Play interactive tour

Edit tour

Analysis Report QRN-CLJC-06112020149.PDF.exe

Overview

General Information

Sample Name:	QRN-CLJC-06112020149.PDF.exe
Analysis ID:	321395
MD5:	cdefe555b30aa451be1c4b519ccaa9a3
SHA1:	dde5a61b58ce44a985ee7ca8d4a789140063616c
SHA256:	67bff3c99f10c2b189df24202f66a3901d355847afee7de4f66c78aff794c923
Tags:	AgentTeslaexe
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Sigma detected: Suspicious Double Extension

Yara detected AgentTesla

Yara detected AntiVM_3

.NET source code contains very large array initializations

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

May check the online IP address of the machine

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Uses an obfuscated file name to hide its real file extension (double extension)

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

QRN-CLJC-06112020149.PDF.exe (PID: 6128 cmdline: 'C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe' MD5: CDEFE555B30AA451BE1C4B519CCAA9A3)

schtasks.exe (PID: 5500 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XwhZikir' /XML 'C:\Users\user\AppData\Local\Temp\tmpF5B4.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 4480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

QRN-CLJC-06112020149.PDF.exe (PID: 4664 cmdline: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe MD5: CDEFE555B30AA451BE1C4B519CCAA9A3)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "AmBIZ", "URL: ": "http://z61os6wyor.com", "To: ": "", "ByHost: ": "mail.privateemail.com:587", "Password: ": "Tp7L2", "From: ": ""}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.504281771.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.248253061.00000000034D1000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.248835494.00000000044D4000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.248377338.0000000003525000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: QRN-CLJC-06112020149.PDF.exe PID: 4664	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: QRN-CLJC-06112020149.PDF.exe PID: 4664	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: QRN-CLJC-06112020149.PDF.exe PID: 6128	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: QRN-CLJC-06112020149.PDF.exe PID: 6128	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.QRN-CLJC-06112020149.PDF.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Sigma Overview

System Summary:

Sigma detected: Scheduled temp file as task from temp location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XwhZikir' /XML 'C:\Users\user\AppData\Local\Temp\tmpF5B4.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XwhZikir' /XML 'C:\Users\user\AppData\Local\Temp\tmpF5B4.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe' , ParentImage: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe, ParentProcessId: 6128, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XwhZikir' /XML 'C:\Users\user\AppData\Local\Temp\tmpF5B4.tmp', ProcessId: 5500

Sigma detected: Suspicious Double Extension

Show sources

Source: Process started

Author: Florian Roth (rule), @blu3_team (idea): Data: Command: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe, CommandLine: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe, NewProcessName: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe, OriginalFileName: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe, ParentCommandLine: 'C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe' , ParentImage: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe, ParentProcessId: 6128, ProcessCommandLine: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe, ProcessId: 4664

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: QRN-CLJC-06112020149.PDF.exe.4664.3.memstr

Malware Configuration Extractor: Agenttesla {"Username: ": "AmBIZ", "URL: ": "http://z61os6wyor.com", "To: ": "", "ByHost: ": "mail.privateemail.com:587", "Password: ": "Tp7L2", "From: ": ""}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\XwhZikir.exe

ReversingLabs: Detection: 33%

Multi AV Scanner detection for submitted file

Show sources

Source: QRN-CLJC-06112020149.PDF.exe	Virustotal: Detection: 52%			Perma Link
Source: QRN-CLJC-06112020149.PDF.exe	ReversingLabs: Detection: 33%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\XwhZikir.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: QRN-CLJC-06112020149.PDF.exe

Joe Sandbox ML: detected

Source: 3.2.QRN-CLJC-06112020149.PDF.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 4x nop then jmp 05C390A6h	0_2_05C38FEB
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_05C39857
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_05C39868

Networking:

May check the online IP address of the machine

Show sources

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.7:49748 -> 198.54.122.60:587

Source: Joe Sandbox View	IP Address: 54.243.161.145 54.243.161.145
Source: Joe Sandbox View	IP Address: 54.243.161.145 54.243.161.145
Source: Joe Sandbox View	IP Address: 198.54.122.60 198.54.122.60

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic

TCP traffic: 192.168.2.7:49748 -> 198.54.122.60:587

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

Code function: 3_2_0269A09A recv,

3_2_0269A09A

Source: unknown

DNS traffic detected: queries for: g.msn.com

Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.509398240.00000000031E6000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.512477564.0000000005F30000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.512477564.0000000005F30000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl0
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.512543715.0000000005F63000.00000004.00000001.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationS
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.509729422.0000000003211000.00000004.00000001.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	String found in binary or memory: http://gWhdeq.com
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.512543715.0000000005F63000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.com1
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp, QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.509398240.00000000031E6000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.509729422.0000000003211000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.509398240.00000000031E6000.00000004.00000001.sdmp, QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.509511016.00000000031F4000.00000004.00000001.sdmp	String found in binary or memory: http://z61os6wyor.com
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org/
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org/(
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.orgGETMozilla/5.0
Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.248835494.00000000044D4000.00000004.00000001.sdmp, QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.504281771.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot%telegramapi%/
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.509729422.0000000003211000.00000004.00000001.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.248835494.00000000044D4000.00000004.00000001.sdmp, QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.504281771.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 3.2.QRN-CLJC-06112020149.PDF.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b161D827Cu002dEE49u002d4B0Eu002d833Fu002dF512BCC8F74Cu007d/u00334888689u002d8818u002d434Eu002dB30Fu002dF3A6EF143ED7.cs

Large array initialization: .cctor: array initializer size 11992

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: QRN-CLJC-06112020149.PDF.exe

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_05BB11CE NtQuerySystemInformation,	0_2_05BB11CE
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_05BB119D NtQuerySystemInformation,	0_2_05BB119D
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_0269B0BA NtQuerySystemInformation,	3_2_0269B0BA
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_0269B089 NtQuerySystemInformation,	3_2_0269B089

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_00D46CC1	0_2_00D46CC1
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_030D0A3F	0_2_030D0A3F
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_030D0AC8	0_2_030D0AC8
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_030D2198	0_2_030D2198
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_030D26E4	0_2_030D26E4
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_030D1C09	0_2_030D1C09
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_030D1CF0	0_2_030D1CF0
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_030D7300	0_2_030D7300
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_030D2131	0_2_030D2131
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_030D2189	0_2_030D2189
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_030D9457	0_2_030D9457
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_030DA77E	0_2_030DA77E
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_030D3770	0_2_030D3770
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_030D37D8	0_2_030D37D8
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_030D37E8	0_2_030D37E8
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_030DE6B0	0_2_030DE6B0
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_030D9457	0_2_030D9457
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_030D1CE0	0_2_030D1CE0
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_05C35150	0_2_05C35150
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_05C35160	0_2_05C35160
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_05C30047	0_2_05C30047
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_05C30070	0_2_05C30070
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_05C307E7	0_2_05C307E7
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_05C30070	0_2_05C30070
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_00D42050	0_2_00D42050
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_00696CC1	3_2_00696CC1
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_02BD71A0	3_2_02BD71A0
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_02BDC938	3_2_02BDC938
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_063A7078	3_2_063A7078
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_063AA0B8	3_2_063AA0B8
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_063A58AC	3_2_063A58AC
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_063A28F8	3_2_063A28F8
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_063A74C8	3_2_063A74C8
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_063AEB30	3_2_063AEB30
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_063AE560	3_2_063AE560
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_063A3B40	3_2_063A3B40
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_063A9ED8	3_2_063A9ED8
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_063D5330	3_2_063D5330
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_063D65FB	3_2_063D65FB
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_00692050	3_2_00692050
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_063D14E0	3_2_063D14E0

Source: QRN-CLJC-06112020149.PDF.exe	Binary or memory string: OriginalFilename vs QRN-CLJC-06112020149.PDF.exe
Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.249206382.000000000469B000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameKedermister.dllT vs QRN-CLJC-06112020149.PDF.exe
Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.252133026.0000000006250000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs QRN-CLJC-06112020149.PDF.exe
Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.249620145.0000000005670000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs QRN-CLJC-06112020149.PDF.exe
Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.252265585.0000000006350000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs QRN-CLJC-06112020149.PDF.exe
Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.252265585.0000000006350000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs QRN-CLJC-06112020149.PDF.exe
Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.248253061.00000000034D1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamegGBfrdvzjTnMYYsrYcgGjNdaKrLUoCIJrGyRgJ.exe4 vs QRN-CLJC-06112020149.PDF.exe
Source: QRN-CLJC-06112020149.PDF.exe	Binary or memory string: OriginalFilename vs QRN-CLJC-06112020149.PDF.exe
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.512915861.00000000063F0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs QRN-CLJC-06112020149.PDF.exe
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.511565740.00000000052A0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs QRN-CLJC-06112020149.PDF.exe
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.504281771.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamegGBfrdvzjTnMYYsrYcgGjNdaKrLUoCIJrGyRgJ.exe4 vs QRN-CLJC-06112020149.PDF.exe
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.512807164.00000000063C0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx.mui vs QRN-CLJC-06112020149.PDF.exe
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.512770176.00000000063B0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs QRN-CLJC-06112020149.PDF.exe
Source: QRN-CLJC-06112020149.PDF.exe	Binary or memory string: OriginalFilenameb3Bd.exeN vs QRN-CLJC-06112020149.PDF.exe

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Section loaded: windows.staterepositoryps.dll			Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Section loaded: security.dll			Jump to behavior

Source: QRN-CLJC-06112020149.PDF.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: XwhZikir.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 3.2.QRN-CLJC-06112020149.PDF.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.2.QRN-CLJC-06112020149.PDF.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/5@3/2

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_05BB1052 AdjustTokenPrivileges,	0_2_05BB1052
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_05BB101B AdjustTokenPrivileges,	0_2_05BB101B
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_0269AF3E AdjustTokenPrivileges,	3_2_0269AF3E
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_0269AF07 AdjustTokenPrivileges,	3_2_0269AF07

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

File created: C:\Users\user\AppData\Roaming\XwhZikir.exe

Jump to behavior

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Mutant created: \Sessions\1\BaseNamedObjects\ZcufQIP
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4480:120:WilError_01

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

File created: C:\Users\user\AppData\Local\Temp\tmpF5B4.tmp

Jump to behavior

Source: QRN-CLJC-06112020149.PDF.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: QRN-CLJC-06112020149.PDF.exe	Virustotal: Detection: 52%
Source: QRN-CLJC-06112020149.PDF.exe	ReversingLabs: Detection: 33%

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

File read: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe 'C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XwhZikir' /XML 'C:\Users\user\AppData\Local\Temp\tmpF5B4.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XwhZikir' /XML 'C:\Users\user\AppData\Local\Temp\tmpF5B4.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process created: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Jump to behavior

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: QRN-CLJC-06112020149.PDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: QRN-CLJC-06112020149.PDF.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: mscorrc.pdb source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.249620145.0000000005670000.00000002.00000001.sdmp, QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.512915861.00000000063F0000.00000002.00000001.sdmp

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_01706E79 push ebx; retf	0_2_01706E7A
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_01706E7C push ebx; retf	0_2_01706E7E
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_01709ADC push ebx; retf	0_2_01709B06
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_01708EA1 push ebx; retf	0_2_01708EA2
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_01708EA4 push ebx; retf	0_2_01708EA6
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_01709A9D push ebx; retf	0_2_01709B06
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_05C3453B push ss; ret	0_2_05C3454A
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_05C348A7 push ss; ret	0_2_05C348AE
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_05C33B59 push edx; retf	0_2_05C33B5A
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_05C34687 push cs; ret	0_2_05C3468E
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_05C3468F push 0000001Ah; ret	0_2_05C346A6
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_05C34657 push 0000001Ah; ret	0_2_05C346A6
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 0_2_05C34A23 push ds; ret	0_2_05C34A3A
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_02BDD0A1 push ss; retf	3_2_02BDD0A3
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Code function: 3_2_063A229F push ecx; ret	3_2_063A22B4

Source: initial sample	Static PE information: section name: .text entropy: 7.83443319066
Source: initial sample	Static PE information: section name: .text entropy: 7.83443319066

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

File created: C:\Users\user\AppData\Roaming\XwhZikir.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: unknown

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XwhZikir' /XML 'C:\Users\user\AppData\Local\Temp\tmpF5B4.tmp'

Hooking and other Techniques for Hiding and Protection:

Uses an obfuscated file name to hide its real file extension (double extension)

Show sources

Source: Possible double extension: pdf.exe

Static PE information: QRN-CLJC-06112020149.PDF.exe

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM_3

Show sources

Source: Yara match	File source: 00000000.00000002.248253061.00000000034D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.248377338.0000000003525000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QRN-CLJC-06112020149.PDF.exe PID: 6128, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.248253061.00000000034D1000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.248253061.00000000034D1000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 1528	Thread sleep time: -54725s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 1528	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 724	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -59406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -58906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -88080s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -87750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -86109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -57000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -113000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -110812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -55000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -53500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -106440s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -106000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -52406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -77250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -75609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -69609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -46000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -44906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -66750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -66000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -65109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -64359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -41406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -61500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -59859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -39000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -56859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -55500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -53859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -35500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -50859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -33220s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -31626s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -31220s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -30720s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -30126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -39939s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -39609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -39189s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -36609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -36330s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -34689s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -34359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -33330s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -59814s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -59626s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -59126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -57814s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -86439s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -85080s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -56314s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -83439s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -55220s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -54314s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -81189s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -52626s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -78189s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -51720s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -76500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -50626s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -75189s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -49906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -74250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -49220s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -49000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -48814s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -48626s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -72609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -48126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -47126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -46906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -46126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -45814s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -45626s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -42626s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -42314s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -42126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -41220s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -40126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -39220s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -38814s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -57189s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -37720s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -35720s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -35000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -34220s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -50580s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -33126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -32906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -59314s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -58220s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -57126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -56906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -54500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -53626s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -53406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -52314s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -51220s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -47720s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -45314s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -45126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -44220s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -43126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -41814s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -39626s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -36126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -34814s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -33500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -31906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -31720s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -31500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -30814s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -30626s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532	Thread sleep time: -30406s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Last function: Thread delayed

Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.248253061.00000000034D1000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.511565740.00000000052A0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.248253061.00000000034D1000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.248253061.00000000034D1000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II\|update users set password = @password where user_id = @user_id
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.511565740.00000000052A0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.511565740.00000000052A0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.248253061.00000000034D1000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.511565740.00000000052A0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

Code function: 3_2_02BD33C8 LdrInitializeThunk,

3_2_02BD33C8

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

Memory written: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XwhZikir' /XML 'C:\Users\user\AppData\Local\Temp\tmpF5B4.tmp'			Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Process created: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe			Jump to behavior

Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.505534819.0000000001270000.00000002.00000001.sdmp	Binary or memory string: uProgram Manager
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.505534819.0000000001270000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.505534819.0000000001270000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.505534819.0000000001270000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

Code function: 0_2_016FB0BE GetUserNameW,

0_2_016FB0BE

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000003.00000002.504281771.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.248835494.00000000044D4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QRN-CLJC-06112020149.PDF.exe PID: 4664, type: MEMORY
Source: Yara match	File source: Process Memory Space: QRN-CLJC-06112020149.PDF.exe PID: 6128, type: MEMORY
Source: Yara match	File source: 3.2.QRN-CLJC-06112020149.PDF.exe.400000.0.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QRN-CLJC-06112020149.PDF.exe PID: 4664, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000003.00000002.504281771.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.248835494.00000000044D4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QRN-CLJC-06112020149.PDF.exe PID: 4664, type: MEMORY
Source: Yara match	File source: Process Memory Space: QRN-CLJC-06112020149.PDF.exe PID: 6128, type: MEMORY
Source: Yara match	File source: 3.2.QRN-CLJC-06112020149.PDF.exe.400000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools1	OS Credential Dumping2	Account Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job1	Scheduled Task/Job1	Access Token Manipulation1	Deobfuscate/Decode Files or Information1	Credentials in Registry1	File and Directory Discovery1	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Encrypted Channel12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Process Injection112	Obfuscated Files or Information13	Security Account Manager	System Information Discovery114	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Scheduled Task/Job1	Software Packing3	NTDS	Query Registry1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	DLL Side-Loading1	LSA Secrets	Security Software Discovery321	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol12	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Masquerading11	Cached Domain Credentials	Virtualization/Sandbox Evasion14	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion14	DCSync	Process Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Access Token Manipulation1	Proc Filesystem	System Owner/User Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Process Injection112	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	System Network Configuration Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
QRN-CLJC-06112020149.PDF.exe	53%	Virustotal		Browse
QRN-CLJC-06112020149.PDF.exe	33%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
QRN-CLJC-06112020149.PDF.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\XwhZikir.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\XwhZikir.exe	33%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
3.2.QRN-CLJC-06112020149.PDF.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://ocsp.com1	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://gWhdeq.com	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSADomainValidationS	3%	Virustotal		Browse
http://crt.sectigo.com/SectigoRSADomainValidationS	0%	Avira URL Cloud	safe
http://z61os6wyor.com	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://api.ipify.orgGETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.orgGETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.orgGETMozilla/5.0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
elb097307-934924932.us-east-1.elb.amazonaws.com	54.243.161.145	true	false	high
mail.privateemail.com	198.54.122.60	true	false	high
g.msn.com	unknown	unknown	false	high
api.ipify.org	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ocsp.com1	QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.512543715.0000000005F63000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org/	QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	false		high
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.509729422.0000000003211000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://127.0.0.1:HTTP/1.1	QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://api.ipify.org	QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	false		high
http://DynDns.comDynDNS	QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://sectigo.com/CPS0	QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.509729422.0000000003211000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://gWhdeq.com	QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.509729422.0000000003211000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.telegram.org/bot%telegramapi%/	QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.248835494.00000000044D4000.00000004.00000001.sdmp, QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.504281771.0000000000402000.00000040.00000001.sdmp	false		high
http://crt.sectigo.com/SectigoRSADomainValidationS	QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.512543715.0000000005F63000.00000004.00000001.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://z61os6wyor.com	QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.509398240.00000000031E6000.00000004.00000001.sdmp, QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.509511016.00000000031F4000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
https://secure.comodo.com/CPS0	QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	false		high
https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x	QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.248835494.00000000044D4000.00000004.00000001.sdmp, QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.504281771.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.ipify.org/(	QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	false		high
https://api.ipify.orgGETMozilla/5.0	QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
54.243.161.145	unknown	United States		14618	AMAZON-AESUS	false
198.54.122.60	unknown	United States		22612	NAMECHEAP-NETUS	false

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	321395
Start date:	21.11.2020
Start time:	09:24:52
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	QRN-CLJC-06112020149.PDF.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/5@3/2
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 99% Number of executed functions: 407 Number of non-executed functions: 15
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 52.147.198.201, 13.88.21.125, 104.79.90.110, 51.104.144.132, 2.20.142.209, 2.20.142.210, 40.67.254.36, 52.155.217.156, 20.54.26.129, 52.142.114.176, 92.122.213.194, 92.122.213.247 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wns.notify.windows.com.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, g-msn-com-nsatc.trafficmanager.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, par02p.wns.notify.windows.com.akadns.net, db5p.wns.notify.windows.com.akadns.net, emea1.notify.windows.com.akadns.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:25:48	API Interceptor	856x Sleep call for process: QRN-CLJC-06112020149.PDF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
54.243.161.145	REQUEST FOR QUOTATION-6container.exe	Get hash	malicious	Browse	api.ipify.org/
	Request for Quote.doc	Get hash	malicious	Browse	api.ipify.org/
	fw314FjnwM.exe	Get hash	malicious	Browse	api.ipify.org/
	mT4sVN5EMN.exe	Get hash	malicious	Browse	api.ipify.orghttp://api.ipify.org/?format=json
	SecuriteInfo.com.ArtemisA49347BCE7B1.exe	Get hash	malicious	Browse	api.ipify.org/
	JwzZ6mkzIG.exe	Get hash	malicious	Browse	api.ipify.org/
	scandocuments_pdf.exe	Get hash	malicious	Browse	api.ipify.org/
	RFQ_NEW029287652267.exe	Get hash	malicious	Browse	api.ipify.org/
	Delivery Note - AWD 200038485852- 234920301190.exe	Get hash	malicious	Browse	api.ipify.org/
	chibuike17.exe	Get hash	malicious	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Browse	api.ipify.org/
	5fNtovgDmX.exe	Get hash	malicious	Browse	api.ipify.org/
	0Cnb8v0C53.exe	Get hash	malicious	Browse	api.ipify.org/?format=xml
	P9OFS5NEj0.exe	Get hash	malicious	Browse	api.ipify.org/?format=xml
	VRRh2DUTnA.exe	Get hash	malicious	Browse	api.ipify.org/?format=xml
	Payment.exe	Get hash	malicious	Browse	api.ipify.org/
198.54.122.60	Certificates Profile Details Of Our Company And About Us.exe	Get hash	malicious	Browse
	74725794.no.exe	Get hash	malicious	Browse
	Certificates Profile Details Of Our Company.exe	Get hash	malicious	Browse
	xgarnica.exe	Get hash	malicious	Browse
	mcaceres.exe	Get hash	malicious	Browse
	DHL-#AWB130501923096PDF.exe	Get hash	malicious	Browse
	Quote Request.xlsx	Get hash	malicious	Browse
	QRN-CLJC-06112020149.PDF.exe	Get hash	malicious	Browse
	INFORMAC.EXE	Get hash	malicious	Browse
	bOP3MQqNAK.exe	Get hash	malicious	Browse
	E6YtI65Keq.exe	Get hash	malicious	Browse
	OEF6v7cotZ.exe	Get hash	malicious	Browse
	ZXzlzc794m.exe	Get hash	malicious	Browse
	NHBXMZhKAy.exe	Get hash	malicious	Browse
	PO-NM-30223 ( STH-JO-200960).exe	Get hash	malicious	Browse
	RFQ.exe	Get hash	malicious	Browse
	SSG0987R544.DPF.exe	Get hash	malicious	Browse
	HIioiKLlx9.exe	Get hash	malicious	Browse
	PO74215.exe	Get hash	malicious	Browse
	aY9ySgsJXn.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
elb097307-934924932.us-east-1.elb.amazonaws.com	yQDGREHA9h.exe	Get hash	malicious	Browse	54.235.83.248
	mcsrXx9lfD.exe	Get hash	malicious	Browse	54.235.83.248
	SecuriteInfo.com.Trojan.PackedNET.461.20928.exe	Get hash	malicious	Browse	23.21.42.25
	Defender-update-kit-x86x64.exe	Get hash	malicious	Browse	54.225.153.147
	https://largemail.r1.rpost.net/files/7xU97qcFgCvB3Uv1wDC4qvS2ZriLfublohKWA5V3/ln/en-us	Get hash	malicious	Browse	54.225.66.103
	ORDER.exe	Get hash	malicious	Browse	54.235.142.93
	Bill # 2.xlsx	Get hash	malicious	Browse	23.21.42.25
	PO1.xlsx	Get hash	malicious	Browse	174.129.214.20
	a7UZzCVWKO.exe	Get hash	malicious	Browse	54.204.14.42
	QKLQkaCe9M.exe	Get hash	malicious	Browse	50.19.252.36
	sAPuJAvs52.exe	Get hash	malicious	Browse	54.243.161.145
	JlgyVmPWZr.exe	Get hash	malicious	Browse	174.129.214.20
	EIUOzWW2JX.exe	Get hash	malicious	Browse	174.129.214.20
	RVAgYSH2qh.exe	Get hash	malicious	Browse	54.235.142.93
	yCyc4rN0u8.exe	Get hash	malicious	Browse	54.235.83.248
	9cXAnovmQX.exe	Get hash	malicious	Browse	54.225.66.103
	T2HDck1Mmy.exe	Get hash	malicious	Browse	54.235.142.93
	Purchase Order.exe	Get hash	malicious	Browse	54.225.66.103
	Payment Advice Note from 19.11.2020.exe	Get hash	malicious	Browse	23.21.126.66
	phy__1__31629__2649094674__1605642612.exe	Get hash	malicious	Browse	23.21.126.66
mail.privateemail.com	Certificates Profile Details Of Our Company And About Us.exe	Get hash	malicious	Browse	198.54.122.60
	74725794.no.exe	Get hash	malicious	Browse	198.54.122.60
	Certificates Profile Details Of Our Company.exe	Get hash	malicious	Browse	198.54.122.60
	xgarnica.exe	Get hash	malicious	Browse	198.54.122.60
	mcaceres.exe	Get hash	malicious	Browse	198.54.122.60
	DHL-#AWB130501923096PDF.exe	Get hash	malicious	Browse	198.54.122.60
	Quote Request.xlsx	Get hash	malicious	Browse	198.54.122.60
	QRN-CLJC-06112020149.PDF.exe	Get hash	malicious	Browse	198.54.122.60
	INFORMAC.EXE	Get hash	malicious	Browse	198.54.122.60
	bOP3MQqNAK.exe	Get hash	malicious	Browse	198.54.122.60
	E6YtI65Keq.exe	Get hash	malicious	Browse	198.54.122.60
	OEF6v7cotZ.exe	Get hash	malicious	Browse	198.54.122.60
	ZXzlzc794m.exe	Get hash	malicious	Browse	198.54.122.60
	NHBXMZhKAy.exe	Get hash	malicious	Browse	198.54.122.60
	PO-NM-30223 ( STH-JO-200960).exe	Get hash	malicious	Browse	198.54.122.60
	RFQ.exe	Get hash	malicious	Browse	198.54.122.60
	SSG0987R544.DPF.exe	Get hash	malicious	Browse	198.54.122.60
	HIioiKLlx9.exe	Get hash	malicious	Browse	198.54.122.60
	PO74215.exe	Get hash	malicious	Browse	198.54.122.60
	aY9ySgsJXn.exe	Get hash	malicious	Browse	198.54.122.60

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AMAZON-AESUS	Purchase Order 40,7045$.exe	Get hash	malicious	Browse	52.71.133.130
	Purchase Order 40,7045.exe	Get hash	malicious	Browse	54.208.77.124
	Fennec Pharma .docx	Get hash	malicious	Browse	54.84.56.113
	Fennec Pharma .docx	Get hash	malicious	Browse	54.84.56.113
	Fennec Pharma.xlsx	Get hash	malicious	Browse	54.84.56.113
	Fennec Pharma.xlsx	Get hash	malicious	Browse	54.84.56.113
	https://albanesebros.sendx.io/lp/shared-doc.html	Get hash	malicious	Browse	3.213.165.33
	http://www.openair.com	Get hash	malicious	Browse	34.202.206.65
	https://faxfax.zizera.com/remittanceadvice	Get hash	malicious	Browse	184.73.218.177
	http://webnavigator.co	Get hash	malicious	Browse	34.235.7.64
	https://mcmms.typeform.com/to/Vtnb9OBC	Get hash	malicious	Browse	34.200.62.85
	yQDGREHA9h.exe	Get hash	malicious	Browse	54.235.83.248
	mcsrXx9lfD.exe	Get hash	malicious	Browse	54.235.83.248
	SecuriteInfo.com.Trojan.PackedNET.461.20928.exe	Get hash	malicious	Browse	23.21.42.25
	Defender-update-kit-x86x64.exe	Get hash	malicious	Browse	54.225.153.147
	https://largemail.r1.rpost.net/files/7xU97qcFgCvB3Uv1wDC4qvS2ZriLfublohKWA5V3/ln/en-us	Get hash	malicious	Browse	54.225.66.103
	ORDER.exe	Get hash	malicious	Browse	54.235.142.93
	http://s1022.t.en25.com/e/er?s=1022&lid=2184&elqTrackId=BEDFF87609C7D9DEAD041308DD8FFFB8&lb_email=bkirwer%40farbestfoods.com&elq=b095bd096fb54161953a2cf8316b5d13&elqaid=3115&elqat=1	Get hash	malicious	Browse	52.1.99.77
	Bill # 2.xlsx	Get hash	malicious	Browse	23.21.42.25
	https://ubereats.app.link/cwmLFZfMz5?%243p=a_custom_354088&%24deeplink_path=promo%2Fapply%3FpromoCode%3DRECONFORT7&%24desktop_url=tracking.spectrumemp.com/el?aid=8feeb968-bdd0-11e8-b27f-22000be0a14e&rid=50048635&pid=285843&cid=513&dest=overlordscan.com/cmV0by5tZXR6bGVyQGlzb2x1dGlvbnMuY2g=%23#kkowfocjoyuynaip#	Get hash	malicious	Browse	35.170.181.205
NAMECHEAP-NETUS	Purchase Order 40,7045$.exe	Get hash	malicious	Browse	198.54.117.211
	Purchase Order 40,7045.exe	Get hash	malicious	Browse	198.54.117.212
	fqwBU8MyzT.rtf	Get hash	malicious	Browse	162.0.232.118
	vOKMFxiCYt.exe	Get hash	malicious	Browse	162.0.232.118
	http://rwiqipwvnklaqkuu.ltiliqhting.com/asci/SmFjcXVlbGluZS5TY2hyYWRlckByYWJvYmFuay5jb20=	Get hash	malicious	Browse	198.54.120.245
	Payment conflict- aptiv 082920134110.htm	Get hash	malicious	Browse	198.54.116.10
	Payment-244581781.doc	Get hash	malicious	Browse	198.187.29.39
	Order List.xlsx	Get hash	malicious	Browse	198.54.117.216
	https://u19114248.ct.sendgrid.net/ls/click?upn=1kMFt-2Foese19BdzKqBBNxmUiDNiO3l4ozyKR3JHYHjGXyXtR1YgfLizwybC7hwFoy4wlb-2FUZczInc9Ssmzz4dQ-3D-3DuU6r_TCf26aIMQHFUMJSqtVnzlcWBqfQpkiFxCOBj9heiSevnqRkiapxQjkatt3r5u5xw-2FNDgXhA220pIRwcKmyMneET98pBkuhL-2FUwJCaSrvE5mZhnMBtJdZf9Opljklq5t7Y-2BINqElPIJU8bjYLY27qV6L-2FSwA36husfmMqwKagSwOgE04FdniEmY9uEbym50XNhqKw9lgczv6HrSrYNm6ouXnIayW-2FSBLzGYxoTYKe6OA-3D	Get hash	malicious	Browse	198.54.114.178
	Certificates Profile Details Of Our Company And About Us.exe	Get hash	malicious	Browse	198.54.122.60
	Final-Payment-Receipt.exe	Get hash	malicious	Browse	162.0.236.49
	Payment Advice.xls	Get hash	malicious	Browse	185.61.154.32
	Payment Advice.xls	Get hash	malicious	Browse	185.61.154.32
	Payment Advice.xls	Get hash	malicious	Browse	185.61.154.32
	Documentation.478396766.doc	Get hash	malicious	Browse	198.187.31.83
	Documentation.478396766.doc	Get hash	malicious	Browse	192.64.118.88
	tl2gnGyMz6eLhZG.exe	Get hash	malicious	Browse	104.219.248.45
	Purchase Order 40,7045.exe	Get hash	malicious	Browse	185.61.154.55
	74725794.no.exe	Get hash	malicious	Browse	198.54.122.60
	Payment Advice - Advice Ref GLV823990339.exe	Get hash	malicious	Browse	198.54.120.58

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	yQDGREHA9h.exe	Get hash	malicious	Browse	54.243.161.145
	mcsrXx9lfD.exe	Get hash	malicious	Browse	54.243.161.145
	SecuriteInfo.com.Trojan.PackedNET.461.20928.exe	Get hash	malicious	Browse	54.243.161.145
	ARjQJiNmBs.exe	Get hash	malicious	Browse	54.243.161.145
	1piS4PBvBp.exe	Get hash	malicious	Browse	54.243.161.145
	ORDER.exe	Get hash	malicious	Browse	54.243.161.145
	a7UZzCVWKO.exe	Get hash	malicious	Browse	54.243.161.145
	QKLQkaCe9M.exe	Get hash	malicious	Browse	54.243.161.145
	sAPuJAvs52.exe	Get hash	malicious	Browse	54.243.161.145
	JlgyVmPWZr.exe	Get hash	malicious	Browse	54.243.161.145
	EIUOzWW2JX.exe	Get hash	malicious	Browse	54.243.161.145
	yCyc4rN0u8.exe	Get hash	malicious	Browse	54.243.161.145
	9cXAnovmQX.exe	Get hash	malicious	Browse	54.243.161.145
	T2HDck1Mmy.exe	Get hash	malicious	Browse	54.243.161.145
	Payment Advice Note from 19.11.2020.exe	Get hash	malicious	Browse	54.243.161.145
	PO N0.1500243224._PDF.exe	Get hash	malicious	Browse	54.243.161.145
	zRHI9DJ0YKIPfBX.exe	Get hash	malicious	Browse	54.243.161.145
	chib(1).exe	Get hash	malicious	Browse	54.243.161.145
	dede.exe	Get hash	malicious	Browse	54.243.161.145
	obi(1).exe	Get hash	malicious	Browse	54.243.161.145

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\QRN-CLJC-06112020149.PDF.exe.log Download File
Process:	C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	664
Entropy (8bit):	5.288448637977022
Encrypted:	false
SSDEEP:	12:Q3LaJU20NaL10Ug+9Yz9t0U29hJ5g1B0U2ukyrFk70U2xANlW3ANv:MLF20NaL3z2p29hJ5g522rW2xAi3A9
MD5:	B1DB55991C3DA14E35249AEA1BC357CA
SHA1:	0DD2D91198FDEF296441B12F1A906669B279700C
SHA-256:	34D3E48321D5010AD2BD1F3F0B728077E4F5A7F70D66FA36B57E5209580B6BDC
SHA-512:	BE38A31888C9C2F8047FA9C99672CB985179D325107514B7500DDA9523AE3E1D20B45EACC4E6C8A5D096360D0FBB98A120E63F38FFE324DF8A0559F6890CC801
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\35774dc3cd31b4550ab06c3354cf4ba5\System.Runtime.Remoting.ni.dll",0..

C:\Users\user\AppData\Local\Temp\tmpF5B4.tmp Download File
Process:	C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1657
Entropy (8bit):	5.1727086987515705
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/dp7hdMlNMFpdU/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBctn:cbhH7MlNQ8/rydbz9I3YODOLNdq3M
MD5:	DFF0C5D55DC1C14F7C3AF9CE63D4AB0D
SHA1:	F2A1480D0F5BEF7F65E33B08ACF3A939ECC2B2E1
SHA-256:	7AC292D8D1EEB9830381CEBFC7C5F519FA1B2DCDA65C585CC9A44EEFE7761C2B
SHA-512:	3771F6CA9654DE7A331C0F4BD276CE18AA90497335FECC2184F3C59E865D5573A7B74AC8BF21226385C9147D55C4AE9B42F94562FFE025BA11851BDD10AB317F
Malicious:	true
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAv

C:\Users\user\AppData\Roaming\XwhZikir.exe Download File
Process:	C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	813568
Entropy (8bit):	7.826575098416478
Encrypted:	false
SSDEEP:	12288:XAxd7LKgnXbr1BzSJeq/sQwINAj+IKCXc1G4ZE2YwhOTuXP9upRIkqW7otI:XAL6wltiJkNzjdQG4ZXD8iXYMIKI
MD5:	CDEFE555B30AA451BE1C4B519CCAA9A3
SHA1:	DDE5A61B58CE44A985EE7CA8D4A789140063616C
SHA-256:	67BFF3C99F10C2B189DF24202F66A3901D355847AFEE7DE4F66C78AFF794C923
SHA-512:	702CF45DD352D8E03D30E830A25B28E82696850AF72C7486BE0D42E32F208B2A669368879C19379CEA543F92CC9539D5E1347217A10FF96363B3F2519B01CBAA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 33%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......_..............P..^...........}... ........@.. ....................................@.................................P}..O.................................................................................... ............... ..H............text....]... ...^.................. ..`.rsrc................`..............@..@.reloc...............h..............@..B.................}......H.......d..............Pi...............................................0............(....(..........(.....o..........................(.......( ......(!......("......(#....N..(....o....($....&..(%.....s&........s'........s(........s)........s............0...........~....o+....+...0...........~....o,....+...0...........~....o-....+...0...........~....o.....+...0...........~....o/....+...0..<........~.....(0.....,!r...p.....(1...o2...s3............~.....+...0......

