B45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F11D2D Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9419daa1d36fde8a515d3a41c04ee51ff236e3e663b17afb27e3a6c756819624
Instruction ID: 35687dfb1c6e2d0c737bbc90567a3fca23e6355c0a981460ec2c969bf5c2eee6
Opcode Fuzzy Hash: 9419daa1d36fde8a515d3a41c04ee51ff236e3e663b17afb27e3a6c756819624
Instruction Fuzzy Hash: B351BF31A1CA9A8FDB49EF1888645BA77E2FB98740F14457ED44AC7282CF34EC42C785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F13191 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f25889f42191303e3eef6c7365d58f1729ca7decf33f97b313a28cfc63a0f4c7
Instruction ID: 8afb1ff557fe32c8ebeccd079020699e53bac75e54978200712d46d827fba746
Opcode Fuzzy Hash: f25889f42191303e3eef6c7365d58f1729ca7decf33f97b313a28cfc63a0f4c7
Instruction Fuzzy Hash: EE512270D0C64E8FEB98EBA8C4956EDBBB1EF58351F10003AD009E72D1DB39A944CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F12145 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4c5a707d2dc8f493bd844737d1fce4985172a064d13074c37d0c36ce3864413
Instruction ID: 4acbdb945d07b3344928852988646e036bbf00181708fe6945b2ef6670488256
Opcode Fuzzy Hash: d4c5a707d2dc8f493bd844737d1fce4985172a064d13074c37d0c36ce3864413
Instruction Fuzzy Hash: D7412831E1DA8A4FE386E7B898551B8BBE0EF8A390F0505BBD44CC71D2DF28AC418355

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1338C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 852075d1bc8943819f728ef96bde7fba0adb35a55e43f6654e47e3d6f0783cb9
Instruction ID: ba9f55ea4f5e92f2e5272395681f1fbd16f5c437efbea0e8e875a19a6d44609e
Opcode Fuzzy Hash: 852075d1bc8943819f728ef96bde7fba0adb35a55e43f6654e47e3d6f0783cb9
Instruction Fuzzy Hash: EC21C33084D78A8FD742AB7488585A57FF4EF5B301F0804EAD445C70A2EA299846C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1084D Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c888388c7bc8e9f23bfd64fc03ace70d16a14df574161ae5dacb7c246740cc40
Instruction ID: ae89d3045b76b4ec4c875d53cf5bf7affa02c7cf07926c90707805b523b626b7
Opcode Fuzzy Hash: c888388c7bc8e9f23bfd64fc03ace70d16a14df574161ae5dacb7c246740cc40
Instruction Fuzzy Hash: A2110131D0C65A9FE741BB7888891E97BE0FF95350F1544B6D409C60D2EA24A844C785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F12C18 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a023dbbff19fb541fa1d56ac7705a66d458a2a932b8a404ac8fc3638cd028f34
Instruction ID: 0590eb3bc23ef9e77a57e92cee7f234701cc16005d5dab634ca8df89cd2c1408
Opcode Fuzzy Hash: a023dbbff19fb541fa1d56ac7705a66d458a2a932b8a404ac8fc3638cd028f34
Instruction Fuzzy Hash: C6111F70918A0D8FDF88EF18C449ABE77E0FF58345F10456AE81ED3294DB34A991CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1B545 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1076aa5143ba60cb12ed31f1dedfba5fb216d3e469d3860a1d48527ae89773b
Instruction ID: 640fcf825fe3322f257a9059b1541f3463da90e248ca2b76d1b07052851551a9
Opcode Fuzzy Hash: e1076aa5143ba60cb12ed31f1dedfba5fb216d3e469d3860a1d48527ae89773b
Instruction Fuzzy Hash: 98116030918A0E9FDB98EF6CC45A6BEB7E0FF58305F10457AE41ED2191DB35A190CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F10F30 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3154e27150d278d0be8ad323238ccc5ccaecd481baacc769de9fc402a9b68b97
Instruction ID: 03093c2b0280cfaa47022adedb1b9e46579455b7256ec3ec59083840cbcd39e6
Opcode Fuzzy Hash: 3154e27150d278d0be8ad323238ccc5ccaecd481baacc769de9fc402a9b68b97
Instruction Fuzzy Hash: 82115B31A1D91A8EEB54FB58D845BAEB7B1FB94341F104275C40AD7296CF38A9818B84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F134B5 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b4bcc659396e7e2cd1e7eedfcd153f36ac49c7b2828fcafa828aadb9fcef4d
Instruction ID: e4ce4cce94b368c58a011c7544079c4faff670462263bd4249eed64fc9d2ca66
Opcode Fuzzy Hash: d3b4bcc659396e7e2cd1e7eedfcd153f36ac49c7b2828fcafa828aadb9fcef4d
Instruction Fuzzy Hash: E0115E7091C68E8FEB59EF6884992BE7BA0FF18341F4404BAD41AC71D1DF39A954C744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1B4DD Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35d2f256ea091faf3bfff449d3fd32cbdb7b9a0bd94a981e78ba5028a8d7ae64
Instruction ID: 356463c79a764a3c4b91324149e396604d5ad4f84b74c2d02ca6d6836f364bca
Opcode Fuzzy Hash: 35d2f256ea091faf3bfff449d3fd32cbdb7b9a0bd94a981e78ba5028a8d7ae64
Instruction Fuzzy Hash: 4E114C3091860E8FDB45EF68D4496BE7BA0FF58345F10057AE81AD2190DB35A590CB48

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F12E91 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d75bd26e6cfc13aa6d012656b9318e126fbd89d2cbf406588cb6481f8183e88
Instruction ID: bbdc73f009a725b2e41d3b4d395cd3ba010878c75edf41133885e179e99dfe50
Opcode Fuzzy Hash: 7d75bd26e6cfc13aa6d012656b9318e126fbd89d2cbf406588cb6481f8183e88
Instruction Fuzzy Hash: 2F01783091D68E8FE751FBA888886A97BE0FF19341F0508B6D40CC70A2EB38E9948704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1AF01 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57412f5a7d836e6d92c76ca826f2d6c517ac56802145be221a63d9b4393034ec
Instruction ID: a8a438b82f8da2d4f3ec489eac4176103b5efcc56e8e7b0692728c3bc9bf0867
Opcode Fuzzy Hash: 57412f5a7d836e6d92c76ca826f2d6c517ac56802145be221a63d9b4393034ec
Instruction Fuzzy Hash: 26017C7086D74A8FE791FB24884D2B9BBE0FF59341F4546B6D408C60A2EB38A880C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F105D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed57972983210687ad16a115856c5821080d06965d6ca1f3335fb98d4af8c91
Instruction ID: 776a5186b04fb868b342bc587acdb6add03045193e682f496c9f24a85cc14a43
Opcode Fuzzy Hash: 4ed57972983210687ad16a115856c5821080d06965d6ca1f3335fb98d4af8c91
Instruction Fuzzy Hash: DB019E3090990E8FEB48EF24C4596BAB7A1FF58345F10547ED40EC21C2DB32A990CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1286D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab050955dee47809f54aa40a982584a51dc8402483b2eaf9b9f56d9048849f1b
Instruction ID: 465edd581ffd45faea11cff828894fe9aca38f9dbcd14d6ac57ec247f3e30275
Opcode Fuzzy Hash: ab050955dee47809f54aa40a982584a51dc8402483b2eaf9b9f56d9048849f1b
Instruction Fuzzy Hash: 08018B30C0D64E9FE751FBA888896B97BE0FF69351F1504B7D408C60A2EF38E8848714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1B319 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc61a716b635cb03c07907159d30b36b72faa32953e9d47a678178e78d6016f5
Instruction ID: e7441e704d55e109b6a9933c9c2cb6e9ddc241e13f23d9d689438731d077cc1f
Opcode Fuzzy Hash: cc61a716b635cb03c07907159d30b36b72faa32953e9d47a678178e78d6016f5
Instruction Fuzzy Hash: 3301783096D6899FE752FB7888591A9BFE0EF5A340F0948F7D008C70E2EA28A854C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1AF79 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07a28987ba2387e2a50867ce9a2269d2f16100d5aaf30765ceb18f6d8de085f
Instruction ID: 2ae7bc439b7fdcbf96951e74ab3c9767a94e14b6af4c91511bc70387d0c9ce5d
Opcode Fuzzy Hash: f07a28987ba2387e2a50867ce9a2269d2f16100d5aaf30765ceb18f6d8de085f
Instruction Fuzzy Hash: 6701BC7081D6894FE742FB3488481A97FE0EF1A340F0506F6D008CB0A2EB38A884C315

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F12F09 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8b76b83cd2aff73e25563a4870e3702753fe7ce7428c9c8e63ce08635c426eb
Instruction ID: 4516acaa09ad58923815e024134f7e57aceacca6b2abdf37b88e9253f4830e53
Opcode Fuzzy Hash: b8b76b83cd2aff73e25563a4870e3702753fe7ce7428c9c8e63ce08635c426eb
Instruction Fuzzy Hash: 2401843191D6894FE742FBB488591A97FE0FF59340F4645F6D408CB0E6EB38A844C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F11CAD Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6924456bc2451a982a674cb64f2809bdad3ffeac408f0c7e865e603dc21fae8c
Instruction ID: 158f55ff15625efc3e599c8eab106dde0a190b7dbae8f806b6e5f33ca8f777aa
Opcode Fuzzy Hash: 6924456bc2451a982a674cb64f2809bdad3ffeac408f0c7e865e603dc21fae8c
Instruction Fuzzy Hash: CA01813080D68E8FEB59EF2498596FA7BA0FF55341F4415BAE808C21D2DB769890C744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F10608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61cc8fe0a738afc4882b0116766ca57f34be567228959de858faabacce2acca9
Instruction ID: 60e63f92950068e310e82253dbb5c6e393fcdc942cce6ef98766ee897061e66f
Opcode Fuzzy Hash: 61cc8fe0a738afc4882b0116766ca57f34be567228959de858faabacce2acca9
Instruction Fuzzy Hash: 9A018C30918A0E9EEB49FFA4C4582BA77A1FF18345F50087EE40ED25D1DF35A990CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F10610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba92d3f3268ae6165e1bd56070eafe8d35e1ac809f3c704e11c53008ad5c518
Instruction ID: cd951bf446401056a7d925087b9ac75385de364c0a3d4d745024ba4e77b0fd5e
Opcode Fuzzy Hash: dba92d3f3268ae6165e1bd56070eafe8d35e1ac809f3c704e11c53008ad5c518
Instruction Fuzzy Hash: 0E016930918A0E9FEB48EFA484592B9B7A0FF18355F60087EE80EC21D1DF36A954CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F105D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2d4ab4e5a2994e3d762539e47ac805ff9f113126fe42f5355eafdc9959c1571
Instruction ID: efb773e8eb66c956cc8860262a084664a3f8030682335bdd3df5c15f9764118d
Opcode Fuzzy Hash: f2d4ab4e5a2994e3d762539e47ac805ff9f113126fe42f5355eafdc9959c1571
Instruction Fuzzy Hash: 7AF0F63081E64E8FEB44FF2494052FA7BA4FF15345F00147AE80DC21C2DB35A890C748

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F123FB Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 708cfaa410fd1ec97ef51abff87d77e01427f3ed0b15ca408bed6065b368c452
Instruction ID: 15b8057d4815bbb80a933128dd4fac78da5db87a8da5d0c912cfe3682b56ac92
Opcode Fuzzy Hash: 708cfaa410fd1ec97ef51abff87d77e01427f3ed0b15ca408bed6065b368c452
Instruction Fuzzy Hash: 6611B371D085298EEB68EF60C895BE8B2B1FB50351F0001AAD40EA62D2DB782E84CF04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F12789 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faa6b5a809287d1e22c731bb5b02359c46aaa3af7e0d6579c5c3b323326c7265
Instruction ID: edecf2a93a0319e8d40154374200601ed8f0c7c73fc9595200fdd1834b31c0c1
Opcode Fuzzy Hash: faa6b5a809287d1e22c731bb5b02359c46aaa3af7e0d6579c5c3b323326c7265
Instruction Fuzzy Hash: FCF0F63180E78A8FEB59EF7488182BA3B61FF16341F0504BFD409C64D2EB38A854C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F127FD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb63772a3c0faacff1131ca69c5f2943986eaae5f7145e1bd4f9146cdf74f7bc
Instruction ID: c89de929331227b2b5350388b1ccf3202a0f2c38fc211abd52eb37d27bca394b
Opcode Fuzzy Hash: fb63772a3c0faacff1131ca69c5f2943986eaae5f7145e1bd4f9146cdf74f7bc
Instruction Fuzzy Hash: BCF0907080E6898FEB59AFA488991B97BA0FF15351F5404BFE809C51D2EB399854C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F111B6 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac7a1329a316df95cc09e4671272a661e2f9cbb4893fecbdc5abc1eec89c8701
Instruction ID: 9d1593f368832ea318718041d6d541f6b4eb2adbb522240ded33155587c7e9d4
Opcode Fuzzy Hash: ac7a1329a316df95cc09e4671272a661e2f9cbb4893fecbdc5abc1eec89c8701
Instruction Fuzzy Hash: 77C01230C1662E8EDB40EB50A8010FEB270FB84200F801022E81CA20C2EF3829108688

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF848F1A62D Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2606691282.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848f10000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7bb04ef484f2cd634f4f150ab367eb34b63c3f941ede210018b3db2db0b833a
Instruction ID: 21756239e689c56ac00783326d32f10f7c35ed584d900ce20e349328a3df9024
Opcode Fuzzy Hash: a7bb04ef484f2cd634f4f150ab367eb34b63c3f941ede210018b3db2db0b833a
Instruction Fuzzy Hash: 7851676044E7C54FE7539B748C666A63FB0AF13354B0A02EBD488CB4E3E6285D99C762

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 5660, Parent PID: 1068COMMON

Executed Functions

Function 00007FF848F4F8AF Relevance: 6.3, Strings: 5, Instructions: 85COMMON

Download Yara Rule

Strings

I, xrefs: 00007FF848F4F8B8
], xrefs: 00007FF848F4F99E
V, xrefs: 00007FF848F4F936
k, xrefs: 00007FF848F4F0B6
^, xrefs: 00007FF848F4F9D3

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F4F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f4f000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: I$V$]$^$k
API String ID: 0-2537897772
Opcode ID: 30a997011f3e29c91c4521fa3f7d755e8d85d348abe81597821d97deff2a9d7e
Instruction ID: 52d393b6eee9653c570dd21295a68024b807525b45d473439aa1e13e2ba443d9
Opcode Fuzzy Hash: 30a997011f3e29c91c4521fa3f7d755e8d85d348abe81597821d97deff2a9d7e
Instruction Fuzzy Hash: 1E31E270D0862D8FDBA8EF18C8947E9B7B1EB64741F0041EAD40EA7291DB386E84DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4F0A8 Relevance: 5.1, Strings: 4, Instructions: 82COMMON

Download Yara Rule

Strings

i, xrefs: 00007FF848F4F3A5
k, xrefs: 00007FF848F4F0B6
}, xrefs: 00007FF848F4F4FA
d, xrefs: 00007FF848F4F535

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F4F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f4f000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: d$i$k$}
API String ID: 0-1577325851
Opcode ID: 234ae109435d6ad56b397c942fa2be2fea1f5182e0acaa0809fc44382a5d89ed
Instruction ID: fed8b10a7d9089894cb5f3a03a7e14663d21b794e7bdc9357b57ae71637f2fac
Opcode Fuzzy Hash: 234ae109435d6ad56b397c942fa2be2fea1f5182e0acaa0809fc44382a5d89ed
Instruction Fuzzy Hash: F841B070D096298FEB64EF18C8887EDB7B1FB64741F1041EAD40DA3292DB386A81DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4F3DF Relevance: 2.5, Strings: 2, Instructions: 48COMMON

Download Yara Rule

Strings

:, xrefs: 00007FF848F4F43B
i, xrefs: 00007FF848F4F3A5

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F4F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f4f000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: :$i
API String ID: 0-322666766
Opcode ID: 51538353381afca9f388be10333f7a8c9b31be3e4ebd4b7febb180e97aa5ad49
Instruction ID: 16daaccc306e3639f1a7beaa26fd2458eb82cdd078722ec3997df09077d58ee8
Opcode Fuzzy Hash: 51538353381afca9f388be10333f7a8c9b31be3e4ebd4b7febb180e97aa5ad49
Instruction Fuzzy Hash: 2A119C70D0C66E8FEBA4EF14C8947B9B7B5EF64741F0001FA940DA2692DB746A84DF04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F55BFD Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

8mH, xrefs: 00007FF848F55D0A

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: 8mH
API String ID: 0-1362847371
Opcode ID: 691317d4f929eda1e07d50cd75624e471fa5fe3164c5fefe773f93b6a0bd9622
Instruction ID: 8f8fe2ebe8d27a9ae4cceed475c8df6f1d4cc5d3efb6b21caf2cc57099347788
Opcode Fuzzy Hash: 691317d4f929eda1e07d50cd75624e471fa5fe3164c5fefe773f93b6a0bd9622
Instruction Fuzzy Hash: FD917F70D0CA4D8FEB94EB68C859AADBBF1FF29341F0001AAD00DE7296DB356945CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F55C10 Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

8mH, xrefs: 00007FF848F55D0A

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: 8mH
API String ID: 0-1362847371
Opcode ID: 71c7f7e6daee61ec55878fd2d1aa4d7515013192a1c39ad99adf3e229f183c1b
Instruction ID: fde6831885dd96ef696a4eb6e4c1783e9c78a76c9ac1bb570a90ec16aaf7b32a
Opcode Fuzzy Hash: 71c7f7e6daee61ec55878fd2d1aa4d7515013192a1c39ad99adf3e229f183c1b
Instruction Fuzzy Hash: E0510871D1891D9FEB94EBA8D859BADBBF1FF68340F4001AAD00DE3296DF3468458B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F41150 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

hyH, xrefs: 00007FF848F411AD

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: hyH
API String ID: 0-3369426750
Opcode ID: 36c31f9d13ceb8ee02372555f6bcd3264f0e3a611d5fa4772c4b4b7eb5a1f230
Instruction ID: f84f6cdef8ecd5d1c9a6597e154b55a231d469f4b17eb851df6511c08b8879e4
Opcode Fuzzy Hash: 36c31f9d13ceb8ee02372555f6bcd3264f0e3a611d5fa4772c4b4b7eb5a1f230
Instruction Fuzzy Hash: DB318D30D1CA6E4EEB98EB64C4696BA77E0FF69741F00057BD00AE21C2EF296584C754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F40A01 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

0vH, xrefs: 00007FF848F40A70

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: 0vH
API String ID: 0-2857910901
Opcode ID: 864db41e83d1f4db4a6de952e8d87979c47212276c5789712d71f75b437a308b
Instruction ID: aedcbd1b4d4001e0ab3c0c10f353881bbca67e213e0c53dda5e9d3e5edcf4bb0
Opcode Fuzzy Hash: 864db41e83d1f4db4a6de952e8d87979c47212276c5789712d71f75b437a308b
Instruction Fuzzy Hash: 5F115B3191894E9EE780FB68C8491BA7BE1FFA8780F4005B6D819E6192EF78A5448744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F53D58 Relevance: .5, Instructions: 463COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd05b7d0aac5042500bb0599b8c767b53cb20d98c4d2c4d314fb7212830230bb
Instruction ID: 2372613ec107cb4876d6cb7f865aad41b629e9905d490408532246a805d20b78
Opcode Fuzzy Hash: dd05b7d0aac5042500bb0599b8c767b53cb20d98c4d2c4d314fb7212830230bb
Instruction Fuzzy Hash: C3218E7180E6D99FE342EB7888591A9BFF0BF16340F0905FBC048CB0D3DA28A5488352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F545B5 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e78517044f21cb08fd8ed221f66926f0735475667b9f78c1da00b13e76114e65
Instruction ID: 6086246cd7520065f08c3be00c1b96d33a255a473dff84deff2173599911fab5
Opcode Fuzzy Hash: e78517044f21cb08fd8ed221f66926f0735475667b9f78c1da00b13e76114e65
Instruction Fuzzy Hash: 03C195B0D1862D8EEB95EB68C8957EDB7B1FB68341F1041AAD00DE3292DF7469848F44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F416A8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d569fe86d81129f6edb94993e72d61bda6e323bffeac8e4f48025c002a16e395
Instruction ID: 6c1ea7851268817209c5a785c263277944875b9f3c611261bff2a523375310c3
Opcode Fuzzy Hash: d569fe86d81129f6edb94993e72d61bda6e323bffeac8e4f48025c002a16e395
Instruction Fuzzy Hash: D981AE31A0CA5A8FDB98EF1898555B977E2FFA8B50F14057AD44ED32C2CF34AC428785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F435BE Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55faa4dd8a7273dc5e37b2fa0121fcaec90fae2eecc2517b28edbc2084c4b07f
Instruction ID: 945752a5953bb22e4f88f49028a37bae8049ce62d96bc399fc4525af15c3bac5
Opcode Fuzzy Hash: 55faa4dd8a7273dc5e37b2fa0121fcaec90fae2eecc2517b28edbc2084c4b07f
Instruction Fuzzy Hash: C371BC71E1D90E9EE784EB6CD8157ADBBE1FBA9354F5002BAD009D32C6DBB818018B45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F41D2D Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475960a1b6d137527c43795050bcbd12437273c4816ad806d96089fc489761d6
Instruction ID: 45545501d2ceb36583b163691a2f89a411724c47dd53138fdaa338a5922594ba
Opcode Fuzzy Hash: 475960a1b6d137527c43795050bcbd12437273c4816ad806d96089fc489761d6
Instruction Fuzzy Hash: 6151B031A1CA9A8FDB48EF1888545BA77E2FFA8740F14457ED44AD7282DF34E842C785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F533CD Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e036bec8fb30b83a8689a9db5b0e9feb26318d9703ec15afa3e6e888b885733
Instruction ID: bd1b33d9e1eee7bab4b96bee9b956f75a58b194640952512c2304cce1664fd3b
Opcode Fuzzy Hash: 5e036bec8fb30b83a8689a9db5b0e9feb26318d9703ec15afa3e6e888b885733
Instruction Fuzzy Hash: 0971D170D19A1D9FEB94EB58C859BEDB7B1FF68340F5041AAC00DE3292DF3469858B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F53301 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f06d4d534d958ecaa26d1e7b796a24bfefbec9ca143d75aa88a70fcdb65d710
Instruction ID: 8462a1823d161b85a2376af7ca3e5f3e76b955b6580cb49a449890f716e17279
Opcode Fuzzy Hash: 4f06d4d534d958ecaa26d1e7b796a24bfefbec9ca143d75aa88a70fcdb65d710
Instruction Fuzzy Hash: A861E370D09A1D9EEB94EB68C8597ADB6F1FF59340F4041BAD00DE7292DF34A984CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F43191 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9663ebd40b4cf26eedf7b1e3d8eb193a018f055d423aed163e341994a300be15
Instruction ID: e977f4ab9bf328b4922045ce653e097aeeee75b655370515fff6669d1ab6fd15
Opcode Fuzzy Hash: 9663ebd40b4cf26eedf7b1e3d8eb193a018f055d423aed163e341994a300be15
Instruction Fuzzy Hash: 32512730D0861D8FEB54EB98C499AEDBBF1EF68751F10007AD00AE72D1DB38A944CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F42145 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438d13888b0f087db24939db5b6b36d1ede124b4002535503d864ccb82b7cd00
Instruction ID: b188f953ddfd95e364b7293b635fe6e63adb3250ec746191c8cba977c213c6fa
Opcode Fuzzy Hash: 438d13888b0f087db24939db5b6b36d1ede124b4002535503d864ccb82b7cd00
Instruction Fuzzy Hash: 21415A31E1DA4A4FE346EB7898451B8BBE0EF96790F0500FBD04DD71D2DF28A9418355

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4D0FB Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f4b000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: decbf975b5d5e773a83496279355da682b88e243aa316127e0a400d0ac2cc580
Instruction ID: 0951aca5ec569316387567837f0240523590dd568e7dace45a20a2b55fc3e482
Opcode Fuzzy Hash: decbf975b5d5e773a83496279355da682b88e243aa316127e0a400d0ac2cc580
Instruction Fuzzy Hash: F241B43290E55AAEFB45BBA8B4450FD7760FFA17B9F041277D90D990C3EF2C644182A8

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F5289D Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9a13b74dc31f017708930b6550f8b8c22b0de5ae3aff54e4181e0aec5fc94b6
Instruction ID: dd1653c044d01cc006d64d1f95038ac74837a33e1e74290dacfe829cfce2eb62
Opcode Fuzzy Hash: b9a13b74dc31f017708930b6550f8b8c22b0de5ae3aff54e4181e0aec5fc94b6
Instruction Fuzzy Hash: CD413071E0D64E8FEB58EFA4C4546FDB7A1EF59340F10067AD00AE7286DF38A9808B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4D0C0 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f4b000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46dbe8ffa27e76a7bba58ba0d4c6b6292b783e2cc60a6d7abdb30ece82bf1ffd
Instruction ID: 03525656f441c9a53d80af159d865aaf4795bd4fb51ba62c1461726dd364bb43
Opcode Fuzzy Hash: 46dbe8ffa27e76a7bba58ba0d4c6b6292b783e2cc60a6d7abdb30ece82bf1ffd
Instruction Fuzzy Hash: 9541C53291E55A6EFB45BBA8A4440FD7760FFA17A9F040677D40EDA0C3DF2C644182A8