C:\Users\user\AppData\Roaming\XwhZikir.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\eeoodpic.1mz\Chrome\Default\Cookies Download File
Process:	C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6969296358976265
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBo2+tYeF+X:T5LLOpEO5J/Kn7U1uBo2UYeQ
MD5:	A9DBC7B8E523ABE3B02D77DBF2FCD645
SHA1:	DF5EE16ECF4B3B02E312F935AE81D4C5D2E91CA8
SHA-256:	39B4E45A062DEA6F541C18FA1A15C5C0DB43A59673A26E2EB5B8A4345EE767AE
SHA-512:	3CF87455263E395313E779D4F440D8405D86244E04B5F577BB9FA2F4A2069DE019D340F6B2F6EF420DEE3D3DEEFD4B58DA3FCA3BB802DE348E1A810D6379CC3B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.826575098416478
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	QRN-CLJC-06112020149.PDF.exe
File size:	813568
MD5:	cdefe555b30aa451be1c4b519ccaa9a3
SHA1:	dde5a61b58ce44a985ee7ca8d4a789140063616c
SHA256:	67bff3c99f10c2b189df24202f66a3901d355847afee7de4f66c78aff794c923
SHA512:	702cf45dd352d8e03d30e830a25b28e82696850af72c7486be0d42e32f208b2a669368879c19379cea543f92cc9539d5e1347217a10ff96363b3f2519b01cbaa
SSDEEP:	12288:XAxd7LKgnXbr1BzSJeq/sQwINAj+IKCXc1G4ZE2YwhOTuXP9upRIkqW7otI:XAL6wltiJkNzjdQG4ZXD8iXYMIKI
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......_..............P..^...........}... ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4c7da2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5FB79382 [Fri Nov 20 09:59:30 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:	v2.0.50727
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc7d50	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x608	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xca000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc5da8	0xc5e00	False	0.828046036008	data	7.83443319066	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xc8000	0x608	0x800	False	0.333984375	data	3.45453132973	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xca000	0xc	0x200	False	0.044921875	data	0.0980041756627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xc8090	0x378	data
RT_MANIFEST	0xc8418	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2009 GateWay Apply
Assembly Version	5.0.3.0
InternalName	b3Bd.exe
FileVersion	5.0.0.0
CompanyName	GateWay Apply
LegalTrademarks
Comments
ProductName	Qusar BDJob Management
ProductVersion	5.0.0.0
FileDescription	Qusar BDJob Management
OriginalFilename	b3Bd.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2020 09:27:18.192522049 CET	49747	443	192.168.2.7	54.243.161.145
Nov 21, 2020 09:27:18.294951916 CET	443	49747	54.243.161.145	192.168.2.7
Nov 21, 2020 09:27:18.295063972 CET	49747	443	192.168.2.7	54.243.161.145
Nov 21, 2020 09:27:18.357414961 CET	49747	443	192.168.2.7	54.243.161.145
Nov 21, 2020 09:27:18.459834099 CET	443	49747	54.243.161.145	192.168.2.7
Nov 21, 2020 09:27:18.459892988 CET	443	49747	54.243.161.145	192.168.2.7
Nov 21, 2020 09:27:18.459911108 CET	443	49747	54.243.161.145	192.168.2.7
Nov 21, 2020 09:27:18.459953070 CET	443	49747	54.243.161.145	192.168.2.7
Nov 21, 2020 09:27:18.459963083 CET	49747	443	192.168.2.7	54.243.161.145
Nov 21, 2020 09:27:18.459965944 CET	443	49747	54.243.161.145	192.168.2.7
Nov 21, 2020 09:27:18.460035086 CET	49747	443	192.168.2.7	54.243.161.145
Nov 21, 2020 09:27:18.461131096 CET	443	49747	54.243.161.145	192.168.2.7
Nov 21, 2020 09:27:18.502279997 CET	49747	443	192.168.2.7	54.243.161.145
Nov 21, 2020 09:27:18.604996920 CET	443	49747	54.243.161.145	192.168.2.7
Nov 21, 2020 09:27:18.651643991 CET	49747	443	192.168.2.7	54.243.161.145
Nov 21, 2020 09:27:18.682792902 CET	49747	443	192.168.2.7	54.243.161.145
Nov 21, 2020 09:27:18.788206100 CET	443	49747	54.243.161.145	192.168.2.7
Nov 21, 2020 09:27:18.839154005 CET	49747	443	192.168.2.7	54.243.161.145
Nov 21, 2020 09:27:22.156596899 CET	49748	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:22.324255943 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:22.324426889 CET	49748	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:22.493100882 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:22.497212887 CET	49748	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:22.664403915 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:22.664596081 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:22.665035963 CET	49748	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:22.832288980 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:22.833358049 CET	49748	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:23.000614882 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:23.002482891 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:23.002502918 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:23.002515078 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:23.002526045 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:23.002659082 CET	49748	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:23.040076971 CET	49748	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:23.207391024 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:23.208277941 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:23.208312988 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:23.208493948 CET	49748	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:23.227200031 CET	49748	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:23.394568920 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:23.394866943 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:23.395863056 CET	49748	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:23.563060045 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:23.565426111 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:23.565884113 CET	49748	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:23.733217955 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:23.735497952 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:23.736067057 CET	49748	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:23.903297901 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:23.907161951 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:23.907991886 CET	49748	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:24.075160027 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:24.115935087 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:24.116437912 CET	49748	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:24.283616066 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:24.285295963 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:24.287934065 CET	49748	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:24.288211107 CET	49748	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:24.288391113 CET	49748	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:24.288578033 CET	49748	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:24.455068111 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:24.455212116 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:24.455327988 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:24.455537081 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:24.502146006 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:24.542758942 CET	49748	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:24.705236912 CET	49748	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:24.706397057 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:24.871182919 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:24.871296883 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:24.872343063 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:24.872786045 CET	587	49748	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:24.872859001 CET	49748	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:25.036874056 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:25.037481070 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:25.201610088 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:25.201838970 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:25.202136040 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:25.366183996 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:25.367031097 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:25.531219959 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:25.531275988 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:25.531296015 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:25.531512976 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:25.534564018 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:25.536571980 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:25.698688984 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:25.698735952 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:25.700448990 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:25.700792074 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:25.701545000 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:25.865628004 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:25.866852045 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:25.867408037 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:26.031650066 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:26.035135031 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:26.035531044 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:26.199805975 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:26.202466965 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:26.203012943 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:26.367146969 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:26.411320925 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:26.411956072 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:26.576116085 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:26.576699018 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:26.578461885 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:26.578887939 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:26.579209089 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:26.579521894 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:26.579900026 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:26.580236912 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:26.580559015 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:26.580869913 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:26.581115961 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:26.581429005 CET	49749	587	192.168.2.7	198.54.122.60
Nov 21, 2020 09:27:26.742651939 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:26.742829084 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:26.743206978 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:26.743375063 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:26.743813992 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:26.744123936 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:26.744463921 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:26.744770050 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:26.744971037 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:26.745289087 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:26.753937006 CET	587	49749	198.54.122.60	192.168.2.7
Nov 21, 2020 09:27:26.808562994 CET	49749	587	192.168.2.7	198.54.122.60

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2020 09:25:42.707818985 CET	54329	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:25:42.734991074 CET	53	54329	8.8.8.8	192.168.2.7
Nov 21, 2020 09:25:43.447550058 CET	58052	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:25:43.474596977 CET	53	58052	8.8.8.8	192.168.2.7
Nov 21, 2020 09:25:44.651257992 CET	54008	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:25:44.678397894 CET	53	54008	8.8.8.8	192.168.2.7
Nov 21, 2020 09:25:45.795574903 CET	59451	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:25:45.822757006 CET	53	59451	8.8.8.8	192.168.2.7
Nov 21, 2020 09:25:47.166912079 CET	52914	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:25:47.202555895 CET	53	52914	8.8.8.8	192.168.2.7
Nov 21, 2020 09:25:48.808952093 CET	64569	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:25:48.836057901 CET	53	64569	8.8.8.8	192.168.2.7
Nov 21, 2020 09:25:50.345596075 CET	52816	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:25:50.381453991 CET	53	52816	8.8.8.8	192.168.2.7
Nov 21, 2020 09:25:51.491879940 CET	50781	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:25:51.518984079 CET	53	50781	8.8.8.8	192.168.2.7
Nov 21, 2020 09:25:52.833378077 CET	54230	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:25:52.860532045 CET	53	54230	8.8.8.8	192.168.2.7
Nov 21, 2020 09:25:53.851005077 CET	54911	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:25:53.878101110 CET	53	54911	8.8.8.8	192.168.2.7
Nov 21, 2020 09:25:54.648602009 CET	49958	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:25:54.675689936 CET	53	49958	8.8.8.8	192.168.2.7
Nov 21, 2020 09:25:55.853594065 CET	50860	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:25:55.889377117 CET	53	50860	8.8.8.8	192.168.2.7
Nov 21, 2020 09:25:56.513628960 CET	50452	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:25:56.540740967 CET	53	50452	8.8.8.8	192.168.2.7
Nov 21, 2020 09:25:59.628086090 CET	59730	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:25:59.663594007 CET	53	59730	8.8.8.8	192.168.2.7
Nov 21, 2020 09:26:13.417721987 CET	59310	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:26:13.453461885 CET	53	59310	8.8.8.8	192.168.2.7
Nov 21, 2020 09:26:31.607011080 CET	51919	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:26:31.644329071 CET	53	51919	8.8.8.8	192.168.2.7
Nov 21, 2020 09:26:33.014739037 CET	64296	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:26:33.067392111 CET	53	64296	8.8.8.8	192.168.2.7
Nov 21, 2020 09:26:35.065587044 CET	56680	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:26:35.101301908 CET	53	56680	8.8.8.8	192.168.2.7
Nov 21, 2020 09:26:35.512938976 CET	58820	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:26:35.548549891 CET	53	58820	8.8.8.8	192.168.2.7
Nov 21, 2020 09:26:35.989327908 CET	60983	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:26:36.028019905 CET	53	60983	8.8.8.8	192.168.2.7
Nov 21, 2020 09:26:36.322974920 CET	49247	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:26:36.358740091 CET	53	49247	8.8.8.8	192.168.2.7
Nov 21, 2020 09:26:36.614655018 CET	52286	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:26:36.660595894 CET	53	52286	8.8.8.8	192.168.2.7
Nov 21, 2020 09:26:36.702131987 CET	56064	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:26:36.737735033 CET	53	56064	8.8.8.8	192.168.2.7
Nov 21, 2020 09:26:37.120349884 CET	63744	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:26:37.157901049 CET	53	63744	8.8.8.8	192.168.2.7
Nov 21, 2020 09:26:37.759391069 CET	61457	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:26:37.786513090 CET	53	61457	8.8.8.8	192.168.2.7
Nov 21, 2020 09:26:38.517909050 CET	58367	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:26:38.544979095 CET	53	58367	8.8.8.8	192.168.2.7
Nov 21, 2020 09:26:39.565310955 CET	60599	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:26:39.592513084 CET	53	60599	8.8.8.8	192.168.2.7
Nov 21, 2020 09:26:40.546679020 CET	59571	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:26:40.573904991 CET	53	59571	8.8.8.8	192.168.2.7
Nov 21, 2020 09:26:42.512928009 CET	52689	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:26:42.563261986 CET	53	52689	8.8.8.8	192.168.2.7
Nov 21, 2020 09:26:43.213361025 CET	50290	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:26:43.250516891 CET	53	50290	8.8.8.8	192.168.2.7
Nov 21, 2020 09:27:10.861074924 CET	60427	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:27:10.896924973 CET	53	60427	8.8.8.8	192.168.2.7
Nov 21, 2020 09:27:18.139945984 CET	56209	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:27:18.166903973 CET	53	56209	8.8.8.8	192.168.2.7
Nov 21, 2020 09:27:21.173374891 CET	59582	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:27:22.154793024 CET	53	59582	8.8.8.8	192.168.2.7
Nov 21, 2020 09:27:33.820509911 CET	60949	53	192.168.2.7	8.8.8.8
Nov 21, 2020 09:27:33.847554922 CET	53	60949	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 21, 2020 09:26:42.512928009 CET	192.168.2.7	8.8.8.8	0xc2c	Standard query (0)	g.msn.com	A (IP address)	IN (0x0001)
Nov 21, 2020 09:27:18.139945984 CET	192.168.2.7	8.8.8.8	0xe4c8	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)
Nov 21, 2020 09:27:21.173374891 CET	192.168.2.7	8.8.8.8	0x23a4	Standard query (0)	mail.privateemail.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Nov 21, 2020 09:26:42.563261986 CET	8.8.8.8	192.168.2.7	0xc2c	No error (0)	g.msn.com	g-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Nov 21, 2020 09:27:18.166903973 CET	8.8.8.8	192.168.2.7	0xe4c8	No error (0)	api.ipify.org	nagano-19599.herokussl.com		CNAME (Canonical name)	IN (0x0001)
Nov 21, 2020 09:27:18.166903973 CET	8.8.8.8	192.168.2.7	0xe4c8	No error (0)	nagano-19599.herokussl.com	elb097307-934924932.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Nov 21, 2020 09:27:18.166903973 CET	8.8.8.8	192.168.2.7	0xe4c8	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.243.161.145	A (IP address)	IN (0x0001)
Nov 21, 2020 09:27:18.166903973 CET	8.8.8.8	192.168.2.7	0xe4c8	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.225.153.147	A (IP address)	IN (0x0001)
Nov 21, 2020 09:27:18.166903973 CET	8.8.8.8	192.168.2.7	0xe4c8	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		23.21.252.4	A (IP address)	IN (0x0001)
Nov 21, 2020 09:27:18.166903973 CET	8.8.8.8	192.168.2.7	0xe4c8	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.235.182.194	A (IP address)	IN (0x0001)
Nov 21, 2020 09:27:18.166903973 CET	8.8.8.8	192.168.2.7	0xe4c8	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.235.83.248	A (IP address)	IN (0x0001)
Nov 21, 2020 09:27:18.166903973 CET	8.8.8.8	192.168.2.7	0xe4c8	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.225.169.28	A (IP address)	IN (0x0001)
Nov 21, 2020 09:27:18.166903973 CET	8.8.8.8	192.168.2.7	0xe4c8	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		23.21.42.25	A (IP address)	IN (0x0001)
Nov 21, 2020 09:27:18.166903973 CET	8.8.8.8	192.168.2.7	0xe4c8	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		174.129.214.20	A (IP address)	IN (0x0001)
Nov 21, 2020 09:27:22.154793024 CET	8.8.8.8	192.168.2.7	0x23a4	No error (0)	mail.privateemail.com		198.54.122.60	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Nov 21, 2020 09:27:18.461131096 CET	54.243.161.145	443	192.168.2.7	49747	CN=*.ipify.org, OU=PositiveSSL Wildcard, OU=Domain Control Validated CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Wed Jan 24 01:00:00 CET 2018 Wed Feb 12 01:00:00 CET 2014 Tue Jan 19 01:00:00 CET 2010	Sun Jan 24 00:59:59 CET 2021 Mon Feb 12 00:59:59 CET 2029 Tue Jan 19 00:59:59 CET 2038	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	3b5074b1b5d032e5620f69f9f700ff0e
					CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Wed Feb 12 01:00:00 CET 2014	Mon Feb 12 00:59:59 CET 2029
					CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Jan 19 01:00:00 CET 2010	Tue Jan 19 00:59:59 CET 2038

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 21, 2020 09:27:22.493100882 CET	587	49748	198.54.122.60	192.168.2.7	220 PrivateEmail.com prod Mail Node
Nov 21, 2020 09:27:22.497212887 CET	49748	587	192.168.2.7	198.54.122.60	EHLO 715575
Nov 21, 2020 09:27:22.664596081 CET	587	49748	198.54.122.60	192.168.2.7	250-mta-13.privateemail.com 250-PIPELINING 250-SIZE 81788928 250-ETRN 250-AUTH PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 STARTTLS
Nov 21, 2020 09:27:22.665035963 CET	49748	587	192.168.2.7	198.54.122.60	STARTTLS
Nov 21, 2020 09:27:22.832288980 CET	587	49748	198.54.122.60	192.168.2.7	220 Ready to start TLS
Nov 21, 2020 09:27:25.036874056 CET	587	49749	198.54.122.60	192.168.2.7	220 PrivateEmail.com prod Mail Node
Nov 21, 2020 09:27:25.037481070 CET	49749	587	192.168.2.7	198.54.122.60	EHLO 715575
Nov 21, 2020 09:27:25.201838970 CET	587	49749	198.54.122.60	192.168.2.7	250-mta-13.privateemail.com 250-PIPELINING 250-SIZE 81788928 250-ETRN 250-AUTH PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 STARTTLS
Nov 21, 2020 09:27:25.202136040 CET	49749	587	192.168.2.7	198.54.122.60	STARTTLS
Nov 21, 2020 09:27:25.366183996 CET	587	49749	198.54.122.60	192.168.2.7	220 Ready to start TLS

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: QRN-CLJC-06112020149.PDF.exe PID: 6128 Parent PID: 5656

General

Start time:	09:25:47
Start date:	21/11/2020
Path:	C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe'
Imagebase:	0xd40000
File size:	813568 bytes
MD5 hash:	CDEFE555B30AA451BE1C4B519CCAA9A3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.248253061.00000000034D1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.248835494.00000000044D4000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.248377338.0000000003525000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 5500 Parent PID: 6128

General

Start time:	09:25:49
Start date:	21/11/2020
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XwhZikir' /XML 'C:\Users\user\AppData\Local\Temp\tmpF5B4.tmp'
Imagebase:	0x280000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4480 Parent PID: 5500

General

Start time:	09:25:50
Start date:	21/11/2020
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: QRN-CLJC-06112020149.PDF.exe PID: 4664 Parent PID: 6128

General

Start time:	09:25:50
Start date:	21/11/2020
Path:	C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe
Imagebase:	0x690000
File size:	813568 bytes
MD5 hash:	CDEFE555B30AA451BE1C4B519CCAA9A3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.504281771.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: QRN-CLJC-06112020149.PDF.exe PID: 6128 Parent PID: 5656 QRN-CLJC-06112020149.PDF.exeCOMMON

Executed Functions

Function 05BB101B, Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 05BB109B

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 655449d68cc2f428f66a357d5446fe7e7cbbe5499c65f8ecf698e628c497bde2
Instruction ID: e6588e522ae2a21d1d4a9ea5587add792419c41e0b8067bf3a3436c002022cbf
Opcode Fuzzy Hash: 655449d68cc2f428f66a357d5446fe7e7cbbe5499c65f8ecf698e628c497bde2
Instruction Fuzzy Hash: E72180755097C49FEB128F25DC44BA2BFB4EF06210F0885DAE9858B163D2B5A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05BB119D, Relevance: 1.6, APIs: 1, Instructions: 57nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 05BB1209

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: ae35d83287dd8fb85b29c5f1800d02850a080e036366e9f9ea4dec9f692a669c
Instruction ID: 2b7a9f069d2c6fee4d9f5fb757f5e3fad07e18a48b61550f1896a90debd28941
Opcode Fuzzy Hash: ae35d83287dd8fb85b29c5f1800d02850a080e036366e9f9ea4dec9f692a669c
Instruction Fuzzy Hash: AB118E725097C09FDB228B15DC45AA2FFB4EF06314F0984DAED848F163D2B5A908DB62

Uniqueness

Uniqueness Score: -1.00%

Function 05BB1052, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 05BB109B

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 95a66c4f90f06c5765d9b2ebcc4af27f6383fa073b00a657dde3ff60791b2c93
Instruction ID: 580a2762ab53614840f5b4856635d820a374e50e5bbb53cf4491224589a16d08
Opcode Fuzzy Hash: 95a66c4f90f06c5765d9b2ebcc4af27f6383fa073b00a657dde3ff60791b2c93
Instruction Fuzzy Hash: 69115E355042449FEB20CF59D884BA6FBE4EF04220F08C4AADD45CB652D3B5E418CB61

Uniqueness

Uniqueness Score: -1.00%

Function 016FB0BE, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,00000E2C,?,?), ref: 016FB10E

Memory Dump Source

Source File: 00000000.00000002.247488647.00000000016FA000.00000040.00000001.sdmp, Offset: 016FA000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 1063ce0a337bd8b76f64708e3563125781ae4db4449584c4a069b03e864a454a
Instruction ID: d0544e150239c245b353ed11322429597cf57784b6163d59018b4fc1a3ffe407
Opcode Fuzzy Hash: 1063ce0a337bd8b76f64708e3563125781ae4db4449584c4a069b03e864a454a
Instruction Fuzzy Hash: 03016275500600ABD610DF1ADC86B36FBE8FB88B20F14815AED085B741D675F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 05BB11CE, Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 05BB1209

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 502dd67f5e206da9d7f033f96b8222883159bfe05de7e82a7da7cc8629100470
Instruction ID: bb689d06c533781578930262527c487220a9c915eda43f774aca08303c41e5fd
Opcode Fuzzy Hash: 502dd67f5e206da9d7f033f96b8222883159bfe05de7e82a7da7cc8629100470
Instruction Fuzzy Hash: 64018F35500640DFEB20CF49E884B75FFA0EF08720F08C59ADD894B216C3F5A418CB62

Uniqueness

Uniqueness Score: -1.00%

Function 030D0A3F, Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e1e7e43b1a155138251b1567cb22939d65574815093a72febb776c6ec2f6ebe
Instruction ID: c0f2c3707af6201e1963153a3eb1908abfb4c943592355197218c5795489e762
Opcode Fuzzy Hash: 6e1e7e43b1a155138251b1567cb22939d65574815093a72febb776c6ec2f6ebe
Instruction Fuzzy Hash: 3F12AF74E012289FDB64DFA9DD50B9DBBB2BF88304F1080A9D609AB351EB715E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 030D0AC8, Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0ba50d407823c4fe0ed0f37be4d30e14acc1ce9af7aaacd3ed0cf28c232fe77
Instruction ID: ea6c263a6ea22c767a4c4eb475849dd34f8a1fe487a37dd86633f57ceec90878
Opcode Fuzzy Hash: c0ba50d407823c4fe0ed0f37be4d30e14acc1ce9af7aaacd3ed0cf28c232fe77
Instruction Fuzzy Hash: DA027C74E002289FDB65DFA9DD50BDDFBB2BF88300F1080A9D609AB255EA715E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 030D1C09, Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f4a68041ad21d1779c6c217762b6b94986e2da495a7dc49c6e40c3813fc849d
Instruction ID: 73f7141a8324e0764efa3adfc7411d950a649830b8cb5feee4730be593094718
Opcode Fuzzy Hash: 7f4a68041ad21d1779c6c217762b6b94986e2da495a7dc49c6e40c3813fc849d
Instruction Fuzzy Hash: D2A10674D06308DFDB98DFA9D444AADBBF2FF89310F2494AAD405AB265DB305981CF14

Uniqueness

Uniqueness Score: -1.00%

Function 030D2198, Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db9934fd555d9e4f5e85e45357daa868c91fa10a218d7bb59f74cf8e01a5e382
Instruction ID: ff8914f3c65c7f66f77502b9a3f5fa7ad41424c83bfc69ccb6b7c5575bb286ff
Opcode Fuzzy Hash: db9934fd555d9e4f5e85e45357daa868c91fa10a218d7bb59f74cf8e01a5e382
Instruction Fuzzy Hash: CF91ED70D01218CFDB64CFAAC844BEEBBF6BF89300F4488A9D419A7240DB745A86CF10

Uniqueness

Uniqueness Score: -1.00%

Function 030D26E4, Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91c1fc2af8d08ab5ee9340f28b34f43274bfce0b2265b5f96aed7b3e8feb6d5e
Instruction ID: 2733f1a4dde1f0c59c942f2c3b2757ee57e76e41d1189aa88f911003cd180deb
Opcode Fuzzy Hash: 91c1fc2af8d08ab5ee9340f28b34f43274bfce0b2265b5f96aed7b3e8feb6d5e
Instruction Fuzzy Hash: 9F815974D02209CFCB14CFA9D484A9EFBFABF48324F54895AD419B7398D7309942CB55

Uniqueness

Uniqueness Score: -1.00%

Function 030D1CE0, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94e5c70d5c323204e74e70d3365770d903bda5869f32955fdde538087ec736c6
Instruction ID: 6cb4081bcff39de695ce5ea02d96863bcd5c91bcb3174e86f78d8790a2ff3d6f
Opcode Fuzzy Hash: 94e5c70d5c323204e74e70d3365770d903bda5869f32955fdde538087ec736c6
Instruction Fuzzy Hash: 0981E6B4E06308DFDB58DFA9D484AADBBF2BF89310F24846AD415AB355DB305941CF14

Uniqueness

Uniqueness Score: -1.00%

Function 030D1CF0, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcf697d4499fc0f8a0c05d02b772c77b09a5aa909c21b108495b90ed1da6b586
Instruction ID: 4f749a9a750122fb6640e740c45f8b70e59cec07dde1698214a335eebd624e02
Opcode Fuzzy Hash: fcf697d4499fc0f8a0c05d02b772c77b09a5aa909c21b108495b90ed1da6b586
Instruction Fuzzy Hash: 0D81D474E02308DFDB58DFA9D484AADBBF2BF89310F24846AD419AB355DB309981CF15

Uniqueness

Uniqueness Score: -1.00%

Function 030D2131, Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cebf06acf0cc5cf241598d310f3a01a097e89773ba99a5bbf05bdf86152f94be
Instruction ID: dae92184c0ab00a972626e11917fa61d0f8a97d7a03005815793de1b16e5d264
Opcode Fuzzy Hash: cebf06acf0cc5cf241598d310f3a01a097e89773ba99a5bbf05bdf86152f94be
Instruction Fuzzy Hash: 5471F2B4D05318CFDB64CFAAC8447EDBBF6BB89300F14C8AAD519A7241DB345A868F11

Uniqueness

Uniqueness Score: -1.00%

Function 030D2189, Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2af23b2e4d804f105892807cce9574dc1209e11e76d190c7d7130315eaed9f58
Instruction ID: f608ab32c468db38a6a4afcc81fb12de03d6336c279c237d47d1d184fc269943
Opcode Fuzzy Hash: 2af23b2e4d804f105892807cce9574dc1209e11e76d190c7d7130315eaed9f58
Instruction Fuzzy Hash: 8371F274D05318CFDB24CFAAC8447EDBBF6BF89300F1488AAC559A7251DB345A868F11

Uniqueness

Uniqueness Score: -1.00%

Function 05C38FEB, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eddf493127b4eda549716c728dff075d3417782aff0bf1893e96e08eb3c4eba0
Instruction ID: be88a99fa2514db25c910d889e4c5f26018c8352068760039855b341d302faec
Opcode Fuzzy Hash: eddf493127b4eda549716c728dff075d3417782aff0bf1893e96e08eb3c4eba0
Instruction Fuzzy Hash: 1C11AB75E051288FCB60CEA8D891BE8F7B5AB4A314F1084EAEA4DE3251D7319A84CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C3886D, Relevance: 3.8, Strings: 3, Instructions: 47COMMON

Download Yara Rule

Strings

$, xrefs: 05C385E5
!, xrefs: 05C3887A
#, xrefs: 05C38933

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID: !$#$$
API String ID: 0-3795006478
Opcode ID: 787c036753ad0ff75c53909a227f18aa0722d342b20d9a7e1878e91a5746ec5e
Instruction ID: 3be625a064236942d6b6aea0bd8b0f045c3064117666d8da58a75f4cfda0bcb5
Opcode Fuzzy Hash: 787c036753ad0ff75c53909a227f18aa0722d342b20d9a7e1878e91a5746ec5e
Instruction Fuzzy Hash: E321C47484626DCFEB64DF68C859BECBBB1BB49304F0006EAD00AA6290DB754AC0CF05

Uniqueness

Uniqueness Score: -1.00%

Function 05C38D73, Relevance: 2.6, Strings: 2, Instructions: 51COMMON

Download Yara Rule

Strings

', xrefs: 05C38D84
", xrefs: 05C38804

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID: "$'
API String ID: 0-2422873937
Opcode ID: dbd6955c3989802de60066a0ac3a8a5849c96f393957332a8aad33725b5acb1e
Instruction ID: 291476557a4afd779a6b82a487ce68b527027f396ee7602a73dd2510b3e7cdf4
Opcode Fuzzy Hash: dbd6955c3989802de60066a0ac3a8a5849c96f393957332a8aad33725b5acb1e
Instruction Fuzzy Hash: 64110471A05218CFDB14CF69C884BEDBBB6FF4A304F5880AAE419AB251C7349A81CF15

Uniqueness

Uniqueness Score: -1.00%

Function 05C38D93, Relevance: 2.5, Strings: 2, Instructions: 36COMMON

Download Yara Rule

Strings

*, xrefs: 05C38E0C
(, xrefs: 05C38ADE

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID: ($*
API String ID: 0-3813467706
Opcode ID: 8a323405b58942afc69e3a5be0833843fc4817e7a5244ee48d8e2cbd47c990c8
Instruction ID: 2f5514030a00dae7d2bf65117b94781696a20ba509b43f3f96c886577b36511f
Opcode Fuzzy Hash: 8a323405b58942afc69e3a5be0833843fc4817e7a5244ee48d8e2cbd47c990c8
Instruction Fuzzy Hash: 8A01CA31901229DFDB60CF64CD98BE9BBB1BB09304F0482D9E409A3291CB35AA89DF04

Uniqueness

Uniqueness Score: -1.00%

Function 05BB0CC3, Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 05BB0D73

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4da2a1a8719a919720dc7e5804bf0c386dbfd40e042e484f7ccb13bd2fa30e4a
Instruction ID: f78fc40bf33c9da95f6a101256484b532740663b033f0fe9c7f45b0fe1b3b6db
Opcode Fuzzy Hash: 4da2a1a8719a919720dc7e5804bf0c386dbfd40e042e484f7ccb13bd2fa30e4a
Instruction Fuzzy Hash: 1D31A2715043846FE7228B25DC45FA6BFA8EF46710F0884AEE985CB192D264A909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 016FB074, Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,00000E2C,?,?), ref: 016FB10E

Memory Dump Source

Source File: 00000000.00000002.247488647.00000000016FA000.00000040.00000001.sdmp, Offset: 016FA000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 6c2696e99f7f08e0aeb3cc9b191a04268763f27eab57bfca7841702aa00a6fc2
Instruction ID: 7cca444591259c668120ce8177a8cb3fdc23b1126ca857e7e8dab79cde5b104b
Opcode Fuzzy Hash: 6c2696e99f7f08e0aeb3cc9b191a04268763f27eab57bfca7841702aa00a6fc2
Instruction Fuzzy Hash: 8E31B675509380AFD713CB25CC41F22BFB4EF87614F0A81DBE9848B253D224E816C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 016FAB26, Relevance: 1.6, APIs: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E2C), ref: 016FABD5

Memory Dump Source

Source File: 00000000.00000002.247488647.00000000016FA000.00000040.00000001.sdmp, Offset: 016FA000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: cbf41aaf06c745db734286418ec1f79a69d69ef0756230ed349acfd42e1cc272
Instruction ID: f02f0216dcbae462619d4b9764989863082952e5f720620761c0824a4c783b4d
Opcode Fuzzy Hash: cbf41aaf06c745db734286418ec1f79a69d69ef0756230ed349acfd42e1cc272
Instruction Fuzzy Hash: 7131A2725043846FE7228B65CC45FA7BFECEF05710F0885AEED849B152D364A549CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05BB08BC, Relevance: 1.6, APIs: 1, Instructions: 90fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 05BB095D

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b659fe865673d66134eca183301ee313c3cf290a96d5e83f426979dcdc288d7e
Instruction ID: 018f51ac6f15dffee6ec2867892470952109cd2fb6a3d15357d25b40b6b7aadf
Opcode Fuzzy Hash: b659fe865673d66134eca183301ee313c3cf290a96d5e83f426979dcdc288d7e
Instruction Fuzzy Hash: 6B316D71504284AFE722CF65DD44F66BFE8EF45610F0884AEE9858B252D3B5E409CB61

Uniqueness

Uniqueness Score: -1.00%

Function 016FBE5A, Relevance: 1.6, APIs: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 016FBEE6

Memory Dump Source

Source File: 00000000.00000002.247488647.00000000016FA000.00000040.00000001.sdmp, Offset: 016FA000, based on PE: false

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 6a0228c49cc83862b6819d90a8c74c3dabcd98f5ba624cd9bd647732954cade1
Instruction ID: b26439535a4cf6767f127e8f6ea92083fda5f2052a770080bcedfb75f10adda1
Opcode Fuzzy Hash: 6a0228c49cc83862b6819d90a8c74c3dabcd98f5ba624cd9bd647732954cade1
Instruction Fuzzy Hash: 51316C6150E3C05FD7138B28DC656A2BFB89F07214F0D84DFE984CF2A3D2299848C762

Uniqueness

Uniqueness Score: -1.00%

Function 016FBABE, Relevance: 1.6, APIs: 1, Instructions: 89synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 016FBB65

Memory Dump Source

Source File: 00000000.00000002.247488647.00000000016FA000.00000040.00000001.sdmp, Offset: 016FA000, based on PE: false

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 34eb1a3d3689d4a28af27802bd6bfbbe67739dbfea3de0eb914ddb629f7dcb56
Instruction ID: 6d23954a379e9692dd1f7fc09b5c72ce4277ae7dc9c631eb17e3559c9cd75961
Opcode Fuzzy Hash: 34eb1a3d3689d4a28af27802bd6bfbbe67739dbfea3de0eb914ddb629f7dcb56
Instruction Fuzzy Hash: FE316171509784AFE722CF25DC85B56FFE8EF06210F18849EE984CB293D365A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 016FAC1D, Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,7DFF3024,00000000,00000000,00000000,00000000), ref: 016FACD8

Memory Dump Source

Source File: 00000000.00000002.247488647.00000000016FA000.00000040.00000001.sdmp, Offset: 016FA000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 9b4f49ca748283f09bad0fa6f06f6ef59032fed0a5f6ae6ea4e245a08451c420
Instruction ID: 85df764299be7471e1c0cfde2a595cc2364136109c3856c004b4b8827ffc1106
Opcode Fuzzy Hash: 9b4f49ca748283f09bad0fa6f06f6ef59032fed0a5f6ae6ea4e245a08451c420
Instruction Fuzzy Hash: 943181761097845FE722CB65CC44FA2BFE8EF06610F08849EE989CB253D364E549CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05BB00BE, Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

LsaOpenPolicy.ADVAPI32(?,00000E2C), ref: 05BB015B

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: OpenPolicy
String ID:
API String ID: 2030686058-0
Opcode ID: 9a9d6efb96373062bfee312a5445b964beab963ef9139848e601f46de73f0238
Instruction ID: b56e6da87e674e0bbc2c0856d386c207155d8760caf977b1ad38bb41b02f04cb
Opcode Fuzzy Hash: 9a9d6efb96373062bfee312a5445b964beab963ef9139848e601f46de73f0238
Instruction Fuzzy Hash: 67218D72504344AFE721CF25DC49FA6FFA8EF45710F1884AAED84DB192D264A948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05BB07DA, Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNELBASE(?,00000E2C,?,?), ref: 05BB0886

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: FileNameTemp
String ID:
API String ID: 745986568-0
Opcode ID: 48b6aa9e60728fbb6e6f287506eda795cedf969d5d454d1f8712e964a2a26215
Instruction ID: 9222ef31d0e51151e73bc4d86f66f0c0793d85e3d2917753ed4d6e60a75b2159
Opcode Fuzzy Hash: 48b6aa9e60728fbb6e6f287506eda795cedf969d5d454d1f8712e964a2a26215
Instruction Fuzzy Hash: 7B318E714093C06FD7138B25DC51B62BFB4EF47620F0A81DBEC849F553D224A919D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05BB0357, Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(?,00000E2C,7DFF3024,00000000,00000000,00000000,00000000), ref: 05BB03EC

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: cb7f225c5053f38bc78b7c09a243e8a8c043320a84f1b7b17fb78e360fc9a16c
Instruction ID: 1a08b6838b04bee65854623cd70aa824cb86ed44cf5cca86567538e40acc6c64
Opcode Fuzzy Hash: cb7f225c5053f38bc78b7c09a243e8a8c043320a84f1b7b17fb78e360fc9a16c
Instruction Fuzzy Hash: 12217E72504384AFEB22CB65DC45FA7FFF8EF06310F0884AEE985DB152D265A548CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05BB06F6, Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,?), ref: 05BB079A

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 698ba8f009e1a69d2bc7f732a3682090c1053b618174c1362b4ca48697883ab3
Instruction ID: cd6c10f4714cef5928bb3b7dacd2323be1e9fb1ef1791ec39114ce81f7ab8007
Opcode Fuzzy Hash: 698ba8f009e1a69d2bc7f732a3682090c1053b618174c1362b4ca48697883ab3
Instruction Fuzzy Hash: AA316D7540E3C45FDB138B64C859AA2BFB4AF47314F0E84DBD8848F163D2655809CB72

Uniqueness

Uniqueness Score: -1.00%

Function 05BB09B4, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,7DFF3024,00000000,00000000,00000000,00000000), ref: 05BB0A49

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 6ba17bb7e04f2ece16d127d350661bd0ff7e4503d825a296eb48e277e14ed9bf
Instruction ID: 7cb43cbc9a6c31f12368c547026cd75b0fa8ec38cb5816d4173e295ed8c4824d
Opcode Fuzzy Hash: 6ba17bb7e04f2ece16d127d350661bd0ff7e4503d825a296eb48e277e14ed9bf
Instruction Fuzzy Hash: 0921F8B54097846FE7128B25DC41FB2BFACEF46720F1885DAED848B193D2646909C771

Uniqueness

Uniqueness Score: -1.00%

Function 05BB0CF6, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 05BB0D73

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 450d94388602b2cbb99f7d18dd849a59861b62d226b0cab8c4b9b518f1015382
Instruction ID: 0bc82f01a7f5f0e0cc4b41a67606396e60c5d0b2ef82ac7533d12f8a8cadcccb
Opcode Fuzzy Hash: 450d94388602b2cbb99f7d18dd849a59861b62d226b0cab8c4b9b518f1015382
Instruction Fuzzy Hash: 21218E72500604AFEB219F69DC45FBBFBE8EF08720F04886AED859A151D6B4A5088B61

Uniqueness

Uniqueness Score: -1.00%

Function 05BB0DD1, Relevance: 1.6, APIs: 1, Instructions: 79fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 05BB0E58

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 41204bda6b26aa11c616145b77a1cda922b8086c5ae097851979957295eaa07f
Instruction ID: 3a6f7242b96725e15cdfb34dbb7c8a30768800d541d4f0b26569d8e9239736f8
Opcode Fuzzy Hash: 41204bda6b26aa11c616145b77a1cda922b8086c5ae097851979957295eaa07f
Instruction Fuzzy Hash: FB2181765093C49FD712CB25DC55BA2BFA4EF07210F0D84DADD858F2A3D2A5A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05BB08DE, Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 05BB095D

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 09b19f9184ec1ffd7e9ff4b7f7e19121d89cb3afacebaddce832e4292fa416e9
Instruction ID: 35ec5cb792876a47ae567dd98264da98d183d506e414fa9a1b389ace672ccf12
Opcode Fuzzy Hash: 09b19f9184ec1ffd7e9ff4b7f7e19121d89cb3afacebaddce832e4292fa416e9
Instruction Fuzzy Hash: 3B216D71504244AFFB21DF6ADD49BB6FBE8EF08610F1884AEE9858B251D3B1E404CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05BB0A84, Relevance: 1.6, APIs: 1, Instructions: 75fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,7DFF3024,00000000,00000000,00000000,00000000), ref: 05BB0B15

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: a63e803fae7280b2517c069f8510b63229575cdb608d183d2ffaf29bc874270c
Instruction ID: 226a9c8da5dae6ec37a27e1686281f2f983f08d75b82df87309cfc6d2d981180
Opcode Fuzzy Hash: a63e803fae7280b2517c069f8510b63229575cdb608d183d2ffaf29bc874270c
Instruction Fuzzy Hash: 74219072409380AFE7228B25DC45FA6BFB8EF46314F0884DFE9849B153C265A409CB72

Uniqueness

Uniqueness Score: -1.00%

Function 016FAB56, Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E2C), ref: 016FABD5

Memory Dump Source

Source File: 00000000.00000002.247488647.00000000016FA000.00000040.00000001.sdmp, Offset: 016FA000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 2118f93a16ea14fabcbdab722f8cc18b41969fa63995d5ab25bef1ee2f474a23
Instruction ID: 573815f5f81f73fa0c6518dc96cdb863b631c652480370d4a634ec321ab70aba
Opcode Fuzzy Hash: 2118f93a16ea14fabcbdab722f8cc18b41969fa63995d5ab25bef1ee2f474a23
Instruction Fuzzy Hash: B6219F72500604AFE7219F69DC84F6AFBECEF08710F04895EEE859B241D774E5488A71

Uniqueness

Uniqueness Score: -1.00%

Function 016FBAF2, Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 016FBB65

Memory Dump Source

Source File: 00000000.00000002.247488647.00000000016FA000.00000040.00000001.sdmp, Offset: 016FA000, based on PE: false

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 0f656b4c0165938bd5723537d36882b3ed141d754c104e6a591e58f3e5ee47c6
Instruction ID: 6c9ea745230e5a8082058764d15a05862ada327f1f97a27eaf5f407f2306802c
Opcode Fuzzy Hash: 0f656b4c0165938bd5723537d36882b3ed141d754c104e6a591e58f3e5ee47c6
Instruction Fuzzy Hash: E9218E71604244AFE721DF29DC85B66FBE8EF04320F1884AEEE858B246D775E405CB76

Uniqueness

Uniqueness Score: -1.00%

Function 05BB00EA, Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

LsaOpenPolicy.ADVAPI32(?,00000E2C), ref: 05BB015B

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: OpenPolicy
String ID:
API String ID: 2030686058-0
Opcode ID: 5f8a8f1c554e50747621b45e677ad6efe06c8856cc20cebd22175f1c3cb04b05
Instruction ID: ec67858c603eff0e110b43c5d47e8ceea033784c66d72da1b85453caca09d0d3
Opcode Fuzzy Hash: 5f8a8f1c554e50747621b45e677ad6efe06c8856cc20cebd22175f1c3cb04b05
Instruction Fuzzy Hash: 3A216F71500204AEFB20DF69DC45FBAFBA8EF44710F14846AED859B241D6B4A5048A71

Uniqueness

Uniqueness Score: -1.00%

Function 05BB0E9F, Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 05BB0F1A

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 34297d4806243a595326204e0721dc227545acddc5b8aedeeb16f8b89fafeabd
Instruction ID: fd055b5738fb000f83d67b3a3a14c94f6a28728db07604517f7978459740c6e9
Opcode Fuzzy Hash: 34297d4806243a595326204e0721dc227545acddc5b8aedeeb16f8b89fafeabd
Instruction Fuzzy Hash: 112183715093845FE721CF25DC85BA7BFE8EF46210F0984EAE945CF262D2B5E508CB61

Uniqueness

Uniqueness Score: -1.00%

Function 016FAC5E, Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,7DFF3024,00000000,00000000,00000000,00000000), ref: 016FACD8