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F5312D Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f92f181c44ed0353aa1bef197c75b0992dc8b433a3a06b4eebf1c5764e64cbf
Instruction ID: be06637c6297cc53f53235a10a68af1abc9460d148c4c96c8be2fa0e265e1f60
Opcode Fuzzy Hash: 4f92f181c44ed0353aa1bef197c75b0992dc8b433a3a06b4eebf1c5764e64cbf
Instruction Fuzzy Hash: DA418D30E1964D9FEB44EBA8D8556EEB7B1FF58300F50017AD409E3282DF386841CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4CA48 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f4b000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a9e4e50299af9233ea7cb1a4adcae2df7006939e7bc023972d606f382cae434
Instruction ID: ded99808265ae141e0b4fc8b81b332463a3b7ac34731828326f4dfa2efa7e50c
Opcode Fuzzy Hash: 5a9e4e50299af9233ea7cb1a4adcae2df7006939e7bc023972d606f382cae434
Instruction Fuzzy Hash: 6731B234E1C91D8EEB98FBA89855ABCB7B1FF68740F50116AD00DE3282EE3468418B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4BAB2 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f4b000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4339ac349e57236e1b9c1db7eeacebf49b792f74aaab20d4a8a304e4ebbfad88
Instruction ID: 6c66a79282d8e2741cd2d03abec96e9426d3b8ef1b8d45f9dfaa7234bbf1d337
Opcode Fuzzy Hash: 4339ac349e57236e1b9c1db7eeacebf49b792f74aaab20d4a8a304e4ebbfad88
Instruction Fuzzy Hash: 8F311C70D1851A8EEB54EB94C8557FDBAF1FF68751F1041BAC10DE22D2DF3819848B54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F544FB Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 636d57255f55970b318eb4a7c7b3dfa1dfd42f2f43d29765a1486f4bac63fa65
Instruction ID: 24ffc2a23f5163189ae0063f1bde3c0b6a0680b60e6d765687eb4e5755ab41bb
Opcode Fuzzy Hash: 636d57255f55970b318eb4a7c7b3dfa1dfd42f2f43d29765a1486f4bac63fa65
Instruction Fuzzy Hash: D721C172D0D6994FE752EB3898591B9BBE0FF6A350F0444B7D448CB093EB2459488715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4338C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 707122941ee08d36fc1b03ee50c61f9c1465781be815d7151da225c23eeed7d9
Instruction ID: 3e6a4a76ac2967cda479b90d2242886bd1434fdd4392a66ed88956225d824799
Opcode Fuzzy Hash: 707122941ee08d36fc1b03ee50c61f9c1465781be815d7151da225c23eeed7d9
Instruction Fuzzy Hash: A221C03184D68A8FE742EB7888585E97FF0EF5B300F0804EBD449C70A2EA28A446C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4B75D Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f4b000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 044d2a4dfdf2bb559112dfce93c604c5edf19d95c4efb1847d1c32d1b3919402
Instruction ID: 7f377d6998c173aa74d89753c26d37401171cb5a91da7bc80c8dcb96088084f5
Opcode Fuzzy Hash: 044d2a4dfdf2bb559112dfce93c604c5edf19d95c4efb1847d1c32d1b3919402
Instruction Fuzzy Hash: 34218931D2D94A9EEB51BBA888191F9BBE0FF69780F1409B7D419E60D2EF28A5408644

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4084D Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53cb6ad0a98596a284727aa9af6f273d90aa2dddb28aa7c65ea96ff77f0f5327
Instruction ID: 7d8855fc776d3ba88c945197a40f5aefeaa36fa2c45a4750921e5526949408b4
Opcode Fuzzy Hash: 53cb6ad0a98596a284727aa9af6f273d90aa2dddb28aa7c65ea96ff77f0f5327
Instruction Fuzzy Hash: 45110131D0D64A9FF785BB7888495E97BE0FFA5740F1544B7C809D70D3EA28A4448685

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F576E1 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca557b867c610480c8b89cd988e946a8fe14aca7a4aab35a8458c58eae4a071
Instruction ID: a57184c5868bfa80a283c921d081025d69c310f789715b030facf9715b4304b7
Opcode Fuzzy Hash: aca557b867c610480c8b89cd988e946a8fe14aca7a4aab35a8458c58eae4a071
Instruction Fuzzy Hash: 8A11AF3080DA4E9FEB88EF28D4592BABBA0FF68741F0005BAD40DC21D2DB38A444C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F52E21 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50699c4dccd3684316ff2e7d80a159ab1e3bc13063d52a0bb9f40163da81bd99
Instruction ID: 3fda38a305824d3731c50a7cffef2c0af0ab13cad57466a46efd5d248c16cdb7
Opcode Fuzzy Hash: 50699c4dccd3684316ff2e7d80a159ab1e3bc13063d52a0bb9f40163da81bd99
Instruction Fuzzy Hash: CC1179709186498FDB48EF68D4961E9BBE1FF69345F0502BEE84EC2282DB34A550CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F53BF9 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff3b5bc53a5d4f79d20fe9c8ba7a5212ec1359d7392498e9cb0b2030971d8724
Instruction ID: 61f21165356735b92f064ab4937dd177b6b0bb63f4e7e13034a194b9e5a5ae6a
Opcode Fuzzy Hash: ff3b5bc53a5d4f79d20fe9c8ba7a5212ec1359d7392498e9cb0b2030971d8724
Instruction Fuzzy Hash: D821A53180D68A5FE742EB68885D6AABFF0EF5A340F0405F6D448C70A3DA286544C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F57785 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02965fd09920dfd08ebb345cd37060c69f0cfd8b0a4f24ac35e06bac5ffce6c
Instruction ID: d176cfe0c9986aabe1e81b07ff6f88b2d1b455169b956f96fc4c07956737f74c
Opcode Fuzzy Hash: a02965fd09920dfd08ebb345cd37060c69f0cfd8b0a4f24ac35e06bac5ffce6c
Instruction Fuzzy Hash: 5011AF3090EA4E8FEB89EF2894592BEBBA0FF69741F1405BAD419C61D2DB38A440C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F55155 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6bcee18233baf78bde33871ea6290e151f2238e9b87dc7e2a50a64a69c0e405
Instruction ID: 26505daec4b8dd51df479c9fa8cd4822fa9c8403a2aab90b331f864d4b3d5d9c
Opcode Fuzzy Hash: c6bcee18233baf78bde33871ea6290e151f2238e9b87dc7e2a50a64a69c0e405
Instruction Fuzzy Hash: 89117C3090DA8E9FEB89EF6884592BDBBA0FF69341F1405BED409C61D2DB39A584C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F550B9 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7b7c010a4d3c2c25c7d35d9df1bb02ef3097c117b5cfc3c8fd7431a4e8ee1a
Instruction ID: e33c58324fbfa84a4174d0ba49d7f2326e01904cd5838b9583e36ec5b58b34c2
Opcode Fuzzy Hash: cf7b7c010a4d3c2c25c7d35d9df1bb02ef3097c117b5cfc3c8fd7431a4e8ee1a
Instruction Fuzzy Hash: 87215C3090D68A9FEB89EF6888692B9BFA0FF69341F1405BBD409C75D2DB39A444C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F555F5 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438fe57d4e9506e3543d4711d1098613e066370bd377769116130b0ccd19264d
Instruction ID: 230e2995c4333a2a1ceb6dd2a98887f64ce9e08762b42a371ff47be4254817a2
Opcode Fuzzy Hash: 438fe57d4e9506e3543d4711d1098613e066370bd377769116130b0ccd19264d
Instruction Fuzzy Hash: 7511B271D0DAC98FE759EB6494AA2B8BAA0FF19340F0944FEC00DC65D3EB296444C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F57825 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e00660b67a72dcae9df52720e9a616f9a80bb8e49e248bb6bdb436cb4d758b5
Instruction ID: abb264561c4a5137a343aab02c2e735832443d59e5ac54256edadd3cd1914a62
Opcode Fuzzy Hash: 7e00660b67a72dcae9df52720e9a616f9a80bb8e49e248bb6bdb436cb4d758b5
Instruction Fuzzy Hash: 1511C471D0DA8A4FE759EB2488A92B9BBA0FF16341F2400BED419C25D3DB295444C749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F40F30 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a2d22f77bb89b9d5fc41141b6776ba12d2989efe1c3d2a581b924dd554427cc
Instruction ID: 1ca9d7e8343d85536acd2ef78a7825b7a954d315049f8c27bd98559e6a641d3e
Opcode Fuzzy Hash: 1a2d22f77bb89b9d5fc41141b6776ba12d2989efe1c3d2a581b924dd554427cc
Instruction Fuzzy Hash: 4B11513190D90D8EEB94FB58D845BAE77B1FBA4350F104276C40AE7296CF38A981CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F55969 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69477d5d68da4cef27771dae55a52eabbece902f09c6957c9b935d0088cdd225
Instruction ID: 74ec1929c20647d6055fb552a27ee54ca36d9c979a0e9c3357861762217be366
Opcode Fuzzy Hash: 69477d5d68da4cef27771dae55a52eabbece902f09c6957c9b935d0088cdd225
Instruction Fuzzy Hash: 9D11793080D68A8FEB49EB6488692B9BBA0FF19351F0404BBC40DC61D3DB29A584C742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F578BD Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b07d824f5497f3dbde4709d57b1083715dca097eb63ff936f846029aa08f196
Instruction ID: 28891d29cee995b49edd5398906fbe93443213b53eb04415d8353f660198b290
Opcode Fuzzy Hash: 4b07d824f5497f3dbde4709d57b1083715dca097eb63ff936f846029aa08f196
Instruction Fuzzy Hash: EF11BF3180DA4E8FEB89FF2484552B9BBA0FF69341F1400BAD40DC61D3DF29A444C795

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F57E21 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a8207f98b02fed48d2e148d6db1c38c123829a1b25ec56cab8dc45a0a81b7c2
Instruction ID: c61b14f9f29e8ce7932b6ba2c7017593a399d6619109198275a146b8afa0c88a
Opcode Fuzzy Hash: 9a8207f98b02fed48d2e148d6db1c38c123829a1b25ec56cab8dc45a0a81b7c2
Instruction Fuzzy Hash: 6D11653094DA4A9FE741FB74C8486AABBF4FF19341F0504B6D419C70A2DB38A644C755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F434B5 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27ea3e67614e7e36a51c46735b803eaed07a8723a006671ce7934e528517829
Instruction ID: d59734e56c857495ef43f7c694317d53760560fd675af0fcd91bbe9f6bf7bd74
Opcode Fuzzy Hash: f27ea3e67614e7e36a51c46735b803eaed07a8723a006671ce7934e528517829
Instruction Fuzzy Hash: CC11AC3090C68E8FEB49EF2884596BDBBA0FF28700F0404BFD41AD61E1EB34A450C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F56A09 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ffd452690c5f767dd75b729e66602a86b17726d8f9485ed8aea9986e80319de
Instruction ID: 1b7af13d5bc4fb594b66c5b2766dc2a6ca44e08f53f6796d17d35f60ef056be3
Opcode Fuzzy Hash: 1ffd452690c5f767dd75b729e66602a86b17726d8f9485ed8aea9986e80319de
Instruction Fuzzy Hash: 0D11943090D6895FE741FB2488592AABBF0FF19340F0444B6C418C7193DB38A5448715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F53281 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45885e92a5cf292312e02d5e0f817271f61ea4c0c9b617ed8f8a94b79b306c2e
Instruction ID: 9575d4afab7368cc7a09c2b55f350ba1d0af0081e01f25c2c836d2734ab8b63b
Opcode Fuzzy Hash: 45885e92a5cf292312e02d5e0f817271f61ea4c0c9b617ed8f8a94b79b306c2e
Instruction Fuzzy Hash: 8511A13090D94E5EE781FB7C844C5F9BBE0FF1A341F0404B6D408C7096EB34A1548714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4DE8D Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f4b000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afce078c747fbbea05953517288bacec630b367ca176cdba2ac09dca726a0411
Instruction ID: 51e5c63254612733e3694842210eb02533e627941776edce310ce7e145836435
Opcode Fuzzy Hash: afce078c747fbbea05953517288bacec630b367ca176cdba2ac09dca726a0411
Instruction Fuzzy Hash: 5B11793091DA4E9FEB89FF6488982B97BA0FF38741F0004BBD409E61E2EB75A550C744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4C8E9 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f4b000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 682944cb541fe65816a7db0040846dc4bc37fcf4e0a76513084cf95ff65d4475
Instruction ID: 9db385b4b6cda6e4bc6d8164d3d2af18372ef39af11238fbe9f406b3597aac36
Opcode Fuzzy Hash: 682944cb541fe65816a7db0040846dc4bc37fcf4e0a76513084cf95ff65d4475
Instruction Fuzzy Hash: 4B11707080D68D9FEB49EB2488592B97FE0FF29701F0515BBD409D61D2EB39A540C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F558DD Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c91a631b70e9831577ead7d151b51dc8023666aacd62df41864015b4977417d7
Instruction ID: 0baf389a2a8fdc12c437e6089c730a58bf476d9583589274121c6bedd8b06bb4
Opcode Fuzzy Hash: c91a631b70e9831577ead7d151b51dc8023666aacd62df41864015b4977417d7
Instruction Fuzzy Hash: 25119E3080DA8E8FEB49EB2488596BEBBE0FF18351F0404BAD41DC61D2DF39A544C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F5571D Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7086a0e051d37cd7438310ab08a11850ade6b97a37aedd0524a565b99f3bc64c
Instruction ID: ba149aae9928d26b55fefb0928646b7b7989372d267f7c206d4468fa0749e1c3
Opcode Fuzzy Hash: 7086a0e051d37cd7438310ab08a11850ade6b97a37aedd0524a565b99f3bc64c
Instruction Fuzzy Hash: 98118C3080D68E9FEB59EB2498696BEBBA0FF19341F0404BED40AD71D3DB39A544C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4C465 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f4b000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3484fe27a5c309910eb4234123e35fc4c9a713e90f8339aaabb5a1c04a3860f
Instruction ID: a489f18d46104dd64fe577a52ca0660db33fe863ab7c145fe7431f201a69660b
Opcode Fuzzy Hash: d3484fe27a5c309910eb4234123e35fc4c9a713e90f8339aaabb5a1c04a3860f
Instruction Fuzzy Hash: FF118E30909A4D8FEB85FB64C4596B9BBE0FF28301F1105BBD409D31A2EB35A550C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F42E91 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b6a8448d580d3ee218a1baa709c16896fcc5171acaa006be63664e82559929e
Instruction ID: 6a31bfe48cb1a3a8bedee3a1daca73a126eb693050adb5be66de2467f5e8f6dd
Opcode Fuzzy Hash: 3b6a8448d580d3ee218a1baa709c16896fcc5171acaa006be63664e82559929e
Instruction Fuzzy Hash: EA01783091D68E8FE751FBA888886A97BE0EF29741F0508B7D40CD70A2EF38E5848704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4B77D Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f4b000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf0360158c922dcc7b225eccba95332baf757a778e355ae1c99be649db6d4115
Instruction ID: 60c2343edeb187fd6256cfa2c085d7ff4be21b8b41593c3b65536f453c38feda
Opcode Fuzzy Hash: bf0360158c922dcc7b225eccba95332baf757a778e355ae1c99be649db6d4115
Instruction Fuzzy Hash: 4801AD31D2DA4B9EEB51BBA89C191FEBBA0FF59684F04097BD45CE60C3FF2865008644

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F405D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1c0e6ead60f47950bb2bd4ee42ea4a1775f7eec7dba157b89417c6a538c3dcb
Instruction ID: 36af8ecaad6cd511117fa624baaf5dc19f83cff0919b0026d9ad177b7a50d0f7
Opcode Fuzzy Hash: c1c0e6ead60f47950bb2bd4ee42ea4a1775f7eec7dba157b89417c6a538c3dcb
Instruction Fuzzy Hash: A0015E30908A1E9FEB48EF64C4596BAB7A1FF68345F50447ED40EE21D1DB36A590CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F58609 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c067495f2fb5e6f07b51c5ff469e2ec830eb0c588372361c9560bbb396b027
Instruction ID: b685a5818b88a7ca13abe15815f7e6c25ca3379f79beab5d70d8ca23e4bd3e59
Opcode Fuzzy Hash: 20c067495f2fb5e6f07b51c5ff469e2ec830eb0c588372361c9560bbb396b027
Instruction Fuzzy Hash: 4E01803081D6898FDB4AAF2484692BABBA0EF16341F4508BED419C70E3EB25A950DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4286D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5adb3253abe820f43adbdf46863cea5e70a503d86085918856e4d80167d7e2
Instruction ID: 65aba66931ca53822b319646216f7c4fc320a1f49b9ca85bdad53b983644e47a
Opcode Fuzzy Hash: ac5adb3253abe820f43adbdf46863cea5e70a503d86085918856e4d80167d7e2
Instruction Fuzzy Hash: C201787090D64E8FE791FB6888886AD7BE0EF69741F1505B7E408D60A2EF38E0808704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F52CB5 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38340cc03d70732b2fe4a615fdfc525dbf4c8eef5192bf7d8e07837a80db62c4
Instruction ID: 516e06c4a677a0270fc7f0e94756dc521b70a0ef6266afb3d88b6bb61350353f
Opcode Fuzzy Hash: 38340cc03d70732b2fe4a615fdfc525dbf4c8eef5192bf7d8e07837a80db62c4
Instruction Fuzzy Hash: 7A01DF3090D68A8FDB59EB64C46D2B9BBA0FF19350F0005BED80AC70D7EB79A540C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4B319 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f4b000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb2ae287e072c60f42a7abb04a5cac2e016aeacc37ea5f56e7bf467df2b8297c
Instruction ID: 8bf007241bddd707a98ec5909d13a62b7aceeda99661961227577d9b5479b007
Opcode Fuzzy Hash: eb2ae287e072c60f42a7abb04a5cac2e016aeacc37ea5f56e7bf467df2b8297c
Instruction Fuzzy Hash: 56017C3091D6899FE752BBB488591B97BE0EF69740F0548B7D008D70E3EA28A4448701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F42F09 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c79446c49e83e671866abb93ce7c228b19e62eb8ca3c214232e17723b46399d4
Instruction ID: f7ca26f5795bebbabd8ee532a8d28b2d76e02d23973fe8ffba5e2b78cbb8ce2d
Opcode Fuzzy Hash: c79446c49e83e671866abb93ce7c228b19e62eb8ca3c214232e17723b46399d4
Instruction Fuzzy Hash: 3901BC3190D2898FE742BB7488591A97BE0EF6A750F8608F7C408DB0E6EB38A484C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F41CAD Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21d6225968d230dbef48f553f66cfc28118618fe9a476653cef6a179877b05b8
Instruction ID: 4a950fb4b86c16475f0f1fbbf2cb834c3110d962ad9aa5f6911fc00c2a10eec0
Opcode Fuzzy Hash: 21d6225968d230dbef48f553f66cfc28118618fe9a476653cef6a179877b05b8
Instruction Fuzzy Hash: C501DC3080D69E8FEB98EF2488592FA7BA0FF65741F4000BAE808D21C2DB36D490C744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F5867D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7a648cf461ecd68d5d4c7c20c05f79e080cd01199b8e3b1463a230afc209e00
Instruction ID: 2a4d9c40737da07b9b1cb3de778574823100a0e0112de5f10bd7b41c397640b0
Opcode Fuzzy Hash: d7a648cf461ecd68d5d4c7c20c05f79e080cd01199b8e3b1463a230afc209e00
Instruction Fuzzy Hash: 6801B13091D6898FDB49EB24C4692BEBBA0FF19345F4508BED41AC60D3EB35A950CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F57FA9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 489f11e8c366995b7589ac9c9a345311ee3f2d5a26ee74f68ac0a7064ec30c54
Instruction ID: 7c9d5b0378f71558c0832f70d53afd0473ab2952f95b68b5298430c8e094f8c4
Opcode Fuzzy Hash: 489f11e8c366995b7589ac9c9a345311ee3f2d5a26ee74f68ac0a7064ec30c54
Instruction Fuzzy Hash: 4C01BC3080EA8E5FE742EB34884C6A9BBE0EF1A340F4508B2D408CB0A3EB28A4448355

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F40608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa6168d2e3c02e2816ca5912620f895021e8b7e94c5ace37a20e1a6913ba2497
Instruction ID: c3ad7cdc03076ea1ff195028cae95ab04ff66b82487bf55d3bc45eff12aab9d5
Opcode Fuzzy Hash: aa6168d2e3c02e2816ca5912620f895021e8b7e94c5ace37a20e1a6913ba2497
Instruction Fuzzy Hash: 9D016930918A0E9EEB48FB64C4582BA76A1FF28745F60087EE40EE21D1DF35A590CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F40610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03b09ca12954135ccd4a2aac70b551309b3dc8d56d62863f1cc53c91af6518f6
Instruction ID: 2376acde085e6912167d74d80d32fc9eeaf851cb85c1023334476e2053f2dd02
Opcode Fuzzy Hash: 03b09ca12954135ccd4a2aac70b551309b3dc8d56d62863f1cc53c91af6518f6
Instruction Fuzzy Hash: ED016930818A0E9FEB48EF6484592BDB7A0FF28345F60087FE80ED21D1EF36A594C604

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F423FB Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 708cfaa410fd1ec97ef51abff87d77e01427f3ed0b15ca408bed6065b368c452
Instruction ID: 0ca23d964820d760e3803ed356c8386083777bdd506a643a5edec7cb62bcf9de
Opcode Fuzzy Hash: 708cfaa410fd1ec97ef51abff87d77e01427f3ed0b15ca408bed6065b368c452
Instruction Fuzzy Hash: 4211B371D085298EEB68EF60C855BE8B2B1FB60751F0001BAD40EA62D2DB782A84CF04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F405D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cc7b1654d368acbc204d3bd7bde2628444aa83cc52f8528949a96eab8a89f35
Instruction ID: ab081bdb47e41f32d33ffaa1c4968dce5fd4da53ff1f02719fbb2b181627a91d
Opcode Fuzzy Hash: 7cc7b1654d368acbc204d3bd7bde2628444aa83cc52f8528949a96eab8a89f35
Instruction Fuzzy Hash: EAF0C23081D65E8FEB44EF2498052FA77A4FF25349F00047AE80DD21C1DB35A490C748

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F52A05 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d0e28bc2731958187c8e64c998e09d5f5a17a3eb04bd9254c3579273de2dbfd
Instruction ID: b259c03a2971576d6550103cf8f2ea1198902aeb7614bb85aa43a50dd1ecc161
Opcode Fuzzy Hash: 7d0e28bc2731958187c8e64c998e09d5f5a17a3eb04bd9254c3579273de2dbfd
Instruction Fuzzy Hash: 2EF04432D1D51A8EEF08EBA495951FDB3A2EF59350F10163AC00A93283CF386911AA44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F42789 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e042db41fad72b30ad84eb8f42d0d67bd6a5ea74daada77ec2b898c36cd4f9
Instruction ID: 33b0d099a63f157b72f97b421f488f01bbd1e55b442fadb2b10f63dd77260819
Opcode Fuzzy Hash: e0e042db41fad72b30ad84eb8f42d0d67bd6a5ea74daada77ec2b898c36cd4f9
Instruction Fuzzy Hash: ADF0CD3180E78A8FEB5AAF3488182A93BA1FF26741F1504BBE409C60D2EB38A444C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F427FD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e394fae5bbb24b74112dddfe7d044ec40d420170e97528de02abef3e22f85d9d
Instruction ID: cd46051c86f3e0c3b4d270792330758a6c4110588c9c8accfcb8560ca5bd9272
Opcode Fuzzy Hash: e394fae5bbb24b74112dddfe7d044ec40d420170e97528de02abef3e22f85d9d
Instruction Fuzzy Hash: FFF0907180E68D8FEB59AF6488591BD7BA0FF25241F5504BFD809C51D2EB399454C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F5246A Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e2ea40da15c94901b1db95feb5a4aa0336a6375e6bf6908dce976703cf05e88
Instruction ID: 95f75c3b22c937ad53387c8043f6599d60463f8b938f60781c1576b7522ddbf0
Opcode Fuzzy Hash: 4e2ea40da15c94901b1db95feb5a4aa0336a6375e6bf6908dce976703cf05e88
Instruction Fuzzy Hash: DEE0E279C0C38A8EEB25EF90C4443FDBAB0AF00385F10003690096B2E2CBB82A84DB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F5367D Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d458aae0aef93ddb01d104f4523cd5693e7a85a590e848667d2edc490a4168ac
Instruction ID: b1b60970465add62a668be740e080fa9a498a22a2efe070faf1297e1827a30f0
Opcode Fuzzy Hash: d458aae0aef93ddb01d104f4523cd5693e7a85a590e848667d2edc490a4168ac
Instruction Fuzzy Hash: 96D04270D0D5099EEB60FBA8C4562ACBAA1AF54744F60007AD00DB32D3DF3868518B15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4BB7F Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f4b000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9a023122b0bbdeeb64b408706279ee1816212e44f1dfe2796f882ae0461ff7d
Instruction ID: 76e0df3e6575684e4c4ebf4ba28b72d0a58b42fc509a31d25bd943715a4adcc1
Opcode Fuzzy Hash: a9a023122b0bbdeeb64b408706279ee1816212e44f1dfe2796f882ae0461ff7d
Instruction Fuzzy Hash: 2FD09230C2D41E8EDB55FB54C841AE9B671FB28340F1046B2851DE2186CFB8AAC08B84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F411B6 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02547457d6674f1df1f7e1e828613abb61688a4942a83ef5fddad5a47bf4481
Instruction ID: 46f531f9da52c4328e9e5d337f21d7158f73b39826e05e064d1267d9c256fae7
Opcode Fuzzy Hash: b02547457d6674f1df1f7e1e828613abb61688a4942a83ef5fddad5a47bf4481
Instruction Fuzzy Hash: 75C01230C1661E8EDB80EB50A8010FEB270FB84200F801022E81DA20C2EF3825108688