Memory Dump Source

Source File: 00000000.00000002.247488647.00000000016FA000.00000040.00000001.sdmp, Offset: 016FA000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: ebcd0d1658212046ee61beaed4496d777e009ec80b465a3f76b4a50e97e54ecd
Instruction ID: 08d1fdad591a51c1369b83b452fc842be6fedeb0ba9124a8d12bac504f19d597
Opcode Fuzzy Hash: ebcd0d1658212046ee61beaed4496d777e009ec80b465a3f76b4a50e97e54ecd
Instruction Fuzzy Hash: 56215E76600604AFEB21CF5ADC85F66FBECEF08710F08856EEA49DB251D760E449CA71

Uniqueness

Uniqueness Score: -1.00%

Function 05BB0382, Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(?,00000E2C,7DFF3024,00000000,00000000,00000000,00000000), ref: 05BB03EC

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 4fb06e7e0f5248877cb51f1fe6cef86d36dad76eaee3afacecd64032864d2e32
Instruction ID: 753bf44b2d29970103e0c1e9c87dcba70bc2be3a6eebe5bef34bd5df8c4b72a6
Opcode Fuzzy Hash: 4fb06e7e0f5248877cb51f1fe6cef86d36dad76eaee3afacecd64032864d2e32
Instruction Fuzzy Hash: 30116D71500204AFEB21DB6ADC85FBBFBE8EF08320F04846AED459A251D6A4A4458B71

Uniqueness

Uniqueness Score: -1.00%

Function 05BB10E8, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 05BB1154

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 095d320de386c6699ae922818097c3d3c48aab5872f64950de5da8c21d11659e
Instruction ID: b913a619d96731c5cc3feecb7fa941641e51acae05666c8f755ebe9e05f1f6e5
Opcode Fuzzy Hash: 095d320de386c6699ae922818097c3d3c48aab5872f64950de5da8c21d11659e
Instruction Fuzzy Hash: 1421A4715093C05FDB128B25DC547A2BFB4EF07224F0D80DADC858F263D275A508CB62

Uniqueness

Uniqueness Score: -1.00%

Function 016FB3B9, Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

LoadLibraryShim.MSCOREE(?,?,?,?), ref: 016FB435

Memory Dump Source

Source File: 00000000.00000002.247488647.00000000016FA000.00000040.00000001.sdmp, Offset: 016FA000, based on PE: false

Similarity

API ID: LibraryLoadShim
String ID:
API String ID: 1475914169-0
Opcode ID: cd6b808d9768f16c293041bb8339991bef3b77fcb221ea8dfbcb5f95e757c094
Instruction ID: cfdbd5c80209b5dabe50bbc9bfdd400cfaa215bfa16626546615ef625e9449c0
Opcode Fuzzy Hash: cd6b808d9768f16c293041bb8339991bef3b77fcb221ea8dfbcb5f95e757c094
Instruction Fuzzy Hash: 912160755097809FD7228B19DC45B62FFE8EF46614F08809EEE84CB253D365E909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 05BB0006, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?), ref: 05BB006F

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 0532a4647acffb4faff00439a18e6634ea4133ab4b36ae143db3722eb395e38f
Instruction ID: 353bb163205975247ea20ae66931aeffc3288a153bc84181e6740d8598748574
Opcode Fuzzy Hash: 0532a4647acffb4faff00439a18e6634ea4133ab4b36ae143db3722eb395e38f
Instruction Fuzzy Hash: A111A2715093845FD7128B25DC85B66BFE8EF46210F0980EAED85CF253D2A5A848CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05BB12E1, Relevance: 1.6, APIs: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 05BB1355

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 122348e3f0f31b4252419b0d9bdc7464fae12dbd038e2d428915118ca41559b8
Instruction ID: 67a3b4d85987d66793f2fecda64e5597b92524697357d239ffa70c54882bf27a
Opcode Fuzzy Hash: 122348e3f0f31b4252419b0d9bdc7464fae12dbd038e2d428915118ca41559b8
Instruction Fuzzy Hash: 99218C714093C0AFDB238B25DC54AA2FFB4EF07210F0D85DBE9848F563D265A818DB62

Uniqueness

Uniqueness Score: -1.00%

Function 016FA5AF, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 016FA61A

Memory Dump Source

Source File: 00000000.00000002.247488647.00000000016FA000.00000040.00000001.sdmp, Offset: 016FA000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e394f5c2f71c763859bddd9daa4154d2e4dadd7761a4852f6e07f9646ffe54f8
Instruction ID: cad7fdcca173ec343599d2874970ce1541cef6a2509f8527428c490b3d603ead
Opcode Fuzzy Hash: e394f5c2f71c763859bddd9daa4154d2e4dadd7761a4852f6e07f9646ffe54f8
Instruction Fuzzy Hash: 4A117271409380AFDB228F55DC44A62FFF4EF4A614F08859EEE858B263C375A418DB61

Uniqueness

Uniqueness Score: -1.00%

Function 05BB0AB6, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,7DFF3024,00000000,00000000,00000000,00000000), ref: 05BB0B15

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 03ff9ca461bb7892fb0149b031c6bc173f88c7090b477d7518a4f0af0a427bed
Instruction ID: 003275bb5306303f3c4c0d30baa137c1dc66812bd6e806966e0486376123f06e
Opcode Fuzzy Hash: 03ff9ca461bb7892fb0149b031c6bc173f88c7090b477d7518a4f0af0a427bed
Instruction Fuzzy Hash: 6B11B271500204AFEB21DF55DC45FB6FBE8EF08724F1484AAEE499B251C2B4A408CB71

Uniqueness

Uniqueness Score: -1.00%

Function 016FA65A, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 016FA6CC

Memory Dump Source

Source File: 00000000.00000002.247488647.00000000016FA000.00000040.00000001.sdmp, Offset: 016FA000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 0ca9ec8d531dac0aa2085c02d89971971f42edbd075db7861fed95dd805669b7
Instruction ID: 3248d34c6ad56dd4dffa633f21bfec0f986fe35ac66f51dbd8527fbc50c7c8e8
Opcode Fuzzy Hash: 0ca9ec8d531dac0aa2085c02d89971971f42edbd075db7861fed95dd805669b7
Instruction Fuzzy Hash: 371147754093C49FD7138B25DC94A52BFB4DF07224F0A80DBD9858F2A3D2699948CB72

Uniqueness

Uniqueness Score: -1.00%

Function 016FA2D6, Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 016FA32C

Memory Dump Source

Source File: 00000000.00000002.247488647.00000000016FA000.00000040.00000001.sdmp, Offset: 016FA000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 7f5569b94d237fdf4d689fbbd884e26b9198447d918a01639ea0dd841ef74230
Instruction ID: c81d41ce49a8ae45534a065ee240c308cef2ff6ef76e6557b9c660b729d4d9a0
Opcode Fuzzy Hash: 7f5569b94d237fdf4d689fbbd884e26b9198447d918a01639ea0dd841ef74230
Instruction Fuzzy Hash: 2B1182715093809FDB128B25DC94B56BFA8DF46224F0880EBED858F653D2759408CB62

Uniqueness

Uniqueness Score: -1.00%

Function 016FBE9E, Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 016FBEE6

Memory Dump Source

Source File: 00000000.00000002.247488647.00000000016FA000.00000040.00000001.sdmp, Offset: 016FA000, based on PE: false

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 7fae8fc5b75a39f229297d25575c69b718aacb03d812dc9a4d756e0f86f06d0b
Instruction ID: 38f7fa7b0db4302ff6a68b7d91017a0da407614a03e6c71cc802f4aa5a5f17ba
Opcode Fuzzy Hash: 7fae8fc5b75a39f229297d25575c69b718aacb03d812dc9a4d756e0f86f06d0b
Instruction Fuzzy Hash: F4113C71A002408FEB20CF69EC85766FBD8EF04660F08846EEE49CB352D375E404CA71

Uniqueness

Uniqueness Score: -1.00%

Function 05BB0ED2, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 05BB0F1A

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 220c2f1c4d9e69b4bba8f98d4f4b080f0f931d57060188243d9fab5eee8626aa
Instruction ID: facf67386a13dd6607346654b37b49868f8a7f9aafdb6da13b8fc36732f1803c
Opcode Fuzzy Hash: 220c2f1c4d9e69b4bba8f98d4f4b080f0f931d57060188243d9fab5eee8626aa
Instruction Fuzzy Hash: 45115271A046448FEB20DF69D849BB7FBD8EF44620F0884AADD49CB641D6F5E504CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05BB09F6, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,7DFF3024,00000000,00000000,00000000,00000000), ref: 05BB0A49

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: b422effef070a4fd4c951e79c853630df52234a08526fc330a0ca848da1d9022
Instruction ID: 8853dda2b3e4d781c8c2900d96258eea87a19d5fd6f93bb1b24f253561f6ba72
Opcode Fuzzy Hash: b422effef070a4fd4c951e79c853630df52234a08526fc330a0ca848da1d9022
Instruction Fuzzy Hash: E101C071501204AFE720DB1ADC85FB7FBD8EF08720F18C4AAED489B241D2F4A5048A71

Uniqueness

Uniqueness Score: -1.00%

Function 016FA9F0, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32 ref: 016FAA4A

Memory Dump Source

Source File: 00000000.00000002.247488647.00000000016FA000.00000040.00000001.sdmp, Offset: 016FA000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: bccb77dbe28491ba27f31ebfa05f48dec9c4cedb82ff08734d857aa4bf5b6314
Instruction ID: 3bafed7bd27d3e2396740e1a3486874e4c2c72cdaaebaa2ecb60e72b88aa17ce
Opcode Fuzzy Hash: bccb77dbe28491ba27f31ebfa05f48dec9c4cedb82ff08734d857aa4bf5b6314
Instruction Fuzzy Hash: E9117C314097849FD7228F55DC84A52FFB4EF06620F08C59AEE894B263D375A818CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05BB0032, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?), ref: 05BB006F

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 589010ee0c63fc7662e735e45198246e698601901123f190330460b5bc3fe93a
Instruction ID: cb46ec892b81e35e712bd1f93c0e2b5dc74190d34ddf66ba3b75b5a3843c0cb6
Opcode Fuzzy Hash: 589010ee0c63fc7662e735e45198246e698601901123f190330460b5bc3fe93a
Instruction Fuzzy Hash: A90196715042488FEB10DF19D8897B6FBD4EF44220F4884AADD45CB242E6F5E404CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05BB0836, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNELBASE(?,00000E2C,?,?), ref: 05BB0886

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: FileNameTemp
String ID:
API String ID: 745986568-0
Opcode ID: 96060ffaadd73484f5ee81728cfc3c203bac147b83c0e74ae96e444a2289486d
Instruction ID: 834b95372214a89666f7f8a1c56e57ee6fb696f1baa929bcc233ead574922bbf
Opcode Fuzzy Hash: 96060ffaadd73484f5ee81728cfc3c203bac147b83c0e74ae96e444a2289486d
Instruction Fuzzy Hash: 9B017171500200ABD710DF2ADC86B36FBE8FB88B20F14816AED089B641D675F515CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05BB0E1E, Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 05BB0E58

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 396deb510b19ca6ee6e8ca4a20e93fec7402673da71333ad29608470d3e3f977
Instruction ID: e5e5dc5320755669b92590af81fbe6a5c21c552513fa997c94a2f4545d8072f8
Opcode Fuzzy Hash: 396deb510b19ca6ee6e8ca4a20e93fec7402673da71333ad29608470d3e3f977
Instruction Fuzzy Hash: CD015271A042448FEB50DF29E8897B6FBD8EF04620F08C4AADD49DB256D2F5E404CB61

Uniqueness

Uniqueness Score: -1.00%

Function 016FB3EA, Relevance: 1.5, APIs: 1, Instructions: 46libraryCOMMON

Download Yara Rule

APIs

LoadLibraryShim.MSCOREE(?,?,?,?), ref: 016FB435

Memory Dump Source

Source File: 00000000.00000002.247488647.00000000016FA000.00000040.00000001.sdmp, Offset: 016FA000, based on PE: false

Similarity

API ID: LibraryLoadShim
String ID:
API String ID: 1475914169-0
Opcode ID: 754c5f3f36f9a686571243ca9779a3f2c21d320b5575f6d66fa58de7edb7d41a
Instruction ID: 8e9b9a49718c6c3c497b0d99bee20002e23191d9b56beb1d73bc6ab9710e2531
Opcode Fuzzy Hash: 754c5f3f36f9a686571243ca9779a3f2c21d320b5575f6d66fa58de7edb7d41a
Instruction Fuzzy Hash: BC016971A012409FDB20CF19DD85B22FBE8EF04620F0880AEDE898B356D375E409CA72

Uniqueness

Uniqueness Score: -1.00%

Function 016FA5D6, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 016FA61A

Memory Dump Source

Source File: 00000000.00000002.247488647.00000000016FA000.00000040.00000001.sdmp, Offset: 016FA000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2831ff6f1df1bdb9feb929e26aaf2dd26aa8e7f41a135305f00d227337d6bfa2
Instruction ID: 2a88a967a842a24a6f6f55066c87e72cf9df649c1a2d0a8168ee87fb9dfdb38d
Opcode Fuzzy Hash: 2831ff6f1df1bdb9feb929e26aaf2dd26aa8e7f41a135305f00d227337d6bfa2
Instruction Fuzzy Hash: 4F0139314006409FDB218F99E844B66FFE0EF48620F0885AEDE894B612C375A019CF61

Uniqueness

Uniqueness Score: -1.00%

Function 016FA2FA, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 016FA32C

Memory Dump Source

Source File: 00000000.00000002.247488647.00000000016FA000.00000040.00000001.sdmp, Offset: 016FA000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 4a34de510f22c410a87fc47c7b364a524d1d4d5fe5096495bf90649c45faa43b
Instruction ID: af3d008f20162e299d220f62069e9adb7a79f85b3607df495796fa9ebfba4392
Opcode Fuzzy Hash: 4a34de510f22c410a87fc47c7b364a524d1d4d5fe5096495bf90649c45faa43b
Instruction Fuzzy Hash: CC017C72A042408FDB208F59EC85766FBD4EF04620F08C4AEDE49CB352D3B5A408CA61

Uniqueness

Uniqueness Score: -1.00%

Function 05BB1122, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 05BB1154

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 1d036318131e75709de658ada1fadc6f901716afc716336e8d3aa0f7a54adb6a
Instruction ID: d62b6274dfbce2cc23609dcadc7fb077aa64c9f24a7aa276a509f74e90dd5715
Opcode Fuzzy Hash: 1d036318131e75709de658ada1fadc6f901716afc716336e8d3aa0f7a54adb6a
Instruction Fuzzy Hash: 950171716042409FDB10CF19E8857A6FBE4EF44620F18C0AADD498F652D2F5A408CB72

Uniqueness

Uniqueness Score: -1.00%

Function 05BB0762, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,?), ref: 05BB079A

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 342c14060473c4122204e1086c7a30742e48bb8ad689352af3c2d215e6a67a89
Instruction ID: c2db9ffa4c6c99873e952cc2859228101903144230d22a3a69b53ee7a552fb8e
Opcode Fuzzy Hash: 342c14060473c4122204e1086c7a30742e48bb8ad689352af3c2d215e6a67a89
Instruction Fuzzy Hash: 110171755042449FEB20DF56E848BB6FBE4EF04720F08C4AADD498B612D2F5A404CF71

Uniqueness

Uniqueness Score: -1.00%

Function 05BB131A, Relevance: 1.5, APIs: 1, Instructions: 38windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 05BB1355

Memory Dump Source

Source File: 00000000.00000002.251966025.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ed499aabee8b8c22416117a8062cd8394dbdf679146495da7488c0f2f98cfd88
Instruction ID: 6fb6f9d61902fbd1a9f235b44d6863ba0865c6b920e270a731ebfb12d83aba9a
Opcode Fuzzy Hash: ed499aabee8b8c22416117a8062cd8394dbdf679146495da7488c0f2f98cfd88
Instruction Fuzzy Hash: 0F017C31904340DFEB208F09D844BA5FFA5EF08320F08C59ADD854B622D3F5A418CB62

Uniqueness

Uniqueness Score: -1.00%

Function 016FAA12, Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32 ref: 016FAA4A

Memory Dump Source

Source File: 00000000.00000002.247488647.00000000016FA000.00000040.00000001.sdmp, Offset: 016FA000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 11eabe25323492f1d0fc98786c930ee7b974482516548599290399f05e3e871f
Instruction ID: afa5ba3a59d1f3ba49646edf6fbe21dd83e5a9b76bcc3cb28e93f2440ea5fe17
Opcode Fuzzy Hash: 11eabe25323492f1d0fc98786c930ee7b974482516548599290399f05e3e871f
Instruction Fuzzy Hash: B8018B355002448FDB208F49E984762FBA0EF04720F08C0AADE894B356C3B5A40CCB62

Uniqueness

Uniqueness Score: -1.00%

Function 016FA69A, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 016FA6CC

Memory Dump Source

Source File: 00000000.00000002.247488647.00000000016FA000.00000040.00000001.sdmp, Offset: 016FA000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 676f46f20022809bfd25f0211009ba5f369c74afecb1efc02054c6ecb7cb0f41
Instruction ID: d51573892acfbd84c6992cb4ec6dba6780062be3de8f6b40460c24d6e9cf192b
Opcode Fuzzy Hash: 676f46f20022809bfd25f0211009ba5f369c74afecb1efc02054c6ecb7cb0f41
Instruction Fuzzy Hash: F5F08C349042408FDB208F49EC84761FBA4EF44620F08C0AEDE494B356D3B5A449CA62

Uniqueness

Uniqueness Score: -1.00%

Function 05C36600, Relevance: 1.5, Strings: 1, Instructions: 274COMMON

Download Yara Rule

Strings

, xrefs: 05C36A2A

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: f3eee6d1f6367cf385e594194d2c26acc8b51d1af487d6db6564fa6f844c6ab5
Instruction ID: fc79c30a66874aa4a1b777dba57d7a1ba25da7947751516b46cf537360310363
Opcode Fuzzy Hash: f3eee6d1f6367cf385e594194d2c26acc8b51d1af487d6db6564fa6f844c6ab5
Instruction Fuzzy Hash: 33C1F874D0621CDFDB24CFA5D9897EDBBB1BB0A305F10946AE005B7290DB744A84DF16

Uniqueness

Uniqueness Score: -1.00%

Function 05C365EF, Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

, xrefs: 05C36A2A

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: df90ad88be4324d8f63758e7111d118d91bf074e8e166fa610629da04651994d
Instruction ID: 4474c647e4eb7f7d56a517777559b5902f1f72544978e1b996a16df8d249d4f5
Opcode Fuzzy Hash: df90ad88be4324d8f63758e7111d118d91bf074e8e166fa610629da04651994d
Instruction Fuzzy Hash: 44A12774D0621CDFDB24CFA5D9897EEBBB1BB0A304F1094AAD009B7290DB744A84DF16

Uniqueness

Uniqueness Score: -1.00%

Function 05C36961, Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

, xrefs: 05C36A2A

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 31d082fb965a25c7cac54c0b3d461adca8c9b35dd808e9009ac914f8a49abf92
Instruction ID: 341d7bd006a08fc00dfc7029bf02f46abb4050b8d8d030297ed0d1c712a06051
Opcode Fuzzy Hash: 31d082fb965a25c7cac54c0b3d461adca8c9b35dd808e9009ac914f8a49abf92
Instruction Fuzzy Hash: 5CA10674D0621CDFDB24CFA5D5897EDBBB1BB0A305F1094AAE009B7290DB749A84DF12

Uniqueness

Uniqueness Score: -1.00%

Function 05C36904, Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

, xrefs: 05C36A2A

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 141405909ccdd0d881dc989822637c5d9e7dd7bdb35f524758e52406958de427
Instruction ID: f66864d9072e81d8e531921913a6c46c9bf4ca6aedb6b29e2c79bd17433d0b26
Opcode Fuzzy Hash: 141405909ccdd0d881dc989822637c5d9e7dd7bdb35f524758e52406958de427
Instruction Fuzzy Hash: 0A912874D0621CDFDB24CF65D9897EDBBB1BB0A305F1098AAE005B7290DB748A84DF16

Uniqueness

Uniqueness Score: -1.00%

Function 05C366CD, Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

, xrefs: 05C36A2A

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4d4dfbb9c0c8778bb32be70e8593c28b37e3cf6e4452aa602d4794518b9acafd
Instruction ID: abb85f0ee377a34054acf5487baf5bd91e84367f61b89c9e8a55c88335ec99a1
Opcode Fuzzy Hash: 4d4dfbb9c0c8778bb32be70e8593c28b37e3cf6e4452aa602d4794518b9acafd
Instruction Fuzzy Hash: 56912874D0621CDFDB24CFA5D5897EDBBB1BB0A305F1094AAE009B7290DB749A84DF12

Uniqueness

Uniqueness Score: -1.00%

Function 05C36A9B, Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

, xrefs: 05C36A2A

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 7325572779134113c15e70c59da53748e8d28b12525159e9b6fd567925f5f19a
Instruction ID: ae7620c274037cee1039f9db1ff44a098fd4999b894b8eb37a76f99de4f5c681
Opcode Fuzzy Hash: 7325572779134113c15e70c59da53748e8d28b12525159e9b6fd567925f5f19a
Instruction Fuzzy Hash: 23912A74D0621CDFDB24CF65D5897EDBBB1BB0A305F1098AAE009B7290CB749A84DF16

Uniqueness

Uniqueness Score: -1.00%

Function 05C366B6, Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

, xrefs: 05C36A2A

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 0762750819d5beef629027bde85e5d5ec44c0a4442d7e96e8ee145b9948e357a
Instruction ID: 136fd8f94f4ba6af6c94cce402b88ed97f1c67fd6e33bd239766f0f8a34626fd
Opcode Fuzzy Hash: 0762750819d5beef629027bde85e5d5ec44c0a4442d7e96e8ee145b9948e357a
Instruction Fuzzy Hash: D5812974D0621CDFDB24CF65D5897EDBBB1BB0A305F1094AAE009B7290CB749A84DF12

Uniqueness

Uniqueness Score: -1.00%

Function 05C38198, Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

+, xrefs: 05C3885E

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID: +
API String ID: 0-2126386893
Opcode ID: 370575a7d87aeb4e3a12e8340a24d3cc29ed25fdaf82159d841ad5af6d761b78
Instruction ID: f12de268bc0fc618e519aa5285a1e239d2caef47ffddfa0c252844e2753bbe22
Opcode Fuzzy Hash: 370575a7d87aeb4e3a12e8340a24d3cc29ed25fdaf82159d841ad5af6d761b78
Instruction Fuzzy Hash: 9881E2B4D4522C8FDBA4DF65C889BEDBBF2BB48300F1089E9E419A7240DB745A85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05C38427, Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

(, xrefs: 05C38CDD

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 7b85463765f20cc10ffb3739cf2a70aaa558fed4770590b75673eae19efb64f5
Instruction ID: d1ffbd7e7fc1aa10fc6b19e8c1db9deea792ea6c1205dfcfe5dedc3ad743af40
Opcode Fuzzy Hash: 7b85463765f20cc10ffb3739cf2a70aaa558fed4770590b75673eae19efb64f5
Instruction Fuzzy Hash: 3241B178806268CFEB25CF64D859BDCBBB1FB49305F004AEAE44AA2295D7754AC4CF05

Uniqueness

Uniqueness Score: -1.00%

Function 05C38943, Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

#, xrefs: 05C38933

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 6e2236499fb295bff4fc5f14e11c1e6796794750443654ca63d627f5e5e65f45
Instruction ID: 9c12d5c7c4e2f535b18da8ace42648602f01868502d2ceade3e2bdacb2998644
Opcode Fuzzy Hash: 6e2236499fb295bff4fc5f14e11c1e6796794750443654ca63d627f5e5e65f45
Instruction Fuzzy Hash: B931C274D062288FDB61DF28C8987DCBBB1BB4A310F1045EAE44AA7291DB759EC0CF41

Uniqueness

Uniqueness Score: -1.00%

Function 05C38741, Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

", xrefs: 05C38804

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 658ec69d957249edbe71ac47c4c3b033bf52edb7fccd8888ee51c4152b84e553
Instruction ID: b7de633d214d9db2ce283c293d3eaa4110c7e9d88888ce578f322dca2a53bf58
Opcode Fuzzy Hash: 658ec69d957249edbe71ac47c4c3b033bf52edb7fccd8888ee51c4152b84e553
Instruction Fuzzy Hash: 4621F671E052288FDB14DF69C894BEDBBB6BF89304F5480AAD10DAB250DB349E80CF15

Uniqueness

Uniqueness Score: -1.00%

Function 030D3798, Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

Y, xrefs: 030D37BB

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID: Y
API String ID: 0-3233089245
Opcode ID: 698cd8f2e6168b5edb8036177bb38897b83b54940e44b9ab12f21ac2840b00ab
Instruction ID: 55c0ee3d3ed329538448d6894b593256f07e228deecdf52601f3d7f5357dc7da
Opcode Fuzzy Hash: 698cd8f2e6168b5edb8036177bb38897b83b54940e44b9ab12f21ac2840b00ab
Instruction Fuzzy Hash: 48F0F4BD90FB889FCB35CA68A9582BABFF85753111F1801DAD84883292E6314515CF53

Uniqueness

Uniqueness Score: -1.00%

Function 05C386D7, Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

, xrefs: 05C386F5

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 6f7d234b297d143d02df099675fca7e291429cd992bf572806b15841a627c366
Instruction ID: 3298f00430c8ba7de173c4ab8b610649f7571bbda9c6157b3f79d3038e55c803
Opcode Fuzzy Hash: 6f7d234b297d143d02df099675fca7e291429cd992bf572806b15841a627c366
Instruction Fuzzy Hash: 78F0A475905228DFEF61CFA1C844BDDBBB2BB5D304F1445DAA459A3292C3358B85CF11

Uniqueness

Uniqueness Score: -1.00%

Function 05C38AF2, Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

., xrefs: 05C38AF8

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 3f89c561c739102e851ff8698d16f3dfbc19d1126f836e6a1019c1fa55086510
Instruction ID: 02eeff84546b07ed903124e37ed24f47e70422b3d7cbd45503d304e7f2d020f9
Opcode Fuzzy Hash: 3f89c561c739102e851ff8698d16f3dfbc19d1126f836e6a1019c1fa55086510
Instruction Fuzzy Hash: C6F0747490616DABDB65EF68C8997ECBBB1BB49300F5084D9E00AA6250DF715FC0EF05

Uniqueness

Uniqueness Score: -1.00%

Function 030D7B23, Relevance: 1.3, Strings: 1, Instructions: 10COMMON

Download Yara Rule

Strings

{, xrefs: 030D7B49

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID: {
API String ID: 0-366298937
Opcode ID: 183e7317a52727e311c75efaa09832321c8b96785d904b950c56df9e04bb6214
Instruction ID: f8f1fbda5ef16583c31f18e4c1464789dca775a0d2ded8fa8f2f56d765d2d089
Opcode Fuzzy Hash: 183e7317a52727e311c75efaa09832321c8b96785d904b950c56df9e04bb6214
Instruction Fuzzy Hash: 95D09EB8D041288BCB50CF24C880B4DF7F1BB18305F1485CE9A0D63301C7349E888F09

Uniqueness

Uniqueness Score: -1.00%

Function 05C37138, Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 596cdd0d4d015e8b657594f14a482bb3dbab6793da6b63267218df21eb00520a
Instruction ID: f2903ff11a5c0cb79eea0d3f82602ac528835a2f61f5c1e0ac5e6bbc7cd0623f
Opcode Fuzzy Hash: 596cdd0d4d015e8b657594f14a482bb3dbab6793da6b63267218df21eb00520a
Instruction Fuzzy Hash: B7A1F370E41208DFDB14DFA5D895BADBBB2FF89700F208529E506BB284DA716981CF58

Uniqueness

Uniqueness Score: -1.00%

Function 05C37148, Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad11b9c722c29b2ce10aa6c552c18cebd91c60f8fa2aa84afc6a8407761afc15
Instruction ID: a8d5b0695f76b2fae5a531a8fefb4628747a292a5ab8047a7baf59802ad9c10d
Opcode Fuzzy Hash: ad11b9c722c29b2ce10aa6c552c18cebd91c60f8fa2aa84afc6a8407761afc15
Instruction Fuzzy Hash: F4A1F270E41208DFDB14DFA5D895BADBBB2BF89700F208529E506BB284DB716981CF58

Uniqueness

Uniqueness Score: -1.00%

Function 016F2477, Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247483646.00000000016F2000.00000040.00000001.sdmp, Offset: 016F2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8c85d708a0aa2536d7d562673a2583edf392d7173e009b1c1d0a98f60897689
Instruction ID: 01af0a2ef17acb1522b0e0175ad9ea5eb8e0a15c89694df90c898bd6b3dad379
Opcode Fuzzy Hash: a8c85d708a0aa2536d7d562673a2583edf392d7173e009b1c1d0a98f60897689
Instruction Fuzzy Hash: AB71B0A154F7D24FCB038B34ACB91547F7AAB02224B4940EFC785CF5D7E254C94A8B62

Uniqueness

Uniqueness Score: -1.00%

Function 030D05A8, Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9975c0396df9279d5e3729bd7a58cf58386718e752687c674fed2c57492a66f
Instruction ID: 8f6ea8f15f50174df25a036a4535ae57abd35aad8ada04ab614e82d4ad96faa5
Opcode Fuzzy Hash: b9975c0396df9279d5e3729bd7a58cf58386718e752687c674fed2c57492a66f
Instruction Fuzzy Hash: E391C174E05218CFDB54CFA9C894BADBBF2BF49310F1091AAD409AB3A0DB319985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05C39548, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5377b0fcbf522d3d07251ca57a5ae1d282e0997564c43f17162610f432e38d5
Instruction ID: f7fd91945b91d06722c9007ed1cc6c8cd07477109afbf5e46947e4cffa695733
Opcode Fuzzy Hash: a5377b0fcbf522d3d07251ca57a5ae1d282e0997564c43f17162610f432e38d5
Instruction Fuzzy Hash: A671D374D1A21CCBDB14CFA6D589BEDBBF6FB4A300F20992AD406A7284D7B55584CF04

Uniqueness

Uniqueness Score: -1.00%

Function 05C375E0, Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58ef4d6052ba08a0d87533a72dbb7763f2a9eaef9952bab089671f2ec5cce639
Instruction ID: 28a137289c21681f78899c160cb605cc2b3ea92dca14f26a5e7cb59c27d8e794
Opcode Fuzzy Hash: 58ef4d6052ba08a0d87533a72dbb7763f2a9eaef9952bab089671f2ec5cce639
Instruction Fuzzy Hash: 81818EB8D01208DFDB14DFA9D895AADBFB2FF89300F208469D405AB354DB345A41CF11

Uniqueness

Uniqueness Score: -1.00%

Function 030D0598, Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48e35ab696855e6e16f6ca5a15c782eb753f6edf941393e8250b23169635cfbe
Instruction ID: 891ab3c1b04626586808ac0ad2183344db78c34665e9160c741254030491b1cb
Opcode Fuzzy Hash: 48e35ab696855e6e16f6ca5a15c782eb753f6edf941393e8250b23169635cfbe
Instruction Fuzzy Hash: 7B71B274E01218CFDB54CFA9C854BADBBF2BF49314F1491AAD409AB3A0DB319985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0170AA37, Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247500510.0000000001702000.00000040.00000001.sdmp, Offset: 01702000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 516a6b97cc7409ef02530e4e2475659ea313ee9c7bc27682bea243b10edf39b5
Instruction ID: 1e69ad754cdcb87cd6f8113a8feb3316123d8303f6fc1a90ae44201cd2b6393c
Opcode Fuzzy Hash: 516a6b97cc7409ef02530e4e2475659ea313ee9c7bc27682bea243b10edf39b5
Instruction Fuzzy Hash: 815165B5509380AFD312CF25DC41956FFF8EF86620F09899FF9889B252D275A904CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05C375CF, Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f48fd653927f38ba3ddef3b86f7b396fe495ecc73bbdcc8a6b82a468b48943c8
Instruction ID: 0902032fe6488e78dc33a3cb77678fef7cdb609636101dd5cc1d38f6fc8849ea
Opcode Fuzzy Hash: f48fd653927f38ba3ddef3b86f7b396fe495ecc73bbdcc8a6b82a468b48943c8
Instruction Fuzzy Hash: 8F71B2B8D01218DFDB14DFA9D895AADBFB6FF89300F208069D409AB354DB345A46DF11

Uniqueness

Uniqueness Score: -1.00%

Function 0170A5AC, Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247500510.0000000001702000.00000040.00000001.sdmp, Offset: 01702000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e56817c625a1e4ed41c1ff1f09b56792d8c82fff69924ea43ef6b63316807334
Instruction ID: df8fcc347c49eb32cf98203278fa290f9e8f15a796c03ff91a889757e0dcd015
Opcode Fuzzy Hash: e56817c625a1e4ed41c1ff1f09b56792d8c82fff69924ea43ef6b63316807334
Instruction Fuzzy Hash: 0E518476509380AFD7128F15DC50952FFF8EB86620F19899FF9889B262D275A804CB72

Uniqueness

Uniqueness Score: -1.00%

Function 05C38188, Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e5b8f09230b2c67b9f382e2157231395d956aa716a9a5b39cfd72c5a5939566
Instruction ID: 4c66ba211d6970420e0dceec68d1f1410148a813109e91d238e5b07574a050f1
Opcode Fuzzy Hash: 3e5b8f09230b2c67b9f382e2157231395d956aa716a9a5b39cfd72c5a5939566
Instruction Fuzzy Hash: 94611374D4122C9FDB64DF69C889BEDBBB2BB48300F1088E9E41DA7280DB705A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05C34E28, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79d238be123085b7633a809196ace02bbb4a1c8d00535f2abe16ce13548436a7
Instruction ID: 7544d346195130f69a5c146de7f56e889cd44626489ab4914dd011e954eb1a4d
Opcode Fuzzy Hash: 79d238be123085b7633a809196ace02bbb4a1c8d00535f2abe16ce13548436a7
Instruction Fuzzy Hash: A251DE74E04209DFCF48CFAAD589AEDBBF2BB48310F2885AAD414A7351D7345A41DF54

Uniqueness

Uniqueness Score: -1.00%

Function 05C39538, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a9d6677899d596c805eef8bf1edd43027efa68b9a3bbde8cc79ecf0da39b770
Instruction ID: fc00132bc3c7225d2b5f4d6ac109c7a6d68ccf8ee9ba7f5f052b87517572b880
Opcode Fuzzy Hash: 5a9d6677899d596c805eef8bf1edd43027efa68b9a3bbde8cc79ecf0da39b770
Instruction Fuzzy Hash: 2E41F2B0D1921CCBDB14CFA6D48A7DDBFF6BB4A300F10992AD006A7294DBB54588CF14

Uniqueness

Uniqueness Score: -1.00%

Function 030D0280, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f1a50ec989dbe346564584c7822e2f175931ff8fa56308d16f94b36ba2369a5
Instruction ID: 64fc457d12ebb638f95f9bd7ac9e8efbc2f426cd448c5ee5fe965dda3aef803d
Opcode Fuzzy Hash: 6f1a50ec989dbe346564584c7822e2f175931ff8fa56308d16f94b36ba2369a5
Instruction Fuzzy Hash: 67419DB8A01218DFDB14DFA9C484BADBBF1FF4D310F144499EA06AB3A0D634A950DF64

Uniqueness

Uniqueness Score: -1.00%

Function 030D1900, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52d88bde222a42d17014125e89cd1a18aadcc61ef520250b065384be455ac909
Instruction ID: 948dc7945966fc0c207dda84afdafb9cabb7df65a82f3de8eec33c2db33f8725
Opcode Fuzzy Hash: 52d88bde222a42d17014125e89cd1a18aadcc61ef520250b065384be455ac909
Instruction Fuzzy Hash: 9B31C37180A349DFD79ADBB8D8483BDBBF8AB46311F0448DAD447D7296DE345880CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0170A6D8, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247500510.0000000001702000.00000040.00000001.sdmp, Offset: 01702000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46616aee4ea04d4901c4b8614246f7c18d227ddbece918ca4a5c4b940702f03c
Instruction ID: cb7a8c74dce7f8c3f7634b4f35be9d4353dd7c3134432e13ddca8bd4dcfd5364
Opcode Fuzzy Hash: 46616aee4ea04d4901c4b8614246f7c18d227ddbece918ca4a5c4b940702f03c
Instruction Fuzzy Hash: BB3191B6509344AFD711CF19EC40E57FFE8EB89660F04C96FFD499B211D275A8048BA2

Uniqueness

Uniqueness Score: -1.00%

Function 030D1FA9, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ee7a2f5b368f7339b25e7334a944ad3208f5d1fb5da6873cf5f5b4298b18cc2
Instruction ID: 190a5c05989146599c222821bbad5b7a8b95f8615ce7a67622b33e050e09ce77
Opcode Fuzzy Hash: 2ee7a2f5b368f7339b25e7334a944ad3208f5d1fb5da6873cf5f5b4298b18cc2
Instruction Fuzzy Hash: 0E311670E06308DFCB45DFA4E4449AEBBF9BF89310F2489AAC415A7262DB355A41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0170A810, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247500510.0000000001702000.00000040.00000001.sdmp, Offset: 01702000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a465189f38addbeba6f89669e83dde9c4cd26cdb1da8431b3a5dca5b888e994a
Instruction ID: 4d167363af4f6c2bcfdbc3212b8b0db923d2630c7428e54512c258d780218da2
Opcode Fuzzy Hash: a465189f38addbeba6f89669e83dde9c4cd26cdb1da8431b3a5dca5b888e994a
Instruction Fuzzy Hash: 02215EB6504344AFD310CF0AEC41E5BFBE8EB88660F14C96EFD499B211D275E9048BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0170A944, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247500510.0000000001702000.00000040.00000001.sdmp, Offset: 01702000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 331791e44ae9ffaed7e22809fcef4e00cce18475e17477f337b58b1e90228e74
Instruction ID: b23e2b0b822edc24d264f661b364ac23cb9f8165c02ee3b46bcf23ff30b09c67
Opcode Fuzzy Hash: 331791e44ae9ffaed7e22809fcef4e00cce18475e17477f337b58b1e90228e74
Instruction Fuzzy Hash: 4D2141B6544304BFD210CF0AEC41D67FBE8EB88660F14C95EFD4997211D275E9148BA2

Uniqueness

Uniqueness Score: -1.00%

Function 05C34B18, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f369f95715707b2cedc61c8083b7af53c770946f42586defa5c699575e1a53bd
Instruction ID: b882ba240f7cab76c0f31f14eae5f6f4b2550f99c3f0cb620a115f854ca6adfd
Opcode Fuzzy Hash: f369f95715707b2cedc61c8083b7af53c770946f42586defa5c699575e1a53bd
Instruction Fuzzy Hash: 0931A230D0460CEFCB08DFA8E58ABACBBB8FB09315F108599E84993350DB71AE44CB45

Uniqueness

Uniqueness Score: -1.00%

Function 05C36CF0, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a721bd8f47b7c03110a2176a452863c571cb1a88127c6d283516076ccc4e3ac
Instruction ID: 91a6286273b3bd7b7c620d0a10c8e48bd0cc982657fa86315179528030a3e455
Opcode Fuzzy Hash: 7a721bd8f47b7c03110a2176a452863c571cb1a88127c6d283516076ccc4e3ac
Instruction Fuzzy Hash: 53215970D1922CFFCB10DFA9E88AAEDBBF5FB49310F105869E406A7240DB3558848B51

Uniqueness

Uniqueness Score: -1.00%

Function 0170A3A8, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247500510.0000000001702000.00000040.00000001.sdmp, Offset: 01702000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e17fb121b751a38c921814a8832ece5b0af664a4f3e702e73a93eb4eb713d516
Instruction ID: adbc3b9e3edafa25363973bb044a393baadb01e74834c0563373b8a04e6d3640
Opcode Fuzzy Hash: e17fb121b751a38c921814a8832ece5b0af664a4f3e702e73a93eb4eb713d516
Instruction Fuzzy Hash: 96219FB6604304BFD6108E0AEC41D67FBE8EB84A70F18C96EFD485B211D276B8048BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0170A95A, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247500510.0000000001702000.00000040.00000001.sdmp, Offset: 01702000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e51818af08ec5a8bbdae921bf241e3788c2ad7ece1e1bb51677faeee42c3792
Instruction ID: ba81addb749028a110a64d41e9f1089fd684a14c7704fbcd12d69736122f1953
Opcode Fuzzy Hash: 0e51818af08ec5a8bbdae921bf241e3788c2ad7ece1e1bb51677faeee42c3792
Instruction Fuzzy Hash: 942121B6544304AFD210CF0AEC41957FBE8EB88630F14C96EFD4897311D275E9148BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0170A82E, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247500510.0000000001702000.00000040.00000001.sdmp, Offset: 01702000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8968bfb7c464185bc0e0c51d7b84bb08efbe79eb6c8a3d344d0e81e49d3529df
Instruction ID: e78e53ba093eef6c428846631fd1368aa84c8569064f4f46fefe6cb4c7855c0c
Opcode Fuzzy Hash: 8968bfb7c464185bc0e0c51d7b84bb08efbe79eb6c8a3d344d0e81e49d3529df
Instruction Fuzzy Hash: C8212FB6644304AFD310CF0AEC41A67FBE8EB88630F14C96EFD4997311D275E9148BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0170A702, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247500510.0000000001702000.00000040.00000001.sdmp, Offset: 01702000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 303eb2363fdb721cc0b6ca04aa843b0c55a58b7300cf6629bc9ce628b1b21a5b
Instruction ID: 83f46e2eb0a4bef393286cda50dc8aa7b9f45eab3434cd6488035a8c103189e7
Opcode Fuzzy Hash: 303eb2363fdb721cc0b6ca04aa843b0c55a58b7300cf6629bc9ce628b1b21a5b
Instruction Fuzzy Hash: 2B212FB6644304AFD710CF0AEC41A67FBE8EB88630F14C96EFD4897311D275E9148BA2

Uniqueness

Uniqueness Score: -1.00%

Function 030D9378, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a55e111a797a2e4cf1f8abdc341cf54b0b054811fd4a4101472d5171c691170
Instruction ID: a8ed85e40df8de19af96819ef2dbed811290d5884826fb4a77ae8d3a4863fe66
Opcode Fuzzy Hash: 4a55e111a797a2e4cf1f8abdc341cf54b0b054811fd4a4101472d5171c691170
Instruction Fuzzy Hash: A2316830E01209DFDB18DFA9D480AAEFBF5FF48310F1485A5C405A7784DB34A981CB95

Uniqueness

Uniqueness Score: -1.00%

Function 030D0006, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5e0cdef9137a61f8a2549431a57fce37ba7cfacb4f379004354d8121d2467a4
Instruction ID: b20553f5dd0394242577082498d7bf34d1213024c9f30b0f060d24bafa407403
Opcode Fuzzy Hash: d5e0cdef9137a61f8a2549431a57fce37ba7cfacb4f379004354d8121d2467a4
Instruction Fuzzy Hash: 65217F71C0E3C5AFC753CB74986579A7FB0AF07210F0984DBD044EB193D6685908C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0170A190, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247500510.0000000001702000.00000040.00000001.sdmp, Offset: 01702000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8776b18858a08267299e869a06bd0d70c35375b992df59009ba180c487c22e86
Instruction ID: 0ce490e12f72db3d3ce0de13f3eba71bdddd5b55e7152772787f4f998a32873c
Opcode Fuzzy Hash: 8776b18858a08267299e869a06bd0d70c35375b992df59009ba180c487c22e86
Instruction Fuzzy Hash: E01184B6640204BFD6108E0AEC41E67FFACEB84A70F08C55EFD495B211D276B9148BB5

Uniqueness

Uniqueness Score: -1.00%

Function 030D24E0, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffdcff0fb364cf3b8dca64714437e64c0a48c44fe2ae2ddcb1299d6fe716a2c0
Instruction ID: 106fd4def48370e331232cc0bdc769729b40fa7a74e3e07375abe40d1c9b064e
Opcode Fuzzy Hash: ffdcff0fb364cf3b8dca64714437e64c0a48c44fe2ae2ddcb1299d6fe716a2c0
Instruction Fuzzy Hash: 2121D270D06349CFDB45CBA8D810AAEFBF8EF86311F1988AAC405D72A5D3705981CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0170A5D6, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247500510.0000000001702000.00000040.00000001.sdmp, Offset: 01702000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90fbc863fd4ba0fbce67de720e4d1276005711d04aef1800895efc59a6c89719
Instruction ID: ad22a18dacb0476bdb99dc67d2c9560543369c4d3d39e57381f81b0d90f4bca3
Opcode Fuzzy Hash: 90fbc863fd4ba0fbce67de720e4d1276005711d04aef1800895efc59a6c89719
Instruction Fuzzy Hash: DF118176644204AFD6108F0AEC41966FBE8EB88630F18C56FFD485B211D276A5148BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0170A3BE, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247500510.0000000001702000.00000040.00000001.sdmp, Offset: 01702000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb434a2fa1f777e1e281e2017f4dc05715007cb0f225a29adbe139f63f35603
Instruction ID: 9bc3b3bd19f46b73e3cff5cf888ed0f04e76b192c6b08ed31c8ec80ad15edd6c
Opcode Fuzzy Hash: ddb434a2fa1f777e1e281e2017f4dc05715007cb0f225a29adbe139f63f35603
Instruction Fuzzy Hash: 82118176644304AFD6108F0AEC41967FBE8EB84630F18C56FFD485B211D276A5148BA2

Uniqueness

Uniqueness Score: -1.00%

Function 05C358E8, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26626d6af4757df3d5abc0cfd95e2a67cc024af6806949b0458f4e7043f3e472
Instruction ID: c4a1a837e82c58ec382cb332b754b622e6d6e42bc767bd05edba4354307b98b8
Opcode Fuzzy Hash: 26626d6af4757df3d5abc0cfd95e2a67cc024af6806949b0458f4e7043f3e472
Instruction Fuzzy Hash: 3821C574E002199BDB08DFAAD8416EEBBF2FF88304F148069D915A3354EB355A01DF55

Uniqueness

Uniqueness Score: -1.00%

Function 030DF220, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08466d9ac907129721f049f1d1b603f53d7b63318ffddfe4c6af2ccd7a6defa2
Instruction ID: 415a8fd603f41c09cd034e7fcf47d6419b2976549c5de1e6a177dcb200f5c523
Opcode Fuzzy Hash: 08466d9ac907129721f049f1d1b603f53d7b63318ffddfe4c6af2ccd7a6defa2
Instruction Fuzzy Hash: 9F212578D0120ACFCB18DFA9D0446BEFBF5FB48300F14C5AAD816A7248DB349981CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0170A1A6, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247500510.0000000001702000.00000040.00000001.sdmp, Offset: 01702000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a61b550549a4de4989b1d7fc8e478264f12086b0fb2d5ca1398e95555846e34
Instruction ID: c55f66ca09f48255e96ce1152584643bd7b2952cb00e62d50254a56e7335cc43
Opcode Fuzzy Hash: 9a61b550549a4de4989b1d7fc8e478264f12086b0fb2d5ca1398e95555846e34
Instruction Fuzzy Hash: B2118676644204BFD6108F0AEC41E66FBECEB84670F18C56FFD095B211D276B5148BB1

Uniqueness

Uniqueness Score: -1.00%

Function 030D1948, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66af291c54c4b01ca3219d65c95a78441b0206f530085b54a079d074aa7d24e1
Instruction ID: 95d17fe5ff50e6677ef84e2a0431204d892e7a4eb2ec7c214d06dcf4ee45978e
Opcode Fuzzy Hash: 66af291c54c4b01ca3219d65c95a78441b0206f530085b54a079d074aa7d24e1
Instruction Fuzzy Hash: A8216A7180630ADFDB99DFB8E4483ADBBF8FF0A321F148895D45AD2241DB745981CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05C34E38, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64688d149a3349dedcfa0b04edb3263f7cb437825c1ef8ca79dacac03630a8da
Instruction ID: 0c35e3a7c55f3768e48a59bf7b5d227c55bb0a043a90d3337c411d4f5407199c
Opcode Fuzzy Hash: 64688d149a3349dedcfa0b04edb3263f7cb437825c1ef8ca79dacac03630a8da
Instruction Fuzzy Hash: 1C216C74D05208DFDB48DFAAC589AADFBF2BF48310F14C4AAD815A7250D7349A85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 030D2C10, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 175a0853906dea547e564d0f1ef7c1e88c4cd0226e87e11186613dc0973b9c59
Instruction ID: 9b7734180c444fe08162cafb952e7fa02e3c37d37cfb8a497932599492beb917
Opcode Fuzzy Hash: 175a0853906dea547e564d0f1ef7c1e88c4cd0226e87e11186613dc0973b9c59
Instruction Fuzzy Hash: 3A11BF70D06318DFCB56DF68C8402AEBBF8EF86314F2899EAC44597251D7329E90CB11

Uniqueness

Uniqueness Score: -1.00%

Function 0318075C, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247833769.0000000003180000.00000040.00000040.sdmp, Offset: 03180000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b182a521770c435f40762cd888aabdb144b9f1fa1f5d30cf10094247e1d85d45
Instruction ID: 5ca2320e21092d965768c1ddbef5d1b022d9404233a4fdda5f63794c8a32e8a8
Opcode Fuzzy Hash: b182a521770c435f40762cd888aabdb144b9f1fa1f5d30cf10094247e1d85d45
Instruction Fuzzy Hash: 8111E434204248EFD715DB14D980B26BB95EB8CB08F28C9ADE8890B643C77BD847CE55

Uniqueness

Uniqueness Score: -1.00%

Function 030D1B54, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 035bdcebbae93c3f3b7957d52558a2f47837a4b557c537eb586c7813a2935a8c
Instruction ID: b25d112e2684dfaf53c32a466e43a3c8c956b5767299b3047c6a893e1cc895eb
Opcode Fuzzy Hash: 035bdcebbae93c3f3b7957d52558a2f47837a4b557c537eb586c7813a2935a8c
Instruction Fuzzy Hash: D7119E3090B7889FD79ECBB898486A9BFF99F83231F1884D6D444C72A2FE344941C721

Uniqueness

Uniqueness Score: -1.00%

Function 030D19A0, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7edc77a68104e2cf502884dafcbbb0871a9c94ce3b873ea8bc55c36ab5a70b7a
Instruction ID: ed5652bc03473b9e843cc3094a03729605c96b9b9f10e160e5ac9450159b8454
Opcode Fuzzy Hash: 7edc77a68104e2cf502884dafcbbb0871a9c94ce3b873ea8bc55c36ab5a70b7a
Instruction Fuzzy Hash: 9221237080630ADFDB98EFA8E4487AEBBF5EB09316F148899C41AA2244DB745680CF55

Uniqueness

Uniqueness Score: -1.00%

Function 05C36359, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08c109d304a499d6bec5e986a6a6df186cc3bb2c4d0726335398931caa83c6b3
Instruction ID: e29948bd4878e643d5ff1e82fac3b38642a4a1be6382ec7f56004432e6a72725
Opcode Fuzzy Hash: 08c109d304a499d6bec5e986a6a6df186cc3bb2c4d0726335398931caa83c6b3
Instruction Fuzzy Hash: 8B214274D0820EDFCB01CFA8C5869EEBBB1EF49300F1094AAD815AB361D7349A85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 030D20D8, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b25701944c7fd2051110fb1c6ff7db772707058be2c44003d380b9d7539e4685
Instruction ID: 6a151fbbf2b96ad925a3109c7b227f93c53e468f4b557fe06f8903c4e8fdec91
Opcode Fuzzy Hash: b25701944c7fd2051110fb1c6ff7db772707058be2c44003d380b9d7539e4685
Instruction Fuzzy Hash: 06119E34C063489FDB55DBA8A8843ADBFF9AF85311F18CCE6C908D3262E6308990CB11

Uniqueness

Uniqueness Score: -1.00%

Function 030D00F8, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c8d265d95f17403fb93f27ec15ab6b1e632177b0e72d4684057c774e7049afa
Instruction ID: d2c7d3de0f5a67cdf4b80b4064728fd485418ac5d69fd342b42d623d7625c10f
Opcode Fuzzy Hash: 3c8d265d95f17403fb93f27ec15ab6b1e632177b0e72d4684057c774e7049afa
Instruction Fuzzy Hash: A0215E3490130ADBCB15EBA8E5A499DBBF2FF40308F20416DEA0597294EF705E51CB56

Uniqueness

Uniqueness Score: -1.00%

Function 05C359D0, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb491e2aca9163a7a59fa697ce73901710da4a5e65b5ef9fc42814585961ef7b
Instruction ID: ed2e4907c83a044457650dfe1fd3f0f52a131dc24d261e1bb41d8c261b9289c3
Opcode Fuzzy Hash: eb491e2aca9163a7a59fa697ce73901710da4a5e65b5ef9fc42814585961ef7b
Instruction Fuzzy Hash: 10113A34D0521CABCF14DFA8E885AADBBB2BF48311F108599D805673A5EA315902DF90

Uniqueness

Uniqueness Score: -1.00%

Function 05C38B54, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08e8f088116a2c456121bc357c631549c0004b190d23437ddf3b5ac5ae4c547c
Instruction ID: 7bdc8fee3e7ed5cc30927aa8ea75ca333b0bd6402c26755d1c4ce39ad1e3fc53
Opcode Fuzzy Hash: 08e8f088116a2c456121bc357c631549c0004b190d23437ddf3b5ac5ae4c547c
Instruction Fuzzy Hash: F721F375906228CFEB24CF20C889BDCBBB1BB09310F1085E9E449A3291D7759AC5CF00

Uniqueness

Uniqueness Score: -1.00%

Function 0170AAF5, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247500510.0000000001702000.00000040.00000001.sdmp, Offset: 01702000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e4e27e30939950e2d983cb558884e0e719dc1e4808d076f7cd5038f454ff0aa
Instruction ID: 740bfb517179b9a8123c668023e0b9350883138f7811caffe3f6c81288e7c244
Opcode Fuzzy Hash: 8e4e27e30939950e2d983cb558884e0e719dc1e4808d076f7cd5038f454ff0aa
Instruction Fuzzy Hash: A511A7B5908301AFD350CF19D881A5BFBE4FB88664F04896EF998D7311D375E9048FA2

Uniqueness

Uniqueness Score: -1.00%

Function 030D2548, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56285d341976c67074457747ccae7a50185e23a856f058f8cd3955551756dfaa
Instruction ID: 08a99683dec1c3b053d578d1796b16893902f9bfd0bf3c2c1a4ef3f7b8e80efc
Opcode Fuzzy Hash: 56285d341976c67074457747ccae7a50185e23a856f058f8cd3955551756dfaa
Instruction Fuzzy Hash: 9F118230D0A349EFCB46DB64C851AADFBF8EF46310F1889EAD8049726AE6355950CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05C36368, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acfe879f7377625f240be76f2ac0e4748544afe930d3774978fcf92a0cc21055
Instruction ID: aa092747898ed14bc77ea177f2cbdb5f1514bbf1a18170f18f56974a4245a5ae
Opcode Fuzzy Hash: acfe879f7377625f240be76f2ac0e4748544afe930d3774978fcf92a0cc21055
Instruction Fuzzy Hash: 8D21E074D0820ADFCB44DFA8D5859EEBBB1FF48300F109069D805AB350DB30AA80CF90

Uniqueness

Uniqueness Score: -1.00%

Function 030D3740, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d12510c66f3b8ee984aa579389b50f3794c535ead33c047dd91d133d1ecdf980
Instruction ID: aaee1cca937e27e7ea5f43aa83e36d4142ad72fc928832238886464f56d36a10
Opcode Fuzzy Hash: d12510c66f3b8ee984aa579389b50f3794c535ead33c047dd91d133d1ecdf980
Instruction Fuzzy Hash: 3E0140BDA0BF84CFC7A5CBB4E9555ADBBF89B43500B1C40C7D40997261D5314900CB93

Uniqueness

Uniqueness Score: -1.00%

Function 030D1BB1, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19bdb475856a560ee4bb014377d4e40d66ffd3224fde409ec965bc45cb3fb51a
Instruction ID: bac53ab572e90af3b2367981e7b4fe74cc6b6fe8ba71c6c661db891343269320
Opcode Fuzzy Hash: 19bdb475856a560ee4bb014377d4e40d66ffd3224fde409ec965bc45cb3fb51a
Instruction Fuzzy Hash: 2E01D23490F348DFDB9ACA74A8416B97BF8DB4B221F1066D6D845C3342EA341941CB51

Uniqueness

Uniqueness Score: -1.00%

Function 030D30C5, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9976a1e596e15b8419ed7db926d5b7905e9897d73ceb8c7626306ec04e838eb5
Instruction ID: a68c0835d3fedccd61569ee669825d3642a20c6a9bfca3c956b4c54da91442b6
Opcode Fuzzy Hash: 9976a1e596e15b8419ed7db926d5b7905e9897d73ceb8c7626306ec04e838eb5
Instruction Fuzzy Hash: E121D3709012298FEB68DF64D895BA9BFB2FB44300F1085EAE40AA7244DE741E84DF20

Uniqueness

Uniqueness Score: -1.00%

Function 05C35080, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08a23c8413079018eaa13d5d4e3235309ae7e3ba011909bcbaf5e95c85982292
Instruction ID: ea5647ba505ab76f1a12f36432a67625e338ea564bf724eb217c385a51acb142
Opcode Fuzzy Hash: 08a23c8413079018eaa13d5d4e3235309ae7e3ba011909bcbaf5e95c85982292
Instruction Fuzzy Hash: EB119AB0C0824CEFCB09CF99E9066EDBFB1EB16300F14C9AAD814A2385D7361655CF85

Uniqueness

Uniqueness Score: -1.00%

Function 030D0108, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 925dd6633d4b209548e13c551261f7804b53e557c82428dc18e457f33fa94708
Instruction ID: e75b96c71fc36e84702b32a8f7133d6bdb3d3bc4c7ab241418ba4e9071c482c1
Opcode Fuzzy Hash: 925dd6633d4b209548e13c551261f7804b53e557c82428dc18e457f33fa94708
Instruction Fuzzy Hash: CB112E30A0130ADBCB15EBA8E9A489DBBF2FB44308B20416DEA0157294EF705E51CF55

Uniqueness

Uniqueness Score: -1.00%

Function 05C394B8, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 648133982d71c380f73c4589db188966e73fc2b48001863528bd4859a248387f
Instruction ID: f0d5704e92c7816c8e88e02a67916c959c37289dea962d5d08da16b39aa8238e
Opcode Fuzzy Hash: 648133982d71c380f73c4589db188966e73fc2b48001863528bd4859a248387f
Instruction Fuzzy Hash: 860184B4E09208EFCB18EFF5D44166DBBBAEB89200F2084ADD809A3354DA305A45DB49

Uniqueness

Uniqueness Score: -1.00%

Function 030D9257, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e81211d7e77a35a76b09ee62d1f7476f393711db251161a9e4957826ae0f2a49
Instruction ID: 17ee2e6b2ea8602b3f809ef3e234e37d5cd7e1c527506a9de96a69ede9327ef5
Opcode Fuzzy Hash: e81211d7e77a35a76b09ee62d1f7476f393711db251161a9e4957826ae0f2a49
Instruction Fuzzy Hash: E211F7B4E05209DFCB44DFA5D5855EEBFF6FB48300F2481AA9905A3344DB345A41DF91

Uniqueness

Uniqueness Score: -1.00%

Function 030D3078, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ecf9f412d0ea446c4d7f0955fea107c1a3b3d3bcac13b838faba644e589fe67
Instruction ID: 98c5ee259f96b9d9ca10e0a522fbe3ee4e2b390c85c6c6c089e8326955b77162
Opcode Fuzzy Hash: 2ecf9f412d0ea446c4d7f0955fea107c1a3b3d3bcac13b838faba644e589fe67
Instruction Fuzzy Hash: 6521E57491222A8FEB24CF64DC45B98BFB1FB44300F1081EAE40AA7244DE341E849F20

Uniqueness

Uniqueness Score: -1.00%

Function 030D7CC4, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd13096b4f1c84d433871c51cf01f4f0dd3949524d33cb33c6372db18c1a8dff
Instruction ID: dc078687d11776c12ba2640219a2aac010e3ab6bda9f2ae4438a9e1f9ec166fd
Opcode Fuzzy Hash: bd13096b4f1c84d433871c51cf01f4f0dd3949524d33cb33c6372db18c1a8dff
Instruction Fuzzy Hash: D5115DB8D4522ADFCB21CF58D981BECBBB0BB19740F0094E6E95AA7705E6705EC09F50

Uniqueness

Uniqueness Score: -1.00%

Function 05C37D7F, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f151642fa135a71d22a1cf2ad1cc6a5512755708440623dcbdf245943bf7898
Instruction ID: f1b94e65533fdaa7aebd6a253f8d5f00a260a480d3792742b4f9caec4caffb8e
Opcode Fuzzy Hash: 3f151642fa135a71d22a1cf2ad1cc6a5512755708440623dcbdf245943bf7898
Instruction Fuzzy Hash: 06018F70D0A20CDFCB21EFA4E9467AD7FB5EB42611F6045A9C40463385D6745B48C756

Uniqueness

Uniqueness Score: -1.00%

Function 05C37950, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf0c54f4635106307c0d8de069bb1e31b23c461f3155035255ec6e1a54484a3
Instruction ID: bf35edb6c5b1c14dfa336d9f6ec8865874011c64aeac5264903b4671853b4cdc
Opcode Fuzzy Hash: cdf0c54f4635106307c0d8de069bb1e31b23c461f3155035255ec6e1a54484a3
Instruction Fuzzy Hash: 6D0171B480830CDBDB00DFA9E4462BCBFF5EB09301F109A95E80993351EA305B54DB91

Uniqueness

Uniqueness Score: -1.00%

Function 031805CF, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247833769.0000000003180000.00000040.00000040.sdmp, Offset: 03180000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f700a5bc5f1e6c1b297c43d2c130edb7a860efe1a3bd46e39c5f339b2b7ec6b8
Instruction ID: 8096a947e351b0b2587d085c0db441a1c7fc5b90c5fff2c74c1bff42a3d73af4
Opcode Fuzzy Hash: f700a5bc5f1e6c1b297c43d2c130edb7a860efe1a3bd46e39c5f339b2b7ec6b8
Instruction Fuzzy Hash: 7A0186B65093905FD7118F06EC41866FFA8EF86630709C5AFED498B612D279A904CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03180747, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247833769.0000000003180000.00000040.00000040.sdmp, Offset: 03180000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27a8f3989680bd01ee07576de1eb19d561debfb64047bd6e2bf47ac3b8794047
Instruction ID: 2a7ad5798d5c58e00b31c4706e6dbc96ebaf971e3eac505d8e3a1d1a42d0c466
Opcode Fuzzy Hash: 27a8f3989680bd01ee07576de1eb19d561debfb64047bd6e2bf47ac3b8794047
Instruction Fuzzy Hash: 01115E35509284DFC716CB10C880B55BBB1EF4A704F28C6EED8895B652C33A9807CF41

Uniqueness

Uniqueness Score: -1.00%

Function 05C34CC2, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da6998cf20bacbb74696256328b9dc9826d977d33cf65ef5aa8433253f53579d
Instruction ID: 475975f1e24a82f57cc982259987c82d57ef6a2c0d3fa565386b017959a0426b
Opcode Fuzzy Hash: da6998cf20bacbb74696256328b9dc9826d977d33cf65ef5aa8433253f53579d
Instruction Fuzzy Hash: B511F774E0521DDFCB08DFA9D989AAEBBB2FB88300F2084A9980567355DB305A45DF91

Uniqueness

Uniqueness Score: -1.00%

Function 030D03E8, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396da05fefd3e09ccc31522a762b0fe59b3b5cbe0339ac3ffaf2d511c93cf230
Instruction ID: 2494e4222b272594e1599093c24948d4ac7904f2471ff176cb1efc7c7cc56482
Opcode Fuzzy Hash: 396da05fefd3e09ccc31522a762b0fe59b3b5cbe0339ac3ffaf2d511c93cf230
Instruction Fuzzy Hash: 72F0AF34E8B3089FC709CBB48954AAE7BBBAFC6200F1654D68105A3286CA745E01E25A

Uniqueness

Uniqueness Score: -1.00%

Function 030D9368, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c3d22159deb9932ffe40e465e150aeec0b9b317073fe887a7558c7f6801344
Instruction ID: 64f0a23f65df707284083e20bdf2860ba676c3a4d4aa7e0edc1388ab67874f89
Opcode Fuzzy Hash: 35c3d22159deb9932ffe40e465e150aeec0b9b317073fe887a7558c7f6801344
Instruction Fuzzy Hash: 9C018F70D05309DFD769DFB9D8407AEBBF9AB89310F24C5A9C444D3284DB349581CB85

Uniqueness

Uniqueness Score: -1.00%

Function 05C39447, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4fe1e9eb44446687fb5595aa8cc275b0e3b29cd28622ac19d96b30649b5d87b
Instruction ID: 1f5d5db09a5fa9f48f93233c2a3b9786a7cf736f4a9064a11d390da33c62eeae
Opcode Fuzzy Hash: d4fe1e9eb44446687fb5595aa8cc275b0e3b29cd28622ac19d96b30649b5d87b
Instruction Fuzzy Hash: 9201F2B1D0D2889FC701CBB8A8826ACBFB0DB12211F1840DAC984832D2E5715A05CB85

Uniqueness

Uniqueness Score: -1.00%

Function 05C35849, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ee342bbeca56188719a998b83ecd3eaa7bc48d678a07b7dcf64fe9b1bb80c5
Instruction ID: ca6f2c9fa3c7b18dc56b286187fcad5b4f0532ffdd6d37f6da6a5ea33c5add7a
Opcode Fuzzy Hash: 79ee342bbeca56188719a998b83ecd3eaa7bc48d678a07b7dcf64fe9b1bb80c5
Instruction Fuzzy Hash: 93012874D4810CAFCB04CBA6C542AADBBF2EB59301F10C5AADC15A3311DB355A51CF86

Uniqueness

Uniqueness Score: -1.00%

Function 030D9268, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 618262f1cb0d11f765c5cee9f24e1d70060261edca915ff7a4eab5b0c63f69d6
Instruction ID: c5ba825b3e8f75ae284f839cba5f3bef2e24f5288e8de506ef155402815be1b0
Opcode Fuzzy Hash: 618262f1cb0d11f765c5cee9f24e1d70060261edca915ff7a4eab5b0c63f69d6
Instruction Fuzzy Hash: 8F01D3B4E05209DBCB44EFA9D5414AEBFF6FB88300F2080AA9905A3344DB305A41DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 030D2E79, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5879398aac5d2c8168354a82c529c0bd3a552c80fbe6529bd8c9ce54f160000a
Instruction ID: 32540369fe1b8c9fad4ed2a3aa96d6dd5e83406584dc596b76de796eef7a8982
Opcode Fuzzy Hash: 5879398aac5d2c8168354a82c529c0bd3a552c80fbe6529bd8c9ce54f160000a
Instruction Fuzzy Hash: 1611E37090220ACFEB14DFA8E588A5DBFF1FB08325F208629E415AB395DB34AC40CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05C34CD0, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1f408b4f94c9fecec49336293f14dba720546bc94a80124ba10419735df0d8d
Instruction ID: 7a65687f6440ee813346367786b1b4542da499b9fd0aff67b8609ea284367291
Opcode Fuzzy Hash: a1f408b4f94c9fecec49336293f14dba720546bc94a80124ba10419735df0d8d
Instruction Fuzzy Hash: EB01E5B4D0120DDFCB08DFA9D9859AEBBB2FB88300F2084699805B3354DB301A40DF91

Uniqueness

Uniqueness Score: -1.00%

Function 030D0450, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9007afe1857a776f90626640e946cc18ed9f88eae30c9090f40525087c8e107e
Instruction ID: c7d10e5227f78704d0998054de804d0faf5e7f5ab1835ebf100cb79f3cf5f0e1
Opcode Fuzzy Hash: 9007afe1857a776f90626640e946cc18ed9f88eae30c9090f40525087c8e107e
Instruction Fuzzy Hash: EAF067B4C06348DFCB06DFB4D8089ADBBF4AF46200F5084EAD404A3392DB315D15CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05C34C40, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f271d15330b78594c4865799b99be0fd1d0f91cb736d1fcbf3363a71c01398
Instruction ID: 12283486b7f82637d234ddf1c88802bfff19eebad68770e288dd118a079c3888
Opcode Fuzzy Hash: 39f271d15330b78594c4865799b99be0fd1d0f91cb736d1fcbf3363a71c01398
Instruction Fuzzy Hash: C7F09071D0920CDBCF18DBB9F4CE3AC7FA4E741205F1885D9D809932A1E6725610DA81

Uniqueness

Uniqueness Score: -1.00%

Function 030D0221, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8991e26c0813a57eccbce70db9b3baed6e8b5cc6e7206b24be880714569c6a6c
Instruction ID: 56cebb95fcd61e437b2d00fcd175470277ee5baa675c7f8bade428cc24ab2bda
Opcode Fuzzy Hash: 8991e26c0813a57eccbce70db9b3baed6e8b5cc6e7206b24be880714569c6a6c
Instruction Fuzzy Hash: 1AF0907480F344EFCB06CBB4A8415A9BFF4AB47310F1480EAD889933A2D6354D54CB92

Uniqueness

Uniqueness Score: -1.00%

Function 030D09D8, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57c79954d8ab5b3c70fc4213066a81f1a3ec4e561663f8bfb216ed5860be7419
Instruction ID: 49af104f1adf644eb31c50a3502e1181760cca4a363327933027f734174ba482
Opcode Fuzzy Hash: 57c79954d8ab5b3c70fc4213066a81f1a3ec4e561663f8bfb216ed5860be7419
Instruction Fuzzy Hash: 17F09030905308DFCB09DBB4D9549ACBF72EF86304F1442E9D40467395CA302E45CB55

Uniqueness

Uniqueness Score: -1.00%

Function 030D1C18, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b767c08cdbcf2bb143dfe0c80a4923da1a306b698ed7784c811f77fcb983fbbf
Instruction ID: 1942f16da1d29c3b55ccfa7c8dc90ce784728ad4c800e2ea3459b3f2bd52fc93
Opcode Fuzzy Hash: b767c08cdbcf2bb143dfe0c80a4923da1a306b698ed7784c811f77fcb983fbbf
Instruction Fuzzy Hash: 96F09034906304DFE758DB69E84565DB7F5EB49301F14E6A1C80883350DB306941CA14

Uniqueness

Uniqueness Score: -1.00%

Function 030D0070, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48a82f85d79ef7471cee6b8bf19c2f4c22590ed29b4434383af7e41bce625e55
Instruction ID: 1ee939b3eb826e96de5844051e18cd77c630f5441c88daae3ce9b5acaf1d31a9
Opcode Fuzzy Hash: 48a82f85d79ef7471cee6b8bf19c2f4c22590ed29b4434383af7e41bce625e55
Instruction Fuzzy Hash: D9F08C70D42209AFDB64DFA9E8597AFFEF4EB09310F10182AD014B3381DA7069448BE8

Uniqueness

Uniqueness Score: -1.00%

Function 030D03F8, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38c785bf0b699da9f8f58fa5c8496f24e2b37128722632946520f2a1d93267c3
Instruction ID: dba1e1e6d39c01c6198795a4870fbd087c948ea10a61bb721118aac9359056b1
Opcode Fuzzy Hash: 38c785bf0b699da9f8f58fa5c8496f24e2b37128722632946520f2a1d93267c3
Instruction Fuzzy Hash: 5EF01C34E46208ABD708DBB4C544FAFB3A79BC9204F2698A4850623388CE746E01A659

Uniqueness

Uniqueness Score: -1.00%

Function 030D0530, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cad3e5a577010a52f8896f6d17c1c2eea27edb3d59c7628c1ec9ee5c7fc3376
Instruction ID: 9e84ac5c8b2bc5f559966156abc87c2aa96eae2debc5a94527c7ed157ee32cd5
Opcode Fuzzy Hash: 7cad3e5a577010a52f8896f6d17c1c2eea27edb3d59c7628c1ec9ee5c7fc3376
Instruction Fuzzy Hash: 8F01F6B4D05309EFCB01DFA8D44495DBBF0BB08220F1486D9D858973A5E630AE45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 03180818, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247833769.0000000003180000.00000040.00000040.sdmp, Offset: 03180000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f6f7c96804cda76668e35a3bbcf86681c06fe62140db942cdcb6afdd34f29c
Instruction ID: d678ec3cfe00ff008ea6d7e436c6d88424bbf7115b53a814190b1524acce32e2
Opcode Fuzzy Hash: c3f6f7c96804cda76668e35a3bbcf86681c06fe62140db942cdcb6afdd34f29c
Instruction Fuzzy Hash: 3BF0FB35204644EFC206DF40D940B15FBA6EB8D718F24C6A9E9891B652C3379813DE85

Uniqueness

Uniqueness Score: -1.00%

Function 030D1C80, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f79e26f0e345b9d42453ea843aec66df5df10413d94eb15b333d70694205465b
Instruction ID: ce777fd58d916c5b5eaddf11f4951e8653d3f79e08a5f0a9c02a5c883f10c79b
Opcode Fuzzy Hash: f79e26f0e345b9d42453ea843aec66df5df10413d94eb15b333d70694205465b
Instruction Fuzzy Hash: E9F0BE34C0A3489FCB6ACB64D8862ACBFF4AF47320F2060EAC48197262CA304991C745

Uniqueness

Uniqueness Score: -1.00%

Function 05C34C82, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dfe76b15008fb432bb277e5970b61698aa935a69dd8fd9f61cb0a667c69f4bd
Instruction ID: 77d8f6b8d9356b75b30a51c6c55bb55c0d07bc0c086e4c25c7794214b12386ce
Opcode Fuzzy Hash: 4dfe76b15008fb432bb277e5970b61698aa935a69dd8fd9f61cb0a667c69f4bd
Instruction Fuzzy Hash: 2AF02B75D4828C9BCB04DBB9F59A3AC3FA0EB45210F2C488E8518D7272D5315501CB41

Uniqueness

Uniqueness Score: -1.00%

Function 030D2674, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51249a89d349d4392df65d600f0fdc2dc243599e57e064d11fe9e0cd3bffcc30
Instruction ID: ef10e0812cd516266ccd4609aa540135f764408ad1795104a9e1b8cdb1928088
Opcode Fuzzy Hash: 51249a89d349d4392df65d600f0fdc2dc243599e57e064d11fe9e0cd3bffcc30
Instruction Fuzzy Hash: A5F05E74D02308DFD718DFA8D4447AEBBF9EB88310F2488A9C804A3354DB705A80CE54

Uniqueness

Uniqueness Score: -1.00%

Function 05C37960, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb7b0b7bd5add647e7a15be4760d634c1f7d73ebad42626957873b76091b65fd
Instruction ID: bfcb6bf12ea8d0248858e6087580e33809b201f123450b05ab4b4369f057596f
Opcode Fuzzy Hash: cb7b0b7bd5add647e7a15be4760d634c1f7d73ebad42626957873b76091b65fd
Instruction Fuzzy Hash: 48F03A78D08308DFDB04DFA9E5455ACBBF5FB48300F108699E80593351EB341A40DB91

Uniqueness

Uniqueness Score: -1.00%

Function 05C37E70, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6f4db4a0188cba6da42425f94e4fc0dfc156a802a27d06128e267826ddd304e
Instruction ID: 5535542fe013ad1242b9a98969e3de7a535e74d95f39fcc123e9ccb06cb193e3
Opcode Fuzzy Hash: f6f4db4a0188cba6da42425f94e4fc0dfc156a802a27d06128e267826ddd304e
Instruction Fuzzy Hash: 66F05874D0A24CDFCB14DFA0E54A9ADBFB4EB46301F20969AD80563281DA755A08DF85

Uniqueness

Uniqueness Score: -1.00%

Function 030DF158, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a11677186f59b9da28eb1345599c21d1b64ddfec80f62e5263a5a7a63d3d6296
Instruction ID: a3efb7a3a649a6c7d3ef90f874fffde2dcddca06c86d9a1c9c8fbe16cab92d4c
Opcode Fuzzy Hash: a11677186f59b9da28eb1345599c21d1b64ddfec80f62e5263a5a7a63d3d6296
Instruction Fuzzy Hash: BEF03474D0230AEFDB04EFACC4446AEBBF9AB48310F24C8A9C80993250D7309A81DA94

Uniqueness

Uniqueness Score: -1.00%

Function 05C35100, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a9f47430a1754e0fb00f9c2ec1cbf8119474bd2719ac7f2ce9659eb65d794c3
Instruction ID: 90797560dce307eccf4903172b8fc3a24101a7a11ec9986eea01661c08cd3bfd
Opcode Fuzzy Hash: 9a9f47430a1754e0fb00f9c2ec1cbf8119474bd2719ac7f2ce9659eb65d794c3
Instruction Fuzzy Hash: 00F06D75D0520CEFCB04DFA5E50A9EDBFB4EB15300F1092AAEC1452355EA311B15DF85

Uniqueness

Uniqueness Score: -1.00%

Function 05C38EE8, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9700e511a8db266cf32a4447b99f8492cb7567b97316dc1d4c9ee200c0b5134a
Instruction ID: 7b79c60452f890fed1988ee767b5615f1317323d905ecb614271b98e95879e28
Opcode Fuzzy Hash: 9700e511a8db266cf32a4447b99f8492cb7567b97316dc1d4c9ee200c0b5134a
Instruction Fuzzy Hash: 7BF01F359042289FEB22CFA4C850BEDBBB1BB4D310F5442DAD049A7261DB318A82CF00

Uniqueness

Uniqueness Score: -1.00%

Function 030DE298, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48a772c0c95df2c41febd37d26f527fbe3948e965566e93e7c3a0d16da15a8cf
Instruction ID: c582d41214fbbf330357322d161c0839ea08a7e14772f5d2848661327e68203b
Opcode Fuzzy Hash: 48a772c0c95df2c41febd37d26f527fbe3948e965566e93e7c3a0d16da15a8cf
Instruction Fuzzy Hash: FDF01C70D06218DFDB48EFA8D4447AEBBF9EB45300F24C5A9D81897395D7706A80CA55

Uniqueness

Uniqueness Score: -1.00%

Function 05C34D48, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 666930e7b32c3df0d7cebc85e2a0ee453f3ac6013725efef5813cf8c5f8d660c
Instruction ID: 9538c83aac6612a7d3259f6ee808e03ebcf65c20f80e56ab08ea86258d3e9775
Opcode Fuzzy Hash: 666930e7b32c3df0d7cebc85e2a0ee453f3ac6013725efef5813cf8c5f8d660c
Instruction Fuzzy Hash: C0F03970C4A24CEFCB05DFA9E44AAA9BFB4AB06201F1082DAC84463796DA341A04DF56

Uniqueness

Uniqueness Score: -1.00%

Function 05C392C8, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e6d6c87a7ddbb0cd11a1d92d84c31125a97dca1f0eff7ebec526d5ff73f3d4
Instruction ID: 1511d17caa745233c22de19685211e2b1150c0e6f220135f3621694d02d5c193
Opcode Fuzzy Hash: 88e6d6c87a7ddbb0cd11a1d92d84c31125a97dca1f0eff7ebec526d5ff73f3d4
Instruction Fuzzy Hash: 4AF0A934C0420CEBCB10DFA4D446AACBBB4EB4A310F20C19AD80963351DA729A12EF81