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F5236D Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f52000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83eef312977ca4709834f9ff416045d66eabab96dbd22dd70cef8f15a2a824e7
Instruction ID: 575c375382547ac2ccd958170ac72eccea4288e8536e095976b50660d6c27a02
Opcode Fuzzy Hash: 83eef312977ca4709834f9ff416045d66eabab96dbd22dd70cef8f15a2a824e7
Instruction Fuzzy Hash: CCC0127980879E8EEB10EFA0C8506FEBBB0EF10340F1010269009AB2C2CA786604EB40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF848F4F182 Relevance: 5.0, Strings: 4, Instructions: 41COMMON

Download Yara Rule

Strings

*, xrefs: 00007FF848F4F09B
[, xrefs: 00007FF848F4F196
k, xrefs: 00007FF848F4F0B6
^, xrefs: 00007FF848F4F9D3

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F4F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f4f000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: *$[$^$k
API String ID: 0-1202021107
Opcode ID: d45b23fcbac47bf73f15d1e701022ec690aa0358cdfd9615b1292719b59082f7
Instruction ID: 130e77935ce56d9aa6e9fa186911cfc0f2d42be3679d99751af225b3e860c2e3
Opcode Fuzzy Hash: d45b23fcbac47bf73f15d1e701022ec690aa0358cdfd9615b1292719b59082f7
Instruction Fuzzy Hash: DB11E870D0C61A8FEB68EF08C8847E9B7B1EB64751F0041FAD41DA62D1DB786A84CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4F318 Relevance: 5.0, Strings: 4, Instructions: 35COMMON

Download Yara Rule

Strings

k, xrefs: 00007FF848F4F0B6
5, xrefs: 00007FF848F4F31C
", xrefs: 00007FF848F4F362
H, xrefs: 00007FF848F4F372

Memory Dump Source

Source File: 00000018.00000002.2191610680.00007FF848F4F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff848f4f000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: "$5$H$k
API String ID: 0-1256405626
Opcode ID: f97adf3c0343b478e9bcfbd9c97bebe8d71f094acad07336634dd5319c8c7562
Instruction ID: d49961043f626d0ff45548347e120224b4b04a82734d04acc6d24240ca956bef
Opcode Fuzzy Hash: f97adf3c0343b478e9bcfbd9c97bebe8d71f094acad07336634dd5319c8c7562
Instruction Fuzzy Hash: 23011A75D09729CEEB24DF14C8807E9B7B1FB64751F0041EAD44DA6291CB389A84CF45

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 4040, Parent PID: 1068COMMON

Executed Functions

Function 00007FF848F016A8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c1cc0b3764265d82d92c8f4095954193f0e20937aed0d41390099acdecd3b37
Instruction ID: 21dba179469269691fdf20b2ab092854a3709ab08378ab83cb0493d046c52882
Opcode Fuzzy Hash: 3c1cc0b3764265d82d92c8f4095954193f0e20937aed0d41390099acdecd3b37
Instruction Fuzzy Hash: 4081AD31A0CA4A8FDB58EF1C98555BA77E2FF9A344F14457AE44EC32C2DF34A8428785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F15C10 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 309cd64b1869e7cb8e1f02522df6fef8ea7c41bd11331396841940036557e917
Instruction ID: 427b738bafb2b331f4cc71757cfc6993ae3272b5c6596a33302a3f41c36dc08e
Opcode Fuzzy Hash: 309cd64b1869e7cb8e1f02522df6fef8ea7c41bd11331396841940036557e917
Instruction Fuzzy Hash: 2C815B70D18A0D8FEB94EF68C859AADBBF1FF19341F0001AAD00DE3292DB356881CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F035BE Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2534649ab182cd4f3cbce720556df325490540d4cc931457896d56b2bfdf9b
Instruction ID: 216cb05fba5c72f25fceb5b2d0c7f8791f5f5cf1905c563831b69f6af5bf6135
Opcode Fuzzy Hash: 4f2534649ab182cd4f3cbce720556df325490540d4cc931457896d56b2bfdf9b
Instruction Fuzzy Hash: F771AB71E1C90A9EE794EB6CD8253ADBFE1FB8A350F54017AC009C72C6DBB818058B55

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F01D2D Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 685955f19d3a4762eae970ca639e9bbedbe32cebe3c2effa7517182014d438f8
Instruction ID: 913f4a14e7b6be5ce2669a00de4293da159ad547e876067dcbee24a6edaaca82
Opcode Fuzzy Hash: 685955f19d3a4762eae970ca639e9bbedbe32cebe3c2effa7517182014d438f8
Instruction Fuzzy Hash: 1251BF31A1CA8A8FDB48EF1888645BA77E2FF99344F14457ED44AC7292DF34E842C785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F03191 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01fb4f1a4cd439ae951b64388d28c259f20c1ac042af3fd0988a9265a7e07597
Instruction ID: 00336620c86c3b6c8a8ba012ee51226b0002e61a368f1477c32aa18becc4e49d
Opcode Fuzzy Hash: 01fb4f1a4cd439ae951b64388d28c259f20c1ac042af3fd0988a9265a7e07597
Instruction Fuzzy Hash: 05511570D1D60E8FEB54EBA8C4946EDBBB1EF59351F50003AD00AE72D1EB39A944CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0B67F Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc6ede7820deb0af50a91e23603b5eb956c0b145f01cdf22d70ed2ec67cf661f
Instruction ID: 594ff346f3d0bd8a681daddc6c3f9db8a9389314b2b106e0a34521d37b2d850d
Opcode Fuzzy Hash: fc6ede7820deb0af50a91e23603b5eb956c0b145f01cdf22d70ed2ec67cf661f
Instruction Fuzzy Hash: 6A511171C1EA4A9FE712BB7888551FA7BE0FF12354F0805BAC45987093EF296445C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F02145 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c03aa5fbb8e4b3718e0bf5e22067f8ca97bce5d2cd0030110fc1d1282df59b7f
Instruction ID: d5bd7127848a66cdd986e9157ef9459bd1ab613fcf23207ffe97f17c870fff7a
Opcode Fuzzy Hash: c03aa5fbb8e4b3718e0bf5e22067f8ca97bce5d2cd0030110fc1d1282df59b7f
Instruction Fuzzy Hash: 9E412831E1D68A5FE347EBB898551B9BBE0EF47390F0501BAD44CC71D2EF28A8418365

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F01150 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c63ebc1b0f409490032adc13d0859f49bb18dd699c57a54f2c2aa545802a98f
Instruction ID: 65ad9c909d6ad3a7977023bf2523a60c11860435e350d3417f6180e603380be5
Opcode Fuzzy Hash: 3c63ebc1b0f409490032adc13d0859f49bb18dd699c57a54f2c2aa545802a98f
Instruction Fuzzy Hash: 3F31AB30D1CA4E8EEB98EF6884692BA77E0FF1A341F00047AD00AD21C2EF256584C754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0338C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e71b44aec52513cb3f57689adc68cdb7ed27047fb7e908d7ddaeb6f6384047b
Instruction ID: a0ea6a91d9581af41b6558e0e5c747cd7e5adc453216950c6a1dc7076bb26fba
Opcode Fuzzy Hash: 3e71b44aec52513cb3f57689adc68cdb7ed27047fb7e908d7ddaeb6f6384047b
Instruction Fuzzy Hash: C221A23184D78A8FE742EB7888585A97FF4EF5B301F0904FAD449CB1A2EB399546C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0084D Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99bf128b960d9b894b817c54f6216cf279d46ba7408f053bd41b337488a4e210
Instruction ID: 5724f87563e7b926c82f82f6ed9436a39ed6a58508f657a76a52d19c6a54cdab
Opcode Fuzzy Hash: 99bf128b960d9b894b817c54f6216cf279d46ba7408f053bd41b337488a4e210
Instruction Fuzzy Hash: 17110131D0D64A9FE755BB7884591E97BE0FF96348F5544B6C809C70D2FE24A4448385

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F00A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b6dc30ff604fa9df22712a6d5af9955581eafd8ed2dd53ee1665de37da8454c
Instruction ID: 22cf72776870ad1035a9267b8d99743cfb203a8f783d0cdac249f536d1378fa0
Opcode Fuzzy Hash: 9b6dc30ff604fa9df22712a6d5af9955581eafd8ed2dd53ee1665de37da8454c
Instruction Fuzzy Hash: A5115830D0C54E9EE780FB68C8496BA7BA0FF99385F4405B6D809D61D2EF38A9448744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F02C18 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9dbee073d1b4e2a3184c684452b472b8c972d87cd7154a6ffc461954bf99edc
Instruction ID: 4df5a5fcae7a385cd353527ec6b8e4a1a171ff78cf39b724db8be25d9c38d6b0
Opcode Fuzzy Hash: e9dbee073d1b4e2a3184c684452b472b8c972d87cd7154a6ffc461954bf99edc
Instruction Fuzzy Hash: 46110A70918A0E8FDB88EF18C489ABE77E0FF59345F10456AE81ED3294DB34A590CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F00F30 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efa49f82553cc662a5cc08fff99c44d3e3323cf6702a96b4ebc769685cb67e2b
Instruction ID: ffad748cfca4dcbe4d8cf505b9e146abd541830e6abd5a3798496064fd44753b
Opcode Fuzzy Hash: efa49f82553cc662a5cc08fff99c44d3e3323cf6702a96b4ebc769685cb67e2b
Instruction Fuzzy Hash: FE118B3090D90A8EEB54FB58C844BEEB7B1FB94345F104276C40AE7286DF38A981CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F034B5 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c285958e4282201adc174ebb31bd39f326aaac2adbbbe7afff3c237feb5eb682
Instruction ID: f5c441d413caec7017d8c18d70515eb61e432dd3e005c39e95b0ea080b344f32
Opcode Fuzzy Hash: c285958e4282201adc174ebb31bd39f326aaac2adbbbe7afff3c237feb5eb682
Instruction Fuzzy Hash: 3D11707091C68E8FDB96EF6884591BDBBA0FF1A341F4404BED41ACA1D2EF35A550C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F02E91 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96590535f6b9f01264e765f1f4083be351883287379b2e1870e7b4aadfc20a55
Instruction ID: 9261bd2a3a4f76df8e29fb919b68c3c935b4ec8eddd0509af28674e8b60a3869
Opcode Fuzzy Hash: 96590535f6b9f01264e765f1f4083be351883287379b2e1870e7b4aadfc20a55
Instruction Fuzzy Hash: 11017C3095D64E8FE752FB6488485B97BE0EF1A341F0504B6D40CC70E2FB34E5848724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0AF01 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66dcaa0c7049e45b8b4c8d7a74bd58e93c186e381baf61b9e5ea23170bcde82e
Instruction ID: 51714cfc23ae27ef1663944fd3380c6e80e6003b2fe1d6c4a0e95c0c94da1e84
Opcode Fuzzy Hash: 66dcaa0c7049e45b8b4c8d7a74bd58e93c186e381baf61b9e5ea23170bcde82e
Instruction Fuzzy Hash: 8C017C7081D64A8FE791FB2488591B9BBE0FF5A342F4545B6E408C71A2FB38A4848714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0B77D Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30820840d3da06c82830b6617b724aacfb58c71a4f656e071b01347243b726b6
Instruction ID: 61fdd4eedfd9cf1d5ed36cddac69c4205204d048b18da4fadf2237d967a819e9
Opcode Fuzzy Hash: 30820840d3da06c82830b6617b724aacfb58c71a4f656e071b01347243b726b6
Instruction Fuzzy Hash: DF01C031D2D54B9EEB51BB6898151FE7BA0FF4A384F4405BAD85CC60C3FF2865008345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F005D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f061a4db89343b3f053888639cb90a111fefcd84cfa21988034a4592f64a207
Instruction ID: a0b4fd5f306f5e1001379073faa5724a8b8559bbcce77af1ed5b0bebb9809f05
Opcode Fuzzy Hash: 4f061a4db89343b3f053888639cb90a111fefcd84cfa21988034a4592f64a207
Instruction Fuzzy Hash: B8019E3090990E8FEB49EF24C4596BAB7E1FF59345F50447EE40EC21C0EB31A590CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0286D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9e27fec99956bb624f741361d1b577dbbd45cbc1b113803e3784c224ae78af1
Instruction ID: b4ebd59e7650f3385217827f39e60cbf684e3265192f7ff3eca57f91a5ef5dd9
Opcode Fuzzy Hash: a9e27fec99956bb624f741361d1b577dbbd45cbc1b113803e3784c224ae78af1
Instruction Fuzzy Hash: 62017C3480D64E8FE752FB6484585B9BBE0FF5A341F5505B7D408C6092EF38E0848724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0B319 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa3c618e76665c4f599ed65842e0cbe611b65ca9b059a179a0fe3f7e9966e0a3
Instruction ID: f7b8346b169e09a228696f2cfd6418e19493fcabf87a1a78c85de4dcc2236f49
Opcode Fuzzy Hash: fa3c618e76665c4f599ed65842e0cbe611b65ca9b059a179a0fe3f7e9966e0a3
Instruction Fuzzy Hash: 1601783085D6899FEB52BB7888592A97FE0EF5A340F1948B6D008C70E2EB28A4448711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0AF79 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9bfa196441641c363a6ca7a172baf7d0d953445cdd9dc53e3818d573bd4a5af
Instruction ID: 186e6c82097fe0d804a8cc61282887dd9486f83d6a6d4e595504d90748c50621
Opcode Fuzzy Hash: b9bfa196441641c363a6ca7a172baf7d0d953445cdd9dc53e3818d573bd4a5af
Instruction Fuzzy Hash: 13018F7080D6898FE752FB3488591A9BFE0EF1A342F4505F6D409CB1E2FB38A4848715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F02F09 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5562fa2b7476ff286ed666a33ce3987eb5e47b134c83947daf156c48d6730e39
Instruction ID: 720b672d765c67b2c95442074e89400d01351b9b76e6a0f759ad74e12aac8a18
Opcode Fuzzy Hash: 5562fa2b7476ff286ed666a33ce3987eb5e47b134c83947daf156c48d6730e39
Instruction Fuzzy Hash: 40017C3191D6899FE742BBB488591A97BE0EF5A381F4605F6D408CB1E6EB38A4448721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F01CAD Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dad74d0e14e8da950a214d53c280de202ad30cad2975c374be1dc2837465d42
Instruction ID: f6843e6621333d905ef31be196aa4537911cddaa7b76748d64b323b044883376
Opcode Fuzzy Hash: 9dad74d0e14e8da950a214d53c280de202ad30cad2975c374be1dc2837465d42
Instruction Fuzzy Hash: A601D130C0D68D8FEB99EF2488592FA7BA1FF56301F4040BAE808C21C1EB75D490C744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F00610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99f0a61871963d0fef58b8deaeaa0becd2bacb5f289c4775933e5fe4055b32d9
Instruction ID: 6100a92be2d86c28b01a3a21fe1c19474416088420b8a821230e3ccbcd82b0c5
Opcode Fuzzy Hash: 99f0a61871963d0fef58b8deaeaa0becd2bacb5f289c4775933e5fe4055b32d9
Instruction Fuzzy Hash: 1A016934819A0E9FEB4AEF6484592B9B7E4FF19345F60087EE80EC21D1EF36A594C614

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F00608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9ea78beca4227d6886870faafcce6dea7379287e39e558bcc820addb1e5839f
Instruction ID: 374ef840ef8e455a0ab9664765f5762fbc64514f7e059a1cee220cdd772c1636
Opcode Fuzzy Hash: c9ea78beca4227d6886870faafcce6dea7379287e39e558bcc820addb1e5839f
Instruction Fuzzy Hash: 0101813091850D9EEB4AFF64C4582BA77A1FF19345F50087ED40ED21D2EF35A590C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F005D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f086280f5727811e0a85dd6c9472a0f523eb4a3de376ce128e51a8077c7384
Instruction ID: 31e8eb37aa3208dccc8ded6d8f687788f4f0c0da7e5fe24801c4a6668998f128
Opcode Fuzzy Hash: e3f086280f5727811e0a85dd6c9472a0f523eb4a3de376ce128e51a8077c7384
Instruction Fuzzy Hash: 9EF0C23081E64E8FEB45EF2498052FA77E4FF16349F40447AE80DC21C1EB35A490CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F023FB Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 708cfaa410fd1ec97ef51abff87d77e01427f3ed0b15ca408bed6065b368c452
Instruction ID: 9cf41c321c676ab1216cd302eceeeff17a8491f5d7f9a1d94610006a9592acd0
Opcode Fuzzy Hash: 708cfaa410fd1ec97ef51abff87d77e01427f3ed0b15ca408bed6065b368c452
Instruction Fuzzy Hash: 7911B371D085298EEB68EF60C855BE9B2B1FB51345F0001AAD40EA62D2EB782A84CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F02789 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7a7be57c4fc53c0bc2edc652789313f718c5e53c3620e392616b10d169d61e0
Instruction ID: 87ad4205179a87d0275d349e91d6069de003b6afd6b696810ab9ff3b17bc05ff
Opcode Fuzzy Hash: a7a7be57c4fc53c0bc2edc652789313f718c5e53c3620e392616b10d169d61e0
Instruction Fuzzy Hash: 21F0C23180E78A8FEB5AAF3488182A93B61FF16341F4504BED409C60D3EB38A444C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F027FD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90625838858aed73b9780ce16adb9ac6e9b5e049ebd45e29c1f02bbbdc70b4b0
Instruction ID: 9945d26470bcc9ea59d878a4c0dd8f29cc01a06eca812b5f15bb6d441ef8a965
Opcode Fuzzy Hash: 90625838858aed73b9780ce16adb9ac6e9b5e049ebd45e29c1f02bbbdc70b4b0
Instruction Fuzzy Hash: 20F0907480E6898FEB5AAF6488A91B97BE0FF56241F5404BFD809C51D2EB399454C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F011B6 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2196086924.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff848f00000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 455f056184316a41b4b9beb1bfd79aa2487955c1a3eb9b535dde6bce44315c3a
Instruction ID: 5dfa2e5d0f8e879ace855f189672cdacad62f64d5256a5165ca6fa045e24d759
Opcode Fuzzy Hash: 455f056184316a41b4b9beb1bfd79aa2487955c1a3eb9b535dde6bce44315c3a
Instruction Fuzzy Hash: 15C01230C1661E8EDB40EB50A8010FEB270FB85204F801022E81CA30C2EF3825108688

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SystemSettings.exePID: 3448, Parent PID: 1068COMMON

Executed Functions

Function 00007FF848F4F8AF Relevance: 6.3, Strings: 5, Instructions: 85COMMON

Download Yara Rule

Strings

V, xrefs: 00007FF848F4F936
I, xrefs: 00007FF848F4F8B8
], xrefs: 00007FF848F4F99E
k, xrefs: 00007FF848F4F0B6
^, xrefs: 00007FF848F4F9D3

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F4F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f4f000_SystemSettings.jbxd

Similarity

API ID:
String ID: I$V$]$^$k
API String ID: 0-2537897772
Opcode ID: 30a997011f3e29c91c4521fa3f7d755e8d85d348abe81597821d97deff2a9d7e
Instruction ID: 52d393b6eee9653c570dd21295a68024b807525b45d473439aa1e13e2ba443d9
Opcode Fuzzy Hash: 30a997011f3e29c91c4521fa3f7d755e8d85d348abe81597821d97deff2a9d7e
Instruction Fuzzy Hash: 1E31E270D0862D8FDBA8EF18C8947E9B7B1EB64741F0041EAD40EA7291DB386E84DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4F0A8 Relevance: 5.1, Strings: 4, Instructions: 82COMMON

Download Yara Rule

Strings

}, xrefs: 00007FF848F4F4FA
i, xrefs: 00007FF848F4F3A5
d, xrefs: 00007FF848F4F535
k, xrefs: 00007FF848F4F0B6

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F4F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f4f000_SystemSettings.jbxd

Similarity

API ID:
String ID: d$i$k$}
API String ID: 0-1577325851
Opcode ID: 234ae109435d6ad56b397c942fa2be2fea1f5182e0acaa0809fc44382a5d89ed
Instruction ID: fed8b10a7d9089894cb5f3a03a7e14663d21b794e7bdc9357b57ae71637f2fac
Opcode Fuzzy Hash: 234ae109435d6ad56b397c942fa2be2fea1f5182e0acaa0809fc44382a5d89ed
Instruction Fuzzy Hash: F841B070D096298FEB64EF18C8887EDB7B1FB64741F1041EAD40DA3292DB386A81DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4F3DF Relevance: 2.5, Strings: 2, Instructions: 48COMMON

Download Yara Rule

Strings

i, xrefs: 00007FF848F4F3A5
:, xrefs: 00007FF848F4F43B

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F4F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f4f000_SystemSettings.jbxd

Similarity

API ID:
String ID: :$i
API String ID: 0-322666766
Opcode ID: 51538353381afca9f388be10333f7a8c9b31be3e4ebd4b7febb180e97aa5ad49
Instruction ID: 16daaccc306e3639f1a7beaa26fd2458eb82cdd078722ec3997df09077d58ee8
Opcode Fuzzy Hash: 51538353381afca9f388be10333f7a8c9b31be3e4ebd4b7febb180e97aa5ad49
Instruction Fuzzy Hash: 2A119C70D0C66E8FEBA4EF14C8947B9B7B5EF64741F0001FA940DA2692DB746A84DF04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F41150 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

hyH, xrefs: 00007FF848F411AD

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID: hyH
API String ID: 0-3369426750
Opcode ID: 36c31f9d13ceb8ee02372555f6bcd3264f0e3a611d5fa4772c4b4b7eb5a1f230
Instruction ID: f84f6cdef8ecd5d1c9a6597e154b55a231d469f4b17eb851df6511c08b8879e4
Opcode Fuzzy Hash: 36c31f9d13ceb8ee02372555f6bcd3264f0e3a611d5fa4772c4b4b7eb5a1f230
Instruction Fuzzy Hash: DB318D30D1CA6E4EEB98EB64C4696BA77E0FF69741F00057BD00AE21C2EF296584C754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F40A01 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

0vH, xrefs: 00007FF848F40A70

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID: 0vH
API String ID: 0-2857910901
Opcode ID: b82282f3e3802ac288d89f979bc4a152f855ea93d96bc49ef790167668550a99
Instruction ID: 24aed3c61b8eadd4f30e44b3bfe1504f64b69f64f2be73439c06bbc7e6364e33
Opcode Fuzzy Hash: b82282f3e3802ac288d89f979bc4a152f855ea93d96bc49ef790167668550a99
Instruction Fuzzy Hash: A7115B3191894E9EE781FB68C8491BA7BE1FFA8781F4005B6D818E6192EF78A5448740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F53D58 Relevance: .5, Instructions: 463COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd05b7d0aac5042500bb0599b8c767b53cb20d98c4d2c4d314fb7212830230bb
Instruction ID: 2372613ec107cb4876d6cb7f865aad41b629e9905d490408532246a805d20b78
Opcode Fuzzy Hash: dd05b7d0aac5042500bb0599b8c767b53cb20d98c4d2c4d314fb7212830230bb
Instruction Fuzzy Hash: C3218E7180E6D99FE342EB7888591A9BFF0BF16340F0905FBC048CB0D3DA28A5488352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F545B5 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8c15bf448b90732ebfcd21c02c19457db7f6db6dc4ffee3cdead0da7491c525
Instruction ID: e23c863b961d342c1e757bc24a9f9fdad8406b39223155cec33f03cd47304062
Opcode Fuzzy Hash: e8c15bf448b90732ebfcd21c02c19457db7f6db6dc4ffee3cdead0da7491c525
Instruction Fuzzy Hash: ABC1A5B0D18A2D8EEB95EB68C8557EDB7B1FF68341F1041AAD00DE3292DF7469848F44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F416A8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d569fe86d81129f6edb94993e72d61bda6e323bffeac8e4f48025c002a16e395
Instruction ID: 6c1ea7851268817209c5a785c263277944875b9f3c611261bff2a523375310c3
Opcode Fuzzy Hash: d569fe86d81129f6edb94993e72d61bda6e323bffeac8e4f48025c002a16e395
Instruction Fuzzy Hash: D981AE31A0CA5A8FDB98EF1898555B977E2FFA8B50F14057AD44ED32C2CF34AC428785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F435BE Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e50f1188e8fe38c86ba15bc612bc68456aa735637994130026ae4a9482a1cab
Instruction ID: c3a3e8f8c7e97705aa2c871fdfddf907c449bc93dd5293936f5bfa852e836e5d
Opcode Fuzzy Hash: 3e50f1188e8fe38c86ba15bc612bc68456aa735637994130026ae4a9482a1cab
Instruction Fuzzy Hash: D171BB71E1D90A8EE785EB6CE8597ADBFE1FF99350F50027AC009D32C6DBA818018B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F41D2D Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475960a1b6d137527c43795050bcbd12437273c4816ad806d96089fc489761d6
Instruction ID: 45545501d2ceb36583b163691a2f89a411724c47dd53138fdaa338a5922594ba
Opcode Fuzzy Hash: 475960a1b6d137527c43795050bcbd12437273c4816ad806d96089fc489761d6
Instruction Fuzzy Hash: 6151B031A1CA9A8FDB48EF1888545BA77E2FFA8740F14457ED44AD7282DF34E842C785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F533CD Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e036bec8fb30b83a8689a9db5b0e9feb26318d9703ec15afa3e6e888b885733
Instruction ID: bd1b33d9e1eee7bab4b96bee9b956f75a58b194640952512c2304cce1664fd3b
Opcode Fuzzy Hash: 5e036bec8fb30b83a8689a9db5b0e9feb26318d9703ec15afa3e6e888b885733
Instruction Fuzzy Hash: 0971D170D19A1D9FEB94EB58C859BEDB7B1FF68340F5041AAC00DE3292DF3469858B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F43191 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b4c648d3b53d82f27038748603ef6f1364daacb204c27556fe87616d2670d14
Instruction ID: 9de34eb176899b03194e63a8b904fbf99f31a38baf75551f1ead8c4b07439006
Opcode Fuzzy Hash: 4b4c648d3b53d82f27038748603ef6f1364daacb204c27556fe87616d2670d14
Instruction Fuzzy Hash: F4512670D0861E8FEB54EB98C499AEDBBB1FF68751F10003AD00AE72D1DB38A944CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F42145 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 212097af5b72486b7fbaf70020f74177a7b9716a998c35132192ac9224094f9b
Instruction ID: 19dc74c7931941944383626d3653644ff1318155b2e2d1c70ced3ab7b692094e
Opcode Fuzzy Hash: 212097af5b72486b7fbaf70020f74177a7b9716a998c35132192ac9224094f9b
Instruction Fuzzy Hash: 3F415A31E1DA4A4FE346EB7898451B8BBE0EF96790F0500BBD04DD71D3DF28A9418355

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4D0FB Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f4b000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: decbf975b5d5e773a83496279355da682b88e243aa316127e0a400d0ac2cc580
Instruction ID: 0951aca5ec569316387567837f0240523590dd568e7dace45a20a2b55fc3e482
Opcode Fuzzy Hash: decbf975b5d5e773a83496279355da682b88e243aa316127e0a400d0ac2cc580
Instruction Fuzzy Hash: F241B43290E55AAEFB45BBA8B4450FD7760FFA17B9F041277D90D990C3EF2C644182A8

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F5289D Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9a13b74dc31f017708930b6550f8b8c22b0de5ae3aff54e4181e0aec5fc94b6
Instruction ID: dd1653c044d01cc006d64d1f95038ac74837a33e1e74290dacfe829cfce2eb62
Opcode Fuzzy Hash: b9a13b74dc31f017708930b6550f8b8c22b0de5ae3aff54e4181e0aec5fc94b6
Instruction Fuzzy Hash: CD413071E0D64E8FEB58EFA4C4546FDB7A1EF59340F10067AD00AE7286DF38A9808B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4D0C0 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f4b000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46dbe8ffa27e76a7bba58ba0d4c6b6292b783e2cc60a6d7abdb30ece82bf1ffd
Instruction ID: 03525656f441c9a53d80af159d865aaf4795bd4fb51ba62c1461726dd364bb43
Opcode Fuzzy Hash: 46dbe8ffa27e76a7bba58ba0d4c6b6292b783e2cc60a6d7abdb30ece82bf1ffd
Instruction Fuzzy Hash: 9541C53291E55A6EFB45BBA8A4440FD7760FFA17A9F040677D40EDA0C3DF2C644182A8

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F5312D Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1afa477b17d7eae851c45f3237f81adf1927bc6e49984d1be087f12beb0c82c0
Instruction ID: 393c66a9e64fcd6ba5371518e3cb09cc27ada53c42b907e51e4226d9c56720ba
Opcode Fuzzy Hash: 1afa477b17d7eae851c45f3237f81adf1927bc6e49984d1be087f12beb0c82c0
Instruction Fuzzy Hash: 58416D30E2965D9FEB44EBA8D8556EEB7B1FF58300F50017AD409E3292DF386841CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4CA48 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f4b000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a9e4e50299af9233ea7cb1a4adcae2df7006939e7bc023972d606f382cae434
Instruction ID: ded99808265ae141e0b4fc8b81b332463a3b7ac34731828326f4dfa2efa7e50c
Opcode Fuzzy Hash: 5a9e4e50299af9233ea7cb1a4adcae2df7006939e7bc023972d606f382cae434
Instruction Fuzzy Hash: 6731B234E1C91D8EEB98FBA89855ABCB7B1FF68740F50116AD00DE3282EE3468418B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4BAB2 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f4b000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0972e412b9e9e3ea9dd64829ddd58c746ed81feadf9a93c5ea56b0b2586accb3
Instruction ID: aaaa5d3afad6f9f4e018cfbf72c59fb577eb741916a6733369e57f8512736fda
Opcode Fuzzy Hash: 0972e412b9e9e3ea9dd64829ddd58c746ed81feadf9a93c5ea56b0b2586accb3
Instruction Fuzzy Hash: 92311C70D1851A8EEB94EB94C8557FDBAF1FF68751F1041BAC10DE22D2DF381A848B54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F544FB Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 636d57255f55970b318eb4a7c7b3dfa1dfd42f2f43d29765a1486f4bac63fa65
Instruction ID: 24ffc2a23f5163189ae0063f1bde3c0b6a0680b60e6d765687eb4e5755ab41bb
Opcode Fuzzy Hash: 636d57255f55970b318eb4a7c7b3dfa1dfd42f2f43d29765a1486f4bac63fa65
Instruction Fuzzy Hash: D721C172D0D6994FE752EB3898591B9BBE0FF6A350F0444B7D448CB093EB2459488715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4338C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 707122941ee08d36fc1b03ee50c61f9c1465781be815d7151da225c23eeed7d9
Instruction ID: 3e6a4a76ac2967cda479b90d2242886bd1434fdd4392a66ed88956225d824799
Opcode Fuzzy Hash: 707122941ee08d36fc1b03ee50c61f9c1465781be815d7151da225c23eeed7d9
Instruction Fuzzy Hash: A221C03184D68A8FE742EB7888585E97FF0EF5B300F0804EBD449C70A2EA28A446C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4B75D Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f4b000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 057fb6283285c3d79406facd0a81aacf8926bc8393af2c3080a431dd5f355885
Instruction ID: f3e0fcf0020bbcddeee70f9f89c41516a481ae7a443115d5b8c688d315a6e9bd
Opcode Fuzzy Hash: 057fb6283285c3d79406facd0a81aacf8926bc8393af2c3080a431dd5f355885
Instruction Fuzzy Hash: 3C218931D2D94A9EEB51BBA888191F9BBE0FF69780F1409B7D419E20D2EF28A5408644

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4084D Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53cb6ad0a98596a284727aa9af6f273d90aa2dddb28aa7c65ea96ff77f0f5327
Instruction ID: 7d8855fc776d3ba88c945197a40f5aefeaa36fa2c45a4750921e5526949408b4
Opcode Fuzzy Hash: 53cb6ad0a98596a284727aa9af6f273d90aa2dddb28aa7c65ea96ff77f0f5327
Instruction Fuzzy Hash: 45110131D0D64A9FF785BB7888495E97BE0FFA5740F1544B7C809D70D3EA28A4448685

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F576E1 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca557b867c610480c8b89cd988e946a8fe14aca7a4aab35a8458c58eae4a071
Instruction ID: a57184c5868bfa80a283c921d081025d69c310f789715b030facf9715b4304b7
Opcode Fuzzy Hash: aca557b867c610480c8b89cd988e946a8fe14aca7a4aab35a8458c58eae4a071
Instruction Fuzzy Hash: 8A11AF3080DA4E9FEB88EF28D4592BABBA0FF68741F0005BAD40DC21D2DB38A444C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F52E21 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50699c4dccd3684316ff2e7d80a159ab1e3bc13063d52a0bb9f40163da81bd99
Instruction ID: 3fda38a305824d3731c50a7cffef2c0af0ab13cad57466a46efd5d248c16cdb7
Opcode Fuzzy Hash: 50699c4dccd3684316ff2e7d80a159ab1e3bc13063d52a0bb9f40163da81bd99
Instruction Fuzzy Hash: CC1179709186498FDB48EF68D4961E9BBE1FF69345F0502BEE84EC2282DB34A550CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F53BF9 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff3b5bc53a5d4f79d20fe9c8ba7a5212ec1359d7392498e9cb0b2030971d8724
Instruction ID: 61f21165356735b92f064ab4937dd177b6b0bb63f4e7e13034a194b9e5a5ae6a
Opcode Fuzzy Hash: ff3b5bc53a5d4f79d20fe9c8ba7a5212ec1359d7392498e9cb0b2030971d8724
Instruction Fuzzy Hash: D821A53180D68A5FE742EB68885D6AABFF0EF5A340F0405F6D448C70A3DA286544C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F57785 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02965fd09920dfd08ebb345cd37060c69f0cfd8b0a4f24ac35e06bac5ffce6c
Instruction ID: d176cfe0c9986aabe1e81b07ff6f88b2d1b455169b956f96fc4c07956737f74c
Opcode Fuzzy Hash: a02965fd09920dfd08ebb345cd37060c69f0cfd8b0a4f24ac35e06bac5ffce6c
Instruction Fuzzy Hash: 5011AF3090EA4E8FEB89EF2894592BEBBA0FF69741F1405BAD419C61D2DB38A440C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F55155 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6bcee18233baf78bde33871ea6290e151f2238e9b87dc7e2a50a64a69c0e405
Instruction ID: 26505daec4b8dd51df479c9fa8cd4822fa9c8403a2aab90b331f864d4b3d5d9c
Opcode Fuzzy Hash: c6bcee18233baf78bde33871ea6290e151f2238e9b87dc7e2a50a64a69c0e405
Instruction Fuzzy Hash: 89117C3090DA8E9FEB89EF6884592BDBBA0FF69341F1405BED409C61D2DB39A584C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F550B9 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7b7c010a4d3c2c25c7d35d9df1bb02ef3097c117b5cfc3c8fd7431a4e8ee1a
Instruction ID: e33c58324fbfa84a4174d0ba49d7f2326e01904cd5838b9583e36ec5b58b34c2
Opcode Fuzzy Hash: cf7b7c010a4d3c2c25c7d35d9df1bb02ef3097c117b5cfc3c8fd7431a4e8ee1a
Instruction Fuzzy Hash: 87215C3090D68A9FEB89EF6888692B9BFA0FF69341F1405BBD409C75D2DB39A444C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F555F5 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438fe57d4e9506e3543d4711d1098613e066370bd377769116130b0ccd19264d
Instruction ID: 230e2995c4333a2a1ceb6dd2a98887f64ce9e08762b42a371ff47be4254817a2
Opcode Fuzzy Hash: 438fe57d4e9506e3543d4711d1098613e066370bd377769116130b0ccd19264d
Instruction Fuzzy Hash: 7511B271D0DAC98FE759EB6494AA2B8BAA0FF19340F0944FEC00DC65D3EB296444C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F57825 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e00660b67a72dcae9df52720e9a616f9a80bb8e49e248bb6bdb436cb4d758b5
Instruction ID: abb264561c4a5137a343aab02c2e735832443d59e5ac54256edadd3cd1914a62
Opcode Fuzzy Hash: 7e00660b67a72dcae9df52720e9a616f9a80bb8e49e248bb6bdb436cb4d758b5
Instruction Fuzzy Hash: 1511C471D0DA8A4FE759EB2488A92B9BBA0FF16341F2400BED419C25D3DB295444C749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F55969 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69477d5d68da4cef27771dae55a52eabbece902f09c6957c9b935d0088cdd225
Instruction ID: 74ec1929c20647d6055fb552a27ee54ca36d9c979a0e9c3357861762217be366
Opcode Fuzzy Hash: 69477d5d68da4cef27771dae55a52eabbece902f09c6957c9b935d0088cdd225
Instruction Fuzzy Hash: 9D11793080D68A8FEB49EB6488692B9BBA0FF19351F0404BBC40DC61D3DB29A584C742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F40F30 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e27d567f153cf73dbee0b9d0e4e82dc2b7972ede0ae9b3afda2fc271d40576e
Instruction ID: 0f372301f2c520e48e1a00e3e1077c4d6a7cd674fd17ee092369f97a5b12a81a
Opcode Fuzzy Hash: 5e27d567f153cf73dbee0b9d0e4e82dc2b7972ede0ae9b3afda2fc271d40576e
Instruction Fuzzy Hash: 9011513190D9098EEB94FB54D845BAE77B1FB94351F104276C40AE7296CF38A981CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F578BD Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b07d824f5497f3dbde4709d57b1083715dca097eb63ff936f846029aa08f196
Instruction ID: 28891d29cee995b49edd5398906fbe93443213b53eb04415d8353f660198b290
Opcode Fuzzy Hash: 4b07d824f5497f3dbde4709d57b1083715dca097eb63ff936f846029aa08f196
Instruction Fuzzy Hash: EF11BF3180DA4E8FEB89FF2484552B9BBA0FF69341F1400BAD40DC61D3DF29A444C795

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F57E21 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a8207f98b02fed48d2e148d6db1c38c123829a1b25ec56cab8dc45a0a81b7c2
Instruction ID: c61b14f9f29e8ce7932b6ba2c7017593a399d6619109198275a146b8afa0c88a
Opcode Fuzzy Hash: 9a8207f98b02fed48d2e148d6db1c38c123829a1b25ec56cab8dc45a0a81b7c2
Instruction Fuzzy Hash: 6D11653094DA4A9FE741FB74C8486AABBF4FF19341F0504B6D419C70A2DB38A644C755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F56A09 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ffd452690c5f767dd75b729e66602a86b17726d8f9485ed8aea9986e80319de
Instruction ID: 1b7af13d5bc4fb594b66c5b2766dc2a6ca44e08f53f6796d17d35f60ef056be3
Opcode Fuzzy Hash: 1ffd452690c5f767dd75b729e66602a86b17726d8f9485ed8aea9986e80319de
Instruction Fuzzy Hash: 0D11943090D6895FE741FB2488592AABBF0FF19340F0444B6C418C7193DB38A5448715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F53281 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45885e92a5cf292312e02d5e0f817271f61ea4c0c9b617ed8f8a94b79b306c2e
Instruction ID: 9575d4afab7368cc7a09c2b55f350ba1d0af0081e01f25c2c836d2734ab8b63b
Opcode Fuzzy Hash: 45885e92a5cf292312e02d5e0f817271f61ea4c0c9b617ed8f8a94b79b306c2e
Instruction Fuzzy Hash: 8511A13090D94E5EE781FB7C844C5F9BBE0FF1A341F0404B6D408C7096EB34A1548714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F434B5 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27ea3e67614e7e36a51c46735b803eaed07a8723a006671ce7934e528517829
Instruction ID: d59734e56c857495ef43f7c694317d53760560fd675af0fcd91bbe9f6bf7bd74
Opcode Fuzzy Hash: f27ea3e67614e7e36a51c46735b803eaed07a8723a006671ce7934e528517829
Instruction Fuzzy Hash: CC11AC3090C68E8FEB49EF2884596BDBBA0FF28700F0404BFD41AD61E1EB34A450C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4DE8D Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f4b000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afce078c747fbbea05953517288bacec630b367ca176cdba2ac09dca726a0411
Instruction ID: 51e5c63254612733e3694842210eb02533e627941776edce310ce7e145836435
Opcode Fuzzy Hash: afce078c747fbbea05953517288bacec630b367ca176cdba2ac09dca726a0411
Instruction Fuzzy Hash: 5B11793091DA4E9FEB89FF6488982B97BA0FF38741F0004BBD409E61E2EB75A550C744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4C8E9 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f4b000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 682944cb541fe65816a7db0040846dc4bc37fcf4e0a76513084cf95ff65d4475
Instruction ID: 9db385b4b6cda6e4bc6d8164d3d2af18372ef39af11238fbe9f406b3597aac36
Opcode Fuzzy Hash: 682944cb541fe65816a7db0040846dc4bc37fcf4e0a76513084cf95ff65d4475
Instruction Fuzzy Hash: 4B11707080D68D9FEB49EB2488592B97FE0FF29701F0515BBD409D61D2EB39A540C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F558DD Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c91a631b70e9831577ead7d151b51dc8023666aacd62df41864015b4977417d7
Instruction ID: 0baf389a2a8fdc12c437e6089c730a58bf476d9583589274121c6bedd8b06bb4
Opcode Fuzzy Hash: c91a631b70e9831577ead7d151b51dc8023666aacd62df41864015b4977417d7
Instruction Fuzzy Hash: 25119E3080DA8E8FEB49EB2488596BEBBE0FF18351F0404BAD41DC61D2DF39A544C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F5571D Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7086a0e051d37cd7438310ab08a11850ade6b97a37aedd0524a565b99f3bc64c
Instruction ID: ba149aae9928d26b55fefb0928646b7b7989372d267f7c206d4468fa0749e1c3
Opcode Fuzzy Hash: 7086a0e051d37cd7438310ab08a11850ade6b97a37aedd0524a565b99f3bc64c
Instruction Fuzzy Hash: 98118C3080D68E9FEB59EB2498696BEBBA0FF19341F0404BED40AD71D3DB39A544C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4C465 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f4b000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3484fe27a5c309910eb4234123e35fc4c9a713e90f8339aaabb5a1c04a3860f
Instruction ID: a489f18d46104dd64fe577a52ca0660db33fe863ab7c145fe7431f201a69660b
Opcode Fuzzy Hash: d3484fe27a5c309910eb4234123e35fc4c9a713e90f8339aaabb5a1c04a3860f
Instruction Fuzzy Hash: FF118E30909A4D8FEB85FB64C4596B9BBE0FF28301F1105BBD409D31A2EB35A550C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F42E91 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b6a8448d580d3ee218a1baa709c16896fcc5171acaa006be63664e82559929e
Instruction ID: 6a31bfe48cb1a3a8bedee3a1daca73a126eb693050adb5be66de2467f5e8f6dd
Opcode Fuzzy Hash: 3b6a8448d580d3ee218a1baa709c16896fcc5171acaa006be63664e82559929e
Instruction Fuzzy Hash: EA01783091D68E8FE751FBA888886A97BE0EF29741F0508B7D40CD70A2EF38E5848704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4B77D Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f4b000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c7b790cb697c51e963040952c427d621af8ec8a7b7b58dd0010dc5dc934ec19
Instruction ID: 869431468e5db9f56b4f0c0d7dc33f51c2a611b57fa5d90edf518f9802e32725
Opcode Fuzzy Hash: 7c7b790cb697c51e963040952c427d621af8ec8a7b7b58dd0010dc5dc934ec19
Instruction Fuzzy Hash: F6018B31D2DA4B9EEB51BBA89C151FEBBA0FF59684F04097BD45CA20C2EF2865008644

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F405D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1c0e6ead60f47950bb2bd4ee42ea4a1775f7eec7dba157b89417c6a538c3dcb
Instruction ID: 36af8ecaad6cd511117fa624baaf5dc19f83cff0919b0026d9ad177b7a50d0f7
Opcode Fuzzy Hash: c1c0e6ead60f47950bb2bd4ee42ea4a1775f7eec7dba157b89417c6a538c3dcb
Instruction Fuzzy Hash: A0015E30908A1E9FEB48EF64C4596BAB7A1FF68345F50447ED40EE21D1DB36A590CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F58609 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c067495f2fb5e6f07b51c5ff469e2ec830eb0c588372361c9560bbb396b027
Instruction ID: b685a5818b88a7ca13abe15815f7e6c25ca3379f79beab5d70d8ca23e4bd3e59
Opcode Fuzzy Hash: 20c067495f2fb5e6f07b51c5ff469e2ec830eb0c588372361c9560bbb396b027
Instruction Fuzzy Hash: 4E01803081D6898FDB4AAF2484692BABBA0EF16341F4508BED419C70E3EB25A950DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F52CB5 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38340cc03d70732b2fe4a615fdfc525dbf4c8eef5192bf7d8e07837a80db62c4
Instruction ID: 516e06c4a677a0270fc7f0e94756dc521b70a0ef6266afb3d88b6bb61350353f
Opcode Fuzzy Hash: 38340cc03d70732b2fe4a615fdfc525dbf4c8eef5192bf7d8e07837a80db62c4
Instruction Fuzzy Hash: 7A01DF3090D68A8FDB59EB64C46D2B9BBA0FF19350F0005BED80AC70D7EB79A540C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4286D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5adb3253abe820f43adbdf46863cea5e70a503d86085918856e4d80167d7e2
Instruction ID: 65aba66931ca53822b319646216f7c4fc320a1f49b9ca85bdad53b983644e47a
Opcode Fuzzy Hash: ac5adb3253abe820f43adbdf46863cea5e70a503d86085918856e4d80167d7e2
Instruction Fuzzy Hash: C201787090D64E8FE791FB6888886AD7BE0EF69741F1505B7E408D60A2EF38E0808704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4B319 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f4b000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb2ae287e072c60f42a7abb04a5cac2e016aeacc37ea5f56e7bf467df2b8297c
Instruction ID: 8bf007241bddd707a98ec5909d13a62b7aceeda99661961227577d9b5479b007
Opcode Fuzzy Hash: eb2ae287e072c60f42a7abb04a5cac2e016aeacc37ea5f56e7bf467df2b8297c
Instruction Fuzzy Hash: 56017C3091D6899FE752BBB488591B97BE0EF69740F0548B7D008D70E3EA28A4448701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F42F09 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c79446c49e83e671866abb93ce7c228b19e62eb8ca3c214232e17723b46399d4
Instruction ID: f7ca26f5795bebbabd8ee532a8d28b2d76e02d23973fe8ffba5e2b78cbb8ce2d
Opcode Fuzzy Hash: c79446c49e83e671866abb93ce7c228b19e62eb8ca3c214232e17723b46399d4
Instruction Fuzzy Hash: 3901BC3190D2898FE742BB7488591A97BE0EF6A750F8608F7C408DB0E6EB38A484C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F5867D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7a648cf461ecd68d5d4c7c20c05f79e080cd01199b8e3b1463a230afc209e00
Instruction ID: 2a4d9c40737da07b9b1cb3de778574823100a0e0112de5f10bd7b41c397640b0
Opcode Fuzzy Hash: d7a648cf461ecd68d5d4c7c20c05f79e080cd01199b8e3b1463a230afc209e00
Instruction Fuzzy Hash: 6801B13091D6898FDB49EB24C4692BEBBA0FF19345F4508BED41AC60D3EB35A950CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F57FA9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 489f11e8c366995b7589ac9c9a345311ee3f2d5a26ee74f68ac0a7064ec30c54
Instruction ID: 7c9d5b0378f71558c0832f70d53afd0473ab2952f95b68b5298430c8e094f8c4
Opcode Fuzzy Hash: 489f11e8c366995b7589ac9c9a345311ee3f2d5a26ee74f68ac0a7064ec30c54
Instruction Fuzzy Hash: 4C01BC3080EA8E5FE742EB34884C6A9BBE0EF1A340F4508B2D408CB0A3EB28A4448355

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F41CAD Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21d6225968d230dbef48f553f66cfc28118618fe9a476653cef6a179877b05b8
Instruction ID: 4a950fb4b86c16475f0f1fbbf2cb834c3110d962ad9aa5f6911fc00c2a10eec0
Opcode Fuzzy Hash: 21d6225968d230dbef48f553f66cfc28118618fe9a476653cef6a179877b05b8
Instruction Fuzzy Hash: C501DC3080D69E8FEB98EF2488592FA7BA0FF65741F4000BAE808D21C2DB36D490C744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F40608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa6168d2e3c02e2816ca5912620f895021e8b7e94c5ace37a20e1a6913ba2497
Instruction ID: c3ad7cdc03076ea1ff195028cae95ab04ff66b82487bf55d3bc45eff12aab9d5
Opcode Fuzzy Hash: aa6168d2e3c02e2816ca5912620f895021e8b7e94c5ace37a20e1a6913ba2497
Instruction Fuzzy Hash: 9D016930918A0E9EEB48FB64C4582BA76A1FF28745F60087EE40EE21D1DF35A590CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F40610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03b09ca12954135ccd4a2aac70b551309b3dc8d56d62863f1cc53c91af6518f6
Instruction ID: 2376acde085e6912167d74d80d32fc9eeaf851cb85c1023334476e2053f2dd02
Opcode Fuzzy Hash: 03b09ca12954135ccd4a2aac70b551309b3dc8d56d62863f1cc53c91af6518f6
Instruction Fuzzy Hash: ED016930818A0E9FEB48EF6484592BDB7A0FF28345F60087FE80ED21D1EF36A594C604