Uniqueness

Uniqueness Score: -1.00%

Function 031805F6, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247833769.0000000003180000.00000040.00000040.sdmp, Offset: 03180000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d70a319d7667fca81fb60276d1dc589b7cee6249916c0880d618d3f90dc0db1
Instruction ID: a67d632c2cd1dcfb49a27881b692324d3c2ce019cc419177916f14df50b05c6f
Opcode Fuzzy Hash: 2d70a319d7667fca81fb60276d1dc589b7cee6249916c0880d618d3f90dc0db1
Instruction Fuzzy Hash: FAE06D766006008B9750CF0AEC41466FBD8EB88630718C07FDC0D8B711D275B5048EA5

Uniqueness

Uniqueness Score: -1.00%

Function 05C34D91, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c1b39bae8a09aa3f6e55cbabed055212dbed5592bce43adf7077c02384202e4
Instruction ID: 804de6e3ded371cb56edde8505257db8a224bad5e701bff85f197ecda4a14e9d
Opcode Fuzzy Hash: 8c1b39bae8a09aa3f6e55cbabed055212dbed5592bce43adf7077c02384202e4
Instruction Fuzzy Hash: C3F03970D4924CEFDB05EBA4E84ABA8BFB4EB06301F1182DAD84567396DA741A40DF42

Uniqueness

Uniqueness Score: -1.00%

Function 030D3304, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41f5b4abf574b63d21a37d3d2a8d278cdca4efeed449bb40a4c2be767c1bdc35
Instruction ID: 7014f405cbad9bcb1045b401b85e61f520e0cd49f1fa4f9e07619d1e163f490d
Opcode Fuzzy Hash: 41f5b4abf574b63d21a37d3d2a8d278cdca4efeed449bb40a4c2be767c1bdc35
Instruction Fuzzy Hash: 8CF01270902358CFEB10DF68E884A8CBFF0FB08304F158999E004EB268DB38A985CF15

Uniqueness

Uniqueness Score: -1.00%

Function 030DEF48, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 932e11e328058e4aa490ea393d53643a1404cdc50aad52f9681838c279271e46
Instruction ID: afe39c77e2c93c67fb317284950a8e7346fdf1f70d5f3a28e85c78153aa44a64
Opcode Fuzzy Hash: 932e11e328058e4aa490ea393d53643a1404cdc50aad52f9681838c279271e46
Instruction Fuzzy Hash: 1EF06D30D02208EFDB44EFA8D44579DFBF8EB44300F14C4F9C8089B250EB309A81CA15

Uniqueness

Uniqueness Score: -1.00%

Function 030D09E8, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b427395ef0f5785859a3a89eddebd00a19ae7d074a4d0e490278d46ee1c69bb
Instruction ID: 3942c07a8b6a5b3967851effdc5d8b603aeb4a46641cc50486164893db76d368
Opcode Fuzzy Hash: 8b427395ef0f5785859a3a89eddebd00a19ae7d074a4d0e490278d46ee1c69bb
Instruction Fuzzy Hash: 46F03930901309EBCB59EBA8D955A9DFBB2EF80304F2042A8C40527394DF306E81DB99

Uniqueness

Uniqueness Score: -1.00%

Function 030DE1E0, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 462906f383786a048105924d5a59ba6b8ba9cb6ab047af8f72b50ce2dafc3367
Instruction ID: 04f83fac1f27af9efa384fce40cb50543997a6115fe102f18f02805e0e849cb4
Opcode Fuzzy Hash: 462906f383786a048105924d5a59ba6b8ba9cb6ab047af8f72b50ce2dafc3367
Instruction Fuzzy Hash: 3DF03934D02208DFD744DBA8D44976DFBF5AF44301F14C5A9D81997690EA309A80CA55

Uniqueness

Uniqueness Score: -1.00%

Function 05C34DD7, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17abbb866510e01ecb5b79bdda3408c9046ecc8c730d151b60077473009febb1
Instruction ID: 2b98911646858811f15d4d0c8ddeff318662f5bc45ad2ff4c180d085aea20cb3
Opcode Fuzzy Hash: 17abbb866510e01ecb5b79bdda3408c9046ecc8c730d151b60077473009febb1
Instruction Fuzzy Hash: CEF08C70C09208AFCB05DFA4E4456D8BFB4EB05301F10819AE91443341DB301A19DB95

Uniqueness

Uniqueness Score: -1.00%

Function 05C393B0, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 973ff85fe90e6da08014fd768823b436e9eccc9775b82efa3dbd94f72a594023
Instruction ID: 2d64ae0871020619f74d50f1928c710a0daa81d671f8d570f2bc7d44e558216c
Opcode Fuzzy Hash: 973ff85fe90e6da08014fd768823b436e9eccc9775b82efa3dbd94f72a594023
Instruction Fuzzy Hash: 85F0657880414CEFDB50CFA4D9417ECBBB1FB49310F24D199C86993391C6759A52DF40

Uniqueness

Uniqueness Score: -1.00%

Function 0170A567, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247500510.0000000001702000.00000040.00000001.sdmp, Offset: 01702000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9329992753edb3889873961c8daf8b29c2d45a85cd03833bccd15a75a0b7ad1f
Instruction ID: a5da3a123071eb515b33280d2022e89afa28e4a255e5360574b817ad713b0663
Opcode Fuzzy Hash: 9329992753edb3889873961c8daf8b29c2d45a85cd03833bccd15a75a0b7ad1f
Instruction Fuzzy Hash: 17E048B164120467D2609E0AEC46B62FB9CDB44930F58C56BED0C5B741E1B6B5048AE5

Uniqueness

Uniqueness Score: -1.00%

Function 0170A8E7, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247500510.0000000001702000.00000040.00000001.sdmp, Offset: 01702000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ba76df05d9822c6601c16a349b9392de551b226c0434f5986065bcadb9fe858
Instruction ID: 83a5dec5b1b445e41365798ce68a7244b9850b62cfbb6c72aa7fbfaec524f7dc
Opcode Fuzzy Hash: 2ba76df05d9822c6601c16a349b9392de551b226c0434f5986065bcadb9fe858
Instruction Fuzzy Hash: B4E048B2A4120467D2609F0AEC46F62FB98DB54A30F18C56BED085F741D1B5B5148BE5

Uniqueness

Uniqueness Score: -1.00%

Function 0170AB57, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247500510.0000000001702000.00000040.00000001.sdmp, Offset: 01702000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e866a4514f425d69b6b0bb142e4384d905fe2f3eeb33e94fa5f8dee2f3bb095
Instruction ID: 6f9c594d4e3f6e2af5f82a6a279372adb47cfeff87a06bb7e9813f5fb6031fc3
Opcode Fuzzy Hash: 0e866a4514f425d69b6b0bb142e4384d905fe2f3eeb33e94fa5f8dee2f3bb095
Instruction Fuzzy Hash: DBE048B26413046BD2609E0AEC46F62FB98DB44A30F18C56BED085B742D1B5B5148BE5

Uniqueness

Uniqueness Score: -1.00%

Function 0170A34F, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247500510.0000000001702000.00000040.00000001.sdmp, Offset: 01702000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa330727616c1c1d4bbbe9582d1dd919fcd9061faadac6738995cb193923c6b
Instruction ID: d8df084347278682467539d256211dddb3adac3dea3e76dd95fd7a806c9ee1e2
Opcode Fuzzy Hash: 3fa330727616c1c1d4bbbe9582d1dd919fcd9061faadac6738995cb193923c6b
Instruction Fuzzy Hash: 24E048B16412046BD2609E0AEC86B62FB98DB44A30F58C56BED085B742D1B5B5048AE5

Uniqueness

Uniqueness Score: -1.00%

Function 0170A138, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247500510.0000000001702000.00000040.00000001.sdmp, Offset: 01702000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48e2b580a23b61483c662bab839b777bc0c8afe6a1dc509a328a8a723e4ff135
Instruction ID: 340c008df5013de598f2da59179d10bb18a13b865ae635a8efce49d026f24e34
Opcode Fuzzy Hash: 48e2b580a23b61483c662bab839b777bc0c8afe6a1dc509a328a8a723e4ff135
Instruction Fuzzy Hash: 85E0D8B164020467D2208E0AEC42B22FB9CDB44A30F08C56BED081B301D1B5B5048AE5

Uniqueness

Uniqueness Score: -1.00%

Function 0170A7BB, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247500510.0000000001702000.00000040.00000001.sdmp, Offset: 01702000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf69146e0eccfee41febe864af14409bc2a3c9cda699b8358b8191e0a9dbbd6
Instruction ID: 956a52cfe55ce5226e4c0c4eeeb3e337ae83736ea6860c063361eb304cf270fa
Opcode Fuzzy Hash: dbf69146e0eccfee41febe864af14409bc2a3c9cda699b8358b8191e0a9dbbd6
Instruction Fuzzy Hash: 4CE048B264120467D2609F0AEC86F63FB98DB54A30F18C56BED085B742D1B6B5148AE5

Uniqueness

Uniqueness Score: -1.00%

Function 0170A68F, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247500510.0000000001702000.00000040.00000001.sdmp, Offset: 01702000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1a15bdfdcb9e81223d87353ae99b53f1a2028dc82959b59ef872b4ee55ce822
Instruction ID: 7788ca9f0298ff77515f12594511504a270b03b98b13783ae2df66e7fe185842
Opcode Fuzzy Hash: f1a15bdfdcb9e81223d87353ae99b53f1a2028dc82959b59ef872b4ee55ce822
Instruction Fuzzy Hash: BCE048B264120467D2609F0AEC46F62FB98DB54A30F18C56BED085B741D1B6B5148AE5

Uniqueness

Uniqueness Score: -1.00%

Function 05C38148, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2758686bba3b68054bad1f5ee5c68d14cf4ace29839807aa1e390635ff03f0b
Instruction ID: 87b7c6d3a76b637b3cb5edaaba56c21e87b65053db667fa5d1f18ad5959e31f9
Opcode Fuzzy Hash: d2758686bba3b68054bad1f5ee5c68d14cf4ace29839807aa1e390635ff03f0b
Instruction Fuzzy Hash: 2EE0D87090B30CEBC704DB74E10A79CBF74AB06215F1095ECE905533C1D7312901DB45

Uniqueness

Uniqueness Score: -1.00%

Function 05C37CC0, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ddd126ee31d1c46dcd3f945751d95764e8fa658871171a97bdee6805611eb8
Instruction ID: 9adee0c496e9c3a98d06dda3f23ace9a7d60a661c2a1f654475ba2cf97212b65
Opcode Fuzzy Hash: e5ddd126ee31d1c46dcd3f945751d95764e8fa658871171a97bdee6805611eb8
Instruction Fuzzy Hash: 02E0D87190A20C9BD708DF79F1867AD7FB4EB01611F2051E8C80563396E5311705D655

Uniqueness

Uniqueness Score: -1.00%

Function 05C35A0F, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45a781e743f57941ea3ba7fe5177c9ea086d92036af077c423402b12a3bc1207
Instruction ID: 4bf34d2dad4ccd58407a2ff92329490e2551064f60746c45af86d9d274531525
Opcode Fuzzy Hash: 45a781e743f57941ea3ba7fe5177c9ea086d92036af077c423402b12a3bc1207
Instruction Fuzzy Hash: 23F06574C0420CEBCB04DFA4E4417ECBBB9EB58300F2080AAD80457340EB319A59EF84

Uniqueness

Uniqueness Score: -1.00%

Function 030D0460, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbad609aade9a4e217c3539944feab62d8e86602d770b3864f2ead124432eefa
Instruction ID: 309608c25668c51888bc3b5c76e15ee448a7b1a56aac629f06288957dbc1a8f2
Opcode Fuzzy Hash: fbad609aade9a4e217c3539944feab62d8e86602d770b3864f2ead124432eefa
Instruction Fuzzy Hash: C9F01E74D01308EBCB14EFB8D0489AEBBB0EB48310F2085AAD804A3380DB719A50CF85

Uniqueness

Uniqueness Score: -1.00%

Function 05C37590, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c7dff4c5a9048ccbd43af1ddcc8ea68d052ca7b015d74e26adbfe7b1b2f61a7
Instruction ID: d29184d9d65bdf1264f90b084971eb8b184458f712cbf30bc85614bddd8012e7
Opcode Fuzzy Hash: 2c7dff4c5a9048ccbd43af1ddcc8ea68d052ca7b015d74e26adbfe7b1b2f61a7
Instruction Fuzzy Hash: 02E0D8B080A31CDBC719DF74E48A6AD7FB4EB05215F2088DCD40423241D7302A06DB95

Uniqueness

Uniqueness Score: -1.00%

Function 05C39400, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 735bb49f11604f78b51ead0f37eb5c2a85fcbdf33d1d917efb34720453a3a213
Instruction ID: ace4966fd18613b485d6b7a4c5dff7143c93eb2b171a3ba8bc04de4e1bc1e12c
Opcode Fuzzy Hash: 735bb49f11604f78b51ead0f37eb5c2a85fcbdf33d1d917efb34720453a3a213
Instruction Fuzzy Hash: 6FF0ED74D0421CEBC704DF98E5416ACBBB4FB49300F20C199D81897341D771AA5ADB55

Uniqueness

Uniqueness Score: -1.00%

Function 05C37EC8, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92cb535b5123ebfd89d4af3b207ab34d5a178a98921cc56c6ef7de8b18144777
Instruction ID: 42a1b8b825c4c5ba5206676f9ba890e8c8a5795f5b7a4d20b70f728700009766
Opcode Fuzzy Hash: 92cb535b5123ebfd89d4af3b207ab34d5a178a98921cc56c6ef7de8b18144777
Instruction Fuzzy Hash: EFE09270C05208EFC704DFA8E4466ADBFB8EB14300F1080EADC04A3781D6306E05CB45

Uniqueness

Uniqueness Score: -1.00%

Function 030D2D1F, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0960506650fc6b4caf2f45506db89e7aed4151f5ced4c158d398954bab629ec3
Instruction ID: c34b5f38ef15626adf1e83fb0f4a929e950a31c187362928ffb95e8174dfe491
Opcode Fuzzy Hash: 0960506650fc6b4caf2f45506db89e7aed4151f5ced4c158d398954bab629ec3
Instruction Fuzzy Hash: 80F0E77495121BCFDB24DF24D885BADBFB1FB08301F1084EAE819A2654EB355E81AF10

Uniqueness

Uniqueness Score: -1.00%

Function 030D2C87, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22320e54f5d6e69348e92d3543b872eb27b6e9c38469860b613be141b574e62b
Instruction ID: 100158293baf26aebefc6eaaa790caa939d4060eea8deb7d8fc8afcaacaa446c
Opcode Fuzzy Hash: 22320e54f5d6e69348e92d3543b872eb27b6e9c38469860b613be141b574e62b
Instruction Fuzzy Hash: 32E0E570D0231DDFCB55DFA8D4456AEBBF9EB49310F6099AAD805A3340D7329A90DB80

Uniqueness

Uniqueness Score: -1.00%

Function 05C358A7, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 904193cfabbf55a289e65c250cad3531f469c4098e6d26b5161a7f21e3572c54
Instruction ID: f4470bbe9a9a8f51dba6a80138abade03bc7e02eac2bb3a8630c0e3aea01d4b9
Opcode Fuzzy Hash: 904193cfabbf55a289e65c250cad3531f469c4098e6d26b5161a7f21e3572c54
Instruction Fuzzy Hash: 14E04F34C45208DFC705EEA4D4467ACBBF4DB04311F1045A9D805A3381EA745A609BDA

Uniqueness

Uniqueness Score: -1.00%

Function 05C36CB7, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7dc52454d2b5999eadb8f659493e3bd2bc8c3ee35a5ff1618c84e9733f1ff3d
Instruction ID: a49ba23b7beda12dc71966e49fd8a8385608da8797145c25d7f32804e67bef1f
Opcode Fuzzy Hash: b7dc52454d2b5999eadb8f659493e3bd2bc8c3ee35a5ff1618c84e9733f1ff3d
Instruction Fuzzy Hash: 46E0C23090A30CFFD310EF64FA0AB697B68F706215F214999900A23261CBB12A58C755

Uniqueness

Uniqueness Score: -1.00%

Function 05C37E80, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb68d77431de1ac00270d976c62e5339ea2327bbea7cf7319f7f753d758a2c8c
Instruction ID: e2271fb249fc4a8b0e7bee3ae5c8adba6065bcd7d0d775b66589f9c11b44c5cf
Opcode Fuzzy Hash: cb68d77431de1ac00270d976c62e5339ea2327bbea7cf7319f7f753d758a2c8c
Instruction Fuzzy Hash: 27E0E574D06208DFC714DFA4E54A5ADBBB5FB4A301F2095A9D80563340DB746A04DF89

Uniqueness

Uniqueness Score: -1.00%

Function 05C37E30, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee3a96f4118b29d14b75cbc2e822d168fc2b1f21795bbf3cbf73ab0cfd587aaf
Instruction ID: 46af65dd42346ef688235148a97a7a4253ea95664ff3005f5b500be550f376e1
Opcode Fuzzy Hash: ee3a96f4118b29d14b75cbc2e822d168fc2b1f21795bbf3cbf73ab0cfd587aaf
Instruction Fuzzy Hash: 80E0DF70C0A34C9FCB14EBA5E9466AE7FB4EB06711F1041EDC80A23381E6306A04DA95

Uniqueness

Uniqueness Score: -1.00%

Function 05C30DD4, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e49abaacc0687cce7de075834aa9982d01b2df55521f26b59687ce632557b8a
Instruction ID: 22e0ab3950b457dadd2952b0c9d820674b0048476d754b798fb0d929c4a9dce4
Opcode Fuzzy Hash: 8e49abaacc0687cce7de075834aa9982d01b2df55521f26b59687ce632557b8a
Instruction Fuzzy Hash: 7AF06278906229CBEB20DF65DD99B99BBB1FB05300F1099E9D50AA3280D7359E848F10

Uniqueness

Uniqueness Score: -1.00%

Function 05C37DF7, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ba8f9671979b6e075be5d6a4e0981ecdcbd18dcb740f5e5ad38e995c4f4e0e1
Instruction ID: b58c3090ab4daaa4c26f7857c853f5f4fd33a3ad1090c23be45ed9552ab6cbf0
Opcode Fuzzy Hash: 0ba8f9671979b6e075be5d6a4e0981ecdcbd18dcb740f5e5ad38e995c4f4e0e1
Instruction Fuzzy Hash: F1D02BB284510C9FC704D9A0D5437A9776CC701211F100CB8C00513380EA71DF04CA59

Uniqueness

Uniqueness Score: -1.00%

Function 05C37BF8, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b6e627a4a329576ff8eaecf0e45cc76be40c045a0ce021a7b4db997eb36730
Instruction ID: 81699a5e28a644ab001869d68adebfdc63005916f9e8cd2396889cec6aa41a67
Opcode Fuzzy Hash: d7b6e627a4a329576ff8eaecf0e45cc76be40c045a0ce021a7b4db997eb36730
Instruction Fuzzy Hash: 99E04F7090520CDFC714EFA8E58679C7BF4EB04705F2004A8D80557361D631AA59C781

Uniqueness

Uniqueness Score: -1.00%

Function 05C36ED0, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab334e16b9054719b168e2668f2529c395371248b86e1d17fa93e9ac2ee66458
Instruction ID: 87fb06e05a8b79eff9d6eed08bce30c0dee09c5786f8596d36cb4cb95c57f5b3
Opcode Fuzzy Hash: ab334e16b9054719b168e2668f2529c395371248b86e1d17fa93e9ac2ee66458
Instruction Fuzzy Hash: 7FE0C23040A20CEBC308DBA4E94E77A3B68E70A211F60159DD0195B692CB321A4DCA15

Uniqueness

Uniqueness Score: -1.00%

Function 05C36E91, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae2216d98393c2bb94021c828ea4193ffb54ae0745c90b9a742667edf7c89ad9
Instruction ID: 68b5cf009a705f9632a5fae809d124f9df7b7710cb09ef9df62950104898808f
Opcode Fuzzy Hash: ae2216d98393c2bb94021c828ea4193ffb54ae0745c90b9a742667edf7c89ad9
Instruction Fuzzy Hash: 93E0C2B1D0921CEBCF10EAB8E5423AC7FB5DB01605F5401B9C885333C0EA309B88D755

Uniqueness

Uniqueness Score: -1.00%

Function 030D0230, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7079b3b6a4b7a287725f7f3dcef83d4ec22a49742596eaa77a4c771496b923c
Instruction ID: 667774c10902cfe7884a939a8e7007d96ac4d9828973430ffe4bbac108dd8131
Opcode Fuzzy Hash: e7079b3b6a4b7a287725f7f3dcef83d4ec22a49742596eaa77a4c771496b923c
Instruction Fuzzy Hash: D1E0463490A308DBCB14DFA8E149AACBBF5EB49301F2080AAD84993380EB315E50CB81

Uniqueness

Uniqueness Score: -1.00%

Function 05C393C0, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf5a169efaea7c6181391f910dee637ed997049ade15d4b726e7ef6d99bd9abb
Instruction ID: d1d360c288be307b1df74b5e3ad947383e3beeb92d7131c095695b3842afaa20
Opcode Fuzzy Hash: bf5a169efaea7c6181391f910dee637ed997049ade15d4b726e7ef6d99bd9abb
Instruction Fuzzy Hash: 52E09A78C0420CEFCB40DFA8E5019ACFBB4EB48300F20C0AADC0463381C6719A11DB84

Uniqueness

Uniqueness Score: -1.00%

Function 05C392D8, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf5a169efaea7c6181391f910dee637ed997049ade15d4b726e7ef6d99bd9abb
Instruction ID: 930f06ded935d080de7121d012e98e242a3b6ed0131c59961ce0e156d0b09589
Opcode Fuzzy Hash: bf5a169efaea7c6181391f910dee637ed997049ade15d4b726e7ef6d99bd9abb
Instruction Fuzzy Hash: 0FE01A74D0420CEFCB04DFA8D545ABCFBB5EB49310F20C1AADC4A53341DA729A51DB95

Uniqueness

Uniqueness Score: -1.00%

Function 05C378B9, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2459d6f00bfbba49dbed0a72beb2dc7951e5cf00764a15cb0fd9346c693ca580
Instruction ID: e65cbf6db0665eb1a6fa29f88e92077abf3bd5684cf05698866541f8212eaf97
Opcode Fuzzy Hash: 2459d6f00bfbba49dbed0a72beb2dc7951e5cf00764a15cb0fd9346c693ca580
Instruction Fuzzy Hash: 74E0127181551CDBC310EB6DE6863E97FF8E709214F244559E40592300DA326A5CDB96

Uniqueness

Uniqueness Score: -1.00%

Function 05C39410, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c292e735e44bde0dcfe29fd96aa22b26d5bc6892af64e034efe5fc7ce686f74
Instruction ID: 1654252aa0f997899e1eac7267f47f9793933eff4f6a76ead81d45f4c575e84d
Opcode Fuzzy Hash: 3c292e735e44bde0dcfe29fd96aa22b26d5bc6892af64e034efe5fc7ce686f74
Instruction Fuzzy Hash: 77E04F74D0420CEFC704DF98E5415ACFBB4FB88300F20C1A9CC0853341D671AA01CB45

Uniqueness

Uniqueness Score: -1.00%

Function 05C37C38, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52589269c0e59c2fda3cd6e5cf4e97af464459802fe4f572c5760e53b5a6e014
Instruction ID: 22e3bbda54fd7d579bdda24956ac62bc7368edfba2106bdb67d6faa2955e237f
Opcode Fuzzy Hash: 52589269c0e59c2fda3cd6e5cf4e97af464459802fe4f572c5760e53b5a6e014
Instruction Fuzzy Hash: 5CD02BB180920CD7C310DB66F5863BE3FE8E306310F140C94940943350D5725B04D340

Uniqueness

Uniqueness Score: -1.00%

Function 05C35A20, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f8102e96b17a5456c20e46f28c2ce972e7da3e14707470c62f1c7a4c86e3cac
Instruction ID: 5a9cfb6c9f94b52c1f1cafa1c4432e7222d6c478db9922e7e19bb106a635da6b
Opcode Fuzzy Hash: 7f8102e96b17a5456c20e46f28c2ce972e7da3e14707470c62f1c7a4c86e3cac
Instruction Fuzzy Hash: B7E04674C0520CEFCB04DFA8E0419ADBBB9EB44304F2081AAD84423340D7319A50EB89

Uniqueness

Uniqueness Score: -1.00%

Function 05C34DA0, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffcb6734932b48930184b2b86fdea49c5f292520a43e554d5c7cabdeb712aaac
Instruction ID: 5fae550911111108a4cfd5d966528a7de6cb946c5668d68be5ac9ae832edca17
Opcode Fuzzy Hash: ffcb6734932b48930184b2b86fdea49c5f292520a43e554d5c7cabdeb712aaac
Instruction Fuzzy Hash: 7CE0E674D4520CEBCB04DFA4E5456ACBFF9EB44700F1081A9D90557344DB745A50DF45

Uniqueness

Uniqueness Score: -1.00%

Function 05C37102, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 725ed1c6d9c73303864fea33c63a3a96edf110010fd27fca7cae1710e1e2e9c4
Instruction ID: 92def4b0ab5d78a58f1e522f47c6e1f6ba372ffaef9a0e0e7f3c73699a246047
Opcode Fuzzy Hash: 725ed1c6d9c73303864fea33c63a3a96edf110010fd27fca7cae1710e1e2e9c4
Instruction Fuzzy Hash: 7AD02B7081621CD7C310DB74F8467A97FBCE70E300F105088D10943100DF711A04D714

Uniqueness

Uniqueness Score: -1.00%

Function 05C34BB0, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50679ec0edf3e7b93b25bf6a66fe7fc426b22e995f808acdcebaa5115d266977
Instruction ID: f09c420f787a08d69a7082d9a844773b61102dc7dfb661e8dc6abd5969d1f8c9
Opcode Fuzzy Hash: 50679ec0edf3e7b93b25bf6a66fe7fc426b22e995f808acdcebaa5115d266977
Instruction Fuzzy Hash: E6E0BF74D0560CDFCB04EFA8D1896ACBBF8EB48304F1085E9D80957351D6715E54CB85

Uniqueness

Uniqueness Score: -1.00%

Function 05C316FD, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa29683e7c43f75de47b40edf55d0889d3de91e6600e08e100b23e2c89c6751
Instruction ID: 3d31bb7cb90c1648aaf6bd5f9c875a54ab9356b84073a8360635f4c9793b2f54
Opcode Fuzzy Hash: 6aa29683e7c43f75de47b40edf55d0889d3de91e6600e08e100b23e2c89c6751
Instruction Fuzzy Hash: F4F07F78A16228CFEB60CF18DC80F89BBF5BB14304F1096EAD50CA3240D6749E808F14

Uniqueness

Uniqueness Score: -1.00%

Function 030D37A8, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4768775b7557d2175d0a30b0cc70e3784ace07be67e522f6222493d4c920db0c
Instruction ID: d21dce198b11f5b1ee0195e6e91c8a2183914e91386fc3bd445b09badcf09a65
Opcode Fuzzy Hash: 4768775b7557d2175d0a30b0cc70e3784ace07be67e522f6222493d4c920db0c
Instruction Fuzzy Hash: 9DD05EB4D16718DBCB50EFA8E5456ADBFB8AB05A01F1041E9D80563340DA301A54CB56

Uniqueness

Uniqueness Score: -1.00%

Function 030D00ED, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b21fe51a0c546c396b6a3c97728f0db5851ebad5ec68950a827539c296945486
Instruction ID: bef703a2d11a40127489260c5f04e49f67938d53aa30f111c1606f56816b9cc5
Opcode Fuzzy Hash: b21fe51a0c546c396b6a3c97728f0db5851ebad5ec68950a827539c296945486
Instruction Fuzzy Hash: 60D01735D01208DBCB00CFA4E0882ECBBB0EB89325F209426C219A3300C73144458F65

Uniqueness

Uniqueness Score: -1.00%

Function 05C358B8, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f86c21cb4839b5914a66eb2f12a018cba1c4c3fbd71f6119ce3922918f3163ac
Instruction ID: a6ce972079ffde3dea36f37aed94eaa576ea246fb3e23915ed79ac17e6fcf06e
Opcode Fuzzy Hash: f86c21cb4839b5914a66eb2f12a018cba1c4c3fbd71f6119ce3922918f3163ac
Instruction Fuzzy Hash: 4FD05E30C5620CDBC704EFB8E5066ACBFF8EB05701F2041A9D80663340DB302A50CB96

Uniqueness

Uniqueness Score: -1.00%

Function 05C34C50, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68fd9e1ce514e72cf5b2fc6d1055d5b21d4dba8618214ee15fdb1733dced1626
Instruction ID: 6ff03c9fd7b3752a6858f4b5dcc2b150ce40f05ebd9ebc9aa909eda3e3d51733
Opcode Fuzzy Hash: 68fd9e1ce514e72cf5b2fc6d1055d5b21d4dba8618214ee15fdb1733dced1626
Instruction Fuzzy Hash: 85D05E30D0630CDBCB08EFA8F58A6ACBFB8FB45601F1085A9D80563350DA312A50CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05C36CC8, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4365124e60e6ac5b40a2faf5a18a471cc27be7e1222401f225c5204bf7a49510
Instruction ID: eb635b999bd63b7bb3406f6d5f149c83e3fc2b4a06531b4627d607dc126d032f
Opcode Fuzzy Hash: 4365124e60e6ac5b40a2faf5a18a471cc27be7e1222401f225c5204bf7a49510
Instruction Fuzzy Hash: 6CD0A93080A20CEBC300DAA4F40AA6ABB2CE706622F208498940923250CB312A50CA99

Uniqueness

Uniqueness Score: -1.00%

Function 05C39488, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc520ee80e4ae32d0513446f8422d59ba3b516ac9fecfb0e5975b57578628628
Instruction ID: 1967361b5f863f7382da21833d75c4af18a994694ce7b5d6da27627dd715ffee
Opcode Fuzzy Hash: dc520ee80e4ae32d0513446f8422d59ba3b516ac9fecfb0e5975b57578628628
Instruction Fuzzy Hash: 2ED02230006A1CCAC330EB48F89A3B87B18F305332FF44804E10812900CFB2A4AEC308

Uniqueness

Uniqueness Score: -1.00%

Function 05C33395, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7439df921a9a4d3cff1807d43ac930836692a6e794860d7dd21617f4e6e9e781
Instruction ID: 541259392bda3ccf0f255c0282a45c0198a476ca33052b2a74e53926d5e9a37f
Opcode Fuzzy Hash: 7439df921a9a4d3cff1807d43ac930836692a6e794860d7dd21617f4e6e9e781
Instruction Fuzzy Hash: 3FE0B674905118CBCB25CF55D95ABA8B7B5FB05301F0069D9940AB3290C7301E84CF04

Uniqueness

Uniqueness Score: -1.00%

Function 05C38666, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33efe56e07488b3d83b9c5912da5c6df5aa56e79ffba9c87b278de80224d12c8
Instruction ID: fe59bfd63ea0085b45b183002519b88b8c04eaa8471ff80ef82dbf287d62f4c2
Opcode Fuzzy Hash: 33efe56e07488b3d83b9c5912da5c6df5aa56e79ffba9c87b278de80224d12c8
Instruction Fuzzy Hash: E9E09274A002189BDB21CF94C851BDCBBB1BB4D300F20818AEA19AB391C3725A429F04

Uniqueness

Uniqueness Score: -1.00%

Function 016F23F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247483646.00000000016F2000.00000040.00000001.sdmp, Offset: 016F2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1679f437294d974290e64063f851ba31d5e3403b1b25f25584010fc4a4f0b92b
Instruction ID: 72094d5f8da0d3810c8da58236e47c7c5e08a42439779cd69637ac9ca7d78acf
Opcode Fuzzy Hash: 1679f437294d974290e64063f851ba31d5e3403b1b25f25584010fc4a4f0b92b
Instruction Fuzzy Hash: 8CD05E79206A814FE3278A1CD5B8B953FA4AB51B04F4644FEE9008B763C3A8D5D1DA10

Uniqueness

Uniqueness Score: -1.00%

Function 030D00CD, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c534812df87d65fb66443d91bbd84059e3d0965627859471429f713dd751515
Instruction ID: 179c2bda2e511c6814d37b80015464354784cc0d8672df7c80ea07558c7a3a13
Opcode Fuzzy Hash: 4c534812df87d65fb66443d91bbd84059e3d0965627859471429f713dd751515
Instruction Fuzzy Hash: 73D0C936E01208DF8B108FB8E0840DCF775EB89335B219066D615B3300C7319455CF65

Uniqueness

Uniqueness Score: -1.00%

Function 016F23BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247483646.00000000016F2000.00000040.00000001.sdmp, Offset: 016F2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfe56cc625943eae9ff5a3bba8793596051b08530eb8989aceb82c4f06b14985
Instruction ID: c44b4757f6fb2f792e5b4605a2cb75e5a5de9b41c1c6c481c622fdee9f9125f2
Opcode Fuzzy Hash: bfe56cc625943eae9ff5a3bba8793596051b08530eb8989aceb82c4f06b14985
Instruction Fuzzy Hash: 8CD05E752006814BD725DB0CC5E4F593BD4EB81B00F0644FDAD008B362C7A4D8C1CA00

Uniqueness

Uniqueness Score: -1.00%

Function 030D5289, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab6050a517fb7d96530cbd430e1e1a384a89721421522f5b1f5823a04236e2f9
Instruction ID: 67a4e30e717a4e6704a21ab964e24884f6cfe16c8ab1a3e8a2b49b21152bad5d
Opcode Fuzzy Hash: ab6050a517fb7d96530cbd430e1e1a384a89721421522f5b1f5823a04236e2f9
Instruction Fuzzy Hash: A3E00278D0622DCFCBA0DF24C989A99BBB1BB09300F1085DAD81DA3310EB305E859F10

Uniqueness

Uniqueness Score: -1.00%

Function 05C39498, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe23372cf087a0355c16cf1e5aa68c5cbede1e79e3aa61a0914fd987c0d41de2
Instruction ID: 02b9e386c0dfa05d495ca753cf6dc6ca8ebcc61081e54c50069fcd6d0a3076a3
Opcode Fuzzy Hash: fe23372cf087a0355c16cf1e5aa68c5cbede1e79e3aa61a0914fd987c0d41de2
Instruction Fuzzy Hash: 32C02B3004BF0CC2C320AA58700E335BB4CD302732F605D00510D104418EF2A060C71D

Uniqueness

Uniqueness Score: -1.00%

Function 030DAAD5, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1f29634bd52d06cfc3043c16b9661d14ca0751858f5f985087949acf98da279
Instruction ID: b6359515bf1fbcef5e911f6d2c4701d90bf425fc25a6525c283ef310a9c75b4a
Opcode Fuzzy Hash: d1f29634bd52d06cfc3043c16b9661d14ca0751858f5f985087949acf98da279
Instruction Fuzzy Hash: 77D0CE74D4622ADFCB25CF14DA946ADB7F4BF15345F0059E9941AA3201D7306F80DF50

Uniqueness

Uniqueness Score: -1.00%

Function 030DB107, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e834f28d814e22fe7e134edb340243d53988bc87bf4b7651e23d0f1469c60f70
Instruction ID: 97ff350aa1246baf43fc42305712a754472c30819501a2f71bb48c763fcd6227
Opcode Fuzzy Hash: e834f28d814e22fe7e134edb340243d53988bc87bf4b7651e23d0f1469c60f70
Instruction Fuzzy Hash: 64D06C78A16228CFDB22CF24C8506DDB7F4AB0A340F8094D6D88AA3200D7306E80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 030DB0F6, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a63f44927e0542b7460ae044b386b6cca7f9d65149c54dfdd9ce1beb804ae6a
Instruction ID: 2de45c07d1e1f90ba9e680daeff757fa23664eebddc73901e0601b7ba38701e4
Opcode Fuzzy Hash: 8a63f44927e0542b7460ae044b386b6cca7f9d65149c54dfdd9ce1beb804ae6a
Instruction Fuzzy Hash: 28D06C78906328CBCBA1CF24C89069CB7B5AB0A320F4044D5950EA2300DE301EC08F44

Uniqueness

Uniqueness Score: -1.00%

Function 05C30E02, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26fd3e16239d8d257da0a98f76d90b75d0ad89c6d80219ce7ff279e4e1323658
Instruction ID: bfc439f038f7d47ef92b92adf91f72f3d7a8cc6a9bf42f94ae5bb5ef584e2393
Opcode Fuzzy Hash: 26fd3e16239d8d257da0a98f76d90b75d0ad89c6d80219ce7ff279e4e1323658
Instruction Fuzzy Hash: 70D06C74D162298BCBA4CF25D899A98BBB1EB08710F1019D9D40EB3210DA301FC08F54

Uniqueness

Uniqueness Score: -1.00%

Function 05C3423A, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f37d031ba01f0c0a93f893d66e3f9e75252f77908b644ddda62de05d704c116
Instruction ID: 4b03f45b05380380fd97904f425dd7729da778ecf431db8f9c20d4677c38e31d
Opcode Fuzzy Hash: 9f37d031ba01f0c0a93f893d66e3f9e75252f77908b644ddda62de05d704c116
Instruction Fuzzy Hash: 45D0CA389043288BCBA2CF20D8A2AC8BB7AAB09314F0040D8D60EA3204CB301EC0CE00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05C35160, Relevance: 1.7, Strings: 1, Instructions: 422COMMON

Download Yara Rule

Strings

, xrefs: 05C3527A

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 428e28c3fa25ff7235eba5aa71768f054e3e63a5f41f9f6e525f67979a69e2f9
Instruction ID: e22fb28f5051db3f0c6527b6d852bdc5a22cc3f2b40a65aa355d18e7d40d70b3
Opcode Fuzzy Hash: 428e28c3fa25ff7235eba5aa71768f054e3e63a5f41f9f6e525f67979a69e2f9
Instruction Fuzzy Hash: 5812BD74E0021C8FDB54CFA9D985AEDBBF2FF48314F1481A9E409AB255DB34AA85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 030DE6B0, Relevance: 1.7, Strings: 1, Instructions: 412COMMON

Download Yara Rule

Strings

, xrefs: 030DE7E2

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 75bcd0f8117c18a70e165e220f924e6f3caa074d2718273194fd6feccb82974e
Instruction ID: 003607930ae815446e8d931f7e0261f37a9defcfb2dfec02dbde8f0a74778ff0
Opcode Fuzzy Hash: 75bcd0f8117c18a70e165e220f924e6f3caa074d2718273194fd6feccb82974e
Instruction Fuzzy Hash: 0312D274E01219CFDB54CFA9D885AAEFBF2FF88310F148169E819AB245D7349982CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05C307E7, Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

K, xrefs: 05C30AFC

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 5216bcfcb9374e7aa276e8c9bc8b2a8efac128e4ee434abacc0b7e1d0eee22db
Instruction ID: d2d38d9a70ef271629e9f3799541e60446ee1548d8d8b363fc7b7143efdce9e0
Opcode Fuzzy Hash: 5216bcfcb9374e7aa276e8c9bc8b2a8efac128e4ee434abacc0b7e1d0eee22db
Instruction Fuzzy Hash: 73A19BB0E5062ECBDB69DFA9C984ADDBBF5FF48300F4081E9D058A6205E7309A95CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C35150, Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