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F405D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cc7b1654d368acbc204d3bd7bde2628444aa83cc52f8528949a96eab8a89f35
Instruction ID: ab081bdb47e41f32d33ffaa1c4968dce5fd4da53ff1f02719fbb2b181627a91d
Opcode Fuzzy Hash: 7cc7b1654d368acbc204d3bd7bde2628444aa83cc52f8528949a96eab8a89f35
Instruction Fuzzy Hash: EAF0C23081D65E8FEB44EF2498052FA77A4FF25349F00047AE80DD21C1DB35A490C748

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F52A05 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d0e28bc2731958187c8e64c998e09d5f5a17a3eb04bd9254c3579273de2dbfd
Instruction ID: b259c03a2971576d6550103cf8f2ea1198902aeb7614bb85aa43a50dd1ecc161
Opcode Fuzzy Hash: 7d0e28bc2731958187c8e64c998e09d5f5a17a3eb04bd9254c3579273de2dbfd
Instruction Fuzzy Hash: 2EF04432D1D51A8EEF08EBA495951FDB3A2EF59350F10163AC00A93283CF386911AA44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F55D6B Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69cb2ee8c2ecab48c0c02cc2b5e2ef61dbe209d8fbfbe8b569bba6437b36d55a
Instruction ID: 3f853e4281de9635b4c7a709bc87d7e00857cb634082b9e1019cc808db0da51b
Opcode Fuzzy Hash: 69cb2ee8c2ecab48c0c02cc2b5e2ef61dbe209d8fbfbe8b569bba6437b36d55a
Instruction Fuzzy Hash: CAF0E731D1C91D8EDF94FB6898467ECB7B1FB58340F800166C00DE3286DF3468458B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F42789 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e042db41fad72b30ad84eb8f42d0d67bd6a5ea74daada77ec2b898c36cd4f9
Instruction ID: 33b0d099a63f157b72f97b421f488f01bbd1e55b442fadb2b10f63dd77260819
Opcode Fuzzy Hash: e0e042db41fad72b30ad84eb8f42d0d67bd6a5ea74daada77ec2b898c36cd4f9
Instruction Fuzzy Hash: ADF0CD3180E78A8FEB5AAF3488182A93BA1FF26741F1504BBE409C60D2EB38A444C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F427FD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e394fae5bbb24b74112dddfe7d044ec40d420170e97528de02abef3e22f85d9d
Instruction ID: cd46051c86f3e0c3b4d270792330758a6c4110588c9c8accfcb8560ca5bd9272
Opcode Fuzzy Hash: e394fae5bbb24b74112dddfe7d044ec40d420170e97528de02abef3e22f85d9d
Instruction Fuzzy Hash: FFF0907180E68D8FEB59AF6488591BD7BA0FF25241F5504BFD809C51D2EB399454C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F5246A Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e2ea40da15c94901b1db95feb5a4aa0336a6375e6bf6908dce976703cf05e88
Instruction ID: 95f75c3b22c937ad53387c8043f6599d60463f8b938f60781c1576b7522ddbf0
Opcode Fuzzy Hash: 4e2ea40da15c94901b1db95feb5a4aa0336a6375e6bf6908dce976703cf05e88
Instruction Fuzzy Hash: DEE0E279C0C38A8EEB25EF90C4443FDBAB0AF00385F10003690096B2E2CBB82A84DB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F5367D Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d458aae0aef93ddb01d104f4523cd5693e7a85a590e848667d2edc490a4168ac
Instruction ID: b1b60970465add62a668be740e080fa9a498a22a2efe070faf1297e1827a30f0
Opcode Fuzzy Hash: d458aae0aef93ddb01d104f4523cd5693e7a85a590e848667d2edc490a4168ac
Instruction Fuzzy Hash: 96D04270D0D5099EEB60FBA8C4562ACBAA1AF54744F60007AD00DB32D3DF3868518B15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4BB7F Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f4b000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9a023122b0bbdeeb64b408706279ee1816212e44f1dfe2796f882ae0461ff7d
Instruction ID: 76e0df3e6575684e4c4ebf4ba28b72d0a58b42fc509a31d25bd943715a4adcc1
Opcode Fuzzy Hash: a9a023122b0bbdeeb64b408706279ee1816212e44f1dfe2796f882ae0461ff7d
Instruction Fuzzy Hash: 2FD09230C2D41E8EDB55FB54C841AE9B671FB28340F1046B2851DE2186CFB8AAC08B84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F411B6 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f40000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02547457d6674f1df1f7e1e828613abb61688a4942a83ef5fddad5a47bf4481
Instruction ID: 46f531f9da52c4328e9e5d337f21d7158f73b39826e05e064d1267d9c256fae7
Opcode Fuzzy Hash: b02547457d6674f1df1f7e1e828613abb61688a4942a83ef5fddad5a47bf4481
Instruction Fuzzy Hash: 75C01230C1661E8EDB80EB50A8010FEB270FB84200F801022E81DA20C2EF3825108688

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F5236D Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f52000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83eef312977ca4709834f9ff416045d66eabab96dbd22dd70cef8f15a2a824e7
Instruction ID: 575c375382547ac2ccd958170ac72eccea4288e8536e095976b50660d6c27a02
Opcode Fuzzy Hash: 83eef312977ca4709834f9ff416045d66eabab96dbd22dd70cef8f15a2a824e7
Instruction Fuzzy Hash: CCC0127980879E8EEB10EFA0C8506FEBBB0EF10340F1010269009AB2C2CA786604EB40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF848F4F182 Relevance: 5.0, Strings: 4, Instructions: 41COMMON

Download Yara Rule

Strings

*, xrefs: 00007FF848F4F09B
[, xrefs: 00007FF848F4F196
k, xrefs: 00007FF848F4F0B6
^, xrefs: 00007FF848F4F9D3

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F4F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f4f000_SystemSettings.jbxd

Similarity

API ID:
String ID: *$[$^$k
API String ID: 0-1202021107
Opcode ID: d45b23fcbac47bf73f15d1e701022ec690aa0358cdfd9615b1292719b59082f7
Instruction ID: 130e77935ce56d9aa6e9fa186911cfc0f2d42be3679d99751af225b3e860c2e3
Opcode Fuzzy Hash: d45b23fcbac47bf73f15d1e701022ec690aa0358cdfd9615b1292719b59082f7
Instruction Fuzzy Hash: DB11E870D0C61A8FEB68EF08C8847E9B7B1EB64751F0041FAD41DA62D1DB786A84CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4F318 Relevance: 5.0, Strings: 4, Instructions: 35COMMON

Download Yara Rule

Strings

H, xrefs: 00007FF848F4F372
", xrefs: 00007FF848F4F362
5, xrefs: 00007FF848F4F31C
k, xrefs: 00007FF848F4F0B6

Memory Dump Source

Source File: 0000001A.00000002.2191873092.00007FF848F4F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff848f4f000_SystemSettings.jbxd

Similarity

API ID:
String ID: "$5$H$k
API String ID: 0-1256405626
Opcode ID: f97adf3c0343b478e9bcfbd9c97bebe8d71f094acad07336634dd5319c8c7562
Instruction ID: d49961043f626d0ff45548347e120224b4b04a82734d04acc6d24240ca956bef
Opcode Fuzzy Hash: f97adf3c0343b478e9bcfbd9c97bebe8d71f094acad07336634dd5319c8c7562
Instruction Fuzzy Hash: 23011A75D09729CEEB24DF14C8807E9B7B1FB64751F0041EAD44DA6291CB389A84CF45

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SystemSettings.exePID: 4616, Parent PID: 1068COMMON

Executed Functions

Function 00007FF848F21150 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

hyH, xrefs: 00007FF848F211AD

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID: hyH
API String ID: 0-3369426750
Opcode ID: c0c051f8534aa2b7000dcb091fba6bc6b5863c08160fd01f9810ff0f85db5fb9
Instruction ID: 70480d3e98b4b229fb17e9309bebec38c586170ba320c810de063357e3683a28
Opcode Fuzzy Hash: c0c051f8534aa2b7000dcb091fba6bc6b5863c08160fd01f9810ff0f85db5fb9
Instruction Fuzzy Hash: 1A31AE30D1DA5E4FEB98EBA4A4692BE77E0FF19341F00047AD00AD21C2EF366584C759

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F20A01 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

0vH, xrefs: 00007FF848F20A70

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID: 0vH
API String ID: 0-2857910901
Opcode ID: 35006c853c703db3f28010366e575b27fccc2baf77d493051c0c56ad334c84b6
Instruction ID: da574f4b602ed3cbbce032440945fa772ed9203de0119054a3925a6b33b39e85
Opcode Fuzzy Hash: 35006c853c703db3f28010366e575b27fccc2baf77d493051c0c56ad334c84b6
Instruction Fuzzy Hash: 36115B32D1854E9FE780FB68D8492BA7BA0FF98380F8045B6D809C6192EF39A5448B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F216A8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfce2f124206478eead3c73241dd5a23ac12614ec79b2c83d4657b6662826966
Instruction ID: 7c348d917b38bf2d246bb531cceb59736b7e1d93ad7793ad32d1976eb000fa68
Opcode Fuzzy Hash: cfce2f124206478eead3c73241dd5a23ac12614ec79b2c83d4657b6662826966
Instruction Fuzzy Hash: 3781BD31A0CA4A8FDB58EF5898615B977E2FF98340F14057AE44EC32C2CF35A8428789

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F235BE Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59e441044599d741ff7fcc19fd7e3d537356a459afa7fd2616a494dda7c67d20
Instruction ID: be50ed0233e4ac3bf73b03cfaf01d2c4e9d5d42a0c5410d1025f7b687fe5fcba
Opcode Fuzzy Hash: 59e441044599d741ff7fcc19fd7e3d537356a459afa7fd2616a494dda7c67d20
Instruction Fuzzy Hash: A5719D71E1D90E8EE794DB6CA8153ADBFE1FB95350F5042BAC009C32D6DBA91801CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F21D2D Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f31fba93f85fff86cadb36507099f259f17d3509c5722fe472d7d9cdea6ea5f
Instruction ID: 40a03fb912ea716ead214ec9f37ed633f5fe64b02a007a6f6faf0875e9517d72
Opcode Fuzzy Hash: 0f31fba93f85fff86cadb36507099f259f17d3509c5722fe472d7d9cdea6ea5f
Instruction Fuzzy Hash: E651B131A0CA9A8FDB48EF5898555BA77E2FF98340F14467ED44AC7281CF35E842C785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F23191 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bda8c298cda3b45d375c4cf218f45bdc4e901453df6754979c172213a885c43
Instruction ID: a09b39b7f6999f54806c6a49c248e26c571c06ff05a94e3cd2985a6a2d2d4608
Opcode Fuzzy Hash: 9bda8c298cda3b45d375c4cf218f45bdc4e901453df6754979c172213a885c43
Instruction Fuzzy Hash: C95145B0D0860E8FEB54EB98E4956EDBBB1FF48341F50007AD009E72E1DB3AA944CB15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F22145 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d896c5a7f7aac2dd010509d6fa7f908f969ca05c4fbabd9b8f13f5fd061ff02
Instruction ID: 8a8a3ca2e15623b3230e41c08be66c42422e4ec1ceb014afd7ce80f97ea4a2fd
Opcode Fuzzy Hash: 4d896c5a7f7aac2dd010509d6fa7f908f969ca05c4fbabd9b8f13f5fd061ff02
Instruction Fuzzy Hash: E7414831E1DA8A4FE346E7B8A8551B8BBE0EF46380F0505BBD40CC71D2DF39A8418355

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F2338C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54fc8e4e1312c70749979b2468136429d449b38fe1bd788ddd42ae7f9d8b9736
Instruction ID: 862448edd1b15aa9aa8cdf6c7ac384b32fe045d822279651ea3db52b5aaae4f0
Opcode Fuzzy Hash: 54fc8e4e1312c70749979b2468136429d449b38fe1bd788ddd42ae7f9d8b9736
Instruction Fuzzy Hash: F721C07184D78A8FE742AB7888585A97FF0EF5B301F0804EAD449C71A2EA299556C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F2084D Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7af450023878b3a831ae99cf11655b60f0a8512c1375ba2619c137a92a737db4
Instruction ID: b49acc1821a8dad30aceb01df868116c5176c6d5f562a49940431b2e9550e8d8
Opcode Fuzzy Hash: 7af450023878b3a831ae99cf11655b60f0a8512c1375ba2619c137a92a737db4
Instruction Fuzzy Hash: BF112332D0D64A9FE755BB7898591EA7BE0FF95340F1544B6C809C70D3EE25A444C385

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F22C18 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a7d8f0f37493ca737acfdb818a927984f229c83a8aecc91a019cbeca6800cab
Instruction ID: f72f6df3923f99921d53e0be51384d6e40b4e4c6fca5ed722e126c4cc9960a5b
Opcode Fuzzy Hash: 6a7d8f0f37493ca737acfdb818a927984f229c83a8aecc91a019cbeca6800cab
Instruction Fuzzy Hash: E3111F70918A0D8FDF84EF18C449ABE77E0FF58345F10456AE81ED3294DB35A591CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F20F30 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9514794f509b6aabc2752f08d530231154a84c1477070a2ac1e2e8f570d0f15
Instruction ID: 36f120109c86b71be93999dc9b8a90e4666e97da57ff4769618e29ed92399648
Opcode Fuzzy Hash: f9514794f509b6aabc2752f08d530231154a84c1477070a2ac1e2e8f570d0f15
Instruction Fuzzy Hash: 8011603290D91A8FEB54FB58D855BEEB7B1FB94340F104275C40AD7295CF38A981CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F234B5 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a652583719d85f04c0a95f3a5ef7f0b838d153e4b3e69178d62f2375b7a335b
Instruction ID: 857d942b2a6cd5dc3dcf6aff753f73e22533fbb8f8e5a74fa455878198c87c16
Opcode Fuzzy Hash: 4a652583719d85f04c0a95f3a5ef7f0b838d153e4b3e69178d62f2375b7a335b
Instruction Fuzzy Hash: DC117CB091C68E8FDB59EF2884592BEBBA0FF18341F0405BED41AC61E1DB3AA550C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F2AF01 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ecda16dc981d365140aa05cd1fc2e6d83b93e999f50bb881950148c37ff7d8e
Instruction ID: 915d2fcb2b0fe7baec84955530c5491bb84320198cf4ca47cf49ddddcc1f1fcb
Opcode Fuzzy Hash: 6ecda16dc981d365140aa05cd1fc2e6d83b93e999f50bb881950148c37ff7d8e
Instruction Fuzzy Hash: 5601787181D69A8FE791FB2898592A9BBE0FF59341F4545BAE408C70A2EB39A4808704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F205D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d92b7129678bee9e5e02af64034f3abb9c24f851d729eb43306fa0131951b9dd
Instruction ID: 28936591c51f031afbde8c206c7ca86af2a653e89e6b60da6166dd5320ecfc6b
Opcode Fuzzy Hash: d92b7129678bee9e5e02af64034f3abb9c24f851d729eb43306fa0131951b9dd
Instruction Fuzzy Hash: 7701883094890E8EEB88EFA4D4596BAB7A1FF58346F50457AD40EC21C1CB32B590CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F2286D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b6d7d7b4d1cc65ca83bb7b65026a729d190794524917f2cc7015ab6df684d17
Instruction ID: 214d1056c179787d4f5ad57836872bc2d1553d9f58d2c65527aa80187250948d
Opcode Fuzzy Hash: 0b6d7d7b4d1cc65ca83bb7b65026a729d190794524917f2cc7015ab6df684d17
Instruction Fuzzy Hash: DA01783180D64E8FE795FB6898896E9BBE0FF69341F1509B7D408C60A2EF39E0808705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F2B319 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 993788228f94f5a9ec3fb948dc982310596a6e788c5acde0406a6816491d0a60
Instruction ID: c3df5eefdea584371c426b9085748f9be3aba9e0b1d9394a606c076b854b571c
Opcode Fuzzy Hash: 993788228f94f5a9ec3fb948dc982310596a6e788c5acde0406a6816491d0a60
Instruction Fuzzy Hash: 9D017C3085D6899FE752BB7498591A97BE0EF59340F0548B7D408C70E2EB29A8548705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F2AF79 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c058e332e1a3acf12b0ffa4fbe1895a50b3dd71890e172ad75339bdf02fd43fb
Instruction ID: 4d8b67b7b11718d4ffbfd2ac1f46ee8e9caae1ea61e46db84fbf1daff4435d27
Opcode Fuzzy Hash: c058e332e1a3acf12b0ffa4fbe1895a50b3dd71890e172ad75339bdf02fd43fb
Instruction Fuzzy Hash: 3501DF7080D6894FE742FB3498581A9BFE0EF1A340F4608F3D008CB0E2EB39A484C715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F22F09 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd1343f345909144e66874eb339253d554738075835cea75c7c29ad2cd4750cc
Instruction ID: 515ab3ecc4f7b9bf1dc15e9230ebc69fe74f96f308ac2ab2964fac6676161d0e
Opcode Fuzzy Hash: dd1343f345909144e66874eb339253d554738075835cea75c7c29ad2cd4750cc
Instruction Fuzzy Hash: A5018F3191D6898FE742BB7498991A9BFE0FF5A340F4609F7D408CB0E6EB39A454C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F21CAD Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4d90c319d91a4f9aeb2f5de6a71cdd7eb0dd03c47a018591d176a256f096d85
Instruction ID: b83f0114b960669524d8fcce4553b863078b84dc18c4c68d94eefce0645f6fab
Opcode Fuzzy Hash: c4d90c319d91a4f9aeb2f5de6a71cdd7eb0dd03c47a018591d176a256f096d85
Instruction Fuzzy Hash: 5A01F430C4D68D8FEB98EF6498592FA7BA0FF55301F4001BAE808C61C2DB36E490C788

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F20608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f524778dd94b8d9e35f574dac223004760b463eeab2cc0e4a061203a7fdb9bb
Instruction ID: ae1e50c2aafee0c91a435c934a86e71117a3a9976ec6c0998eade3889ab9edb2
Opcode Fuzzy Hash: 0f524778dd94b8d9e35f574dac223004760b463eeab2cc0e4a061203a7fdb9bb
Instruction Fuzzy Hash: 6D01693091DA0E9EEB48FBA4D4582BAB6A1FF18345F500C7EE40ED21D1DF36A590CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F20610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e94a734d0d909aa7751ae3747c2d796615470b58271f09064975fd91ec5489a1
Instruction ID: 90ca8f5d4561a62f5051dfb9c7063f14f593521aa3b6f6e9f5623152e2a5ce58
Opcode Fuzzy Hash: e94a734d0d909aa7751ae3747c2d796615470b58271f09064975fd91ec5489a1
Instruction Fuzzy Hash: 48016930818A0E9FEB48EF6494592F9B7A0FF18345F60087EE80EC21D1DF3AE554C604

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F205D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f21acc383c60015696ccc78f5678048e0113365adcea0834c51436227af282de
Instruction ID: f1c67923859a15faaf9dfc58a0cc9575ae96f9a584a3da60a95cfa7c168b2470
Opcode Fuzzy Hash: f21acc383c60015696ccc78f5678048e0113365adcea0834c51436227af282de
Instruction Fuzzy Hash: E1F0AF3085E64E8FEB44EFA4A4052FA77A4FF15345F40057AE80DC21C1DB36A490C788

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F22789 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a8206a695fd65321dc4ca0cd8b515d111808c049002c9ebd3b6aa16660d2205
Instruction ID: d692575dabc56ec1dfa6209c749fc62e8a17c9e9c2e3cbf9423038fb3a3546aa
Opcode Fuzzy Hash: 0a8206a695fd65321dc4ca0cd8b515d111808c049002c9ebd3b6aa16660d2205
Instruction Fuzzy Hash: B4F0F63180E78A8FEB59AF3498582B97B61FF16341F0508BFD409C60D2EB39A444C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F227FD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ab5360dddaaba3a636a336ddd36af159a830482f096c6bfe2636abca8c9cd4e
Instruction ID: 6bd9877e852bcd3943f05b866efdd490c3ccf89683b126e0d763ef0c278844dd
Opcode Fuzzy Hash: 9ab5360dddaaba3a636a336ddd36af159a830482f096c6bfe2636abca8c9cd4e
Instruction Fuzzy Hash: 9EF0F03080E6898FEB59AF2488991F9BBA0FF15300F5408BFD808C10D2EB3AD814C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F211B6 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2164946272.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff848f20000_SystemSettings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78373d8f96d9c2ba925e3ab8532e17776f1f23c91976e2fc1444358e497175da
Instruction ID: 1a48f0eb55f0ce4b216d3259453a523be56a9db5040a7884a6732ef85bb83793
Opcode Fuzzy Hash: 78373d8f96d9c2ba925e3ab8532e17776f1f23c91976e2fc1444358e497175da
Instruction Fuzzy Hash: 73C01231C1661E8EDB40EB50A8010FEB270FB84200F801022E81CA20C2EF3925108688

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: uPlspWkqijAQ.exePID: 6596, Parent PID: 1068COMMON

Executed Functions

Function 00007FF848F0F8AF Relevance: 6.3, Strings: 5, Instructions: 85COMMON

Download Yara Rule

Strings

k, xrefs: 00007FF848F0F0B6
^, xrefs: 00007FF848F0F9D3
], xrefs: 00007FF848F0F99E
V, xrefs: 00007FF848F0F936
I, xrefs: 00007FF848F0F8B8

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F0F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F0F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f0f000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID: I$V$]$^$k
API String ID: 0-2537897772
Opcode ID: d3ac33f2bbe06e060f2a8dcf1716afbe746e8bd95791059499eadf2a50c33389
Instruction ID: 218eb7b8fc1e9b9c38a1345eaa20225cf8b860a228692ea556fb1561a275587d
Opcode Fuzzy Hash: d3ac33f2bbe06e060f2a8dcf1716afbe746e8bd95791059499eadf2a50c33389
Instruction Fuzzy Hash: 1831D1B0D0862D8FDBA8EF14C8947E9B7B1EB55341F5081EAD40DA7291EB385E80DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0F0A8 Relevance: 5.1, Strings: 4, Instructions: 82COMMON

Download Yara Rule

Strings

d, xrefs: 00007FF848F0F535
k, xrefs: 00007FF848F0F0B6
i, xrefs: 00007FF848F0F3A5
}, xrefs: 00007FF848F0F4FA

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F0F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F0F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f0f000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID: d$i$k$}
API String ID: 0-1577325851
Opcode ID: 234ae109435d6ad56b397c942fa2be2fea1f5182e0acaa0809fc44382a5d89ed
Instruction ID: 5c36a079b466a0380b55c659c022138273ffccc42f2db7731ad8982567539bec
Opcode Fuzzy Hash: 234ae109435d6ad56b397c942fa2be2fea1f5182e0acaa0809fc44382a5d89ed
Instruction Fuzzy Hash: 6A41AF70D196298FEB64EF14C8887A9B7B1FB15341F1041EAD40DA62D1EB386A81DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0F3DF Relevance: 2.5, Strings: 2, Instructions: 48COMMON

Download Yara Rule

Strings

i, xrefs: 00007FF848F0F3A5
:, xrefs: 00007FF848F0F43B

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F0F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F0F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f0f000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID: :$i
API String ID: 0-322666766
Opcode ID: c9f2d55fbbefd45ece68d1e7f6c9fac8e88ea1d4b89d53a3c09158a6475726b4
Instruction ID: 5d6890ac785a455ee6a83559008bbae4bef359099d4ddd960b94b568ae82a2ec
Opcode Fuzzy Hash: c9f2d55fbbefd45ece68d1e7f6c9fac8e88ea1d4b89d53a3c09158a6475726b4
Instruction Fuzzy Hash: 7811B470D0866ACEEBA4EF14C8947A9B7B5AF19380F4001EA940DA62C1EB746A80CF04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F13D58 Relevance: .5, Instructions: 465COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f1181eea4d6b74443fc66d0b9aa5ecf197af75f0a112698700cf3799e276c48
Instruction ID: ebdda3b60cb720c576f4eb78d91a275b4f9bfa330cdaf89501805df8a294f47f
Opcode Fuzzy Hash: 5f1181eea4d6b74443fc66d0b9aa5ecf197af75f0a112698700cf3799e276c48
Instruction Fuzzy Hash: 56215E3180E6899FE752EB7848595B97FF1FF56740F0905FBD088CB0E3DA28A9448356

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F145B5 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 813a3748adf1f9a82e09e090fd80949a0308215ef7fa1b4c9aea6a2e2d8acaad
Instruction ID: c7911834ec6d1e49394ed2768f4fbd4538e6dc6c6b651217a1bb778cde5c37ce
Opcode Fuzzy Hash: 813a3748adf1f9a82e09e090fd80949a0308215ef7fa1b4c9aea6a2e2d8acaad
Instruction Fuzzy Hash: D6C19470D1862D8EEBA5EF58C8957EDB7B2FB68341F1041AAD00DE3292DB746D848F44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F016A8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c1cc0b3764265d82d92c8f4095954193f0e20937aed0d41390099acdecd3b37
Instruction ID: 21dba179469269691fdf20b2ab092854a3709ab08378ab83cb0493d046c52882
Opcode Fuzzy Hash: 3c1cc0b3764265d82d92c8f4095954193f0e20937aed0d41390099acdecd3b37
Instruction Fuzzy Hash: 4081AD31A0CA4A8FDB58EF1C98555BA77E2FF9A344F14457AE44EC32C2DF34A8428785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F035BE Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef44df9539cd9e8c554bae836d14b1c153edc75c3b41c047112851c1b621d057
Instruction ID: ef27ee481ad3e2fff7e1a9c70990aa57a72b2547ec5c879825b86b0db90a25a2
Opcode Fuzzy Hash: ef44df9539cd9e8c554bae836d14b1c153edc75c3b41c047112851c1b621d057
Instruction Fuzzy Hash: 7671A971E1D90A8EE794EB6CE8157ADBFE1FB8A350F50017AC009C72C6DFA818058B65

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F01D2D Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 685955f19d3a4762eae970ca639e9bbedbe32cebe3c2effa7517182014d438f8
Instruction ID: 913f4a14e7b6be5ce2669a00de4293da159ad547e876067dcbee24a6edaaca82
Opcode Fuzzy Hash: 685955f19d3a4762eae970ca639e9bbedbe32cebe3c2effa7517182014d438f8
Instruction Fuzzy Hash: 1251BF31A1CA8A8FDB48EF1888645BA77E2FF99344F14457ED44AC7292DF34E842C785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F133CD Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 430e2a5e1d37a2d75073814ce8a5d0d3cfb9de4889355048f37352ec9f14ce91
Instruction ID: 67be97a790e8441591bf0718bad75ec4d0600dc4e23aa6d92d9a8d7302acb631
Opcode Fuzzy Hash: 430e2a5e1d37a2d75073814ce8a5d0d3cfb9de4889355048f37352ec9f14ce91
Instruction Fuzzy Hash: 7071D070D19A1D8EEB94EB58C859BECB7B1FF59340F1042A9C44DE3292EF386D848B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F13301 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7faafe39d5da2b9b5109c41f7f92e6970cd83d765e5186fba170f6d80c4c5c3b
Instruction ID: 7f49e013f70f08b1d1c07525d8abadcfdfe425d3721c07a68f6733670dd9361d
Opcode Fuzzy Hash: 7faafe39d5da2b9b5109c41f7f92e6970cd83d765e5186fba170f6d80c4c5c3b
Instruction Fuzzy Hash: B761F374D09A1D8EEB94EB68C8597ADB6F1FF59340F4001BAD44DE7291DF38A9848B08

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F03191 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0227b54376543799aea2026a04049d33fbe7b489c0dffac2a72b615ad0cbfd74
Instruction ID: 8e07a68ef2a8691761e4192d9768a78066b6bb954d8ff50153b98f69e2f44c3f
Opcode Fuzzy Hash: 0227b54376543799aea2026a04049d33fbe7b489c0dffac2a72b615ad0cbfd74
Instruction Fuzzy Hash: FE510470D1C60A8FEB54EB98C4986EDBBB1FF59351F50003AD009E72D1EB396944CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F15D05 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 084cd9cb76e73f651428700d74ab45b49408b6bf5870da29ee3c8851413ec13b
Instruction ID: 7ce91545603625b0b98d1e0cc095123a3243a53dd00855d1985e1da28ce67a83
Opcode Fuzzy Hash: 084cd9cb76e73f651428700d74ab45b49408b6bf5870da29ee3c8851413ec13b
Instruction Fuzzy Hash: 6B417D70D0D94A8FEB95EB28D84A6EDBBB0FF19341F0001AAD00DD7292DF3969458B94

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F02145 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 472a6cd017386d65794831a34ac1872c94785b24fbe9bbd750daeadce643a365
Instruction ID: a2d85d00aa9495fac66bab02cb08309cacd641db7393ffe13d5f9bd55cff0e1e
Opcode Fuzzy Hash: 472a6cd017386d65794831a34ac1872c94785b24fbe9bbd750daeadce643a365
Instruction Fuzzy Hash: 00412831E1D68A5FE347EBB898551B9BBE0EF47390F0501BAD44CC71D2EF28A8418365

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0D0FB Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F0B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F0B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f0b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d20da0c25e1b3a23d3b854666b863909078ad467f1c19fafce4b2857ea8e740
Instruction ID: 7393f7f7ec021397bd24218bcb4b1b271651db505bba195d842870bfa976074e
Opcode Fuzzy Hash: 6d20da0c25e1b3a23d3b854666b863909078ad467f1c19fafce4b2857ea8e740
Instruction Fuzzy Hash: F841BF36A0E6169EFB45BBA8B4451FD7760FF423BAF040237D508C90C3EF2C644582A8

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1289D Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b60fd064306148c8e850e233bbf06b23e05a2c32badd76ae994d1729caab6fb
Instruction ID: 97e50f51384a8d2a5bb490d951cf287bca7de4678bc5f76385823d299a8d8ad9
Opcode Fuzzy Hash: 6b60fd064306148c8e850e233bbf06b23e05a2c32badd76ae994d1729caab6fb
Instruction Fuzzy Hash: C6414271E0D60E8FEB58EBA8C4546FDB7A1EF59340F50017AD00AE72C6DB38A9808B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0D0C0 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F0B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F0B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f0b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f05c4152b7b2a761fb9c5c5d31d763f1398ecd4c02b9a2ce27aa4cd05065f88
Instruction ID: fb3465c26a4387ad857ba82179babe9a9c2115d853c0cae1d2304a1936045fcd
Opcode Fuzzy Hash: 3f05c4152b7b2a761fb9c5c5d31d763f1398ecd4c02b9a2ce27aa4cd05065f88
Instruction Fuzzy Hash: A841AE36A1E55A9EFB46BB68A4051FD7760FF523AAF040777D00CCA0C3EF2C244582A8

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1312D Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e2022ebe4bab6f8e8280aedecb18a42f811beda7b081ef1ac10951cd82aca6
Instruction ID: 4828212be5324ee4837ca41c41f96af6c9bb8b829e3944caf9544e4a32dbc338
Opcode Fuzzy Hash: 27e2022ebe4bab6f8e8280aedecb18a42f811beda7b081ef1ac10951cd82aca6
Instruction Fuzzy Hash: 1A413D30E1965E9FEB44EBA8D8596EEB7B1FF58301F100179E009E3292DF386841CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F01150 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c63ebc1b0f409490032adc13d0859f49bb18dd699c57a54f2c2aa545802a98f
Instruction ID: 65ad9c909d6ad3a7977023bf2523a60c11860435e350d3417f6180e603380be5
Opcode Fuzzy Hash: 3c63ebc1b0f409490032adc13d0859f49bb18dd699c57a54f2c2aa545802a98f
Instruction Fuzzy Hash: 3F31AB30D1CA4E8EEB98EF6884692BA77E0FF1A341F00047AD00AD21C2EF256584C754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0B6F8 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F0B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F0B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f0b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa6eb4097d3c2d91a6c9378b288d59ec3e602c1d25d3541532f23f3a86c73746
Instruction ID: f7aa54d95c8d9b9dcdf59488d123a90a90b00d702510ec60b3513800c7c3ebbd
Opcode Fuzzy Hash: fa6eb4097d3c2d91a6c9378b288d59ec3e602c1d25d3541532f23f3a86c73746
Instruction Fuzzy Hash: A641CE71C1D98A8FEB55BB7888592F97BE0FF16384F0805B6C459870D3EF28A9018755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0CA48 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F0B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F0B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f0b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f491947a4051e73203838611c78f09cd720c24673fca815342db07bd3ced7049
Instruction ID: 9c3da1a43936cbbf2449ea742fe758da6a5f3efed697be703bb057eb09e2999b
Opcode Fuzzy Hash: f491947a4051e73203838611c78f09cd720c24673fca815342db07bd3ced7049
Instruction Fuzzy Hash: E7319474E1D91D8EEB94FBA898556FCB7B1FF5A340F901169D00DE3282EF2468418B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0BAB2 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F0B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F0B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f0b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b70e15f58c1bd19c77433ab464f3c9da09a2327a3fc01e6044d8afde6789b36c
Instruction ID: d1288819d62c240d9937dfabab582a40ab032499640251bc7e012909acf2bcfc
Opcode Fuzzy Hash: b70e15f58c1bd19c77433ab464f3c9da09a2327a3fc01e6044d8afde6789b36c
Instruction Fuzzy Hash: 8E313BB0D1851A8FEB64EB54C8553BDBAF1EF59350F1081BAC00DE22D2EF3819848B55

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F144FB Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e36d776a7f940ff8e370b316e2065569031a16ac2cd08f4637b0f3906379c6e0
Instruction ID: 1098aef88b3537c52e8850274820b8363561dede9ae2c7e9b0df67ba472c044a
Opcode Fuzzy Hash: e36d776a7f940ff8e370b316e2065569031a16ac2cd08f4637b0f3906379c6e0
Instruction Fuzzy Hash: F4210332E0DA8A4FE742BB3888691E9BBF0FF6A351F0404B7D408C7093EB2469448755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0338C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e71b44aec52513cb3f57689adc68cdb7ed27047fb7e908d7ddaeb6f6384047b
Instruction ID: a0ea6a91d9581af41b6558e0e5c747cd7e5adc453216950c6a1dc7076bb26fba
Opcode Fuzzy Hash: 3e71b44aec52513cb3f57689adc68cdb7ed27047fb7e908d7ddaeb6f6384047b
Instruction Fuzzy Hash: C221A23184D78A8FE742EB7888585A97FF4EF5B301F0904FAD449CB1A2EB399546C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0084D Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99bf128b960d9b894b817c54f6216cf279d46ba7408f053bd41b337488a4e210
Instruction ID: 5724f87563e7b926c82f82f6ed9436a39ed6a58508f657a76a52d19c6a54cdab
Opcode Fuzzy Hash: 99bf128b960d9b894b817c54f6216cf279d46ba7408f053bd41b337488a4e210
Instruction Fuzzy Hash: 17110131D0D64A9FE755BB7884591E97BE0FF96348F5544B6C809C70D2FE24A4448385

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F13BF9 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a3b52bdd28df9872d747c7972604d13d709af85fd9c8b0271bafead55fc82d
Instruction ID: 8b721ad7529e5830b80c35ede614451dc5601455869535ff9ebf42fdff94d296
Opcode Fuzzy Hash: a2a3b52bdd28df9872d747c7972604d13d709af85fd9c8b0271bafead55fc82d
Instruction Fuzzy Hash: B321B13080E68A9FE742EB7888596EA7FF0FF5A350F0805F6D488C71A2DA3CA544C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F176E1 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 358ac7f2b5e1f81e4fc21cc316a0000e7ccb379c8226109836111bce44918307
Instruction ID: a35b7e8aa58c0ac8a44fd9c95f679075fc5bfb432617c645fa375b6f72022ead
Opcode Fuzzy Hash: 358ac7f2b5e1f81e4fc21cc316a0000e7ccb379c8226109836111bce44918307
Instruction Fuzzy Hash: BB117C3090DA4E9FEB89EF2884592BA7BA0FF68341F1405BAD40DC25D6DB39A944C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F00A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbfed816dfaee27fa7b008454c6c24cf9668275ef07ca7cc350896a6eaa6eb18
Instruction ID: e9aca9f227ee4fb827490f9b7cd0597be73717df7af77114df630525b2d1a6e3
Opcode Fuzzy Hash: cbfed816dfaee27fa7b008454c6c24cf9668275ef07ca7cc350896a6eaa6eb18
Instruction Fuzzy Hash: AE115830D0C54E9EE780FB68C8496BA7BA0FF99385F4005B6D809D61D2EF38A5448754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F12E21 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0303626efeb9b2a40bb892224435940b39a69ae000938f0401ed26ce6df90b77
Instruction ID: fd71756ebaf1f3a5140d879e6ec796b89721fd2bff3536f8cd2611987d1d31ed
Opcode Fuzzy Hash: 0303626efeb9b2a40bb892224435940b39a69ae000938f0401ed26ce6df90b77
Instruction Fuzzy Hash: 971179709186498FDB48EFA8C4955E97BE1FF59345F05027EE84EC3281DB34A854CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F15155 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 501842986b71adf5ce83bc9c3e845dbbcf33214c9c361b82526655bc9cd49018
Instruction ID: 1add6f2e4d65d91c0983b76bc375640c4cce00cd18d3dcafcf9980af6979d371
Opcode Fuzzy Hash: 501842986b71adf5ce83bc9c3e845dbbcf33214c9c361b82526655bc9cd49018
Instruction Fuzzy Hash: 7E11BE30D0DA4E9FEB89EF6884592BDBBA0FF68381F1001BAD40DD61D2DB38A940C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F17785 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac979209751fd18bb3792f47c9dd50eec1ccc155b7ebbb921ccc7057e38a065
Instruction ID: a8fc587a43591e29f72e49a25a7eb50879897811b3c20bc2c8f8b16d40801b57
Opcode Fuzzy Hash: 7ac979209751fd18bb3792f47c9dd50eec1ccc155b7ebbb921ccc7057e38a065
Instruction Fuzzy Hash: 6D11A23090EA4E9FDB49EF2884592BD7BA0FF58341F1405BAD40DC65D6DB386440C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F150B9 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e3d757019f6aacec916f5fa8ab20d16f8ba288b86d4c5c5d4161636915aefef
Instruction ID: 8bad65316d56cb95804d516b15283153212b020be9d2055f0da7a85a8a170a43
Opcode Fuzzy Hash: 4e3d757019f6aacec916f5fa8ab20d16f8ba288b86d4c5c5d4161636915aefef
Instruction Fuzzy Hash: 24219D3080D68E9FDB8AEF6884692B97BA0FF59341F0401BFD409C71D2DB39A844C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F155F5 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc06b79b9394779565da32c8728415b66284524d48845f8dba2c49e477ffd0b
Instruction ID: 97c3a7f37900279cb35f2855c06df6985d627f2f6f154214a86910d4bda56dc0
Opcode Fuzzy Hash: 6fc06b79b9394779565da32c8728415b66284524d48845f8dba2c49e477ffd0b
Instruction Fuzzy Hash: 4C11E371D0DA899FEB59EB2494AA2B87BE0FF19340F0944FED00DC65D2EF296840C785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F17825 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a64a85bdec01cc6e61c01882d0e191bffdbaa783dd885aedd6c242a3a73cb52
Instruction ID: 5362f5e468980e306f9c9f4ab3a381e4493582c82ef8e85ee792dc0ff16e6ad8
Opcode Fuzzy Hash: 8a64a85bdec01cc6e61c01882d0e191bffdbaa783dd885aedd6c242a3a73cb52
Instruction Fuzzy Hash: A311E331D0DA8A8FEB59EF2488A92B97BA0FF59350F2500BEC40DC25D6DF385844C755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F15969 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a910faff0351cd403045712eb7c8d149dd239c5fd61f497ef2db1d55c915e9
Instruction ID: cd733d62f5a79bad6b4eb38ae592372ee3041583d31f278029644275819428a1
Opcode Fuzzy Hash: 21a910faff0351cd403045712eb7c8d149dd239c5fd61f497ef2db1d55c915e9
Instruction Fuzzy Hash: 52118B3080D68E9FEB49EB2488596B97BF0FF19351F4404BBD40DC61D2EB38A944C742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F17E21 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e82b752336c4fdbba084f1d8d4e93b2471086d6e2a4004b8c4a7d4bd2c892b5
Instruction ID: 7bba74509150bdbe0b2d19843f9e6f8c2023332d4a8138855693ec5e62f2ffe7
Opcode Fuzzy Hash: 3e82b752336c4fdbba084f1d8d4e93b2471086d6e2a4004b8c4a7d4bd2c892b5
Instruction Fuzzy Hash: 50115E3094D94A9FE741FB74C8486AA7BE4FF19341F0404B6D41DC71A5EB38A944C754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F00F30 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f61f62756caaed2ae7c8bc38db62e7fd73a65f6696756a5c9c1cb935ece93c77
Instruction ID: af186959af890a5d327c49df296960b3e202be77199cd3b2a1ae6f43f8b0e918
Opcode Fuzzy Hash: f61f62756caaed2ae7c8bc38db62e7fd73a65f6696756a5c9c1cb935ece93c77
Instruction Fuzzy Hash: EB118E3090D90A8EEB54FB58C844BEEB7B1FB94345F104275C40AD7286DF38A9818B84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F16A09 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29f3b8217bffcf18ca3569eaa0b180d179e423e7930723e175c668bc1c465188
Instruction ID: 53a1af93e9ed4dabcd4195404f0d35ae6a3fcd15a0f50c348b537aa263454095
Opcode Fuzzy Hash: 29f3b8217bffcf18ca3569eaa0b180d179e423e7930723e175c668bc1c465188
Instruction Fuzzy Hash: 6A11A030D0D68A9FEB81FB3888592BA7BF0FF1A341F0545B6D408C71A2EF38A9448755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F178BD Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adf223c07e32f71e11ca384973ab1db58f30fcf18e234c8686df6e6ee75b115a
Instruction ID: b4e069581fef94bbd80c63f868d9250172835ce9f1b92c360f745eafce808321
Opcode Fuzzy Hash: adf223c07e32f71e11ca384973ab1db58f30fcf18e234c8686df6e6ee75b115a
Instruction Fuzzy Hash: 7A11BF3080DA8E8FEB99FF2484592B97BA0FF59340F5401BAD40DC21D6DB39A844C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F034B5 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c285958e4282201adc174ebb31bd39f326aaac2adbbbe7afff3c237feb5eb682
Instruction ID: f5c441d413caec7017d8c18d70515eb61e432dd3e005c39e95b0ea080b344f32
Opcode Fuzzy Hash: c285958e4282201adc174ebb31bd39f326aaac2adbbbe7afff3c237feb5eb682
Instruction Fuzzy Hash: 3D11707091C68E8FDB96EF6884591BDBBA0FF1A341F4404BED41ACA1D2EF35A550C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F158DD Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e87bb389bb11a28c10001070b0e62cf9697c2c56e1b541f58831127f76a22e9c
Instruction ID: 68eb64bea38048d0f4d9c33da676a895298b17e7f1227f6cb156ca931e23d494
Opcode Fuzzy Hash: e87bb389bb11a28c10001070b0e62cf9697c2c56e1b541f58831127f76a22e9c
Instruction Fuzzy Hash: DE119A3080D68E9FEB48EB2488596BA7BE0FF28351F4404BAD41EC61D2DF39A944C742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1571D Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d00fd17bbbbc44a2c7f60a58956bda74cf084b41dea6c0154b59174bb7643c1
Instruction ID: 8f9427de37bd32b5ac3bc0a144e6f6e9c0be0a611beb640ccbe40ac7bae71457
Opcode Fuzzy Hash: 4d00fd17bbbbc44a2c7f60a58956bda74cf084b41dea6c0154b59174bb7643c1
Instruction Fuzzy Hash: 5F116A30C0D64E9FEB59EB24886A6BA7BA0FF18341F0404BED40AD65D2DB39A940C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F13281 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b01fe37b92e64d2c6ff070fb603488fb2a1ec3dea3d287c5b3a95bc2b17c5f54
Instruction ID: b8a9aa8059482a7ce16aae22594493846794d5c4143a72c80e1f64d462bbf14e
Opcode Fuzzy Hash: b01fe37b92e64d2c6ff070fb603488fb2a1ec3dea3d287c5b3a95bc2b17c5f54
Instruction Fuzzy Hash: 0311C03090D68E9FEB82FB68844C6F9BBE0FF1A341F0404B6D448C7096EB38A5448714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0C8E9 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F0B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F0B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f0b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02d15dc61fc7deb4d6811c6a2b6a5f30e2b61aa8b3d1e9646798d552cc4793a6
Instruction ID: 5ed5dcec21e579091bf8697f6ed4d4dff4fbccd127b1143321afbf2faed1ca4e
Opcode Fuzzy Hash: 02d15dc61fc7deb4d6811c6a2b6a5f30e2b61aa8b3d1e9646798d552cc4793a6
Instruction Fuzzy Hash: 54117C7090DA8D8FEB49EB6888696BA7FE0FF1A301F1505BAD40AC71D2FB35A540C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0C465 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F0B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F0B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f0b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd566314f3336b65ea63fdb7eca3fb7eea532219d4762fa38d245df6148cb218
Instruction ID: 2467be4df46b3672989388a480163a99e3858504337758ad8f43bd41e4837940
Opcode Fuzzy Hash: cd566314f3336b65ea63fdb7eca3fb7eea532219d4762fa38d245df6148cb218
Instruction Fuzzy Hash: EC115E34909A4E8FEB95FB64C4696B9BBE0FF19301F5504BAD409C71D1FB35A550C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0DE8D Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F0B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F0B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f0b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e62df5f405739141a7a8324b8e55bcbb99487472c5c19e9526feac82bf1faf6
Instruction ID: 9d0e137eb1e20bb8095c600f40979fec1b804599155ba2bcd3dd724d190d9865
Opcode Fuzzy Hash: 9e62df5f405739141a7a8324b8e55bcbb99487472c5c19e9526feac82bf1faf6
Instruction Fuzzy Hash: F9118E3091DA4E8FEB85FF2484592B9BBE0FF2A345F4005BAD419C61D2EB74A550C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F02E91 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96590535f6b9f01264e765f1f4083be351883287379b2e1870e7b4aadfc20a55
Instruction ID: 9261bd2a3a4f76df8e29fb919b68c3c935b4ec8eddd0509af28674e8b60a3869
Opcode Fuzzy Hash: 96590535f6b9f01264e765f1f4083be351883287379b2e1870e7b4aadfc20a55
Instruction Fuzzy Hash: 11017C3095D64E8FE752FB6488485B97BE0EF1A341F0504B6D40CC70E2FB34E5848724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0B77D Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F0B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F0B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f0b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d906e10a761628f9fba6b21945b30b9b9e5a48f289b28aee5965b9012d22071c
Instruction ID: 040982703d69369e3f503f0964b037a06becb59b1117a890cf6d159f8b195b17
Opcode Fuzzy Hash: d906e10a761628f9fba6b21945b30b9b9e5a48f289b28aee5965b9012d22071c
Instruction Fuzzy Hash: 7201C031D2D54B9EEB51BB6898191FE7BA0FF4A384F4405BAD85CC60C3FF2865008345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F005D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f061a4db89343b3f053888639cb90a111fefcd84cfa21988034a4592f64a207
Instruction ID: a0b4fd5f306f5e1001379073faa5724a8b8559bbcce77af1ed5b0bebb9809f05
Opcode Fuzzy Hash: 4f061a4db89343b3f053888639cb90a111fefcd84cfa21988034a4592f64a207
Instruction Fuzzy Hash: B8019E3090990E8FEB49EF24C4596BAB7E1FF59345F50447EE40EC21C0EB31A590CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F18609 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1157cc5a7bd636b0a24308c111ff7ccf30c4280e2b0fbbc934756f1cf6f0f6dc
Instruction ID: bf89e8cda6609e8594747fad18fe77b29848c4357602e3a7be83896f53696692
Opcode Fuzzy Hash: 1157cc5a7bd636b0a24308c111ff7ccf30c4280e2b0fbbc934756f1cf6f0f6dc
Instruction Fuzzy Hash: 9401923081D6898FDB4AEF2485692BD7BA0EF15340F4504FED419C70D2EB25A950CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F12CB5 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ace9a1f1edd091151f4e667c8f3ab7559b8408de1097b56c6fa5d2538eb5b05
Instruction ID: 03e6606332c7f10bf1d4206a60cf58c37f3528043031bdd13c3d9db4709d90b3
Opcode Fuzzy Hash: 9ace9a1f1edd091151f4e667c8f3ab7559b8408de1097b56c6fa5d2538eb5b05
Instruction Fuzzy Hash: B401DF3090D68A8FDB59EFA4C4A92B97BA0FF59350F0104BED80AC70D2EF79A950C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0286D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9e27fec99956bb624f741361d1b577dbbd45cbc1b113803e3784c224ae78af1
Instruction ID: b4ebd59e7650f3385217827f39e60cbf684e3265192f7ff3eca57f91a5ef5dd9
Opcode Fuzzy Hash: a9e27fec99956bb624f741361d1b577dbbd45cbc1b113803e3784c224ae78af1
Instruction Fuzzy Hash: 62017C3480D64E8FE752FB6484585B9BBE0FF5A341F5505B7D408C6092EF38E0848724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0B319 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F0B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F0B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f0b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d90b7a3d8414ce9cfd8308633ed9423986c38edd95466b0e3e0039c4a5b1fa58
Instruction ID: f7b8346b169e09a228696f2cfd6418e19493fcabf87a1a78c85de4dcc2236f49
Opcode Fuzzy Hash: d90b7a3d8414ce9cfd8308633ed9423986c38edd95466b0e3e0039c4a5b1fa58
Instruction Fuzzy Hash: 1601783085D6899FEB52BB7888592A97FE0EF5A340F1948B6D008C70E2EB28A4448711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F02F09 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5562fa2b7476ff286ed666a33ce3987eb5e47b134c83947daf156c48d6730e39
Instruction ID: 720b672d765c67b2c95442074e89400d01351b9b76e6a0f759ad74e12aac8a18
Opcode Fuzzy Hash: 5562fa2b7476ff286ed666a33ce3987eb5e47b134c83947daf156c48d6730e39
Instruction Fuzzy Hash: 40017C3191D6899FE742BBB488591A97BE0EF5A381F4605F6D408CB1E6EB38A4448721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1867D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11a457e224d88e3ad4bbce6b1a465e28f5e08baebe9ef4f6918a57ad0b04bba
Instruction ID: 711a50d3f338ef2a6591080cb3a9e03440ca44f9aeec239ecd25868e7fe8c287
Opcode Fuzzy Hash: c11a457e224d88e3ad4bbce6b1a465e28f5e08baebe9ef4f6918a57ad0b04bba
Instruction Fuzzy Hash: 1B01BC3091D6898FDB89EB24C5692BA7BA0FF19344F8504BED41AC60D2EB35A950CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F17FA9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1bee3cb8456224a96d1ebf250746df66526774e1ef7125ae8329bb763f5188f
Instruction ID: 4067ec49e2796b82452917628fb0b3813048ca67026095df451104beea506e15
Opcode Fuzzy Hash: e1bee3cb8456224a96d1ebf250746df66526774e1ef7125ae8329bb763f5188f
Instruction Fuzzy Hash: 27018F3195DA8E5FE742FB34885D6AA7BE0EF59340F0549F6D408CB0E6EF28A8448751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F01CAD Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dad74d0e14e8da950a214d53c280de202ad30cad2975c374be1dc2837465d42
Instruction ID: f6843e6621333d905ef31be196aa4537911cddaa7b76748d64b323b044883376
Opcode Fuzzy Hash: 9dad74d0e14e8da950a214d53c280de202ad30cad2975c374be1dc2837465d42
Instruction Fuzzy Hash: A601D130C0D68D8FEB99EF2488592FA7BA1FF56301F4040BAE808C21C1EB75D490C744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F00610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99f0a61871963d0fef58b8deaeaa0becd2bacb5f289c4775933e5fe4055b32d9
Instruction ID: 6100a92be2d86c28b01a3a21fe1c19474416088420b8a821230e3ccbcd82b0c5
Opcode Fuzzy Hash: 99f0a61871963d0fef58b8deaeaa0becd2bacb5f289c4775933e5fe4055b32d9
Instruction Fuzzy Hash: 1A016934819A0E9FEB4AEF6484592B9B7E4FF19345F60087EE80EC21D1EF36A594C614

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F00608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9ea78beca4227d6886870faafcce6dea7379287e39e558bcc820addb1e5839f
Instruction ID: 374ef840ef8e455a0ab9664765f5762fbc64514f7e059a1cee220cdd772c1636
Opcode Fuzzy Hash: c9ea78beca4227d6886870faafcce6dea7379287e39e558bcc820addb1e5839f
Instruction Fuzzy Hash: 0101813091850D9EEB4AFF64C4582BA77A1FF19345F50087ED40ED21D2EF35A590C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F005D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f086280f5727811e0a85dd6c9472a0f523eb4a3de376ce128e51a8077c7384
Instruction ID: 31e8eb37aa3208dccc8ded6d8f687788f4f0c0da7e5fe24801c4a6668998f128
Opcode Fuzzy Hash: e3f086280f5727811e0a85dd6c9472a0f523eb4a3de376ce128e51a8077c7384
Instruction Fuzzy Hash: 9EF0C23081E64E8FEB45EF2498052FA77E4FF16349F40447AE80DC21C1EB35A490CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F023FB Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 708cfaa410fd1ec97ef51abff87d77e01427f3ed0b15ca408bed6065b368c452
Instruction ID: 9cf41c321c676ab1216cd302eceeeff17a8491f5d7f9a1d94610006a9592acd0
Opcode Fuzzy Hash: 708cfaa410fd1ec97ef51abff87d77e01427f3ed0b15ca408bed6065b368c452
Instruction Fuzzy Hash: 7911B371D085298EEB68EF60C855BE9B2B1FB51345F0001AAD40EA62D2EB782A84CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F12A05 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32e35b6ae809a556cb9017b9155e006a31592a5f4059210414413734b073473e
Instruction ID: 9b2c3cb19d08861c5af6e99f1515d5d1ec4e12e16e28ce6b54eb08ce51daa78a
Opcode Fuzzy Hash: 32e35b6ae809a556cb9017b9155e006a31592a5f4059210414413734b073473e
Instruction Fuzzy Hash: 53F04432D1D50E8EEF08EBD895956FDB3A2FB49350F50143AC00A97682DB386911AA84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F02789 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7a7be57c4fc53c0bc2edc652789313f718c5e53c3620e392616b10d169d61e0
Instruction ID: 87ad4205179a87d0275d349e91d6069de003b6afd6b696810ab9ff3b17bc05ff
Opcode Fuzzy Hash: a7a7be57c4fc53c0bc2edc652789313f718c5e53c3620e392616b10d169d61e0
Instruction Fuzzy Hash: 21F0C23180E78A8FEB5AAF3488182A93B61FF16341F4504BED409C60D3EB38A444C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F027FD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90625838858aed73b9780ce16adb9ac6e9b5e049ebd45e29c1f02bbbdc70b4b0
Instruction ID: 9945d26470bcc9ea59d878a4c0dd8f29cc01a06eca812b5f15bb6d441ef8a965
Opcode Fuzzy Hash: 90625838858aed73b9780ce16adb9ac6e9b5e049ebd45e29c1f02bbbdc70b4b0
Instruction Fuzzy Hash: 20F0907480E6898FEB5AAF6488A91B97BE0FF56241F5404BFD809C51D2EB399454C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1246A Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e13da2be6769433977b6923a37a805f6c94bbcfc39cccd5e75f948d14020768
Instruction ID: 3d770e63fbcc876f4f01f44d67236ea84c8feb2044c8b516cb44a3089ededfc6
Opcode Fuzzy Hash: 5e13da2be6769433977b6923a37a805f6c94bbcfc39cccd5e75f948d14020768
Instruction Fuzzy Hash: 7BE0E271C0C34A8EEB24EF90C4443FDBAB0AF00381F10103690096B2D1CBB92A84DB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1367D Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d458aae0aef93ddb01d104f4523cd5693e7a85a590e848667d2edc490a4168ac
Instruction ID: 1ee1e29f91dc82e442adcceb21601d38fd0ed61ec2959125b28e9c0c909ac396
Opcode Fuzzy Hash: d458aae0aef93ddb01d104f4523cd5693e7a85a590e848667d2edc490a4168ac
Instruction Fuzzy Hash: 35D04274D0D5098EEB64FBA884562ACBAA1AF45344F60017AD449A31C2EF3868518B15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F011B6 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f00000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 455f056184316a41b4b9beb1bfd79aa2487955c1a3eb9b535dde6bce44315c3a
Instruction ID: 5dfa2e5d0f8e879ace855f189672cdacad62f64d5256a5165ca6fa045e24d759
Opcode Fuzzy Hash: 455f056184316a41b4b9beb1bfd79aa2487955c1a3eb9b535dde6bce44315c3a
Instruction Fuzzy Hash: 15C01230C1661E8EDB40EB50A8010FEB270FB85204F801022E81CA30C2EF3825108688

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0BB7F Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F0B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F0B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f0b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 719a1e281cd2d9253d6732928ef8945a7aa902de5c23b4c63516e45218efa30d
Instruction ID: 12764eba49ebef6a0e03a3149b91782996c562be6cdf20db926a3fa001a6de61
Opcode Fuzzy Hash: 719a1e281cd2d9253d6732928ef8945a7aa902de5c23b4c63516e45218efa30d
Instruction Fuzzy Hash: 0FD0C930C2D41E8EDB56FB14C441AEAB775FF69340F1046B1841DD2186DF78AAC08F84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1236D Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F12000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f12000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b7e16595a86993ffb08bb6ee94e068a7c7d971b28e495100766f7a8c26d774c
Instruction ID: 7d33313ce6a0bb577b7fe27bde034d60e8361fa380604f80445e0b1e9351bacf
Opcode Fuzzy Hash: 0b7e16595a86993ffb08bb6ee94e068a7c7d971b28e495100766f7a8c26d774c
Instruction Fuzzy Hash: E7C0127580875E8EEB10EFA0C8506FE7BB0EF10340F1020269009AB2C2CA786A04EB80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF848F0F182 Relevance: 5.0, Strings: 4, Instructions: 41COMMON

Download Yara Rule

Strings

k, xrefs: 00007FF848F0F0B6
*, xrefs: 00007FF848F0F09B
^, xrefs: 00007FF848F0F9D3
[, xrefs: 00007FF848F0F196

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F0F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F0F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f0f000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID: *$[$^$k
API String ID: 0-1202021107
Opcode ID: d45b23fcbac47bf73f15d1e701022ec690aa0358cdfd9615b1292719b59082f7
Instruction ID: bce80222433c262c0d5344682b0820e11a11908d78d5e87f0c8a42547e3a9c31
Opcode Fuzzy Hash: d45b23fcbac47bf73f15d1e701022ec690aa0358cdfd9615b1292719b59082f7
Instruction Fuzzy Hash: 8B11E570D0C62ACFEB68EF04C8847E9B7B1EB55341F1041F9D419962D0EB796A84CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F0F318 Relevance: 5.0, Strings: 4, Instructions: 35COMMON

Download Yara Rule

Strings

H, xrefs: 00007FF848F0F372
k, xrefs: 00007FF848F0F0B6
5, xrefs: 00007FF848F0F31C
", xrefs: 00007FF848F0F362

Memory Dump Source

Source File: 0000001C.00000002.2196327475.00007FF848F0F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F0F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff848f0f000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID: "$5$H$k
API String ID: 0-1256405626
Opcode ID: f97adf3c0343b478e9bcfbd9c97bebe8d71f094acad07336634dd5319c8c7562
Instruction ID: 432f9fc6f583b81dcace0573d31d56a52d3d95d4bb4688f166c01a69370a0aa2
Opcode Fuzzy Hash: f97adf3c0343b478e9bcfbd9c97bebe8d71f094acad07336634dd5319c8c7562
Instruction Fuzzy Hash: 44011675D09329CEEB28EF10C8807E9B7B1FB59351F1081EAD44A962D0DB389A84CF45

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: uPlspWkqijAQ.exePID: 6552, Parent PID: 1068COMMON

Executed Functions

Function 00007FF848F4F8AF Relevance: 6.3, Strings: 5, Instructions: 85COMMON

Download Yara Rule

Strings

k, xrefs: 00007FF848F4F0B6
I, xrefs: 00007FF848F4F8B8
^, xrefs: 00007FF848F4F9D3
], xrefs: 00007FF848F4F99E
V, xrefs: 00007FF848F4F936

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F4F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f4f000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID: I$V$]$^$k
API String ID: 0-2537897772
Opcode ID: 30a997011f3e29c91c4521fa3f7d755e8d85d348abe81597821d97deff2a9d7e
Instruction ID: 52d393b6eee9653c570dd21295a68024b807525b45d473439aa1e13e2ba443d9
Opcode Fuzzy Hash: 30a997011f3e29c91c4521fa3f7d755e8d85d348abe81597821d97deff2a9d7e
Instruction Fuzzy Hash: 1E31E270D0862D8FDBA8EF18C8947E9B7B1EB64741F0041EAD40EA7291DB386E84DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4F0A8 Relevance: 5.1, Strings: 4, Instructions: 82COMMON

Download Yara Rule

Strings

}, xrefs: 00007FF848F4F4FA
k, xrefs: 00007FF848F4F0B6
i, xrefs: 00007FF848F4F3A5
d, xrefs: 00007FF848F4F535

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F4F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f4f000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID: d$i$k$}
API String ID: 0-1577325851
Opcode ID: 234ae109435d6ad56b397c942fa2be2fea1f5182e0acaa0809fc44382a5d89ed
Instruction ID: fed8b10a7d9089894cb5f3a03a7e14663d21b794e7bdc9357b57ae71637f2fac
Opcode Fuzzy Hash: 234ae109435d6ad56b397c942fa2be2fea1f5182e0acaa0809fc44382a5d89ed
Instruction Fuzzy Hash: F841B070D096298FEB64EF18C8887EDB7B1FB64741F1041EAD40DA3292DB386A81DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4F3DF Relevance: 2.5, Strings: 2, Instructions: 48COMMON

Download Yara Rule

Strings

i, xrefs: 00007FF848F4F3A5
:, xrefs: 00007FF848F4F43B

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F4F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f4f000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID: :$i
API String ID: 0-322666766
Opcode ID: 51538353381afca9f388be10333f7a8c9b31be3e4ebd4b7febb180e97aa5ad49
Instruction ID: 16daaccc306e3639f1a7beaa26fd2458eb82cdd078722ec3997df09077d58ee8
Opcode Fuzzy Hash: 51538353381afca9f388be10333f7a8c9b31be3e4ebd4b7febb180e97aa5ad49
Instruction Fuzzy Hash: 2A119C70D0C66E8FEBA4EF14C8947B9B7B5EF64741F0001FA940DA2692DB746A84DF04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F41150 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

hyH, xrefs: 00007FF848F411AD

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID: hyH
API String ID: 0-3369426750
Opcode ID: 36c31f9d13ceb8ee02372555f6bcd3264f0e3a611d5fa4772c4b4b7eb5a1f230
Instruction ID: f84f6cdef8ecd5d1c9a6597e154b55a231d469f4b17eb851df6511c08b8879e4
Opcode Fuzzy Hash: 36c31f9d13ceb8ee02372555f6bcd3264f0e3a611d5fa4772c4b4b7eb5a1f230
Instruction Fuzzy Hash: DB318D30D1CA6E4EEB98EB64C4696BA77E0FF69741F00057BD00AE21C2EF296584C754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F40A01 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

0vH, xrefs: 00007FF848F40A70

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID: 0vH
API String ID: 0-2857910901
Opcode ID: 5248eb619807e01b2bcd4d2af1d52f27ac3f509b7928d6972610be59514e0e7e
Instruction ID: 3cb7438caf59037206045f3a762ae5fd0b4b9e95e7e9c4b697b121a7f2358fbb
Opcode Fuzzy Hash: 5248eb619807e01b2bcd4d2af1d52f27ac3f509b7928d6972610be59514e0e7e
Instruction Fuzzy Hash: F4115B3191894E9FE781FB68C8491BA7BE1FFA8790F4005B6D818E6192EF78A5448740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F53D58 Relevance: .5, Instructions: 463COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd05b7d0aac5042500bb0599b8c767b53cb20d98c4d2c4d314fb7212830230bb
Instruction ID: 2372613ec107cb4876d6cb7f865aad41b629e9905d490408532246a805d20b78
Opcode Fuzzy Hash: dd05b7d0aac5042500bb0599b8c767b53cb20d98c4d2c4d314fb7212830230bb
Instruction Fuzzy Hash: C3218E7180E6D99FE342EB7888591A9BFF0BF16340F0905FBC048CB0D3DA28A5488352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F545B5 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3256e924bbae6e0f82122768eef46c0daa8843cc33edadba9d7224d6e9522680
Instruction ID: 940572f034b5daabd22a78809be4ee6f9b2e7114704e1cc44751b852fe4694d3
Opcode Fuzzy Hash: 3256e924bbae6e0f82122768eef46c0daa8843cc33edadba9d7224d6e9522680
Instruction Fuzzy Hash: F8C195B0D1862D8FEB95EB68C8957EDB7B1FB68341F1041AAD00DE3292DF7469848F44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F416A8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d569fe86d81129f6edb94993e72d61bda6e323bffeac8e4f48025c002a16e395
Instruction ID: 6c1ea7851268817209c5a785c263277944875b9f3c611261bff2a523375310c3
Opcode Fuzzy Hash: d569fe86d81129f6edb94993e72d61bda6e323bffeac8e4f48025c002a16e395
Instruction Fuzzy Hash: D981AE31A0CA5A8FDB98EF1898555B977E2FFA8B50F14057AD44ED32C2CF34AC428785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F435BE Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 590eb0ea71ef316df15505e75ee59d39ddf8d3f04d5d483204f7608dcee4ee2a
Instruction ID: c5c267a7a36849bd4f19665eb52b4f112c28e2b6add1c286d8c895aedef52f9b
Opcode Fuzzy Hash: 590eb0ea71ef316df15505e75ee59d39ddf8d3f04d5d483204f7608dcee4ee2a
Instruction Fuzzy Hash: D771BB71E1D90E8FE785EB6CD8557ADBBF1FB99350F50027AC009E32CADBA818018B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F41D2D Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475960a1b6d137527c43795050bcbd12437273c4816ad806d96089fc489761d6
Instruction ID: 45545501d2ceb36583b163691a2f89a411724c47dd53138fdaa338a5922594ba
Opcode Fuzzy Hash: 475960a1b6d137527c43795050bcbd12437273c4816ad806d96089fc489761d6
Instruction Fuzzy Hash: 6151B031A1CA9A8FDB48EF1888545BA77E2FFA8740F14457ED44AD7282DF34E842C785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F533CD Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e036bec8fb30b83a8689a9db5b0e9feb26318d9703ec15afa3e6e888b885733
Instruction ID: bd1b33d9e1eee7bab4b96bee9b956f75a58b194640952512c2304cce1664fd3b
Opcode Fuzzy Hash: 5e036bec8fb30b83a8689a9db5b0e9feb26318d9703ec15afa3e6e888b885733
Instruction Fuzzy Hash: 0971D170D19A1D9FEB94EB58C859BEDB7B1FF68340F5041AAC00DE3292DF3469858B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F53301 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f06d4d534d958ecaa26d1e7b796a24bfefbec9ca143d75aa88a70fcdb65d710
Instruction ID: 8462a1823d161b85a2376af7ca3e5f3e76b955b6580cb49a449890f716e17279
Opcode Fuzzy Hash: 4f06d4d534d958ecaa26d1e7b796a24bfefbec9ca143d75aa88a70fcdb65d710
Instruction Fuzzy Hash: A861E370D09A1D9EEB94EB68C8597ADB6F1FF59340F4041BAD00DE7292DF34A984CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F43191 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a113bb832aa21dd9060631331061db5795740a50b591291399dc2c639d97bb02
Instruction ID: 3cac85c9dbd78e3922bb21c2281b51c72076b7c15bc363a4537396c3905771b2
Opcode Fuzzy Hash: a113bb832aa21dd9060631331061db5795740a50b591291399dc2c639d97bb02
Instruction Fuzzy Hash: CA512630D0861E8FEB54EB98C499AEDBBB1FF68751F10003AD00AE72D1DB386944CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F42145 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed94d9b351d34759731f2fec6f40a297e3b26b6cbc5b9144066ffe922d6f6be
Instruction ID: db021c577beca42de65556c6eb6b36d3f2fb9e29b796ca3fa864eaa6ffd5dff3
Opcode Fuzzy Hash: eed94d9b351d34759731f2fec6f40a297e3b26b6cbc5b9144066ffe922d6f6be
Instruction Fuzzy Hash: CD415A31E1DA4A4FE346EB7898451B8BBE0EF96790F0500BBD00DD71D2DF28A9418365

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4D0FB Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f4b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: decbf975b5d5e773a83496279355da682b88e243aa316127e0a400d0ac2cc580
Instruction ID: 0951aca5ec569316387567837f0240523590dd568e7dace45a20a2b55fc3e482
Opcode Fuzzy Hash: decbf975b5d5e773a83496279355da682b88e243aa316127e0a400d0ac2cc580
Instruction Fuzzy Hash: F241B43290E55AAEFB45BBA8B4450FD7760FFA17B9F041277D90D990C3EF2C644182A8

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F5289D Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9a13b74dc31f017708930b6550f8b8c22b0de5ae3aff54e4181e0aec5fc94b6
Instruction ID: dd1653c044d01cc006d64d1f95038ac74837a33e1e74290dacfe829cfce2eb62
Opcode Fuzzy Hash: b9a13b74dc31f017708930b6550f8b8c22b0de5ae3aff54e4181e0aec5fc94b6
Instruction Fuzzy Hash: CD413071E0D64E8FEB58EFA4C4546FDB7A1EF59340F10067AD00AE7286DF38A9808B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4D0C0 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f4b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46dbe8ffa27e76a7bba58ba0d4c6b6292b783e2cc60a6d7abdb30ece82bf1ffd
Instruction ID: 03525656f441c9a53d80af159d865aaf4795bd4fb51ba62c1461726dd364bb43
Opcode Fuzzy Hash: 46dbe8ffa27e76a7bba58ba0d4c6b6292b783e2cc60a6d7abdb30ece82bf1ffd
Instruction Fuzzy Hash: 9541C53291E55A6EFB45BBA8A4440FD7760FFA17A9F040677D40EDA0C3DF2C644182A8

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4CA48 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f4b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a9e4e50299af9233ea7cb1a4adcae2df7006939e7bc023972d606f382cae434
Instruction ID: ded99808265ae141e0b4fc8b81b332463a3b7ac34731828326f4dfa2efa7e50c
Opcode Fuzzy Hash: 5a9e4e50299af9233ea7cb1a4adcae2df7006939e7bc023972d606f382cae434
Instruction Fuzzy Hash: 6731B234E1C91D8EEB98FBA89855ABCB7B1FF68740F50116AD00DE3282EE3468418B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4BAB2 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f4b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80908ea488ded600646ab91c0e5017e55518688c47c43e870af2880163092bf1
Instruction ID: 25241d47c5e9a05fd0a45276779b900410cee626cc5e8b6b94b41001337697a7
Opcode Fuzzy Hash: 80908ea488ded600646ab91c0e5017e55518688c47c43e870af2880163092bf1
Instruction Fuzzy Hash: E8313970D1851A8EEB98EBA4C8553FDBAF1EF68751F1041BAC00DE22D2DF381A848B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F544FB Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 636d57255f55970b318eb4a7c7b3dfa1dfd42f2f43d29765a1486f4bac63fa65
Instruction ID: 24ffc2a23f5163189ae0063f1bde3c0b6a0680b60e6d765687eb4e5755ab41bb
Opcode Fuzzy Hash: 636d57255f55970b318eb4a7c7b3dfa1dfd42f2f43d29765a1486f4bac63fa65
Instruction Fuzzy Hash: D721C172D0D6994FE752EB3898591B9BBE0FF6A350F0444B7D448CB093EB2459488715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4338C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 707122941ee08d36fc1b03ee50c61f9c1465781be815d7151da225c23eeed7d9
Instruction ID: 3e6a4a76ac2967cda479b90d2242886bd1434fdd4392a66ed88956225d824799
Opcode Fuzzy Hash: 707122941ee08d36fc1b03ee50c61f9c1465781be815d7151da225c23eeed7d9
Instruction Fuzzy Hash: A221C03184D68A8FE742EB7888585E97FF0EF5B300F0804EBD449C70A2EA28A446C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4B75D Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f4b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a332f3565e33be26ed354fff478d4095b5cefec213b1096932d23ba2f00940c2
Instruction ID: 9c25b27249b81ce72761129bc25ffb4acf549e16aa368f321903983885fa5d78
Opcode Fuzzy Hash: a332f3565e33be26ed354fff478d4095b5cefec213b1096932d23ba2f00940c2
Instruction Fuzzy Hash: 03218931D2D94A9FEB51BBA888191F9BBE0FF69780F1409B7D41DE20D2EF28A5408644

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4084D Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53cb6ad0a98596a284727aa9af6f273d90aa2dddb28aa7c65ea96ff77f0f5327
Instruction ID: 7d8855fc776d3ba88c945197a40f5aefeaa36fa2c45a4750921e5526949408b4
Opcode Fuzzy Hash: 53cb6ad0a98596a284727aa9af6f273d90aa2dddb28aa7c65ea96ff77f0f5327
Instruction Fuzzy Hash: 45110131D0D64A9FF785BB7888495E97BE0FFA5740F1544B7C809D70D3EA28A4448685

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F576E1 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca557b867c610480c8b89cd988e946a8fe14aca7a4aab35a8458c58eae4a071
Instruction ID: a57184c5868bfa80a283c921d081025d69c310f789715b030facf9715b4304b7
Opcode Fuzzy Hash: aca557b867c610480c8b89cd988e946a8fe14aca7a4aab35a8458c58eae4a071
Instruction Fuzzy Hash: 8A11AF3080DA4E9FEB88EF28D4592BABBA0FF68741F0005BAD40DC21D2DB38A444C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F52E21 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50699c4dccd3684316ff2e7d80a159ab1e3bc13063d52a0bb9f40163da81bd99
Instruction ID: 3fda38a305824d3731c50a7cffef2c0af0ab13cad57466a46efd5d248c16cdb7
Opcode Fuzzy Hash: 50699c4dccd3684316ff2e7d80a159ab1e3bc13063d52a0bb9f40163da81bd99
Instruction Fuzzy Hash: CC1179709186498FDB48EF68D4961E9BBE1FF69345F0502BEE84EC2282DB34A550CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F53BF9 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff3b5bc53a5d4f79d20fe9c8ba7a5212ec1359d7392498e9cb0b2030971d8724
Instruction ID: 61f21165356735b92f064ab4937dd177b6b0bb63f4e7e13034a194b9e5a5ae6a
Opcode Fuzzy Hash: ff3b5bc53a5d4f79d20fe9c8ba7a5212ec1359d7392498e9cb0b2030971d8724
Instruction Fuzzy Hash: D821A53180D68A5FE742EB68885D6AABFF0EF5A340F0405F6D448C70A3DA286544C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F57785 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02965fd09920dfd08ebb345cd37060c69f0cfd8b0a4f24ac35e06bac5ffce6c
Instruction ID: d176cfe0c9986aabe1e81b07ff6f88b2d1b455169b956f96fc4c07956737f74c
Opcode Fuzzy Hash: a02965fd09920dfd08ebb345cd37060c69f0cfd8b0a4f24ac35e06bac5ffce6c
Instruction Fuzzy Hash: 5011AF3090EA4E8FEB89EF2894592BEBBA0FF69741F1405BAD419C61D2DB38A440C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F55155 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6bcee18233baf78bde33871ea6290e151f2238e9b87dc7e2a50a64a69c0e405
Instruction ID: 26505daec4b8dd51df479c9fa8cd4822fa9c8403a2aab90b331f864d4b3d5d9c
Opcode Fuzzy Hash: c6bcee18233baf78bde33871ea6290e151f2238e9b87dc7e2a50a64a69c0e405
Instruction Fuzzy Hash: 89117C3090DA8E9FEB89EF6884592BDBBA0FF69341F1405BED409C61D2DB39A584C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F550B9 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7b7c010a4d3c2c25c7d35d9df1bb02ef3097c117b5cfc3c8fd7431a4e8ee1a
Instruction ID: e33c58324fbfa84a4174d0ba49d7f2326e01904cd5838b9583e36ec5b58b34c2
Opcode Fuzzy Hash: cf7b7c010a4d3c2c25c7d35d9df1bb02ef3097c117b5cfc3c8fd7431a4e8ee1a
Instruction Fuzzy Hash: 87215C3090D68A9FEB89EF6888692B9BFA0FF69341F1405BBD409C75D2DB39A444C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F555F5 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438fe57d4e9506e3543d4711d1098613e066370bd377769116130b0ccd19264d
Instruction ID: 230e2995c4333a2a1ceb6dd2a98887f64ce9e08762b42a371ff47be4254817a2
Opcode Fuzzy Hash: 438fe57d4e9506e3543d4711d1098613e066370bd377769116130b0ccd19264d
Instruction Fuzzy Hash: 7511B271D0DAC98FE759EB6494AA2B8BAA0FF19340F0944FEC00DC65D3EB296444C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F57825 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e00660b67a72dcae9df52720e9a616f9a80bb8e49e248bb6bdb436cb4d758b5
Instruction ID: abb264561c4a5137a343aab02c2e735832443d59e5ac54256edadd3cd1914a62
Opcode Fuzzy Hash: 7e00660b67a72dcae9df52720e9a616f9a80bb8e49e248bb6bdb436cb4d758b5
Instruction Fuzzy Hash: 1511C471D0DA8A4FE759EB2488A92B9BBA0FF16341F2400BED419C25D3DB295444C749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F55969 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69477d5d68da4cef27771dae55a52eabbece902f09c6957c9b935d0088cdd225
Instruction ID: 74ec1929c20647d6055fb552a27ee54ca36d9c979a0e9c3357861762217be366
Opcode Fuzzy Hash: 69477d5d68da4cef27771dae55a52eabbece902f09c6957c9b935d0088cdd225
Instruction Fuzzy Hash: 9D11793080D68A8FEB49EB6488692B9BBA0FF19351F0404BBC40DC61D3DB29A584C742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F40F30 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b23ed7af89e55dfc0c73287de884053e302101dcd8d662f84b853a0b40b321
Instruction ID: 99fc41573b3457e1f908ee3ae724b7c172f575ba9c2c35e1c61275dc23c03d86
Opcode Fuzzy Hash: d6b23ed7af89e55dfc0c73287de884053e302101dcd8d662f84b853a0b40b321
Instruction Fuzzy Hash: DA11513190D90D8FEB94FB54D845BAE77B1FB94350F104276C40AE7296CF38A981CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F578BD Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b07d824f5497f3dbde4709d57b1083715dca097eb63ff936f846029aa08f196
Instruction ID: 28891d29cee995b49edd5398906fbe93443213b53eb04415d8353f660198b290
Opcode Fuzzy Hash: 4b07d824f5497f3dbde4709d57b1083715dca097eb63ff936f846029aa08f196
Instruction Fuzzy Hash: EF11BF3180DA4E8FEB89FF2484552B9BBA0FF69341F1400BAD40DC61D3DF29A444C795

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F57E21 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a8207f98b02fed48d2e148d6db1c38c123829a1b25ec56cab8dc45a0a81b7c2
Instruction ID: c61b14f9f29e8ce7932b6ba2c7017593a399d6619109198275a146b8afa0c88a
Opcode Fuzzy Hash: 9a8207f98b02fed48d2e148d6db1c38c123829a1b25ec56cab8dc45a0a81b7c2
Instruction Fuzzy Hash: 6D11653094DA4A9FE741FB74C8486AABBF4FF19341F0504B6D419C70A2DB38A644C755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F56A09 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ffd452690c5f767dd75b729e66602a86b17726d8f9485ed8aea9986e80319de
Instruction ID: 1b7af13d5bc4fb594b66c5b2766dc2a6ca44e08f53f6796d17d35f60ef056be3
Opcode Fuzzy Hash: 1ffd452690c5f767dd75b729e66602a86b17726d8f9485ed8aea9986e80319de
Instruction Fuzzy Hash: 0D11943090D6895FE741FB2488592AABBF0FF19340F0444B6C418C7193DB38A5448715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F53281 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45885e92a5cf292312e02d5e0f817271f61ea4c0c9b617ed8f8a94b79b306c2e
Instruction ID: 9575d4afab7368cc7a09c2b55f350ba1d0af0081e01f25c2c836d2734ab8b63b
Opcode Fuzzy Hash: 45885e92a5cf292312e02d5e0f817271f61ea4c0c9b617ed8f8a94b79b306c2e
Instruction Fuzzy Hash: 8511A13090D94E5EE781FB7C844C5F9BBE0FF1A341F0404B6D408C7096EB34A1548714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F434B5 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27ea3e67614e7e36a51c46735b803eaed07a8723a006671ce7934e528517829
Instruction ID: d59734e56c857495ef43f7c694317d53760560fd675af0fcd91bbe9f6bf7bd74
Opcode Fuzzy Hash: f27ea3e67614e7e36a51c46735b803eaed07a8723a006671ce7934e528517829
Instruction Fuzzy Hash: CC11AC3090C68E8FEB49EF2884596BDBBA0FF28700F0404BFD41AD61E1EB34A450C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F558DD Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c91a631b70e9831577ead7d151b51dc8023666aacd62df41864015b4977417d7
Instruction ID: 0baf389a2a8fdc12c437e6089c730a58bf476d9583589274121c6bedd8b06bb4
Opcode Fuzzy Hash: c91a631b70e9831577ead7d151b51dc8023666aacd62df41864015b4977417d7
Instruction Fuzzy Hash: 25119E3080DA8E8FEB49EB2488596BEBBE0FF18351F0404BAD41DC61D2DF39A544C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F5571D Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7086a0e051d37cd7438310ab08a11850ade6b97a37aedd0524a565b99f3bc64c
Instruction ID: ba149aae9928d26b55fefb0928646b7b7989372d267f7c206d4468fa0749e1c3
Opcode Fuzzy Hash: 7086a0e051d37cd7438310ab08a11850ade6b97a37aedd0524a565b99f3bc64c
Instruction Fuzzy Hash: 98118C3080D68E9FEB59EB2498696BEBBA0FF19341F0404BED40AD71D3DB39A544C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4DE8D Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f4b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afce078c747fbbea05953517288bacec630b367ca176cdba2ac09dca726a0411
Instruction ID: 51e5c63254612733e3694842210eb02533e627941776edce310ce7e145836435
Opcode Fuzzy Hash: afce078c747fbbea05953517288bacec630b367ca176cdba2ac09dca726a0411
Instruction Fuzzy Hash: 5B11793091DA4E9FEB89FF6488982B97BA0FF38741F0004BBD409E61E2EB75A550C744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4C8E9 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f4b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 682944cb541fe65816a7db0040846dc4bc37fcf4e0a76513084cf95ff65d4475
Instruction ID: 9db385b4b6cda6e4bc6d8164d3d2af18372ef39af11238fbe9f406b3597aac36
Opcode Fuzzy Hash: 682944cb541fe65816a7db0040846dc4bc37fcf4e0a76513084cf95ff65d4475
Instruction Fuzzy Hash: 4B11707080D68D9FEB49EB2488592B97FE0FF29701F0515BBD409D61D2EB39A540C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4C465 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f4b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3484fe27a5c309910eb4234123e35fc4c9a713e90f8339aaabb5a1c04a3860f
Instruction ID: a489f18d46104dd64fe577a52ca0660db33fe863ab7c145fe7431f201a69660b
Opcode Fuzzy Hash: d3484fe27a5c309910eb4234123e35fc4c9a713e90f8339aaabb5a1c04a3860f
Instruction Fuzzy Hash: FF118E30909A4D8FEB85FB64C4596B9BBE0FF28301F1105BBD409D31A2EB35A550C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F42E91 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b6a8448d580d3ee218a1baa709c16896fcc5171acaa006be63664e82559929e
Instruction ID: 6a31bfe48cb1a3a8bedee3a1daca73a126eb693050adb5be66de2467f5e8f6dd
Opcode Fuzzy Hash: 3b6a8448d580d3ee218a1baa709c16896fcc5171acaa006be63664e82559929e
Instruction Fuzzy Hash: EA01783091D68E8FE751FBA888886A97BE0EF29741F0508B7D40CD70A2EF38E5848704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4B77D Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f4b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07057fa8c657efd5e4c9fbaa18f67b24d1e68d3a2bde2cf3137c9145dee6ecbb
Instruction ID: ad3c4a8eb9cce490bdfc7a51d70e479433264eef2ff1b07d9b973b050342930f
Opcode Fuzzy Hash: 07057fa8c657efd5e4c9fbaa18f67b24d1e68d3a2bde2cf3137c9145dee6ecbb
Instruction Fuzzy Hash: 8D018B31D2DA4B9EEB51BBA89C151FEBBB0FF59684F04097BD41CA20C2EF2865008644

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F405D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1c0e6ead60f47950bb2bd4ee42ea4a1775f7eec7dba157b89417c6a538c3dcb
Instruction ID: 36af8ecaad6cd511117fa624baaf5dc19f83cff0919b0026d9ad177b7a50d0f7
Opcode Fuzzy Hash: c1c0e6ead60f47950bb2bd4ee42ea4a1775f7eec7dba157b89417c6a538c3dcb
Instruction Fuzzy Hash: A0015E30908A1E9FEB48EF64C4596BAB7A1FF68345F50447ED40EE21D1DB36A590CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F58609 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c067495f2fb5e6f07b51c5ff469e2ec830eb0c588372361c9560bbb396b027
Instruction ID: b685a5818b88a7ca13abe15815f7e6c25ca3379f79beab5d70d8ca23e4bd3e59
Opcode Fuzzy Hash: 20c067495f2fb5e6f07b51c5ff469e2ec830eb0c588372361c9560bbb396b027
Instruction Fuzzy Hash: 4E01803081D6898FDB4AAF2484692BABBA0EF16341F4508BED419C70E3EB25A950DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F52CB5 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38340cc03d70732b2fe4a615fdfc525dbf4c8eef5192bf7d8e07837a80db62c4
Instruction ID: 516e06c4a677a0270fc7f0e94756dc521b70a0ef6266afb3d88b6bb61350353f
Opcode Fuzzy Hash: 38340cc03d70732b2fe4a615fdfc525dbf4c8eef5192bf7d8e07837a80db62c4
Instruction Fuzzy Hash: 7A01DF3090D68A8FDB59EB64C46D2B9BBA0FF19350F0005BED80AC70D7EB79A540C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4286D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5adb3253abe820f43adbdf46863cea5e70a503d86085918856e4d80167d7e2
Instruction ID: 65aba66931ca53822b319646216f7c4fc320a1f49b9ca85bdad53b983644e47a
Opcode Fuzzy Hash: ac5adb3253abe820f43adbdf46863cea5e70a503d86085918856e4d80167d7e2
Instruction Fuzzy Hash: C201787090D64E8FE791FB6888886AD7BE0EF69741F1505B7E408D60A2EF38E0808704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4B319 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f4b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb2ae287e072c60f42a7abb04a5cac2e016aeacc37ea5f56e7bf467df2b8297c
Instruction ID: 8bf007241bddd707a98ec5909d13a62b7aceeda99661961227577d9b5479b007
Opcode Fuzzy Hash: eb2ae287e072c60f42a7abb04a5cac2e016aeacc37ea5f56e7bf467df2b8297c
Instruction Fuzzy Hash: 56017C3091D6899FE752BBB488591B97BE0EF69740F0548B7D008D70E3EA28A4448701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F42F09 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c79446c49e83e671866abb93ce7c228b19e62eb8ca3c214232e17723b46399d4
Instruction ID: f7ca26f5795bebbabd8ee532a8d28b2d76e02d23973fe8ffba5e2b78cbb8ce2d
Opcode Fuzzy Hash: c79446c49e83e671866abb93ce7c228b19e62eb8ca3c214232e17723b46399d4
Instruction Fuzzy Hash: 3901BC3190D2898FE742BB7488591A97BE0EF6A750F8608F7C408DB0E6EB38A484C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F5867D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7a648cf461ecd68d5d4c7c20c05f79e080cd01199b8e3b1463a230afc209e00
Instruction ID: 2a4d9c40737da07b9b1cb3de778574823100a0e0112de5f10bd7b41c397640b0
Opcode Fuzzy Hash: d7a648cf461ecd68d5d4c7c20c05f79e080cd01199b8e3b1463a230afc209e00
Instruction Fuzzy Hash: 6801B13091D6898FDB49EB24C4692BEBBA0FF19345F4508BED41AC60D3EB35A950CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F57FA9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 489f11e8c366995b7589ac9c9a345311ee3f2d5a26ee74f68ac0a7064ec30c54
Instruction ID: 7c9d5b0378f71558c0832f70d53afd0473ab2952f95b68b5298430c8e094f8c4
Opcode Fuzzy Hash: 489f11e8c366995b7589ac9c9a345311ee3f2d5a26ee74f68ac0a7064ec30c54
Instruction Fuzzy Hash: 4C01BC3080EA8E5FE742EB34884C6A9BBE0EF1A340F4508B2D408CB0A3EB28A4448355

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F41CAD Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21d6225968d230dbef48f553f66cfc28118618fe9a476653cef6a179877b05b8
Instruction ID: 4a950fb4b86c16475f0f1fbbf2cb834c3110d962ad9aa5f6911fc00c2a10eec0
Opcode Fuzzy Hash: 21d6225968d230dbef48f553f66cfc28118618fe9a476653cef6a179877b05b8
Instruction Fuzzy Hash: C501DC3080D69E8FEB98EF2488592FA7BA0FF65741F4000BAE808D21C2DB36D490C744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F40608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa6168d2e3c02e2816ca5912620f895021e8b7e94c5ace37a20e1a6913ba2497
Instruction ID: c3ad7cdc03076ea1ff195028cae95ab04ff66b82487bf55d3bc45eff12aab9d5
Opcode Fuzzy Hash: aa6168d2e3c02e2816ca5912620f895021e8b7e94c5ace37a20e1a6913ba2497
Instruction Fuzzy Hash: 9D016930918A0E9EEB48FB64C4582BA76A1FF28745F60087EE40EE21D1DF35A590CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F40610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03b09ca12954135ccd4a2aac70b551309b3dc8d56d62863f1cc53c91af6518f6
Instruction ID: 2376acde085e6912167d74d80d32fc9eeaf851cb85c1023334476e2053f2dd02
Opcode Fuzzy Hash: 03b09ca12954135ccd4a2aac70b551309b3dc8d56d62863f1cc53c91af6518f6
Instruction Fuzzy Hash: ED016930818A0E9FEB48EF6484592BDB7A0FF28345F60087FE80ED21D1EF36A594C604

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F423FB Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 708cfaa410fd1ec97ef51abff87d77e01427f3ed0b15ca408bed6065b368c452
Instruction ID: 0ca23d964820d760e3803ed356c8386083777bdd506a643a5edec7cb62bcf9de
Opcode Fuzzy Hash: 708cfaa410fd1ec97ef51abff87d77e01427f3ed0b15ca408bed6065b368c452
Instruction Fuzzy Hash: 4211B371D085298EEB68EF60C855BE8B2B1FB60751F0001BAD40EA62D2DB782A84CF04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F405D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cc7b1654d368acbc204d3bd7bde2628444aa83cc52f8528949a96eab8a89f35
Instruction ID: ab081bdb47e41f32d33ffaa1c4968dce5fd4da53ff1f02719fbb2b181627a91d
Opcode Fuzzy Hash: 7cc7b1654d368acbc204d3bd7bde2628444aa83cc52f8528949a96eab8a89f35
Instruction Fuzzy Hash: EAF0C23081D65E8FEB44EF2498052FA77A4FF25349F00047AE80DD21C1DB35A490C748

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F52A05 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d0e28bc2731958187c8e64c998e09d5f5a17a3eb04bd9254c3579273de2dbfd
Instruction ID: b259c03a2971576d6550103cf8f2ea1198902aeb7614bb85aa43a50dd1ecc161
Opcode Fuzzy Hash: 7d0e28bc2731958187c8e64c998e09d5f5a17a3eb04bd9254c3579273de2dbfd
Instruction Fuzzy Hash: 2EF04432D1D51A8EEF08EBA495951FDB3A2EF59350F10163AC00A93283CF386911AA44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F55D6B Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69cb2ee8c2ecab48c0c02cc2b5e2ef61dbe209d8fbfbe8b569bba6437b36d55a
Instruction ID: 3f853e4281de9635b4c7a709bc87d7e00857cb634082b9e1019cc808db0da51b
Opcode Fuzzy Hash: 69cb2ee8c2ecab48c0c02cc2b5e2ef61dbe209d8fbfbe8b569bba6437b36d55a
Instruction Fuzzy Hash: CAF0E731D1C91D8EDF94FB6898467ECB7B1FB58340F800166C00DE3286DF3468458B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F42789 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e042db41fad72b30ad84eb8f42d0d67bd6a5ea74daada77ec2b898c36cd4f9
Instruction ID: 33b0d099a63f157b72f97b421f488f01bbd1e55b442fadb2b10f63dd77260819
Opcode Fuzzy Hash: e0e042db41fad72b30ad84eb8f42d0d67bd6a5ea74daada77ec2b898c36cd4f9
Instruction Fuzzy Hash: ADF0CD3180E78A8FEB5AAF3488182A93BA1FF26741F1504BBE409C60D2EB38A444C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F427FD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e394fae5bbb24b74112dddfe7d044ec40d420170e97528de02abef3e22f85d9d
Instruction ID: cd46051c86f3e0c3b4d270792330758a6c4110588c9c8accfcb8560ca5bd9272
Opcode Fuzzy Hash: e394fae5bbb24b74112dddfe7d044ec40d420170e97528de02abef3e22f85d9d
Instruction Fuzzy Hash: FFF0907180E68D8FEB59AF6488591BD7BA0FF25241F5504BFD809C51D2EB399454C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F5246A Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e2ea40da15c94901b1db95feb5a4aa0336a6375e6bf6908dce976703cf05e88
Instruction ID: 95f75c3b22c937ad53387c8043f6599d60463f8b938f60781c1576b7522ddbf0
Opcode Fuzzy Hash: 4e2ea40da15c94901b1db95feb5a4aa0336a6375e6bf6908dce976703cf05e88
Instruction Fuzzy Hash: DEE0E279C0C38A8EEB25EF90C4443FDBAB0AF00385F10003690096B2E2CBB82A84DB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F5367D Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d458aae0aef93ddb01d104f4523cd5693e7a85a590e848667d2edc490a4168ac
Instruction ID: b1b60970465add62a668be740e080fa9a498a22a2efe070faf1297e1827a30f0
Opcode Fuzzy Hash: d458aae0aef93ddb01d104f4523cd5693e7a85a590e848667d2edc490a4168ac
Instruction Fuzzy Hash: 96D04270D0D5099EEB60FBA8C4562ACBAA1AF54744F60007AD00DB32D3DF3868518B15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F411B6 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f40000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02547457d6674f1df1f7e1e828613abb61688a4942a83ef5fddad5a47bf4481
Instruction ID: 46f531f9da52c4328e9e5d337f21d7158f73b39826e05e064d1267d9c256fae7
Opcode Fuzzy Hash: b02547457d6674f1df1f7e1e828613abb61688a4942a83ef5fddad5a47bf4481
Instruction Fuzzy Hash: 75C01230C1661E8EDB80EB50A8010FEB270FB84200F801022E81DA20C2EF3825108688

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4BB7F Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F4B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f4b000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9a023122b0bbdeeb64b408706279ee1816212e44f1dfe2796f882ae0461ff7d
Instruction ID: 76e0df3e6575684e4c4ebf4ba28b72d0a58b42fc509a31d25bd943715a4adcc1
Opcode Fuzzy Hash: a9a023122b0bbdeeb64b408706279ee1816212e44f1dfe2796f882ae0461ff7d
Instruction Fuzzy Hash: 2FD09230C2D41E8EDB55FB54C841AE9B671FB28340F1046B2851DE2186CFB8AAC08B84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F5236D Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f52000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83eef312977ca4709834f9ff416045d66eabab96dbd22dd70cef8f15a2a824e7
Instruction ID: 575c375382547ac2ccd958170ac72eccea4288e8536e095976b50660d6c27a02
Opcode Fuzzy Hash: 83eef312977ca4709834f9ff416045d66eabab96dbd22dd70cef8f15a2a824e7
Instruction Fuzzy Hash: CCC0127980879E8EEB10EFA0C8506FEBBB0EF10340F1010269009AB2C2CA786604EB40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF848F4F182 Relevance: 5.0, Strings: 4, Instructions: 41COMMON

Download Yara Rule

Strings

k, xrefs: 00007FF848F4F0B6
*, xrefs: 00007FF848F4F09B
[, xrefs: 00007FF848F4F196
^, xrefs: 00007FF848F4F9D3

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F4F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f4f000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID: *$[$^$k
API String ID: 0-1202021107
Opcode ID: d45b23fcbac47bf73f15d1e701022ec690aa0358cdfd9615b1292719b59082f7
Instruction ID: 130e77935ce56d9aa6e9fa186911cfc0f2d42be3679d99751af225b3e860c2e3
Opcode Fuzzy Hash: d45b23fcbac47bf73f15d1e701022ec690aa0358cdfd9615b1292719b59082f7
Instruction Fuzzy Hash: DB11E870D0C61A8FEB68EF08C8847E9B7B1EB64751F0041FAD41DA62D1DB786A84CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F4F318 Relevance: 5.0, Strings: 4, Instructions: 35COMMON

Download Yara Rule

Strings

k, xrefs: 00007FF848F4F0B6
", xrefs: 00007FF848F4F362
5, xrefs: 00007FF848F4F31C
H, xrefs: 00007FF848F4F372

Memory Dump Source

Source File: 0000001D.00000002.2195593098.00007FF848F4F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F4F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff848f4f000_uPlspWkqijAQ.jbxd

Similarity

API ID:
String ID: "$5$H$k
API String ID: 0-1256405626
Opcode ID: f97adf3c0343b478e9bcfbd9c97bebe8d71f094acad07336634dd5319c8c7562
Instruction ID: d49961043f626d0ff45548347e120224b4b04a82734d04acc6d24240ca956bef
Opcode Fuzzy Hash: f97adf3c0343b478e9bcfbd9c97bebe8d71f094acad07336634dd5319c8c7562
Instruction Fuzzy Hash: 23011A75D09729CEEB24DF14C8807E9B7B1FB64751F0041EAD44DA6291CB389A84CF45

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Xmz1XDgtah.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\33d07815358cfe

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\uPlspWkqijAQ.exe:Zone.Identifier

C:\Program Files (x86)\Windows Mail\33d07815358cfe

C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe

C:\Program Files (x86)\Windows Mail\uPlspWkqijAQ.exe:Zone.Identifier

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\33d07815358cfe

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\uPlspWkqijAQ.exe

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\uPlspWkqijAQ.exe:Zone.Identifier

C:\Program Files\Windows Portable Devices\9e60a5f7a3bd80

C:\Program Files\Windows Portable Devices\SystemSettings.exe

C:\Program Files\Windows Portable Devices\SystemSettings.exe:Zone.Identifier

C:\ProgramData\9e8d7a4ca61bd9

C:\ProgramData\RuntimeBroker.exe

Windows Analysis Report
Xmz1XDgtah.exe