, xrefs: 05C3527A

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 5c7259d040f24a35b9c45de0e9fff9318224e46a38be178e83666d308fa8aa00
Instruction ID: a6961fdb24f3509da478c87f1cf532411063f72373985870c6edc0da40644e76
Opcode Fuzzy Hash: 5c7259d040f24a35b9c45de0e9fff9318224e46a38be178e83666d308fa8aa00
Instruction Fuzzy Hash: 8151B1B0E002188FDB58CFAAD8457DEBBF2BF88310F14C4AAD908A7255E7745A85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00D46CC1, Relevance: .7, Instructions: 688COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.246864082.0000000000D42000.00000002.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.246858435.0000000000D40000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18835151a127eef9d841494d254ad5055390f22b7b7c372b39eef0c6905aa69a
Instruction ID: fb844c65402a41cf66ab2dee6d5837db086116a62e48307a33778829d209cbf0
Opcode Fuzzy Hash: 18835151a127eef9d841494d254ad5055390f22b7b7c372b39eef0c6905aa69a
Instruction Fuzzy Hash: 1042782240E7C14FC7138B7899B56D17FB1AE5721470E48CBC4C18F4B3E2286A6AE772

Uniqueness

Uniqueness Score: -1.00%

Function 030D7300, Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ede4f4278d159f564fcf2100a66c6b1505f4385f402623571e0d5ac7f5d9c746
Instruction ID: 2cd452a233706e4c026f3706b8c3ea7217c838718ac46af5050f47075b200902
Opcode Fuzzy Hash: ede4f4278d159f564fcf2100a66c6b1505f4385f402623571e0d5ac7f5d9c746
Instruction Fuzzy Hash: 33A16CB0D056288BEB64DF29C985B8DBBF5EF88304F1085E9D55CA7206E7309A968F44

Uniqueness

Uniqueness Score: -1.00%

Function 030DA77E, Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6fdf7790cb3178e3ef6d82a8664c2cbf4684f20181078a66d37e39d8d284e39
Instruction ID: 7cc666b70b6c6444c5e7267281df0130905e58f5a6ba5a86f0f1a85dc5608eeb
Opcode Fuzzy Hash: d6fdf7790cb3178e3ef6d82a8664c2cbf4684f20181078a66d37e39d8d284e39
Instruction Fuzzy Hash: 1D91C070E04A298FCB69DF68DD847ADBBF4FF48345F1481E9D048E6264DB349A998F01

Uniqueness

Uniqueness Score: -1.00%

Function 030D3770, Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeecae1441e65280fc5bbd868a3b5a5a6eb77dfae7efa8f17c660ab3dfbceadb
Instruction ID: 43604df0367e3ac8fb59ec571e685088f8fdbda7656cae050eaa6d7d7b45fca2
Opcode Fuzzy Hash: aeecae1441e65280fc5bbd868a3b5a5a6eb77dfae7efa8f17c660ab3dfbceadb
Instruction Fuzzy Hash: B7517970E02749CFD755DF6AE85068DBFE2FF85304F19C06EE1089B269DB34580A8B12

Uniqueness

Uniqueness Score: -1.00%

Function 030D37D8, Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2702a3859488c1422d40525425c0bf1475356761326f27b250dd787c86e5d32
Instruction ID: 40a73ae230feb8686d04eac064c2e71505b6b3ba5273e14fd353011bc4e9ecb4
Opcode Fuzzy Hash: a2702a3859488c1422d40525425c0bf1475356761326f27b250dd787c86e5d32
Instruction Fuzzy Hash: 10516A74E02749CFE754DF6AE840B8EBFE6FB84314F15C06DE108AB258DB7458068B52

Uniqueness

Uniqueness Score: -1.00%

Function 030D37E8, Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba28b53b06f18b0bc65176b5194fc1d2f85ebfe1d7a76dac2464fd05e17881ec
Instruction ID: d9801970f12f309b8691c452311d7fd2377201bba51ee96539150f02d0366b13
Opcode Fuzzy Hash: ba28b53b06f18b0bc65176b5194fc1d2f85ebfe1d7a76dac2464fd05e17881ec
Instruction Fuzzy Hash: 49513870E02349CFE754DF6AE850B8DBFE6FB84314F19C02DE1089B269DB74584A8B56

Uniqueness

Uniqueness Score: -1.00%

Function 05C30047, Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc57b0428779a0746ae1383ced46ef2edc7435557acc1259c7b95b44a2a22e9c
Instruction ID: 0ca19f000d79269b45aaa7f17870ab227230c12c4f5762bb50f352c6f7bcef23
Opcode Fuzzy Hash: cc57b0428779a0746ae1383ced46ef2edc7435557acc1259c7b95b44a2a22e9c
Instruction Fuzzy Hash: 314171B2E056588FEB59CF6B8C4169AFBF7AFC9200F18C1FA8448AB255EB7405458F11

Uniqueness

Uniqueness Score: -1.00%

Function 030D9457, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247688475.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec83865add4c49f6e745a57678e3001948dba4c7568657d88895b5b5ec009fd7
Instruction ID: f1f396bc01cc6549de7482b37ad7b552b92869c64a48a4799b5a1018935092d5
Opcode Fuzzy Hash: ec83865add4c49f6e745a57678e3001948dba4c7568657d88895b5b5ec009fd7
Instruction Fuzzy Hash: 44415CB1D057188BEB5DCF6B894479EFAF7AFC8200F18C1B9840CA6255EB7456828F11

Uniqueness

Uniqueness Score: -1.00%

Function 05C30070, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 285daeb25687b053e154d10fa3feccdb14c31c8a0a0b1109f21aeda86bd7da5b
Instruction ID: dfff341acd437c677d41eda74f649ce1424fbdb2f431490e2b0fce704c121ee8
Opcode Fuzzy Hash: 285daeb25687b053e154d10fa3feccdb14c31c8a0a0b1109f21aeda86bd7da5b
Instruction Fuzzy Hash: ED411DB1E016188BEB5CCF6B8D4169AFAF7BFC9200F14C1BAC54CAB254EB7006428F15

Uniqueness

Uniqueness Score: -1.00%

Function 05C39857, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cd5e1fbf2b3506c4cb0c5a0c95b27b30ca9f487d0f8489da70bddefb84d797b
Instruction ID: dc5106d5ae9e32679214e2efda638fc960c6efe968a1524bd69b626e2e2749f5
Opcode Fuzzy Hash: 0cd5e1fbf2b3506c4cb0c5a0c95b27b30ca9f487d0f8489da70bddefb84d797b
Instruction Fuzzy Hash: C2217C70D4921DDECB10DFA9D44ABEEBFF4AB4A300F14586AE005B3281D7704A48CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05C39868, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.251992768.0000000005C30000.00000040.00000001.sdmp, Offset: 05C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfdc10e3c4df876d684ddddbced837cb062bc0b8d9156155a5bb75a5c29084a5
Instruction ID: b810702e48e5b748a5f99686f077ba013b919badca6e9402291cd3ee8ccf45a5
Opcode Fuzzy Hash: bfdc10e3c4df876d684ddddbced837cb062bc0b8d9156155a5bb75a5c29084a5
Instruction Fuzzy Hash: 3811F870D452199ECB14DFAAD449BEEBFF1BF4A300F149469E005B3280D7744A40CFA9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: QRN-CLJC-06112020149.PDF.exe PID: 4664 Parent PID: 6128 QRN-CLJC-06112020149.PDF.exeCOMMON

Executed Functions

Function 02BD33C8, Relevance: 2.7, APIs: 1, Instructions: 1239libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02BD37C7

Memory Dump Source

Source File: 00000003.00000002.506044505.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 95c65faaf32af227899d2dfb2736c2bdc9281a3d1a0a1a4166797a2e19cc6e82
Instruction ID: 82e6499b80af2089f1e62a74f7d33106a8616204cdbac98048436bda51aba13a
Opcode Fuzzy Hash: 95c65faaf32af227899d2dfb2736c2bdc9281a3d1a0a1a4166797a2e19cc6e82
Instruction Fuzzy Hash: CDD2B374E006298FCB64DF64DC94AAEBBB2BF48302F5085E6D809A3354DB359E91CF51

Uniqueness

Uniqueness Score: -1.00%

Function 063A3B40, Relevance: 2.4, APIs: 1, Instructions: 890COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512738415.00000000063A0000.00000040.00000001.sdmp, Offset: 063A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3476344b747b5e0797f316af62176c2bed8555c6ffddcbcf96135397194cc934
Instruction ID: a699775fbcb210913d595da173f4ede151a091e61ee683c5804b4d51c361ddd3
Opcode Fuzzy Hash: 3476344b747b5e0797f316af62176c2bed8555c6ffddcbcf96135397194cc934
Instruction Fuzzy Hash: 42727B35E00259CFCB25DF64C854B9EBBF2EF89300F1584A9D909AB261DB71AD85DF80

Uniqueness

Uniqueness Score: -1.00%

Function 063D5330, Relevance: 2.2, Strings: 1, Instructions: 958COMMON

Download Yara Rule

Strings

\, xrefs: 063D5379

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: 1e87fdcf0e5ef3387a90fef72a5695bcbf35cea81d9e1487b104526da1f6ac42
Instruction ID: ee6f9aab3951fd1585fe9f9e3a906eff95fc7f75e9f6da72f4bff359c6ade6a1
Opcode Fuzzy Hash: 1e87fdcf0e5ef3387a90fef72a5695bcbf35cea81d9e1487b104526da1f6ac42
Instruction Fuzzy Hash: 8B72AC35B002069FDB55CF68D880BAEBBF2EF89310F148469E505DB3A5DA36DC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 063D65FB, Relevance: 2.1, Instructions: 2069COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e997706e6b705a0896ed1d0cb23998a19458145feb3a9b9d2da88fe0afa1eb
Instruction ID: 5d9ad22b1975a3dbdccc6e9535ca9235ef67d7a1e3ea4b65f460526277731df0
Opcode Fuzzy Hash: 88e997706e6b705a0896ed1d0cb23998a19458145feb3a9b9d2da88fe0afa1eb
Instruction Fuzzy Hash: F682D335F002019FDB60CB28D885B6DB7F2AF46310F2445AAE559DF392CA75EC498B92

Uniqueness

Uniqueness Score: -1.00%

Function 0269AF07, Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 0269AF87

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 863f69ef98e9d9374e6ca8dbde71adf1661061e65238feaf1ee04ecf3a4b2207
Instruction ID: e118894042475587b863026cf0bbdf56f3025a4540d6b40cd82badee64e4b5c9
Opcode Fuzzy Hash: 863f69ef98e9d9374e6ca8dbde71adf1661061e65238feaf1ee04ecf3a4b2207
Instruction Fuzzy Hash: E621B1B65093809FDB128F25DC40B52BFF8EF06310F08849AE9848F163D335A808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0269B089, Relevance: 1.6, APIs: 1, Instructions: 57nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 0269B0F5

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 9d312d24dd65207d6a53d441be0864e83d690490cca557c549f55b5c85583e98
Instruction ID: 4899d458ac800740b14aa572142be358f2ab8bea582968a38ec1565165e24864
Opcode Fuzzy Hash: 9d312d24dd65207d6a53d441be0864e83d690490cca557c549f55b5c85583e98
Instruction Fuzzy Hash: E811AC724093809FDB22CB14DC41A62FFB4EF06314F0980DAE9848F263C275A918CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0269AF3E, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 0269AF87

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 635f8ebe9a5e5424d488e6517110645c7ad8de7030afb9fe27fbef15968dc728
Instruction ID: 4f5305b9a20eb54db5d789f9e38cdbee03aa8b05c627b8cfb3bce6cc4e208e38
Opcode Fuzzy Hash: 635f8ebe9a5e5424d488e6517110645c7ad8de7030afb9fe27fbef15968dc728
Instruction Fuzzy Hash: EE115E765002009FDF20CF95E884B66FBE8EF04320F08856AED858B652D775E818CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0269A09A, Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,?), ref: 0269A0D5

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 32ebad0ccff1790f9a6cf5573f803f01ae416d0383f68fab1a3365ed3d3d0928
Instruction ID: cf68f2ac1d8b98025efb115cde5848ac5364161e206925126e3f574f6ba7f1de
Opcode Fuzzy Hash: 32ebad0ccff1790f9a6cf5573f803f01ae416d0383f68fab1a3365ed3d3d0928
Instruction Fuzzy Hash: 8C019E314002409FDF20CF95E844B65FBE4EF48324F0884AADD898B212D775A418CF72

Uniqueness

Uniqueness Score: -1.00%

Function 0269B0BA, Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 0269B0F5

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: b4ed2e6e83444f6b4062884a9d691faabf059fccf7f923444be1d587faa80959
Instruction ID: 51f5c54798d44e5c69ffc647b8918fe7c3fa94fb41cf10c78f9c5ce916cb4422
Opcode Fuzzy Hash: b4ed2e6e83444f6b4062884a9d691faabf059fccf7f923444be1d587faa80959
Instruction Fuzzy Hash: 3B018B355002449FDF20CF45E884B65FFA4EF08724F08C4AADD894B212C375A419CF72

Uniqueness

Uniqueness Score: -1.00%

Function 063D14E0, Relevance: 1.2, Instructions: 1181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e64bef8eb746ab7332b43e3cf5ffa6597ee5591987424d9ae7d6ac754730cf6
Instruction ID: 06c2d6eb8107ffeb1d23bb073c8de66fd9fb20aceefc793edad1baf9530ed5cd
Opcode Fuzzy Hash: 6e64bef8eb746ab7332b43e3cf5ffa6597ee5591987424d9ae7d6ac754730cf6
Instruction Fuzzy Hash: EAA22B70E012189FDB68DB79D8547AEB7F6BF84304F1484A9D609AB395DB309E85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 059324EE, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100registryCOMMON

Download Yara Rule

APIs

RegNotifyChangeKeyValue.KERNEL32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05932598

Strings

}SV, xrefs: 05932559

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: ChangeNotifyValue
String ID: }SV
API String ID: 3933585183-3818434562
Opcode ID: 15b19851042ebd35c93fbec47f593cd1d87330f3525df5f660fc47ec54ba7919
Instruction ID: 7e2fc2fe0d1beee2c3ddcfc29eeebfbcab4c9aa768b0d0b2507b2b3b8752c7f2
Opcode Fuzzy Hash: 15b19851042ebd35c93fbec47f593cd1d87330f3525df5f660fc47ec54ba7919
Instruction Fuzzy Hash: 3431F775409380AFEB12CF65CC55FA6FFA9EF06310F08859AE9809F153C324A509C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 02BD33F8, Relevance: 2.2, APIs: 1, Instructions: 691libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02BD37C7

Memory Dump Source

Source File: 00000003.00000002.506044505.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8c9f392f47b4feace2826c81cf010ec89cb4eeebbc36623a8b9d08eaef0c656b
Instruction ID: 5f0b49d23ccc8bf6ea8608beb9a2231cf737204e0b754f11335e5a0bb17e1c29
Opcode Fuzzy Hash: 8c9f392f47b4feace2826c81cf010ec89cb4eeebbc36623a8b9d08eaef0c656b
Instruction Fuzzy Hash: 9A72A1B8E002298FCB64DF64DC84AADBBF1FB49212F5085E6994DA3310DB359E91CF15

Uniqueness

Uniqueness Score: -1.00%

Function 02BD344C, Relevance: 2.2, APIs: 1, Instructions: 679libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02BD37C7

Memory Dump Source

Source File: 00000003.00000002.506044505.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 96245df05ced41019c08b0c9da3d8138f7e4bda1102cf0b1c3e4c9bc3603a5d2
Instruction ID: 908694efa823bc67826c58be072630513448fc36c44c01861dd40cf459079b9f
Opcode Fuzzy Hash: 96245df05ced41019c08b0c9da3d8138f7e4bda1102cf0b1c3e4c9bc3603a5d2
Instruction Fuzzy Hash: E072B2B8E002298FCB64DF64DC84AADBBF1FB49212F5085E6994DA3310DB359E91CF15

Uniqueness

Uniqueness Score: -1.00%

Function 02BD3497, Relevance: 2.2, APIs: 1, Instructions: 671libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02BD37C7

Memory Dump Source

Source File: 00000003.00000002.506044505.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6d8a1d2dce63bfd1ee1872c90ddb4e9c2b237edbe1bd12da8b78afd5d4dd66f3
Instruction ID: c613b88a2b60ae2d94f2cc3c4c3889cc5a65f6b3d06de822c41db75685f8a487
Opcode Fuzzy Hash: 6d8a1d2dce63bfd1ee1872c90ddb4e9c2b237edbe1bd12da8b78afd5d4dd66f3
Instruction Fuzzy Hash: A572B2B8E002298FCB64DF64DC84AADBBF1FB49212F5085E6994DA3310DB359E91CF15

Uniqueness

Uniqueness Score: -1.00%

Function 02BD34EB, Relevance: 2.2, APIs: 1, Instructions: 661libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02BD37C7

Memory Dump Source

Source File: 00000003.00000002.506044505.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2bc891a53674532be0f2c6a28d0f48d91a0e75f0e9f714a0b1af3ad93dc098fe
Instruction ID: 685b432206648d71d17a9e413ea7db309aff41f01ef8bedce0ea31610f1de098
Opcode Fuzzy Hash: 2bc891a53674532be0f2c6a28d0f48d91a0e75f0e9f714a0b1af3ad93dc098fe
Instruction Fuzzy Hash: 4072A2B8E006298FCB64DF64DC84AADBBF1FB48212F5085E6994DA3310DB359E91CF15

Uniqueness

Uniqueness Score: -1.00%

Function 02BD354B, Relevance: 2.1, APIs: 1, Instructions: 648libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02BD37C7

Memory Dump Source

Source File: 00000003.00000002.506044505.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 407a3106481fdef395f2e6f21a69a489ab4ba90cc0b9f2c060353f1736dda5e1
Instruction ID: d74f815ca14d8111badcdb9fda8e9cbed4a5f82f8e9888c1b8aece0e45ac0932
Opcode Fuzzy Hash: 407a3106481fdef395f2e6f21a69a489ab4ba90cc0b9f2c060353f1736dda5e1
Instruction Fuzzy Hash: F762B2B8E006298FCB64DF64DC84AADBBF1FB48212F5085E6994DA3310DB359E91CF15

Uniqueness

Uniqueness Score: -1.00%

Function 02BD359F, Relevance: 2.1, APIs: 1, Instructions: 638libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02BD37C7

Memory Dump Source

Source File: 00000003.00000002.506044505.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: db881d1406cf9e9919ad30f2394b7538fc10cf3c39dbbb29ae2f4ffd87661dd5
Instruction ID: 7a32804e836d13190a204025844b75b3804264aee892b1b40443bc8ed5cb49c1
Opcode Fuzzy Hash: db881d1406cf9e9919ad30f2394b7538fc10cf3c39dbbb29ae2f4ffd87661dd5
Instruction Fuzzy Hash: 2B62A2B8E006298FCB64DF64DC84AADBBF1FB48212F5085E6994DA3310DB359E91CF15

Uniqueness

Uniqueness Score: -1.00%

Function 02BD35F3, Relevance: 2.1, APIs: 1, Instructions: 628libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02BD37C7

Memory Dump Source

Source File: 00000003.00000002.506044505.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5f1d3400908475751bb76d4f8f743cf17688634cafa2a6ac12f71cc7daec4285
Instruction ID: e09957aae2f7c149781de3369f809a955b3563c5a2afa894d02b59d3c54155d5
Opcode Fuzzy Hash: 5f1d3400908475751bb76d4f8f743cf17688634cafa2a6ac12f71cc7daec4285
Instruction Fuzzy Hash: A162A2B4E006298FCB64DF64DC84AADBBF1FB48212F5085E6994DA3310DB359E91CF15

Uniqueness

Uniqueness Score: -1.00%

Function 02BD3647, Relevance: 2.1, APIs: 1, Instructions: 618libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02BD37C7

Memory Dump Source

Source File: 00000003.00000002.506044505.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e5f1b4a551f1abb0bf9a42a6c9c8aef5a3c5be7445846e5806e22d07de5c24f9
Instruction ID: 3f8a4e55dae254a8e01c2843ec48277d9daea7953ebc29aa731393cec3f233c8
Opcode Fuzzy Hash: e5f1b4a551f1abb0bf9a42a6c9c8aef5a3c5be7445846e5806e22d07de5c24f9
Instruction Fuzzy Hash: 4762A2B4E402298FCB64DF64DC88AADBBB1FF48212F5085E6994DA3310DB359E91CF15

Uniqueness

Uniqueness Score: -1.00%

Function 02BD369B, Relevance: 2.1, APIs: 1, Instructions: 606libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02BD37C7

Memory Dump Source

Source File: 00000003.00000002.506044505.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5c520c4b8314bcc55a42d66c2e42213ebab6836c2d04eb67d46eaa3afa9cbb4e
Instruction ID: c21b06221b11447f626c16375af6913b96f73284d39fe040fa9a8bad2b0a38f5
Opcode Fuzzy Hash: 5c520c4b8314bcc55a42d66c2e42213ebab6836c2d04eb67d46eaa3afa9cbb4e
Instruction Fuzzy Hash: 0962B2B4E402298FCB64DF64DC88AADBBB1FF48202F5085E6994DA3310DB359E91CF15

Uniqueness

Uniqueness Score: -1.00%

Function 063AC2B0, Relevance: 1.7, APIs: 1, Instructions: 204libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 063AC3B5

Memory Dump Source

Source File: 00000003.00000002.512738415.00000000063A0000.00000040.00000001.sdmp, Offset: 063A0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b0149c838ce87a128bd40d50cab08a06eacb6874f8db8529032ab1595c4b3299
Instruction ID: acf79a3e3d5da9a434ad535650e8946370fa728b50a8d84159b22c3c5c20bfa6
Opcode Fuzzy Hash: b0149c838ce87a128bd40d50cab08a06eacb6874f8db8529032ab1595c4b3299
Instruction Fuzzy Hash: B9619230F003499FDB04EBB4D854AAE7BB6EF84304F148579E506DB285EA34EC45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 063AD110, Relevance: 1.7, APIs: 1, Instructions: 202libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 063AD150

Memory Dump Source

Source File: 00000003.00000002.512738415.00000000063A0000.00000040.00000001.sdmp, Offset: 063A0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8b126c7147419992c87e2decc5f03b98c2cb1b3769dd2d6634998931ecaf0bd6
Instruction ID: da4986b2cfed14be910d7d092e447360c8ed0fcd1c4e9e9c13a96ed773726a25
Opcode Fuzzy Hash: 8b126c7147419992c87e2decc5f03b98c2cb1b3769dd2d6634998931ecaf0bd6
Instruction Fuzzy Hash: 4F715A30E00306DFDB54DFB4D898AAEBBF2EF88315F118928D406AB794DB749845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 063AC350, Relevance: 1.7, APIs: 1, Instructions: 155libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 063AC3B5

Memory Dump Source

Source File: 00000003.00000002.512738415.00000000063A0000.00000040.00000001.sdmp, Offset: 063A0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 27007f272f68dd1c133b3f8accd2920daf6295ee96aec08c9258ee1749f12f36
Instruction ID: 0b27fa14bdafeb27f2c8e20a76a2866d2303f01ec172412d3039a2e97b8bca1f
Opcode Fuzzy Hash: 27007f272f68dd1c133b3f8accd2920daf6295ee96aec08c9258ee1749f12f36
Instruction Fuzzy Hash: 59514E70F002099FCB04EBB4D854AAEB7B6FF88304F148969E506DB244EF349C45DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 059323E2, Relevance: 1.6, APIs: 1, Instructions: 110registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000E2C), ref: 05932499

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 0e7628b6411f9a26c384c5d9b833f4891d23962a3ac908b07117d4842bf7b231
Instruction ID: 3d256c5d67cd137f7158386300f9887f639a41707ffd1f7a54566b6e91f6f89b
Opcode Fuzzy Hash: 0e7628b6411f9a26c384c5d9b833f4891d23962a3ac908b07117d4842bf7b231
Instruction Fuzzy Hash: 07319371509380AFE7228F65CC45FA6BFACEF46710F0888ABE984DF153D264A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 05931330, Relevance: 1.6, APIs: 1, Instructions: 105networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 059313E2

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: d11f8929851ccf543c0a51bdbb6781ae2f56404e9c0c9ad8169e8474cf36f296
Instruction ID: cb200b3829a4d268ea86b908d9f3c9b91e2a54b6169f713726a83cb520f2176c
Opcode Fuzzy Hash: d11f8929851ccf543c0a51bdbb6781ae2f56404e9c0c9ad8169e8474cf36f296
Instruction Fuzzy Hash: 38318D714097C0AFD7238B65DC45B66BFB8EF06210F0984DBE8C49F1A3C265A809DB72

Uniqueness

Uniqueness Score: -1.00%

Function 05931D9C, Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05931E30

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: fc1443f69b0d125584fbe3ba28104f48bf2511b450bf326e470d055e588a235d
Instruction ID: 86c96158ea6157048ba21d171909b88c3e52bc7ab530c9d3e91119fe99b1f1dc
Opcode Fuzzy Hash: fc1443f69b0d125584fbe3ba28104f48bf2511b450bf326e470d055e588a235d
Instruction Fuzzy Hash: 703103B2904744AFE712CB15DC45FA6BFA8EF46320F0880AEE944CF292D3756909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05932D27, Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000E2C), ref: 05932DFF

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: c296a5d123f9492be3bb614d62abeb1a2ab9fa855acfaaab9871fc1c985e843a
Instruction ID: a6cfab5a80e7325a0dcbee350ab06a1db14d04c631ac264f2812d5dba0de90c8
Opcode Fuzzy Hash: c296a5d123f9492be3bb614d62abeb1a2ab9fa855acfaaab9871fc1c985e843a
Instruction Fuzzy Hash: 3931C0B1104340AFEB228B61DC85FA6BFACEF45710F14849AEA849B192D375A909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05930E16, Relevance: 1.6, APIs: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 05930ED5

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a94d13fb8496d36966a956c032c2d3b7fe754d2733e99940505a7e5b8d01da65
Instruction ID: eb896bb981f213b8fa9415a3407283b04adfd5c7c018f2ff402ba848117f289a
Opcode Fuzzy Hash: a94d13fb8496d36966a956c032c2d3b7fe754d2733e99940505a7e5b8d01da65
Instruction Fuzzy Hash: FB31A171509380AFE722CF65DC45B62BFE8EF06314F08849EE9858B252D335A909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 063AD0B1, Relevance: 1.6, APIs: 1, Instructions: 92libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 063AD150

Memory Dump Source

Source File: 00000003.00000002.512738415.00000000063A0000.00000040.00000001.sdmp, Offset: 063A0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4049cf1350d9a9ea5bf91a49ec7d4ae3d0f9e030120490566370b07c120ebb69
Instruction ID: fdc27629b93483100920615de3b23025d3aa51ccee6389c3e3321d9ea9afae95
Opcode Fuzzy Hash: 4049cf1350d9a9ea5bf91a49ec7d4ae3d0f9e030120490566370b07c120ebb69
Instruction Fuzzy Hash: 1431DF30E05349EFDB45DBB4D854AAEBBB2EF45304F118469E440AB291DB359C85CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 059325E2, Relevance: 1.6, APIs: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000E2C), ref: 0593268E

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 7aa2edbf1fd88a788a5357d1d188e73cf80eb54c835d86f8f5d0f37d4bcd010b
Instruction ID: cb1856d177740d83c0f1a982fe3fd251eb3b07b9eaacec8aa9cddd27a5849478
Opcode Fuzzy Hash: 7aa2edbf1fd88a788a5357d1d188e73cf80eb54c835d86f8f5d0f37d4bcd010b
Instruction Fuzzy Hash: 2431B3B5509784AFEB228B25DC45F66BFA8EF46314F0884ABED848B153D224A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 05932039, Relevance: 1.6, APIs: 1, Instructions: 92networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 059320ED

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: Ioctl
String ID:
API String ID: 3041054344-0
Opcode ID: 562abd1b159c845ac32861e6e539e95ebf20831a90d5324f8454c968af83cd1f
Instruction ID: 221fa1dc833a48ca16129ea513732d861b885dace64c2d303fd43c053a83cbec
Opcode Fuzzy Hash: 562abd1b159c845ac32861e6e539e95ebf20831a90d5324f8454c968af83cd1f
Instruction Fuzzy Hash: 4D318175109780AFEB228F65DC45F66FFF8EF06310F08859AE9858B162D334A809CB61

Uniqueness

Uniqueness Score: -1.00%

Function 059343DF, Relevance: 1.6, APIs: 1, Instructions: 91registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05934494

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: f143b5bb66fb8c06f165fdb837920a5b57d25fb2a09c6c2fbf0fae7610e8644a
Instruction ID: 63dff04b42f6efdc04960e2bb5f1515b1678b1db64742b6053d9f340e56b81cd
Opcode Fuzzy Hash: f143b5bb66fb8c06f165fdb837920a5b57d25fb2a09c6c2fbf0fae7610e8644a
Instruction Fuzzy Hash: 45319471509380AFEB22CB65DC45F62BFE8EF46310F09849AE9899F153D364A408CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0269A8D9, Relevance: 1.6, APIs: 1, Instructions: 90registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000E2C), ref: 0269A989

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 2137268361b5ed0ef282a17a3c88f6604dde21a185fab00bdb9fa54d358d3ad5
Instruction ID: 91ab71969f34eebf119543e39ecb1f1b4a8e8e86f92291a04b0b4306ba537520
Opcode Fuzzy Hash: 2137268361b5ed0ef282a17a3c88f6604dde21a185fab00bdb9fa54d358d3ad5
Instruction Fuzzy Hash: 893191725087806FE7228B65CC84F66FFBCEF05710F08859AE9849B152D324A948CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0269A9D1, Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 0269AA8C

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: b34348ee9eb808746922bcf07cd7dc1b70d6b9aadee80b9d1a536f93ac340b7d
Instruction ID: f766b64c0c4d4edfd4f8057fe9decc0f13120c461920a422594f8f9d9e493f8b
Opcode Fuzzy Hash: b34348ee9eb808746922bcf07cd7dc1b70d6b9aadee80b9d1a536f93ac340b7d
Instruction Fuzzy Hash: 843193715097846FEB22CB65CC44FA2BFECEF06710F08849AE985CB252D364E949CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05931758, Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E2C), ref: 059317EF

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: c275ee443b25502985bb93f9d33c5c6b13c9eb8b4f872d2050bc2c390067572b
Instruction ID: e9e8e01e7deb54022d39ea6e56b414fd1156431b3e238a76e019b0f485ac6807
Opcode Fuzzy Hash: c275ee443b25502985bb93f9d33c5c6b13c9eb8b4f872d2050bc2c390067572b
Instruction Fuzzy Hash: 88318F72504384AFE722CF65DC45F67BFACEF45720F0884AAED85DB152D324A818CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0269B21C, Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

TerminateProcess.KERNEL32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 0269B2B0

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: f5c72e667a4c0a1d1c796deeb1bdd41dc532b4f335a3f043556d7079ddff72fd
Instruction ID: 0ce1900774e56be90670c8a1e950447773a3036141cbdaff593179f083a4f136
Opcode Fuzzy Hash: f5c72e667a4c0a1d1c796deeb1bdd41dc532b4f335a3f043556d7079ddff72fd
Instruction Fuzzy Hash: 2221D6725093806FEB12CB65DC45BA6BFBCEF46324F0884EAE984DF193D2649505C771

Uniqueness

Uniqueness Score: -1.00%

Function 059319F0, Relevance: 1.6, APIs: 1, Instructions: 87fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 05931AA2

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 8861efb91003704025faae0ce36f7394b1255abf3348f6e887d6b1bd49067ca5
Instruction ID: ac478ed9cf0aa37162c4f54039cb59eaf2391ef8f2f796a28d4b5b743e6e7b3b
Opcode Fuzzy Hash: 8861efb91003704025faae0ce36f7394b1255abf3348f6e887d6b1bd49067ca5
Instruction Fuzzy Hash: EB31B3B2404784AFE722CF55DC45F56FFF8EF05320F08859EE9848B162D365A509CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05932137, Relevance: 1.6, APIs: 1, Instructions: 87networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 059321DE

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: EventSelect
String ID:
API String ID: 31538577-0
Opcode ID: c066d88a15dceb866ef4b5cb60c430148ee9f3f1dc0d69be95e71314a3ded441
Instruction ID: 3eef1a0420ef41a5160cd230287ee89ee5ea6b4617d7d2c13a8a3cbeb862c4ce
Opcode Fuzzy Hash: c066d88a15dceb866ef4b5cb60c430148ee9f3f1dc0d69be95e71314a3ded441
Instruction Fuzzy Hash: 5131C1724093846FEB138B65DC55FA6BFA8EF06314F0884DBE984DF153D224A509CB75

Uniqueness

Uniqueness Score: -1.00%

Function 0593165A, Relevance: 1.6, APIs: 1, Instructions: 87registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05931704

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 2bf732ec725b3b93ecf8b100182ef2a26f1cb49ea675c260a17e2fceab092f5d
Instruction ID: 3c42053a8b2d66e832ab709440029202ef6dd7e9de83406553a803ba44c2eab1
Opcode Fuzzy Hash: 2bf732ec725b3b93ecf8b100182ef2a26f1cb49ea675c260a17e2fceab092f5d
Instruction Fuzzy Hash: A931B172509380AFD722CB65CC41FA2BFF8EF06314F0884DAE985CB1A3D264A509C771

Uniqueness

Uniqueness Score: -1.00%

Function 05931253, Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

RasEnumConnectionsW.RASAPI32(?,00000E2C,?,?), ref: 05931306

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: ConnectionsEnum
String ID:
API String ID: 3832085198-0
Opcode ID: d0943d07e9ac128c14f943514bdf8b1735f6edf2540672b633826ae89210164f
Instruction ID: 18ddcc8acce125a3aac94c832f7b8203a46d296d947644ef409973e6eb0ce14c
Opcode Fuzzy Hash: d0943d07e9ac128c14f943514bdf8b1735f6edf2540672b633826ae89210164f
Instruction Fuzzy Hash: 5B314C6150E3C05FC7138B258C65A62BFB4EF87610B0A81DFD884CF5A3D229A819C762

Uniqueness

Uniqueness Score: -1.00%

Function 0269B309, Relevance: 1.6, APIs: 1, Instructions: 85encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateChain.CRYPT32(?,00000E2C,?,?), ref: 0269B3B6

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: CertCertificateChain
String ID:
API String ID: 3019455780-0
Opcode ID: 47473f5ea928bbd8c9fd1cba47bc8a7530cc59a75cd296ec2c76a3020604cdc6
Instruction ID: 03e3a2ae8fda1ee60c8fe75ca108d567e9be3fc0c0b2a0a60e3b06d535e8acee
Opcode Fuzzy Hash: 47473f5ea928bbd8c9fd1cba47bc8a7530cc59a75cd296ec2c76a3020604cdc6
Instruction Fuzzy Hash: D3318E7150E3C05FD7138B25CC55A66BFB4EF87610F0980CBD8848F2A3D624A919C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 05931CA5, Relevance: 1.6, APIs: 1, Instructions: 85synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 05931D45

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 8a588c511c8ece4f3ac4215db663b36afbb68bfd4982b27ffa869fa3f50d337a
Instruction ID: fb65c55ac5668d41a271e11031f454a767c5835a91e24e57ca09189a7498bfcc
Opcode Fuzzy Hash: 8a588c511c8ece4f3ac4215db663b36afbb68bfd4982b27ffa869fa3f50d337a
Instruction Fuzzy Hash: D03186B1509780AFE721CF25CC45F66FFE8EF06210F18849EE984CB252D365E908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05932D5A, Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000E2C), ref: 05932DFF

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: de0d7d07789aa1ce58ffc34903ffd0f43454934691ee090aa7ac2232017f3e69
Instruction ID: 756f8e59a324ad632b153322390eaf4c44c87038c030d4c04dd074ca07170930
Opcode Fuzzy Hash: de0d7d07789aa1ce58ffc34903ffd0f43454934691ee090aa7ac2232017f3e69
Instruction Fuzzy Hash: FA21E271500200AFEB30DF65DC85FA6FBACEF48710F14885EFE499B181D274A5498BB1

Uniqueness

Uniqueness Score: -1.00%

Function 059342F6, Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000E2C), ref: 0593438A

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: c352ead5f35275f7c6c298bec54d7eef991b465d1c5904c4f1360cff7d192fba
Instruction ID: db9e126291c8bb82ffb787454ae5293fc5d25cf44758c92e47e41d1ef472ba8e
Opcode Fuzzy Hash: c352ead5f35275f7c6c298bec54d7eef991b465d1c5904c4f1360cff7d192fba
Instruction Fuzzy Hash: 8021ADB2505384AFEB218F25DC45F6AFFACEF45720F08849AED84DB152D274A9088B71

Uniqueness

Uniqueness Score: -1.00%

Function 059322F4, Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenCurrentUser.KERNELBASE(?,00000E2C), ref: 0593238D

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: CurrentOpenUser
String ID:
API String ID: 1571386571-0
Opcode ID: 6aa44bbc50ff172e5e19a873044177a68d70f1a9b502cd83672723f8f04bd82d
Instruction ID: 654c27fd15453432975826754270f47452aab3df3e7601f8d56df17ce2a64dc5
Opcode Fuzzy Hash: 6aa44bbc50ff172e5e19a873044177a68d70f1a9b502cd83672723f8f04bd82d
Instruction Fuzzy Hash: 5221E1B54093806FEB128B25DC45F66FFA8EF46714F0884AFED848F143C264A908CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0269B711, Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 0269B7A2

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: 3215370d43c4c845d095ffedabcbeb61b0e5883d2c1a7a9679a533b3297bc155
Instruction ID: 4a19c3840f3c3f96dfe2557622735e374665540856befb0cdda2943ee4d4c698
Opcode Fuzzy Hash: 3215370d43c4c845d095ffedabcbeb61b0e5883d2c1a7a9679a533b3297bc155
Instruction Fuzzy Hash: 2D21D3715053806FEB12CB25DC45FA6FFACEF46214F0884AAE944DF252D764E808CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0269B808, Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

K32GetModuleFileNameExW.KERNEL32(?,00000E2C,?,?), ref: 0269B8AE

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 0b2b8ed5ca36aab728a78332ec718354f80df91776db6c58e86edec15ac33ffd
Instruction ID: d94d49081eabbedf8e08d8bc31960d626937a6207e6eec9aa2112c6261d26118
Opcode Fuzzy Hash: 0b2b8ed5ca36aab728a78332ec718354f80df91776db6c58e86edec15ac33ffd
Instruction Fuzzy Hash: 3421A0715093C06FD312CB65CC55B66BFB8EF87610F0980DBD8848F193D224A919CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 05930F2C, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05930FC1

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 50f834fec6e13531844108ce8c0b152a1bf95ea256dd9f96991a23783b7e5db1
Instruction ID: dd323129de137e5d1b208cec85eb148cec905e25c3af556b10f2110c7d579495
Opcode Fuzzy Hash: 50f834fec6e13531844108ce8c0b152a1bf95ea256dd9f96991a23783b7e5db1
Instruction Fuzzy Hash: 8221F8B54097806FE7128B25DC41FA6BFACEF4A720F1885DAED848B193D2646909C771

Uniqueness

Uniqueness Score: -1.00%

Function 05931E80, Relevance: 1.6, APIs: 1, Instructions: 79timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05931F09

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 6e29cb3e22a8395701194790b391c7528beeb1af93af65dedd3ac8783367fc53
Instruction ID: 220d4a7f12c9c7ac13291babcb56367d328f97f61e6bd4efa545d2986a1f0f72
Opcode Fuzzy Hash: 6e29cb3e22a8395701194790b391c7528beeb1af93af65dedd3ac8783367fc53
Instruction Fuzzy Hash: 1321B272105380AFDB228F25DC45FA7FFB8EF46310F0884AEE9459B162C335A449CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05932507, Relevance: 1.6, APIs: 1, Instructions: 78registryCOMMON

Download Yara Rule

APIs

RegNotifyChangeKeyValue.KERNEL32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05932598

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: ChangeNotifyValue
String ID:
API String ID: 3933585183-0
Opcode ID: af52694aba4d33bab6ffaed123e2b1379654bf43f3c5733a87a79607a9cef411
Instruction ID: 8877e026cf4047d4df15000d84bc09a39d3c52e5ee5abe96b6f8ad292c84eec0
Opcode Fuzzy Hash: af52694aba4d33bab6ffaed123e2b1379654bf43f3c5733a87a79607a9cef411
Instruction Fuzzy Hash: C9219F71409384AFDB22CF65DC45FA6FFACEF49210F08889AE9849B152D224A548CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0593190E, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 05931999

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: f07fb00bdf4ecead6eeff38fcc404a39e21ca0fdd8656aaca3309d2f2ce311bf
Instruction ID: afa4eda62caf18ecc8c4d6a957ce70aff6b913459e11b51458a097bba47fe609
Opcode Fuzzy Hash: f07fb00bdf4ecead6eeff38fcc404a39e21ca0fdd8656aaca3309d2f2ce311bf
Instruction Fuzzy Hash: 8C218DB1509280AFE722CF65DC45F66FFA8EF45210F1884AEED848B252D375A908CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05933CB7, Relevance: 1.6, APIs: 1, Instructions: 78encryptionCOMMON

Download Yara Rule

APIs

CertVerifyCertificateChainPolicy.CRYPT32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05933D3E

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: CertCertificateChainPolicyVerify
String ID:
API String ID: 3930008701-0
Opcode ID: 15a71c25d9ccfe80d8264722dcf8d0999807c211558e0b7e20fd1954f9d05b48
Instruction ID: 8669f7018519891650fa0527b25e195b8ddf0da1d4fcb867cbf60d37818f1839
Opcode Fuzzy Hash: 15a71c25d9ccfe80d8264722dcf8d0999807c211558e0b7e20fd1954f9d05b48
Instruction Fuzzy Hash: D9218171509280AFE7118B65DC45F66FFA8EF46310F0884AEED859F152C265A848CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0593241A, Relevance: 1.6, APIs: 1, Instructions: 78registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000E2C), ref: 05932499

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 451af0bb5082376a835c721684245d2377601c9c1b9a524c181432cc474b8ffd
Instruction ID: e15fe7a13668c09f9afd49d6d4066df2c7cefcc606837c5e8bbda5e7f61d5431
Opcode Fuzzy Hash: 451af0bb5082376a835c721684245d2377601c9c1b9a524c181432cc474b8ffd
Instruction Fuzzy Hash: 6B216076500204AEEB21DF65DC49F6BFBACEF48710F04896AED85DB141D674A5088A71

Uniqueness

Uniqueness Score: -1.00%

Function 05934224, Relevance: 1.6, APIs: 1, Instructions: 78registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNEL32(?,00000E2C,?,?), ref: 059342CA

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: Enum
String ID:
API String ID: 2928410991-0
Opcode ID: 0a8292e62c3f04837b0f7443250de3a5e75d5db591f7ac86d541d2b43794ba3c
Instruction ID: 112d21c30c56adab658b39e73a694e1747e90a8a5945cc2d3fc8d8d4878aeb04
Opcode Fuzzy Hash: 0a8292e62c3f04837b0f7443250de3a5e75d5db591f7ac86d541d2b43794ba3c
Instruction Fuzzy Hash: 6421306550E3C06FC3138B758C55A25BFB4EF87610F1D81DFD8848B5A3D225A919C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0269B570, Relevance: 1.6, APIs: 1, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E2C,?,?), ref: 0269B60A

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: df131c32fbd75fd053e786979e44f795d0681e072fb3a21b9ea93ec9f8fda2d9
Instruction ID: 667a9c99a06f64efd63f29ba17df9b9428c08be19d7c679ae736f3670594558a
Opcode Fuzzy Hash: df131c32fbd75fd053e786979e44f795d0681e072fb3a21b9ea93ec9f8fda2d9
Instruction Fuzzy Hash: CA21C8755093C06FD3138B25DC51B62BFB8EF87A10F0981DBEC848B653D225A919C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0593177E, Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E2C), ref: 059317EF

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: b699859c221259935a025848dcf21544dd5f850761159d8bbc7740448834a0ad
Instruction ID: 7c92b20000fc8df9a21bcc9d69024b7ab7e47a4eb705ac888c26c5f144ae7c57
Opcode Fuzzy Hash: b699859c221259935a025848dcf21544dd5f850761159d8bbc7740448834a0ad
Instruction Fuzzy Hash: 8B219F72600204AFEB20DF69DC85F6AFBACEF44720F18886AED45DB251D674A409CA75

Uniqueness

Uniqueness Score: -1.00%

Function 0593069C, Relevance: 1.6, APIs: 1, Instructions: 76libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000E2C), ref: 05930737

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e6acde5ebff14e176502115d902266bc8cf34cf100cb2cd856ede1bcb4deba18
Instruction ID: 41fda368040c9271a338c102650360e2979e161339c24600b58db10614e59342
Opcode Fuzzy Hash: e6acde5ebff14e176502115d902266bc8cf34cf100cb2cd856ede1bcb4deba18
Instruction Fuzzy Hash: 47210A71109380AFE722CB15CC45FA6FFB8EF46720F1880DAED859F192C2686949CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05930E56, Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 05930ED5

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a17caadfd8e02639f6360a44c9c8885d6aa11a00a48cfcf2935a93b1c3973ad0
Instruction ID: ef01e73db94337ac54617658ed6926d405c4fa87f8bada19640e55708119ce50
Opcode Fuzzy Hash: a17caadfd8e02639f6360a44c9c8885d6aa11a00a48cfcf2935a93b1c3973ad0
Instruction Fuzzy Hash: C8219C71604640AFEB21CF65DD49B66FBE8EF08310F08846EE9858B241D371E408CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0269A90A, Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000E2C), ref: 0269A989

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 085104f556b998593026d42538329548c9036ffde4b67034660887541b99badf
Instruction ID: 5999fa9db536d8e11f47e5af2d0ea6bcfde47c55042de83e3d79e449230d1219
Opcode Fuzzy Hash: 085104f556b998593026d42538329548c9036ffde4b67034660887541b99badf
Instruction Fuzzy Hash: B921A172500604AFEB219F59DC85F6BFBECEF48710F04895AED859B241D770E909CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0269B636, Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 0269B6B2

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: 0cce0485fd9d8bb5729d5964f2af67b52aefe8e5ce66ac755f6ef00abaecca5e
Instruction ID: 892b18c23fdebaab1a3df85e46f0484b510c7f3672f2c19b10e9485ae340a2ce
Opcode Fuzzy Hash: 0cce0485fd9d8bb5729d5964f2af67b52aefe8e5ce66ac755f6ef00abaecca5e
Instruction Fuzzy Hash: 572180725053806FEB12CB65DC45F66FFA8EF45220F1884AAE985DB152C364A448CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05934316, Relevance: 1.6, APIs: 1, Instructions: 73registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000E2C), ref: 0593438A

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 55c5318461d99254d02cb1737a16b80e50b2186027b9d0e6bc19255c07254e58
Instruction ID: 19f58bb923cea312baf01a7488f29ecb404f2cc8fa6715deb0eee58d93ea1233
Opcode Fuzzy Hash: 55c5318461d99254d02cb1737a16b80e50b2186027b9d0e6bc19255c07254e58
Instruction Fuzzy Hash: 8C21AEB2500304AFEB20DF65DD49F6AFBACEF44720F04886AED499B241D374A5188A75

Uniqueness

Uniqueness Score: -1.00%

Function 05932F0A, Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05932F99

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: AdaptersAddresses
String ID:
API String ID: 2506852604-0
Opcode ID: e1e2cb447e00658165df7e3c36956da9fc0a2a70365f5872f9ea2e17032d270c
Instruction ID: 48bfdd6917875b4b33a78bff139c2cd695d19282241d8bc2e4f6c3709dfc2145
Opcode Fuzzy Hash: e1e2cb447e00658165df7e3c36956da9fc0a2a70365f5872f9ea2e17032d270c
Instruction Fuzzy Hash: 4021A175409780AFDB228B15DC45FA6FFB8EF46310F08859BE9849B193C365A408CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0593261A, Relevance: 1.6, APIs: 1, Instructions: 73registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000E2C), ref: 0593268E

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 409fb21fd1860284a96173e89350e6cc586cc34cbea27b6279916cb41997033f
Instruction ID: b48e3b95e4c1dd188a911430ab48035abd935f0990d82445fcfdf3b282adae57
Opcode Fuzzy Hash: 409fb21fd1860284a96173e89350e6cc586cc34cbea27b6279916cb41997033f
Instruction Fuzzy Hash: F221A1B5500304AFEB20DF65DC45F6BFBACEF44724F04886BED449B241D274A8088A71

Uniqueness

Uniqueness Score: -1.00%

Function 0269ACEF, Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 0269AD6A

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: f9f89a0a211fa8eacba459d8b19c92332f0966b3c53692bafa507bada16d183e
Instruction ID: 2af6147c076dcb4e296f3778bc55f5e994ab595970cee50a0ed855165804e82f
Opcode Fuzzy Hash: f9f89a0a211fa8eacba459d8b19c92332f0966b3c53692bafa507bada16d183e
Instruction Fuzzy Hash: 912183755093805FDB128B65DC85B92BFE8EF46214F0984EAD885CF293D735D808C761

Uniqueness

Uniqueness Score: -1.00%

Function 05933D9E, Relevance: 1.6, APIs: 1, Instructions: 72encryptionCOMMON

Download Yara Rule

APIs

CertVerifyCertificateChainPolicy.CRYPT32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05933E26

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: CertCertificateChainPolicyVerify
String ID:
API String ID: 3930008701-0
Opcode ID: dac15aba965bb58886d0b6101c1e7e91b75cb46de9a19a7fbf531f7e544db09b
Instruction ID: aae42c5643a7aa84cb1b2964b086dd7bf5a1fac998c50cb7a82cf0a9b2aa838f
Opcode Fuzzy Hash: dac15aba965bb58886d0b6101c1e7e91b75cb46de9a19a7fbf531f7e544db09b
Instruction Fuzzy Hash: 1D218071509380AFE7228B55DC45F66FFA8EF45710F0885AEED849F152C375A448CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05932A8E, Relevance: 1.6, APIs: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

GetNetworkParams.IPHLPAPI(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05932B18

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: NetworkParams
String ID:
API String ID: 2134775280-0
Opcode ID: fb995690bcc72a75deea0dcb27ef4afe11f9234d96599e06517b7b3e887da130
Instruction ID: 1dc1de718789b7b7536ac343de4febdaf251b88cc2bed72b8b517242961a58ca
Opcode Fuzzy Hash: fb995690bcc72a75deea0dcb27ef4afe11f9234d96599e06517b7b3e887da130
Instruction Fuzzy Hash: C72180754093806FE7128B15DC45F66FFB8EF46720F0884DBE9849F193C268A849CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05931CD2, Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 05931D45

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 86042c57a0adcbbd75df47d55cd648521cab24e5deb20d501f4aab4b3e55ba26
Instruction ID: 64f0adf65b83bf65f476a4ef625ce855a544ec14460aba5541e9302858139c2d
Opcode Fuzzy Hash: 86042c57a0adcbbd75df47d55cd648521cab24e5deb20d501f4aab4b3e55ba26
Instruction Fuzzy Hash: 30219FB1604644AFE720DF25DC85B66FBE8EF05310F18886AED898B251D375E404CA71

Uniqueness

Uniqueness Score: -1.00%

Function 05932072, Relevance: 1.6, APIs: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 059320ED

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: Ioctl
String ID:
API String ID: 3041054344-0
Opcode ID: 38c5fdbd93846cf7f8f51f40e5f264c673ccaccb9572fdf90b83836672a28712
Instruction ID: 540014a4989b64e6fb66d39f709ea7e5b5bec29c967b7e9531f04ad00fe4cb21
Opcode Fuzzy Hash: 38c5fdbd93846cf7f8f51f40e5f264c673ccaccb9572fdf90b83836672a28712
Instruction Fuzzy Hash: A1216A75500600AFEB21CF56DD85FA6FBE8EF08710F04896AED868B251D334E448CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05932228, Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

RasConnectionNotificationW.RASAPI32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 059322B7

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: ConnectionNotification
String ID:
API String ID: 1402429939-0
Opcode ID: 7f241b52b72137a7ab14ef46973c2589ce7f737ffb80ed7190a762b7d9a56a36
Instruction ID: c03bb186f0efade7fb71191a626aa6445d103f84f46c6eb6c7cf9e2b7442ea5f
Opcode Fuzzy Hash: 7f241b52b72137a7ab14ef46973c2589ce7f737ffb80ed7190a762b7d9a56a36
Instruction Fuzzy Hash: F421B0754093846FEB128B25DC45FA6FFB8EF46314F08849AE9849B153D264A508CB75

Uniqueness

Uniqueness Score: -1.00%

Function 059310DE, Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 0593115D

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 92fb86a4f9bc028861142ee5d4de1e03f993f3d9ea3efd5769aef0bb2a2e8dea
Instruction ID: a5c4372c2f7ad8d6bb90e99003599a0510a2e65a943c8536ad03110589f393e9
Opcode Fuzzy Hash: 92fb86a4f9bc028861142ee5d4de1e03f993f3d9ea3efd5769aef0bb2a2e8dea
Instruction Fuzzy Hash: EC219272405380AFDB22CF55DC45FA6FFB8EF45310F08849AE9449B152C234A408CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0269AAFB, Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

MkParseDisplayName.OLE32(?,00000E2C,?,?), ref: 0269AB7E

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: DisplayNameParse
String ID:
API String ID: 3580041360-0
Opcode ID: d294dc52949a78565f9dad10fa0933bff5f685aa4a8cfbee49c5d88315da4f05
Instruction ID: a55abc19c50f78537caf53f7b649239220fc562d7050088084fe4600a00c0716
Opcode Fuzzy Hash: d294dc52949a78565f9dad10fa0933bff5f685aa4a8cfbee49c5d88315da4f05
Instruction Fuzzy Hash: DF21A5715093806FD7128B25DC41F72BFB8EF86620F19819AEC848B653D225B915CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 0269AA12, Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 0269AA8C

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 4876e7c11168ed4de4bd90f0139fb19d8f8aa4a0b616132ca9d39651af1772e5
Instruction ID: 6f596433936d3edfdba3aa9044b5e4acd36809c76f9723179bdd35f599466896
Opcode Fuzzy Hash: 4876e7c11168ed4de4bd90f0139fb19d8f8aa4a0b616132ca9d39651af1772e5
Instruction Fuzzy Hash: 4A218C71600604AFEB20CF5ADD84FA6FBECEF08720F08846AE945CB351D760E909CA71

Uniqueness

Uniqueness Score: -1.00%

Function 05932FD6, Relevance: 1.6, APIs: 1, Instructions: 69networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 0593305A

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 89544350ec473472d4b9fb1f2c2af137c6deae86b493c8d2d6e9acf92fddbe84
Instruction ID: 97569a712a870e10ee0da2da844ea428e985fb8e5f501253ad9398aa55b453ec
Opcode Fuzzy Hash: 89544350ec473472d4b9fb1f2c2af137c6deae86b493c8d2d6e9acf92fddbe84
Instruction Fuzzy Hash: 7F218E754093809FDB22CF61D885AA2FFF4EF06210F0985DEE9858F163D375A819CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05931F73, Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05931FEF

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: cfbb0733943d4bcf08487baf31b7828252ec25694dda354dc42d2f51308d252d
Instruction ID: 5981d23254459a39bd058f36a539725d4ab483b4cfb0bb9b6477fdb76805bc74
Opcode Fuzzy Hash: cfbb0733943d4bcf08487baf31b7828252ec25694dda354dc42d2f51308d252d
Instruction Fuzzy Hash: C1216F71509384AFDB22CB55DC85F66FFA8EF45310F0884AAE9459B152C374A508CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05934422, Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05934494

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: d6b151b39789237a54f1401c1c1a15d639081861cf7aa1f95b73c56c3c149c16
Instruction ID: d71400c6e3d2b6e6c3055d48658a72dcacb031b11bd10463aad5a0051e48c48e
Opcode Fuzzy Hash: d6b151b39789237a54f1401c1c1a15d639081861cf7aa1f95b73c56c3c149c16
Instruction Fuzzy Hash: C7216D71504200AFEB20CF55DC49FA6BBECEF44710F04886AED89DB242D374E4088A71

Uniqueness

Uniqueness Score: -1.00%

Function 0269AFD4, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,7DBEF230,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 0269B040

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 58dd12d420b8f9f4aee5df298b1e35a7094bbafeb7140ff1cf0d37be2e972176
Instruction ID: a9c01e162fe942ca599e72ab78a9d81d07a8051a99c69412b68659b5f9a1dd2f
Opcode Fuzzy Hash: 58dd12d420b8f9f4aee5df298b1e35a7094bbafeb7140ff1cf0d37be2e972176
Instruction Fuzzy Hash: 9B21A1725093C05FDB02CB25DC94792BFA4AF47324F0980DAEC858F263D275A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0593192E, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 05931999

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: 14e3b250b5d875bcca2547f7d3ebe4e56fc5e8d560bf55ffd9e2c02b95ecae72
Instruction ID: 25cc5078108cc702fe085d8cdfd49af93edc82298061dde16fd420b13a8b0c73
Opcode Fuzzy Hash: 14e3b250b5d875bcca2547f7d3ebe4e56fc5e8d560bf55ffd9e2c02b95ecae72
Instruction Fuzzy Hash: AD21A171504240AFE721DF65EC46B66FBD8EF08320F14846EED858B251D375A404CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0269B73E, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 0269B7A2

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: 32dfd89a12747446184b7c2dbf3b7fc23e7e49178d445122072b120434ef2719
Instruction ID: 6c3c4b1ed500794717fb63ec0dbb22aaab8841bf3274b33b3153991a0a276319
Opcode Fuzzy Hash: 32dfd89a12747446184b7c2dbf3b7fc23e7e49178d445122072b120434ef2719
Instruction Fuzzy Hash: A6119D71500200AFEB20CB25EC85FAABBACEF04724F04856AED45CF251D775A404CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05931376, Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 059313E2

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: aef8c5a30b0fae83b4ecb07204d16866fa2e401f3fde50365d9fe57d837678db
Instruction ID: 2aa50db003e7d9110a59b0640c42e12fca1b7dd0bfab7c0b5cd7eeaba7532802
Opcode Fuzzy Hash: aef8c5a30b0fae83b4ecb07204d16866fa2e401f3fde50365d9fe57d837678db
Instruction Fuzzy Hash: 0721BB71500240AFEB21DF65DC89B66FBA8EF08320F14886EED858B251C372A409CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05931A2E, Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 05931AA2

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 0601fd9dee26f0ad53d55e6ef415bb386603ca2a6a263e53505765ad181943ab
Instruction ID: 9b1b6ed2493664459baa9dae932d959812af1c305bd303398b3130337f8f8c82
Opcode Fuzzy Hash: 0601fd9dee26f0ad53d55e6ef415bb386603ca2a6a263e53505765ad181943ab
Instruction Fuzzy Hash: 44219A71500744AFEB21CF6ADD85FAAFBE8EF08320F14845EE9888B251D371A549CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0269AC3B, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,7DBEF230,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 0269ACA8

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 3607d90de9188d37fdc1cfc79828d09321957d12eee87b3ff87ddb7b595e3fb0
Instruction ID: 59bfc0b19e54f6b461acfdb52784bda4815e369d768aed8a67b02d8ae68ca0d8
Opcode Fuzzy Hash: 3607d90de9188d37fdc1cfc79828d09321957d12eee87b3ff87ddb7b595e3fb0
Instruction Fuzzy Hash: F2216D7550A3C09FDB138B65D855792BFB4EF07220F0984EBDC858F163D265A948CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0593232A, Relevance: 1.6, APIs: 1, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegOpenCurrentUser.KERNELBASE(?,00000E2C), ref: 0593238D

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: CurrentOpenUser
String ID:
API String ID: 1571386571-0
Opcode ID: 4e8fc818709fb4492110409319965c2243f890b5b3630db65d735f634f7f25be
Instruction ID: cab4742e581660e666b301ec085f2e06c947f27f602f9cefb150e333e7087326
Opcode Fuzzy Hash: 4e8fc818709fb4492110409319965c2243f890b5b3630db65d735f634f7f25be
Instruction Fuzzy Hash: F611B275504204AFEB20DF65EC85F7AFB9CEF44720F18886AED44DF242D274A5498AB1

Uniqueness

Uniqueness Score: -1.00%

Function 05934EB0, Relevance: 1.6, APIs: 1, Instructions: 66fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,?,7DBEF230,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 05934F1E

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: cf63f65142935a44a3f873925243046666b16c776071ae033349cbabad49f025
Instruction ID: c5da5576dc05db50a66e1e11997f77397f03093cb08698176aac2b157777cbfd
Opcode Fuzzy Hash: cf63f65142935a44a3f873925243046666b16c776071ae033349cbabad49f025
Instruction Fuzzy Hash: A02163B15093809FDB11CF65DC85B66BFE8EF55210F0D84AAED49CB252D334E848CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0593252E, Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegNotifyChangeKeyValue.KERNEL32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05932598

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: ChangeNotifyValue
String ID:
API String ID: 3933585183-0
Opcode ID: d5e86ba79c4be09574a892f654a3fe8052f7b9fcde344d02b10db398b339aa9b
Instruction ID: 8854ce609f752c5855c7017f7a50ed910fb5cef68f63ef3353bbfa68ce9ec428
Opcode Fuzzy Hash: d5e86ba79c4be09574a892f654a3fe8052f7b9fcde344d02b10db398b339aa9b
Instruction Fuzzy Hash: F611BE72400204AFEB21CF56DC85FAAFBECEF08321F04886AED459B241D674A548CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 05931692, Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05931704

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: edc5bf6e509a641472594b9cef4abb00461a856a784cdffe59db799e787398c2
Instruction ID: 18d629e24ff3129f491cc5a692df46263e5337124f67466df3d9cf1474281df7
Opcode Fuzzy Hash: edc5bf6e509a641472594b9cef4abb00461a856a784cdffe59db799e787398c2
Instruction Fuzzy Hash: A1117F76504600AFEB20CF56DC85F66FBECEF08720F08856AE9469B251D760E544DA71

Uniqueness

Uniqueness Score: -1.00%

Function 05931EAA, Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05931F09

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: f42a83c7e61bc9136eaf6436717d72448e5ad104e360df56ff78a0681ce7a594
Instruction ID: d38ccf11198d73bd2dc6819a570a1a7602e3b99a5963ea72e5a68fcd6a34123c
Opcode Fuzzy Hash: f42a83c7e61bc9136eaf6436717d72448e5ad104e360df56ff78a0681ce7a594
Instruction Fuzzy Hash: 70119072500200AFEB21CF56DC45FAAFBA8EF48721F04846AED499B261D774A405CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0269B656, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 0269B6B2

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: bf41493340d3c295dd93209bd72c04f9a0c5f90b69b81b63655c2b6954dfd015
Instruction ID: 506f6582bd68602bdd15e5d5d931a7531f00ccda7b38cbfff298428b3696603f
Opcode Fuzzy Hash: bf41493340d3c295dd93209bd72c04f9a0c5f90b69b81b63655c2b6954dfd015
Instruction Fuzzy Hash: 0611B271500200AFEF21CF5AEC45B66FBACEF48724F14846AED45DB241D774A405CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05934DF4, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,7DBEF230,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 05934E5B

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 6c9757783fdaeb64fbe98c15c486aab3743fb44258f47095ba7114a3567d3887
Instruction ID: 3b2f51dcfca679a15c41a08a2205b3a5460ef7e2bb740f3a8c073ad78a1f1626
Opcode Fuzzy Hash: 6c9757783fdaeb64fbe98c15c486aab3743fb44258f47095ba7114a3567d3887
Instruction Fuzzy Hash: 3F1142715092809FDB21CF65DC89B56BFE8EF45220F0984AAED49CF252D378E849CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0593217A, Relevance: 1.6, APIs: 1, Instructions: 63networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 059321DE

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: EventSelect
String ID:
API String ID: 31538577-0
Opcode ID: e1ed3537a5f86e80d7b866e3da3edd0d81f22b8aace79062e5d69edc523a53de
Instruction ID: c868f6c4c549cf4d33a644e186dca9a934dc068b136c093208ed2048e3057358
Opcode Fuzzy Hash: e1ed3537a5f86e80d7b866e3da3edd0d81f22b8aace79062e5d69edc523a53de
Instruction Fuzzy Hash: 2311B272500204AFEB21CF5ADD85FAAFBDCEF48721F04886AED45DB241D674A405CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05933CE2, Relevance: 1.6, APIs: 1, Instructions: 63encryptionCOMMON

Download Yara Rule

APIs

CertVerifyCertificateChainPolicy.CRYPT32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05933D3E

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: CertCertificateChainPolicyVerify
String ID:
API String ID: 3930008701-0
Opcode ID: eaacede6706af4bce77f19f5abe7326a1c3609ef2b02b1ec73d5c01b3cc0e5d5
Instruction ID: cf9b4492a7eb1529711222e9b9993198bf7b337c940626f46a1b2abbe50f5f09
Opcode Fuzzy Hash: eaacede6706af4bce77f19f5abe7326a1c3609ef2b02b1ec73d5c01b3cc0e5d5
Instruction Fuzzy Hash: E611B271500200AFEB21CF6ADC45F66FBA8EF44721F04886EED499B241D374A808CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0269A836, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,7DBEF230,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 0269A8A8

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 604ff12f867336938527178e7e655a87f70d00500b3e62c0503bdb0be65b0598
Instruction ID: 47afb2b2b4e8bb6adb00ae8f3b5bfa75ccebe465c839c9eb7c3cbbbac671e931
Opcode Fuzzy Hash: 604ff12f867336938527178e7e655a87f70d00500b3e62c0503bdb0be65b0598
Instruction Fuzzy Hash: BA216D7140D3C45FDB138B259C54661BFB4DF07614F0984DBDC858F2A3D2695909DB72

Uniqueness

Uniqueness Score: -1.00%

Function 0269B25A, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

TerminateProcess.KERNEL32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 0269B2B0

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 6559697626a7531c2968f8cf519eaf42ed008df729ead9092d6219197d90e2bf
Instruction ID: 1a1cf20db6039b290ceea2b494d4c466d73081f78251356797cc35e2010ea963
Opcode Fuzzy Hash: 6559697626a7531c2968f8cf519eaf42ed008df729ead9092d6219197d90e2bf
Instruction Fuzzy Hash: 2E11E371500204AFEB10CF1AEC85BBAFB9CEF49324F1484AAED45DB241D774A405CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0269A78B, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0269A7F6

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 96c893eba90b94f5251eaa4cae1d5cc54f4bb5f9a50db695822e7a13dc485283
Instruction ID: f01efa3e2c5ef33e06dd431b07a86f9216e11bf8b0cda13029753821768a6ab8
Opcode Fuzzy Hash: 96c893eba90b94f5251eaa4cae1d5cc54f4bb5f9a50db695822e7a13dc485283
Instruction Fuzzy Hash: BD117271409380AFDB228F55DC44B62FFF8EF4A210F08859AED858B152D375A419DB61

Uniqueness

Uniqueness Score: -1.00%

Function 059310FE, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 0593115D

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 4a21e8ec87eb339da336dc7915dcbe0cabc752761c82e64e5be7ad4e01179077
Instruction ID: 56048ada678209938f507e4d135b3d3347f9e5e6e8f6f13b41b0ed6e1845fe4f
Opcode Fuzzy Hash: 4a21e8ec87eb339da336dc7915dcbe0cabc752761c82e64e5be7ad4e01179077
Instruction Fuzzy Hash: 67119472500204EFEB21CF95DD45FA6FBE8EF48721F14886AED459B251C375A409CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05933DCA, Relevance: 1.6, APIs: 1, Instructions: 59encryptionCOMMON

Download Yara Rule

APIs

CertVerifyCertificateChainPolicy.CRYPT32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05933E26

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: CertCertificateChainPolicyVerify
String ID:
API String ID: 3930008701-0
Opcode ID: 04d0e913144deaebd460e66b6092c41b50a2fb1fa5923f8cdae009af93e79cd4
Instruction ID: af0ffddcef166bd4d6cef8c84bb8e1d0f06bea0470dda1385a6b78cb6518b6da
Opcode Fuzzy Hash: 04d0e913144deaebd460e66b6092c41b50a2fb1fa5923f8cdae009af93e79cd4
Instruction Fuzzy Hash: 3311A371500200EFEB21DF59DC45F66FBA8EF48721F14C86AED499B241D374A408CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05934F79, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNEL32(?,7DBEF230,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 05934FD8

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: DirectoryRemove
String ID:
API String ID: 597925465-0
Opcode ID: 48899002a2bc9f1bf56d8c0a7053617f068dc26b978371660155ebecfe7e6ecc
Instruction ID: 9aad88c8d6937265c9ec29e51143f0cf47b3eb80cfa525a785454511adcf205c
Opcode Fuzzy Hash: 48899002a2bc9f1bf56d8c0a7053617f068dc26b978371660155ebecfe7e6ecc
Instruction Fuzzy Hash: 1A1190769093809FD711CF25DC85B52BFE8EF46220F0984AAEC49CF252D339E948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 059346DD, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,7DBEF230,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 0593473C

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 85d097930963b2e4f884f803bceae793e1c85e4b7b66c5582755bfe0155fac1f
Instruction ID: 8ea96938466a3fcc9817afb9cdfb55eeb06d6377dafac9f160fdb801a3d9b361
Opcode Fuzzy Hash: 85d097930963b2e4f884f803bceae793e1c85e4b7b66c5582755bfe0155fac1f
Instruction Fuzzy Hash: 33117F715093C09FDB128B65D845AA2BFF4EF47210F0984EADC858F162C275A458CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05931F96, Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05931FEF

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: ecd03f99f7bbb8366d9ed616bfb02bf01bb660b2a4e81b823394478f58049e18
Instruction ID: 3415282a6f6e3397e34155ab78fb1b5f346ddc4083e555372438f96fe7d712f3
Opcode Fuzzy Hash: ecd03f99f7bbb8366d9ed616bfb02bf01bb660b2a4e81b823394478f58049e18
Instruction Fuzzy Hash: 3F11A371500200AFEB21CF55DC85F66FB98EF48721F1484AAED499B241C374A409CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05931DDA, Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05931E30

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: bd62ccd7402420b1d078312eea3714914f699b542b1c232c600b17edffe8449d
Instruction ID: f12982a22f1cadb98301fae0fdb0ff2f7cb27c8e9763a306d952272c577a4b11
Opcode Fuzzy Hash: bd62ccd7402420b1d078312eea3714914f699b542b1c232c600b17edffe8449d
Instruction Fuzzy Hash: 4D11C271500200EFEB20CF15DC85BAAFB98EF44721F1484AAED489F251D275A409CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05932F3A, Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05932F99

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: AdaptersAddresses
String ID:
API String ID: 2506852604-0
Opcode ID: 2d55e2b6c9a4207ec1fcb1b3b137c66d99c98401c760f9bc008a3d4849bbc9e4
Instruction ID: d26d8fa274c6b5140c7e2bb22ccf8e497b5f2359f9407465ea18ec75bf8137b3
Opcode Fuzzy Hash: 2d55e2b6c9a4207ec1fcb1b3b137c66d99c98401c760f9bc008a3d4849bbc9e4
Instruction Fuzzy Hash: 9E11C275504700EFEB218F16EC41F6AFBA8EF48720F04846AED459B251C375A409CB72

Uniqueness

Uniqueness Score: -1.00%

Function 059306CE, Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000E2C), ref: 05930737

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 59575ca22ca131671c93ab16180e37dea739278a122265806fbf4a656828328c
Instruction ID: 19e95bc7337e897a62b1046cb0217322a7e55c14b4c139160042cc0194a232d2
Opcode Fuzzy Hash: 59575ca22ca131671c93ab16180e37dea739278a122265806fbf4a656828328c
Instruction Fuzzy Hash: 8A112571500300AFEB20DB15DC8AFB6FF98DF04720F18849AED858B281C2B4A544CEB1

Uniqueness

Uniqueness Score: -1.00%

Function 0269A078, Relevance: 1.6, APIs: 1, Instructions: 54networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,?), ref: 0269A0D5

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 40f20ccbad8b1df15f2c01a5ace186c9661957a9d7459d3138720f15b2eda670
Instruction ID: e7ccf99c1299999975f674f714951a76951fd8e458dc02e18c6b21c318315acb
Opcode Fuzzy Hash: 40f20ccbad8b1df15f2c01a5ace186c9661957a9d7459d3138720f15b2eda670
Instruction Fuzzy Hash: FC118F75409380AFDB22CF55DC44B52FFB4EF45224F0884AEED848F252C375A818CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0593225E, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RasConnectionNotificationW.RASAPI32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 059322B7

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: ConnectionNotification
String ID:
API String ID: 1402429939-0
Opcode ID: f7a6e033d23a2f6b6eee38036c04f48e68fbc1f8008643bc5cc6685279426bcf
Instruction ID: 33b4691a1e23634bb9c7a9c09cb35739f214950c9bb9823c0ec9244224e3fbd7
Opcode Fuzzy Hash: f7a6e033d23a2f6b6eee38036c04f48e68fbc1f8008643bc5cc6685279426bcf
Instruction Fuzzy Hash: D411A175504204AFEB20CB16DC85F76FBA8EF48721F14846AED459B241D374A405CAB5

Uniqueness

Uniqueness Score: -1.00%

Function 0269AD22, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 0269AD6A

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 186c8a439e94fa5f99a2d5132a1b203b134b39e7d87f84f0dd4292437f8e5ad1
Instruction ID: d663885a1137754bae7d71833b775c13ffcb4d59e91956346ba381ce8e7ef615
Opcode Fuzzy Hash: 186c8a439e94fa5f99a2d5132a1b203b134b39e7d87f84f0dd4292437f8e5ad1
Instruction Fuzzy Hash: BD115EB5A003409FDB60CF69D885766FBE8EF44625F08846ADD49CB386DB75E808CA71

Uniqueness

Uniqueness Score: -1.00%

Function 05934ED6, Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,?,7DBEF230,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 05934F1E

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: ebde4f7f359e84fd57c86bf6f843160ba11701074d8edb9808761b755226efcb
Instruction ID: c3e75e3fb23546d1737237dc94992e496d04ae77d08076b4525893a741b09535
Opcode Fuzzy Hash: ebde4f7f359e84fd57c86bf6f843160ba11701074d8edb9808761b755226efcb
Instruction Fuzzy Hash: AF115271604240CFDB20CF69E88AB66FBD8EF44620F0D84AADD49CB241D374E404CA71

Uniqueness

Uniqueness Score: -1.00%

Function 05932AC2, Relevance: 1.6, APIs: 1, Instructions: 53networkCOMMON

Download Yara Rule

APIs

GetNetworkParams.IPHLPAPI(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05932B18

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: NetworkParams
String ID:
API String ID: 2134775280-0
Opcode ID: 972676f5fd6c41152408956f13b41e0598691d84a5075dacd49df3d6605de9af
Instruction ID: 2c97041d230da274fdeed23ee70e500fac73a866ee368f23d52967bca961a161
Opcode Fuzzy Hash: 972676f5fd6c41152408956f13b41e0598691d84a5075dacd49df3d6605de9af
Instruction Fuzzy Hash: 12010075500300AFEB20CF1AEC81FA6FBACEF09720F0484AAED489B241C274A4048BB1

Uniqueness

Uniqueness Score: -1.00%

Function 0269A44B, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0269A4AC

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 3f1e35f8db46bd7d51a8c80560fcf812e0299733452cc8493f40930009311ede
Instruction ID: c18760d205f3ca76f2f3a7c56c4e05d0c95be065aa0c55de5cba0acd0a303e48
Opcode Fuzzy Hash: 3f1e35f8db46bd7d51a8c80560fcf812e0299733452cc8493f40930009311ede
Instruction Fuzzy Hash: FD11BF714493849FDB12CF25DC49B52BFA4EF42224F0984EBED458F253C379A808CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05930F6E, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000E2C,7DBEF230,00000000,00000000,00000000,00000000), ref: 05930FC1

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 16dbd08120613c61f076940bcb3497c6fcedacd70d23d85b6b36b24d0681a6e0
Instruction ID: 7d993359db2089dfa9832606bba4d1be0a90a709e7e94dcc38b8d488010a0f2e
Opcode Fuzzy Hash: 16dbd08120613c61f076940bcb3497c6fcedacd70d23d85b6b36b24d0681a6e0
Instruction Fuzzy Hash: 1A01D271504300AFE720CB1AEC89FBAFBDCEF48721F1484AAED449B241D274A544CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 05934E16, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,7DBEF230,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 05934E5B

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 76a3a3e459e0bc2259e07900e7a998ec5506101ffca4eb2508906fa32b97db77
Instruction ID: 8ac5ca0537c694f1280e28871107e18d732003a2417122418596bbd56602f089
Opcode Fuzzy Hash: 76a3a3e459e0bc2259e07900e7a998ec5506101ffca4eb2508906fa32b97db77
Instruction Fuzzy Hash: 76116571604240CFDF60CF19D889B66FBD8EF04620F08C4AADD49CB241D374E408CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0593300E, Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 0593305A

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: ef9a9621ce8eab0717353e0662c21bda41a50cf5abc743711d7002c99345d390
Instruction ID: 6e0a5542a65149f8fed0e00dd772430fe5b7bd9e94db323f095f9bb13f0a9fb1
Opcode Fuzzy Hash: ef9a9621ce8eab0717353e0662c21bda41a50cf5abc743711d7002c99345d390
Instruction Fuzzy Hash: 9B115E31504644DFDF20CF55D845B66FBE5EF08710F0889AADD858B612D375E418CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0269B366, Relevance: 1.5, APIs: 1, Instructions: 47encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateChain.CRYPT32(?,00000E2C,?,?), ref: 0269B3B6

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: CertCertificateChain
String ID:
API String ID: 3019455780-0
Opcode ID: 5479af9156c91c3f7d25fd424193f16e4ab5fbbac88851cd85da2ff1303b8f4b
Instruction ID: 06dc3c30ca290739f9cf72e9f0e6cbea1e9e8f773148f3a1feca997c3e5bcea2
Opcode Fuzzy Hash: 5479af9156c91c3f7d25fd424193f16e4ab5fbbac88851cd85da2ff1303b8f4b
Instruction Fuzzy Hash: 5D017175501200ABD750DF26DC86B36FBA8EB88B20F14816AED089B641D335F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0269B85E, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

K32GetModuleFileNameExW.KERNEL32(?,00000E2C,?,?), ref: 0269B8AE

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: f127a59930649bed8e65ad6862c08cab8ab49a6619828e0f527a7624c865e8dd
Instruction ID: 54f58f7d5d86b4b47ec2a14d97be9c7cd122c8670887c2b9b33edac7eeac7437
Opcode Fuzzy Hash: f127a59930649bed8e65ad6862c08cab8ab49a6619828e0f527a7624c865e8dd
Instruction Fuzzy Hash: 62017175501200ABD710DF26DC86B36FBA8EB88B20F14816AED089B641D335F515CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05934F9E, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNEL32(?,7DBEF230,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 05934FD8

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: DirectoryRemove
String ID:
API String ID: 597925465-0
Opcode ID: 251ee5c6dd615e49511f44f89ec6e4adfcdea184f35c3e2066983a34e9329bb7
Instruction ID: 0b9c1783023d808a7096c0fe64c6810c2bb806c3d8f1f22237269664736a026e
Opcode Fuzzy Hash: 251ee5c6dd615e49511f44f89ec6e4adfcdea184f35c3e2066983a34e9329bb7
Instruction Fuzzy Hash: 4E015E75A04240CFDB10CF29E88A766FB98EF45621F0884AADD49CF246D775E548CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 0269A7B2, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0269A7F6

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1f7f7a9cad213c96ee5333749a4850326a56293262ac5a162ae8e363840f07ee
Instruction ID: 91a2c1232f64512d822901c0d1c3f14a77c53e750129982f2c277f401358a6a6
Opcode Fuzzy Hash: 1f7f7a9cad213c96ee5333749a4850326a56293262ac5a162ae8e363840f07ee
Instruction Fuzzy Hash: 490161314007409FDF218F95E944B66FFE4EF48720F08C56ADD854B611D375A416DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0269AC76, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,7DBEF230,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 0269ACA8

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 338d232e10f8201ed733b6d12361fb1bb812a60f7ce5bdcc1446f44282995e0c
Instruction ID: 01eaa388b3a51d851653db79f5207edc297e5d393830d3fbba865c507913ee47
Opcode Fuzzy Hash: 338d232e10f8201ed733b6d12361fb1bb812a60f7ce5bdcc1446f44282995e0c
Instruction Fuzzy Hash: D6017C75904240DFDB108F59E985766FBE8EF44220F18C4AADD498F252D779A808CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0269AB2E, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

MkParseDisplayName.OLE32(?,00000E2C,?,?), ref: 0269AB7E

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: DisplayNameParse
String ID:
API String ID: 3580041360-0
Opcode ID: d252c108b776ac4809773a4fed7561014044a9322453534bbc3a0c77fec2d2ae
Instruction ID: 0e068acfca8830f12e4cccb673b8330fc5bae13cb102f4acadae8f21bc25f31b
Opcode Fuzzy Hash: d252c108b776ac4809773a4fed7561014044a9322453534bbc3a0c77fec2d2ae
Instruction Fuzzy Hash: ED016275501600ABD250DF1ADC86B36FBA8FBC8B20F14815AED485B741D371F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0269B5BA, Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E2C,?,?), ref: 0269B60A

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 9cf1d6f45f1b0433700e6937f526ff6856a5f365b17081b5d5699702461113e8
Instruction ID: eca730d53de88faf04df6fceaa923766a70a177106d83908f6120e7dd5be457d
Opcode Fuzzy Hash: 9cf1d6f45f1b0433700e6937f526ff6856a5f365b17081b5d5699702461113e8
Instruction Fuzzy Hash: EA016275501600ABD250DF1ADC86B36FBA8FBC8B20F14815AED485B741D371F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0269B00E, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,7DBEF230,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 0269B040

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 7e3a16a3b5e6e6e36ae7a41c4352cccef2b14c0e171453667a1c862f0c1a5b44
Instruction ID: 1e61850fef0911c3795807441a82c0ff1febe652f597aafe528ef825f4b196f0
Opcode Fuzzy Hash: 7e3a16a3b5e6e6e36ae7a41c4352cccef2b14c0e171453667a1c862f0c1a5b44
Instruction Fuzzy Hash: 09018F755042808FDB20CF59E885766FBA8EF44724F08C0AADD498F652D775A409CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0593470A, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,7DBEF230,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 0593473C

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 12541fb32d65cdea2f365be80d59197f0ac0832209bbf98383185a1c24a93d4d
Instruction ID: dc9b8db54fd3febe21fc90401e22ea4b90753ea112366e3da2d3901b43f8f496
Opcode Fuzzy Hash: 12541fb32d65cdea2f365be80d59197f0ac0832209bbf98383185a1c24a93d4d
Instruction Fuzzy Hash: 22017C75A04240DFDB20CF59E889766FF94EF45220F08C4AADD4A8F652D375A418CE61

Uniqueness

Uniqueness Score: -1.00%

Function 059312B6, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

RasEnumConnectionsW.RASAPI32(?,00000E2C,?,?), ref: 05931306

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: ConnectionsEnum
String ID:
API String ID: 3832085198-0
Opcode ID: f1dd1292ee3254c5b1dc5ef6d0d67bd86af5dbcdf19100f8f9f41a9fcf7f5d80
Instruction ID: c1750d98287190edea19175ad7da8cd44ec58b7889c7543534d663d666e3803a
Opcode Fuzzy Hash: f1dd1292ee3254c5b1dc5ef6d0d67bd86af5dbcdf19100f8f9f41a9fcf7f5d80
Instruction Fuzzy Hash: AC016275501600ABD250DF1ADC86B36FBA8FBC8B20F14815AED085B741D371F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0593427A, Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNEL32(?,00000E2C,?,?), ref: 059342CA

Memory Dump Source

Source File: 00000003.00000002.512243329.0000000005930000.00000040.00000001.sdmp, Offset: 05930000, based on PE: false

Similarity

API ID: Enum
String ID:
API String ID: 2928410991-0
Opcode ID: 291dd19a589c0fc2124ec80bfc1427f591f4bb5d1a77bc2bd206ace270d78341
Instruction ID: c51827ea82e544b5ee2bceaec3068eb2ab16726e339e4b612c1c5d5a2ed3b2bc
Opcode Fuzzy Hash: 291dd19a589c0fc2124ec80bfc1427f591f4bb5d1a77bc2bd206ace270d78341
Instruction Fuzzy Hash: 4D016275501600ABD250DF1ADC86B36FBA8FBC8B20F14815AED085B741D371F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0269A47A, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0269A4AC

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: b75a651690b5f8ed9c7ba447621bf64184f37e4dad286eea1d30645ee33a0ab8
Instruction ID: f44bbe0642d68a6be7f4fda51a1f62b7e1ca502b8a09e6e025fa7bb8e91528e5
Opcode Fuzzy Hash: b75a651690b5f8ed9c7ba447621bf64184f37e4dad286eea1d30645ee33a0ab8
Instruction Fuzzy Hash: C101AD749042408FDF20CF55E888765FBE8EF45720F18C4AADD488F202D779A809CE72

Uniqueness

Uniqueness Score: -1.00%

Function 0269A876, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,7DBEF230,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 0269A8A8

Memory Dump Source

Source File: 00000003.00000002.505646470.000000000269A000.00000040.00000001.sdmp, Offset: 0269A000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 45a5ce84d7a413b38de9e5b7363deb3000db940bf0482dc3a19d4d13ade5a2eb
Instruction ID: 7ad29fa8438c4fdfe2d239839e94568c510c9e1575dfdb316b1c971e019da726
Opcode Fuzzy Hash: 45a5ce84d7a413b38de9e5b7363deb3000db940bf0482dc3a19d4d13ade5a2eb
Instruction Fuzzy Hash: 4EF08C349046408FDB208F46E988761FBE8EF04720F08C4AADD494B352D775A80ACAA2

Uniqueness

Uniqueness Score: -1.00%

Function 063D4297, Relevance: .6, Instructions: 624COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d09119606310999f432ccf837f055817fffaae97aed860efc1576ad0c3c886a8
Instruction ID: 0d28204431096af1732f7dfd04b03036864010f9b32d26e3c98e9f09ca92bff8
Opcode Fuzzy Hash: d09119606310999f432ccf837f055817fffaae97aed860efc1576ad0c3c886a8
Instruction Fuzzy Hash: F122E630B093865FD7129738A850B6A7BF69B82304F1984F6E584CF2D3D678EC49C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 063D5E50, Relevance: .6, Instructions: 602COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21f2f96324a474040af6c627c281a783cfa2fe2cdbbb0501f3280208bf86436f
Instruction ID: 33a39c99d09edf37c4ae5154b6cc40b4deee46dce3b19bf52fee6a0f668e6ab7
Opcode Fuzzy Hash: 21f2f96324a474040af6c627c281a783cfa2fe2cdbbb0501f3280208bf86436f
Instruction Fuzzy Hash: F5227E36A102049FDB64CF68E885BADB7B6FF4A320F114469E815DB3A1CB31DC49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 063D3C07, Relevance: .5, Instructions: 484COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3c4359eaa92cd9600a71367b309775681fdd3bc888789ab6814c1e128e2337
Instruction ID: 3bcafd0717a5f49a0dec9a0900d5d8791f93e02ab0f9020c3250cc2f2b96c68c
Opcode Fuzzy Hash: 4d3c4359eaa92cd9600a71367b309775681fdd3bc888789ab6814c1e128e2337
Instruction Fuzzy Hash: 4CF18270F002165FEB54AF788850BAEB2E7AF84341F6444B5D809EB395EE789C468F91

Uniqueness

Uniqueness Score: -1.00%

Function 063D3C18, Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fad23ed5c37bed2ca7d191e46e254f0c7384afe4e2f8c7314be3a21102e29280
Instruction ID: bcf3569f8773752105f922037fc4ecabaf32755c3731e05901d0fec41db0c26f
Opcode Fuzzy Hash: fad23ed5c37bed2ca7d191e46e254f0c7384afe4e2f8c7314be3a21102e29280
Instruction Fuzzy Hash: 5FF19170F002165FEB54AF788850BAEB2E7AFC4341F6444B5D809EB395EE789C468F91

Uniqueness

Uniqueness Score: -1.00%

Function 063D4B88, Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 955d833b7d606a2ee19219e7a2dc91531c56bf6098b7c2f001a4e2d376f00327
Instruction ID: 2a23acbfc793b19f3af6c7b1057a6557c1da68ff2add6ad849c0e0196a0b836b
Opcode Fuzzy Hash: 955d833b7d606a2ee19219e7a2dc91531c56bf6098b7c2f001a4e2d376f00327
Instruction Fuzzy Hash: AA914971F103155BDFC8BBF9881466EA2E6AFC8244F148D28D415EB398EE78DC0297D1

Uniqueness

Uniqueness Score: -1.00%

Function 063D4B98, Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c90090772c3423eab8d6f098c4c2d023437b2d80883f81ae14136afad3ae8a6f
Instruction ID: 0e271524bbe7cd03530e9d1e8390f12a87cedd06ddcc56da47f0cf67834c2ce7
Opcode Fuzzy Hash: c90090772c3423eab8d6f098c4c2d023437b2d80883f81ae14136afad3ae8a6f
Instruction Fuzzy Hash: 84913671F102165BDFC8BBF9881466EA2E6AFC8344B548928D415EB398EE78DC0297D1

Uniqueness

Uniqueness Score: -1.00%

Function 063D2FF0, Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7cc18e42f6f920a008aa838b89b9565b89115533e582decde552bebb8dcf150
Instruction ID: 7ab950b99425d2c707974a09f42852cde26b1a2dcc4e4984e9a7afe11df74855
Opcode Fuzzy Hash: c7cc18e42f6f920a008aa838b89b9565b89115533e582decde552bebb8dcf150
Instruction Fuzzy Hash: 08914531F082418FE755A778A815BBE3BA69F86344F0584B9E505DB381EE34CC46C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 02692477, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.505636159.0000000002692000.00000040.00000001.sdmp, Offset: 02692000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bddff3e83ff27ccf8a924cf501bda0b66642e7d7c8c90e09b512fc434d4fde62
Instruction ID: 62cfe4a646bfa0e49d2044903560f4bbf4f4437daa5442f4ade78934a982b233
Opcode Fuzzy Hash: bddff3e83ff27ccf8a924cf501bda0b66642e7d7c8c90e09b512fc434d4fde62
Instruction Fuzzy Hash: 1C8100B550D3C26FCF079B28D9B56A47F7CAB0362874950EBC884CF1D7DA149A4B8361

Uniqueness

Uniqueness Score: -1.00%

Function 063D10F0, Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9acc98c27311c5689969dc4c6ca416bef477e3aa59fc0b7a141162893be1d9f5
Instruction ID: 1cf405d3e38014d00798f2687b61670ec45dc151911400e394213bab390d26c4
Opcode Fuzzy Hash: 9acc98c27311c5689969dc4c6ca416bef477e3aa59fc0b7a141162893be1d9f5
Instruction Fuzzy Hash: D9815B71F003159BDF59EBB5D8506AEB7B3AF88304F508928C9099B398EF709806CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 063D2CC8, Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c52a48fff628c8d9beed0943699926a7f0e13616788e6c4949188399d3076e7
Instruction ID: 2bdac30d0ddfe9aba11f205c6999cf13d4700e244075ef78b5c7a0245ef39d0b
Opcode Fuzzy Hash: 1c52a48fff628c8d9beed0943699926a7f0e13616788e6c4949188399d3076e7
Instruction Fuzzy Hash: 10717131F100459BEF645ABCE850B6F7ADADF89310F104829E20AD7395CA78CE5597E2

Uniqueness

Uniqueness Score: -1.00%

Function 063D2CD8, Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c2191156048638c1f63a1a9840191b46830a2f1512a1cd6d649203d2372debd
Instruction ID: d6d7d0061de6d30c2b3399834c7689d751bb64932ff97cf16a5ff2055a30b30d
Opcode Fuzzy Hash: 3c2191156048638c1f63a1a9840191b46830a2f1512a1cd6d649203d2372debd
Instruction Fuzzy Hash: 0D715F31F100059BEF645ABCE454B6F69DAEF8D310F204839E20AD7394CA78CE5597E6

Uniqueness

Uniqueness Score: -1.00%

Function 063D3490, Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59be765f1291dd8c06430112ab1387ab9d63ebd6bd8d19f88f65272865e4c4aa
Instruction ID: 22dd1f5e2222a22baac36aa7e60e1f98a81eb01b2c35111427a994d088b88e48
Opcode Fuzzy Hash: 59be765f1291dd8c06430112ab1387ab9d63ebd6bd8d19f88f65272865e4c4aa
Instruction Fuzzy Hash: EA714B75B001099FCF48AFB5D8585ADBBB7BF88300B248429E406AB3A4DF359D46CF85

Uniqueness

Uniqueness Score: -1.00%

Function 063D0E18, Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c279c762a9751b837cd419c916eea5927ed8bfbce9b4690fb8bb89fa99f0161f
Instruction ID: 0cc62a79fb03a06fef236c57ecbf667c695c6969e56696b19eefa803b360dde4
Opcode Fuzzy Hash: c279c762a9751b837cd419c916eea5927ed8bfbce9b4690fb8bb89fa99f0161f
Instruction Fuzzy Hash: 7F619A31B002459FCB49EB74D454AAEBBE3AF88210F158569E906DB394EF34EC468BC1

Uniqueness

Uniqueness Score: -1.00%

Function 063D0BF8, Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73538b34e5c6697485f558a0f6cdaecd85f8e651e4636b95389bca57c33efe71
Instruction ID: 0919a2a5476c76a56e1e78f15be15c404c9cfdcbba7d9451cf5150c82010ceac
Opcode Fuzzy Hash: 73538b34e5c6697485f558a0f6cdaecd85f8e651e4636b95389bca57c33efe71
Instruction Fuzzy Hash: 8451D530F093855FD7869B78A8549AA3FF59F46300F1580ABE448DF693EB28AD05C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 063D1091, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47e5707323f1ade2c2c6aa09d9ff5ff28514c4db72fb21bbc3ea4d0691ece65f
Instruction ID: e1c77994c5412e27c4f6f61679446c9be96473021d9fbe42af1a998810c9b0bc
Opcode Fuzzy Hash: 47e5707323f1ade2c2c6aa09d9ff5ff28514c4db72fb21bbc3ea4d0691ece65f
Instruction Fuzzy Hash: 6B518A71E007099FDB55EBB8D8506AEBBF3AF88300F118429D905EB255EB34AC06CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 063D3848, Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f35f6e6e8478841b430019ddaf9d2be8068e1bebf6a2c4ab5397e7a0d001dcd0
Instruction ID: bdfb488f2c899a8e47689f3a7cfd5a0844ee27b26af74f0922e17276de53fd2e
Opcode Fuzzy Hash: f35f6e6e8478841b430019ddaf9d2be8068e1bebf6a2c4ab5397e7a0d001dcd0
Instruction Fuzzy Hash: EA517172F001059FDF54ABB8D858AAE7BFAEF89310B104469E106EB364DE349C56CF91

Uniqueness

Uniqueness Score: -1.00%

Function 063D4948, Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51ab1708b50dff94483b89581cd6feabcb11b29443ea3918b46ae5137dc99792
Instruction ID: 03443c8cf4496841d514d58917dcf46aa66ac700e9093dbc9111943d6287b6fa
Opcode Fuzzy Hash: 51ab1708b50dff94483b89581cd6feabcb11b29443ea3918b46ae5137dc99792
Instruction Fuzzy Hash: C151A230B002025FDB58AB7D9D21BAF6AEB9FD8700F144439D445E73A9EE788D0297E5

Uniqueness

Uniqueness Score: -1.00%

Function 063D0E68, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ceaa7819455f382d4529dac13e29fb87e26bdb24fd68f61c00ed699d7b0f71f
Instruction ID: ac711351808d119a3c6084b0f086daa76fd531f02966a71688c0edb74855cedb
Opcode Fuzzy Hash: 4ceaa7819455f382d4529dac13e29fb87e26bdb24fd68f61c00ed699d7b0f71f
Instruction Fuzzy Hash: A6515931F002059BDB54EBB4D4946AEB7F3AF88210B158929D906DB394EF34EC46CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 063D1482, Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a2372c787b062ef65f0b93a6581cb3b09979cd6ae625707c602a7bdc923d3b8
Instruction ID: c503c9d82c8a998c9a8423025e429e267ee648b1c5ce235adb009146ffcb0f61
Opcode Fuzzy Hash: 4a2372c787b062ef65f0b93a6581cb3b09979cd6ae625707c602a7bdc923d3b8
Instruction Fuzzy Hash: 98517C30F013459FDB54DBB4D9586AEBBF6AF88204F0448A9D90AEB351EE349D81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 063D4998, Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fad2243a89483f7589861bf02b6e5b3bda470676d107e1feb001009b8e34b9cf
Instruction ID: 5c19865bb79b003e659cfc9769b4a3d8f0e622ebd5671bbc9fd340799ca057d5
Opcode Fuzzy Hash: fad2243a89483f7589861bf02b6e5b3bda470676d107e1feb001009b8e34b9cf
Instruction Fuzzy Hash: 0C417F30B002169BDF98AB7D9D21BAF69DB9FD8700F144439C405E73A8EE788D0297E5

Uniqueness

Uniqueness Score: -1.00%

Function 063D508D, Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48a03e5321314cb2d06f1556a6e72562b8e2e7625052ab167bdb35d75a2b6ca7
Instruction ID: c160fd37f0d3c5dbde44627b3390eb623301d6e512ca395add82173a2bee21fc
Opcode Fuzzy Hash: 48a03e5321314cb2d06f1556a6e72562b8e2e7625052ab167bdb35d75a2b6ca7
Instruction Fuzzy Hash: AC410572A043069FDB54DF28E85076FBBE1EF803A4F158869E485DB290C774D84ACBD2

Uniqueness

Uniqueness Score: -1.00%

Function 063D02B0, Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f46b2a5d2f6314d933e169311f7e4de0bdba904b5a62f9115b3c701d058a78d9
Instruction ID: 47dfbc2e369dde145743d60acb1cdc8f3ad9bed599efbd9fdce2b8be30e58a95
Opcode Fuzzy Hash: f46b2a5d2f6314d933e169311f7e4de0bdba904b5a62f9115b3c701d058a78d9
Instruction Fuzzy Hash: 5C417F31F102149BCF94EBB8D84899EBAE6EF88611B104928E506E7384EF349D518FE1

Uniqueness

Uniqueness Score: -1.00%

Function 063D3747, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ee5547c17b3ac5cd32e074047f29696c9c13b5157a853fd1422b73478151580
Instruction ID: 0b9830caf9e3d5ed2bb59138573b8b3ec032881a763de466fcc72b11cb793b80
Opcode Fuzzy Hash: 5ee5547c17b3ac5cd32e074047f29696c9c13b5157a853fd1422b73478151580
Instruction Fuzzy Hash: 79419330B093859FE3519B34A854B693FF59F47300F1980FAD584CB292EA399C49C792

Uniqueness

Uniqueness Score: -1.00%

Function 063D4F37, Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d44ac1b3f0f157f0a5a3ad82b71b7d0754a72e2ca13b4339de189aedfed03c
Instruction ID: 8faa9eb40de62526ba0153a62b9c8fa19e8a50aa31cc0621cb6001c3d4f59661
Opcode Fuzzy Hash: 07d44ac1b3f0f157f0a5a3ad82b71b7d0754a72e2ca13b4339de189aedfed03c
Instruction Fuzzy Hash: B9312231A093459FC7119F64D810BEB3FF99F45364F1884A6E440EB2A2DA35E844CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 063D55E1, Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51f426d0c2efafb9f6fbc247d3f9b4f24799c47394a0a69e4fdcba2ce6a482cc
Instruction ID: cb41a5316e7b8dab0f01809d97c38556b2cd0a93210508744ecb5eb7520535f9
Opcode Fuzzy Hash: 51f426d0c2efafb9f6fbc247d3f9b4f24799c47394a0a69e4fdcba2ce6a482cc
Instruction Fuzzy Hash: 5A413974A0035ACFCB04CF29D4949AEBBF2FF88314B158599E8558B365D731ED46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 063D0018, Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 841abfc1d509939da55e832901b65a7f49c84564aae3a2f9fcb615655b10b1b3
Instruction ID: 1f0241e7a71e1c6987201bb37d35bfb9bebb59dfd8ecbb1ca722ceb65b047325
Opcode Fuzzy Hash: 841abfc1d509939da55e832901b65a7f49c84564aae3a2f9fcb615655b10b1b3
Instruction Fuzzy Hash: 6B21B531E093845FC786EB789C2499F7FF5EF8A140B1480ABD449E7252EB285D01CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 063D0260, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f2de8debeb1637cb1a85397a594cf0e820db562de3048174d0962fb15af02d7
Instruction ID: e1ec53d0510cb56ed8778c049ab894f040b05410c5b9be2c176dece9b4c2e752
Opcode Fuzzy Hash: 8f2de8debeb1637cb1a85397a594cf0e820db562de3048174d0962fb15af02d7
Instruction Fuzzy Hash: 4F212431F043459FCB98AB7858156BE3BE69B89714F010479D609EB381EF388C4187E2

Uniqueness

Uniqueness Score: -1.00%

Function 063D0140, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c24e53ad59260ff7eb317dbaecf449c2b43c8b31eceaacaf5e148af7a03bf7d8
Instruction ID: bd1994ce02b25318b8c060f1d71bf45586ebee464edc2b30ebf4f5988a5fd666
Opcode Fuzzy Hash: c24e53ad59260ff7eb317dbaecf449c2b43c8b31eceaacaf5e148af7a03bf7d8
Instruction Fuzzy Hash: 9621AE30F102459FCB84EBB8D8119AE7BF6EB89214F148069D509EB351EF389D018BE5

Uniqueness

Uniqueness Score: -1.00%

Function 027A072F, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.505870862.00000000027A0000.00000040.00000040.sdmp, Offset: 027A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c012e66311867c48c1aba8ab2698a051f0b969fe79ce001f805b129cc27073
Instruction ID: ca6d647d11832d51aa3447c8b47716752bde95990c4302045b1cc356b7d4ca25
Opcode Fuzzy Hash: d6c012e66311867c48c1aba8ab2698a051f0b969fe79ce001f805b129cc27073
Instruction Fuzzy Hash: 282194355093C48FD702CB24D891755BFB1EF86228F18C6EED8448B6A3C33A990ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 063D3B10, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ac87f6b8dc69bca8b4f7788d88d39d2d941c01c226db05e0f8a2524e942c076
Instruction ID: 501bccbe4b911f18e6ea3486e9e0dac43e1769ce8aa0075efb3dd20000f6765c
Opcode Fuzzy Hash: 6ac87f6b8dc69bca8b4f7788d88d39d2d941c01c226db05e0f8a2524e942c076
Instruction Fuzzy Hash: AA11D035F206128BEF645A68F8603993755E786260F104836E806DB2C0EA79DC4982D6

Uniqueness

Uniqueness Score: -1.00%

Function 063D02A1, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0373aa2ae06862dced8e5535de1e2d7965e4eba87f7cf52213f55b632247451e
Instruction ID: 85d4d4f6e1d83357d80a860d3fbc3e03fae853ee03c9ced2fb7738dae0fb3e45
Opcode Fuzzy Hash: 0373aa2ae06862dced8e5535de1e2d7965e4eba87f7cf52213f55b632247451e
Instruction Fuzzy Hash: 4111E931F002159FCF94EB7858556BE7AE6DFC8614F110929EA0AE7384EF348D418BE2

Uniqueness

Uniqueness Score: -1.00%

Function 027A075C, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.505870862.00000000027A0000.00000040.00000040.sdmp, Offset: 027A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1db821c47d687d9a953003cbb728e6b52bb22ddc0f52ea4b491f76431c1d848
Instruction ID: dc4a56406e0ef5012cc734b4747c2aeb29bdc427b448e731f3ed4bcc7e5681a3
Opcode Fuzzy Hash: d1db821c47d687d9a953003cbb728e6b52bb22ddc0f52ea4b491f76431c1d848
Instruction Fuzzy Hash: 3F110634204245DFDB15CB14D990B26BBA5EBC8B28F28CAADE8491B643C77BD803CE51

Uniqueness

Uniqueness Score: -1.00%

Function 05943A89, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512269094.0000000005940000.00000040.00000001.sdmp, Offset: 05940000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65c49d60a8478b037f4cf5ee9ddb406043c3435f1fe00e564462daf2fda5b0d3
Instruction ID: f75d43efa3e5e2c264708a556ba84ddd2159e37ebf0e839e7b908db6c0d75861
Opcode Fuzzy Hash: 65c49d60a8478b037f4cf5ee9ddb406043c3435f1fe00e564462daf2fda5b0d3
Instruction Fuzzy Hash: 3A11D4B5908301AFD350CF19D880A5BFBE4FB88660F04892EF89897311D335E9048FA2

Uniqueness

Uniqueness Score: -1.00%

Function 05943021, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512269094.0000000005940000.00000040.00000001.sdmp, Offset: 05940000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39be660dafb6241891ad45ed5438716d1670616d18c1c81c963e346f732ecea2
Instruction ID: dcdfa12d351420a986315469dcec17f6cec6541b329106a5b9b88992782bbbb1
Opcode Fuzzy Hash: 39be660dafb6241891ad45ed5438716d1670616d18c1c81c963e346f732ecea2
Instruction Fuzzy Hash: 1811D4B5908301AFD350CF19D880A5BFBE4FB88664F04892EF99897311D335E9048FA2

Uniqueness

Uniqueness Score: -1.00%

Function 063D0070, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f897eef486721e7d331df256e502f37168707f8f326313a625c8312e6c02d0a7
Instruction ID: ae810c600f6354234526f21350a1d834dfca5cafb7a5f2525a59f341c2a2ab65
Opcode Fuzzy Hash: f897eef486721e7d331df256e502f37168707f8f326313a625c8312e6c02d0a7
Instruction Fuzzy Hash: 83112771F102198F8BC4EFB8E8549AEB7F6EB88650B108029D519E7354EF389D028BD5

Uniqueness

Uniqueness Score: -1.00%

Function 063D0D48, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c07533284162dd5c86056845d3412085049ecc6419a0cfc1e1bf55e5b7e31ff7
Instruction ID: 76254d4efbf2595b86978d1f9c62f5df33b6ba24b420713a5a58884a5a4ec2b6
Opcode Fuzzy Hash: c07533284162dd5c86056845d3412085049ecc6419a0cfc1e1bf55e5b7e31ff7
Instruction Fuzzy Hash: DB112A71F002159F8BC4EBBCD85459EB7F6EF88610B204029D509E7350EF34AD428BE5

Uniqueness

Uniqueness Score: -1.00%

Function 063D0190, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10dbda4a09fa6e294361109992888f7a6a4cc261224c8b43f9e59b4da6e2692d
Instruction ID: cd74dc4c95795f7ec5e8407d27bc5ba8c105dfeb8d9401a479e43472fb4cf922
Opcode Fuzzy Hash: 10dbda4a09fa6e294361109992888f7a6a4cc261224c8b43f9e59b4da6e2692d
Instruction Fuzzy Hash: 32112771F102158F8BC4EBB8D9549AEB7F6EB8C614B104129D51DE7310EF389E028BE5

Uniqueness

Uniqueness Score: -1.00%

Function 05943924, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512269094.0000000005940000.00000040.00000001.sdmp, Offset: 05940000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 757c55d046f82f9283aefa0150b575410fa1ccd824cc6247224dfdc4aa271b9c
Instruction ID: 6fcee261b02d7d6697fc58f016e028bb660b95404579037851ecf809555609f9
Opcode Fuzzy Hash: 757c55d046f82f9283aefa0150b575410fa1ccd824cc6247224dfdc4aa271b9c
Instruction Fuzzy Hash: AD11ECB5508301AFD350CF49D880A57FBE8EB88660F04C92EFD9897311D331E9048BA2

Uniqueness

Uniqueness Score: -1.00%

Function 063D2C40, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396026a89e1c2dd5218b0c2764f6900a4ad0aa64cc3a4df3a81d763d2ad46ad5
Instruction ID: 8fc2dd25678b997fd26f64dc5c27568ed71885ec7f508608575001e0ef40d19a
Opcode Fuzzy Hash: 396026a89e1c2dd5218b0c2764f6900a4ad0aa64cc3a4df3a81d763d2ad46ad5
Instruction Fuzzy Hash: 10018131F042185BCB98EAB9981466F26DB9BC4214B11887AD219DB344EE35DD018785

Uniqueness

Uniqueness Score: -1.00%

Function 063D4FE8, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c9f7fe6958614b760bfddd52f188855d0547e262408875812f15067994efbe
Instruction ID: 27934321f9bb6c2c9ab185a811c2abe5d1abfe8325d6a75d0061b44ca8ec368b
Opcode Fuzzy Hash: 20c9f7fe6958614b760bfddd52f188855d0547e262408875812f15067994efbe
Instruction Fuzzy Hash: D4012D71D00219DFDB64AFA4D418B9FBFB9EB08365F144865D405B3240CA74A884CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 027A05D0, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.505870862.00000000027A0000.00000040.00000040.sdmp, Offset: 027A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4764e2c014fcb69d67db047aa0227fed521bb15a21728e5fcdfcfe5defe65cc5
Instruction ID: a7fbac20ce3922ddfe0e48dac13124d21d3ecaf9235e001193981875125672db
Opcode Fuzzy Hash: 4764e2c014fcb69d67db047aa0227fed521bb15a21728e5fcdfcfe5defe65cc5
Instruction Fuzzy Hash: 5D0186755093805FD712CB16EC40862FFA8DA86620709C0AFEC898B612D225B808CB75

Uniqueness

Uniqueness Score: -1.00%

Function 063D32BE, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8f473b3f075a82fe456bbe47b32c1bc0ed999ecc01b810ac609e8bb7c28e140
Instruction ID: 9fc69d58cdab79a3dd52d33556443a7691a4c9f4e82fd5d885e33d71035aba10
Opcode Fuzzy Hash: a8f473b3f075a82fe456bbe47b32c1bc0ed999ecc01b810ac609e8bb7c28e140
Instruction Fuzzy Hash: D2F0F032F045208BCB14BB78BA5822CB7A2EF88214F014878DA4993344EF314D24C7C3

Uniqueness

Uniqueness Score: -1.00%

Function 027A0818, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.505870862.00000000027A0000.00000040.00000040.sdmp, Offset: 027A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f6f7c96804cda76668e35a3bbcf86681c06fe62140db942cdcb6afdd34f29c
Instruction ID: bc04406a6ce246a93cf36658e23738785b98021c742274dd3fde8f2d8e4c8d37
Opcode Fuzzy Hash: c3f6f7c96804cda76668e35a3bbcf86681c06fe62140db942cdcb6afdd34f29c
Instruction Fuzzy Hash: 61F0FB35104645DFC606CF40D980B15FBA6EB89718F24CAA9E9491B652C3379813DE81

Uniqueness

Uniqueness Score: -1.00%

Function 027A05F6, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.505870862.00000000027A0000.00000040.00000040.sdmp, Offset: 027A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fb4fefbb05ed5f1bb103abecbfd6bad9d7da19086205d96ff1b504418139076
Instruction ID: 57ebb53bcbd15361d2599091ec8286c78deeb9224fdcedf199d285a5756b087b
Opcode Fuzzy Hash: 6fb4fefbb05ed5f1bb103abecbfd6bad9d7da19086205d96ff1b504418139076
Instruction Fuzzy Hash: 3EE092B66006004BD750CF0AEC41466F7D8EB88630B18C07FDC0D8B701D235B505CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 05943397, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512269094.0000000005940000.00000040.00000001.sdmp, Offset: 05940000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ada939e13f18bb22c87f507d934b920047c63f0e3b3a1baa99b9e25c523c44c9
Instruction ID: 3497eb663740aba431520721925153f27f8435ef4cb34056308eabcb7c38df77
Opcode Fuzzy Hash: ada939e13f18bb22c87f507d934b920047c63f0e3b3a1baa99b9e25c523c44c9
Instruction Fuzzy Hash: FFE0D8B250120067D220DE06EC41B63FB98DB84A30F04C56BED081F302D176B514CAF5

Uniqueness

Uniqueness Score: -1.00%

Function 05943083, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512269094.0000000005940000.00000040.00000001.sdmp, Offset: 05940000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42cfcf537190c77d9e513953a3ea6a7d6d07b2dd55ade9116ea8f00f235cff3f
Instruction ID: 5644eb791b21e0e634887e0094b941a9aea4301869fbacc30a481326d79912e3
Opcode Fuzzy Hash: 42cfcf537190c77d9e513953a3ea6a7d6d07b2dd55ade9116ea8f00f235cff3f
Instruction Fuzzy Hash: EFE0D8B250130067D2208F06EC41B62FB58DB84A30F04C56BED081F302D175B5148AF5

Uniqueness

Uniqueness Score: -1.00%

Function 05943AEB, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512269094.0000000005940000.00000040.00000001.sdmp, Offset: 05940000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f974bd0f14160a35fae8bc6c137a81dc02a0778cafcc372fc7e46e4e324c841
Instruction ID: d3233afa89a205f78ff2e914e9269f9ea1a4f1eeb7365b0930595b56f804b9c8
Opcode Fuzzy Hash: 5f974bd0f14160a35fae8bc6c137a81dc02a0778cafcc372fc7e46e4e324c841
Instruction Fuzzy Hash: 24E0D8B25412046BD3608E06EC41B62FB98DB94A30F04C56BED081F302D175B5148AF5

Uniqueness

Uniqueness Score: -1.00%

Function 05943973, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512269094.0000000005940000.00000040.00000001.sdmp, Offset: 05940000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10b501b28593f4439e7fd35bb82cc30310990f0c3abfebeb32f953d05d783ccf
Instruction ID: 669044d7379f03a7d5f8aa45a8570cd578f5c0d7481ea8e4574f683b3f1abe7f
Opcode Fuzzy Hash: 10b501b28593f4439e7fd35bb82cc30310990f0c3abfebeb32f953d05d783ccf
Instruction Fuzzy Hash: 79E0D8B250120467D2609E06EC81B63FB98DB44A30F04C56BED081F302D276B5148AF5

Uniqueness

Uniqueness Score: -1.00%

Function 063D0DA7, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cebe16f29ff1013c5a12ea9185b1e65b71780ef3977fdad60db33389e9c9da3c
Instruction ID: f019adbf21dec70d16e5eacd094d4c3c20929746c3501cef9a47f420cc5b20ee
Opcode Fuzzy Hash: cebe16f29ff1013c5a12ea9185b1e65b71780ef3977fdad60db33389e9c9da3c
Instruction Fuzzy Hash: 2DE0ED39F001448F8F84EBBCE4548DDB3E1EF886157118465D11AE7290DF399D029BA5

Uniqueness

Uniqueness Score: -1.00%

Function 063D01EF, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bff55145f7085047c6c7a809c36c6506234cff0647af1a855e4a05b094a14884
Instruction ID: f1e67c17339705df570b0abe2e1d4704efe80bec7e570637da934e90e25cdd90
Opcode Fuzzy Hash: bff55145f7085047c6c7a809c36c6506234cff0647af1a855e4a05b094a14884
Instruction Fuzzy Hash: 73E0653AF001048F8F84EBF8E8548DDB3F1EF88225B104465D11EE7290EF389E028BA5

Uniqueness

Uniqueness Score: -1.00%

Function 063D00CF, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd0c6203f6e6ebd80ea181d74d0f8adb311f9ec38d56456c471f4a4a63b0b933
Instruction ID: aed3766d093905effaa260df10ccc8589cd7442205892d0909372f46a8a91d47
Opcode Fuzzy Hash: fd0c6203f6e6ebd80ea181d74d0f8adb311f9ec38d56456c471f4a4a63b0b933
Instruction Fuzzy Hash: BEE0E53AF001048B8F84EBB8F8548DDB3E2FB88655B104465D11AE7295EF399E068B95

Uniqueness

Uniqueness Score: -1.00%

Function 063D5598, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2697fa80e14651c068d3eea667ddc645405ebd44642b0293e3350296e17705ca
Instruction ID: 30cfd1af21e004b90f9b7466ea9a17f2e0e40db913110bdd284c8d0f0eea0eff
Opcode Fuzzy Hash: 2697fa80e14651c068d3eea667ddc645405ebd44642b0293e3350296e17705ca
Instruction Fuzzy Hash: 4DE04F3251020A9FDF230F60E805B9A3B67EB45315F108431F50AC9160E736C4B4EB80

Uniqueness

Uniqueness Score: -1.00%

Function 026923F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.505636159.0000000002692000.00000040.00000001.sdmp, Offset: 02692000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60798d4b5efaf86ce4afa824b95b175f26b662e0c6bc3271edce0dbae5aa0edc
Instruction ID: ef3c7264e69e2df248437e1f311918512b3f8d42bd86384a8805c18eb99db197
Opcode Fuzzy Hash: 60798d4b5efaf86ce4afa824b95b175f26b662e0c6bc3271edce0dbae5aa0edc
Instruction Fuzzy Hash: 0CD05E79205A815FD7268A1CD1B8B953B98AB62B08F4644FDEC008B763C768D5D1D600

Uniqueness

Uniqueness Score: -1.00%

Function 026923BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.505636159.0000000002692000.00000040.00000001.sdmp, Offset: 02692000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b0d5d0f61f74e98788dc5a139ffb83419ddf4a0dc383af7814c47e1ef86d7b7
Instruction ID: d8f37bba220ea4871b28feef7ffee0253de9eadfa7141b66c633b001e73289ba
Opcode Fuzzy Hash: 7b0d5d0f61f74e98788dc5a139ffb83419ddf4a0dc383af7814c47e1ef86d7b7
Instruction Fuzzy Hash: 6CD05E342002814BCB25DB0CC1E4F5937D8AB81B04F0644FDAC008B362CBA4D8C1C600

Uniqueness

Uniqueness Score: -1.00%

Function 063D6528, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.512837674.00000000063D0000.00000040.00000001.sdmp, Offset: 063D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a76a26e45e331958c5019c5e8b47600eef87411a09f559d617075d481b4813e
Instruction ID: 020a7bd8ad00a2f8fed30b9fd845034b0c5e5ef7f3a6772ab64d2a48523df12c
Opcode Fuzzy Hash: 1a76a26e45e331958c5019c5e8b47600eef87411a09f559d617075d481b4813e
Instruction Fuzzy Hash: F7D012A140D3926FCF13473194186633FA42F03145B0944DAD0C1C9093C66AE489E361

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report QRN-CLJC-06112020149.PDF.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

SMTP Packets

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre