Loading ...

Play interactive tourEdit tour

Analysis Report QRP-57843552.exe

Overview

General Information

Sample Name:QRP-57843552.exe
Analysis ID:339036
MD5:7da0fbd98ffd79125bc0373fe2e0c508
SHA1:97fbd05a865e216f1fba898602a15d9bb02b7e13
SHA256:c7ccb3ceba2173fcd6839e02a2e11abd7d32bd39b932ed74dcf389535be818f6
Tags:AgentTeslaexe

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Yara detected AgentTesla
Yara detected AntiVM_3
.NET source code contains very large array initializations
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • QRP-57843552.exe (PID: 4628 cmdline: 'C:\Users\user\Desktop\QRP-57843552.exe' MD5: 7DA0FBD98FFD79125BC0373FE2E0C508)
    • schtasks.exe (PID: 4584 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\UWFDvz' /XML 'C:\Users\user\AppData\Local\Temp\tmp19EB.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 4536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • QRP-57843552.exe (PID: 5724 cmdline: {path} MD5: 7DA0FBD98FFD79125BC0373FE2E0C508)
    • QRP-57843552.exe (PID: 5640 cmdline: {path} MD5: 7DA0FBD98FFD79125BC0373FE2E0C508)
    • QRP-57843552.exe (PID: 2076 cmdline: {path} MD5: 7DA0FBD98FFD79125BC0373FE2E0C508)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000002.708065889.00000000034DC000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000000.00000002.366535440.00000000044BE000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000000.00000002.358136683.0000000002AE1000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
        00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
          00000005.00000002.704749590.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 4 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            5.2.QRP-57843552.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

              Sigma Overview

              System Summary:

              barindex
              Sigma detected: Scheduled temp file as task from temp locationShow sources
              Source: Process startedAuthor: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\UWFDvz' /XML 'C:\Users\user\AppData\Local\Temp\tmp19EB.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\UWFDvz' /XML 'C:\Users\user\AppData\Local\Temp\tmp19EB.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\QRP-57843552.exe' , ParentImage: C:\Users\user\Desktop\QRP-57843552.exe, ParentProcessId: 4628, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\UWFDvz' /XML 'C:\Users\user\AppData\Local\Temp\tmp19EB.tmp', ProcessId: 4584

              Signature Overview

              Click to jump to signature section

              Show All Signature Results

              AV Detection:

              barindex
              Multi AV Scanner detection for dropped fileShow sources
              Source: C:\Users\user\AppData\Roaming\UWFDvz.exeReversingLabs: Detection: 42%
              Multi AV Scanner detection for submitted fileShow sources
              Source: QRP-57843552.exeVirustotal: Detection: 45%Perma Link
              Source: QRP-57843552.exeReversingLabs: Detection: 42%
              Machine Learning detection for dropped fileShow sources
              Source: C:\Users\user\AppData\Roaming\UWFDvz.exeJoe Sandbox ML: detected
              Machine Learning detection for sampleShow sources
              Source: QRP-57843552.exeJoe Sandbox ML: detected
              Source: 5.2.QRP-57843552.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
              Source: 0.2.QRP-57843552.exe.520000.0.unpackAvira: Label: TR/Crypt.XPACK.Gen2

              Compliance:

              barindex
              Detected unpacking (overwrites its own PE header)Show sources
              Source: C:\Users\user\Desktop\QRP-57843552.exeUnpacked PE file: 0.2.QRP-57843552.exe.520000.0.unpack
              Source: QRP-57843552.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
              Source: QRP-57843552.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
              Source: QRP-57843552.exe, 00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
              Source: QRP-57843552.exe, 00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
              Source: QRP-57843552.exe, 00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmpString found in binary or memory: http://LAucWZ.com
              Source: QRP-57843552.exe, 00000000.00000003.335080210.0000000007E2B000.00000004.00000001.sdmpString found in binary or memory: http://en.wikipO3
              Source: QRP-57843552.exe, 00000000.00000003.332794815.0000000007E55000.00000004.00000001.sdmp, QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmp, QRP-57843552.exe, 00000005.00000002.707936279.00000000034C2000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
              Source: QRP-57843552.exe, 00000000.00000003.335023621.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com
              Source: QRP-57843552.exe, 00000000.00000003.334948111.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com$V_h
              Source: QRP-57843552.exe, 00000000.00000003.334915296.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com.n
              Source: QRP-57843552.exe, 00000000.00000003.335023621.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comTCx
              Source: QRP-57843552.exe, 00000000.00000003.334777327.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comh
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
              Source: QRP-57843552.exe, 00000000.00000003.334777327.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.como.n
              Source: QRP-57843552.exe, 00000000.00000003.334948111.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comueb
              Source: QRP-57843552.exe, 00000000.00000003.334948111.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comx
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
              Source: QRP-57843552.exe, 00000000.00000003.355904269.0000000007E20000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comasom
              Source: QRP-57843552.exe, 00000000.00000003.338723745.0000000007E2A000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comd
              Source: QRP-57843552.exe, 00000000.00000003.332511872.0000000007E55000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
              Source: QRP-57843552.exe, 00000000.00000003.334185618.0000000007E2B000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
              Source: QRP-57843552.exe, 00000000.00000003.334622662.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/
              Source: QRP-57843552.exe, 00000000.00000003.334405269.0000000007E4E000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/$j
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
              Source: QRP-57843552.exe, 00000000.00000003.334275061.0000000007E4F000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnL
              Source: QRP-57843552.exe, 00000000.00000003.334185618.0000000007E2B000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnv-s
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
              Source: QRP-57843552.exe, 00000000.00000003.335299369.0000000007E23000.00000004.00000001.sdmp, QRP-57843552.exe, 00000000.00000003.335599789.0000000007E27000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
              Source: QRP-57843552.exe, 00000000.00000003.336005803.0000000007E28000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/(
              Source: QRP-57843552.exe, 00000000.00000003.335299369.0000000007E23000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/-ca
              Source: QRP-57843552.exe, 00000000.00000003.336005803.0000000007E28000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/3
              Source: QRP-57843552.exe, 00000000.00000003.335299369.0000000007E23000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/M
              Source: QRP-57843552.exe, 00000000.00000003.335820810.0000000007E2A000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0/3
              Source: QRP-57843552.exe, 00000000.00000003.335599789.0000000007E27000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/e0
              Source: QRP-57843552.exe, 00000000.00000003.335599789.0000000007E27000.00000004.00000001.sdmp, QRP-57843552.exe, 00000000.00000003.336005803.0000000007E28000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
              Source: QRP-57843552.exe, 00000000.00000003.336005803.0000000007E28000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/M
              Source: QRP-57843552.exe, 00000000.00000003.336005803.0000000007E28000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/of(
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
              Source: QRP-57843552.exe, 00000000.00000003.334566180.0000000007E4E000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comi
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
              Source: QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
              Source: QRP-57843552.exe, 00000000.00000003.334845139.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cno.
              Source: QRP-57843552.exe, 00000000.00000003.334845139.0000000007E50000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cnx
              Source: QRP-57843552.exe, 00000005.00000002.707936279.00000000034C2000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org
              Source: QRP-57843552.exe, 00000005.00000002.707936279.00000000034C2000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org/
              Source: QRP-57843552.exe, 00000005.00000002.707936279.00000000034C2000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org4
              Source: QRP-57843552.exe, 00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.orgGETMozilla/5.0
              Source: QRP-57843552.exe, 00000000.00000002.366535440.00000000044BE000.00000004.00000001.sdmp, QRP-57843552.exe, 00000005.00000002.704749590.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/
              Source: QRP-57843552.exe, 00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
              Source: QRP-57843552.exe, 00000000.00000002.366535440.00000000044BE000.00000004.00000001.sdmp, QRP-57843552.exe, 00000005.00000002.704749590.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
              Source: QRP-57843552.exe, 00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

              Key, Mouse, Clipboard, Microphone and Screen Capturing:

              barindex
              Installs a global keyboard hookShow sources
              Source: C:\Users\user\Desktop\QRP-57843552.exeWindows user hook set: 0 keyboard low level C:\Users\user\Desktop\QRP-57843552.exeJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior

              System Summary:

              barindex
              .NET source code contains very large array initializationsShow sources
              Source: 5.2.QRP-57843552.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bFD76F4A7u002dBD02u002d46B4u002d982Bu002d6679466F04DCu007d/u00369EA8EE0u002dDC3Bu002d4A0Fu002d8799u002d06D648F82B11.csLarge array initialization: .cctor: array initializer size 11825
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_09EE37E00_2_09EE37E0
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_09EE16C90_2_09EE16C9
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_09EE17B80_2_09EE17B8
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_09EE40000_2_09EE4000
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_032346A05_2_032346A0
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_032346725_2_03234672
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_032346525_2_03234652
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_032346905_2_03234690
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_05FE75405_2_05FE7540
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_05FE94F85_2_05FE94F8
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_05FE6C705_2_05FE6C70
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_05FE69285_2_05FE6928
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_0665CF185_2_0665CF18
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_066583545_2_06658354
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_05FE25315_2_05FE2531
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_05FE26805_2_05FE2680
              Source: QRP-57843552.exeBinary or memory string: OriginalFilename vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000000.00000000.328554084.0000000000522000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameF vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000000.00000002.370426593.00000000098B0000.00000002.00000001.sdmpBinary or memory string: originalfilename vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000000.00000002.370426593.00000000098B0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000000.00000002.366535440.00000000044BE000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameAssemblyReferenceEntry.exeD vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000000.00000002.366535440.00000000044BE000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameayFuqEWmvNAHmAlzKQKEIyhuEgCdlLwcgzfPvP.exe4 vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000000.00000002.370366227.0000000009860000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000000.00000002.371240106.0000000009EF0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000000.00000002.358136683.0000000002AE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameTypeLibImporterFlags.dll4 vs QRP-57843552.exe
              Source: QRP-57843552.exeBinary or memory string: OriginalFilename vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000003.00000000.352649188.00000000001C2000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameF vs QRP-57843552.exe
              Source: QRP-57843552.exeBinary or memory string: OriginalFilename vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000004.00000000.353964684.0000000000392000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameF vs QRP-57843552.exe
              Source: QRP-57843552.exeBinary or memory string: OriginalFilename vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000005.00000002.704847164.0000000000438000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameayFuqEWmvNAHmAlzKQKEIyhuEgCdlLwcgzfPvP.exe4 vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000005.00000002.712320384.0000000007490000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000005.00000002.705432399.00000000014F8000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs QRP-57843552.exe
              Source: QRP-57843552.exe, 00000005.00000002.704879740.0000000000FD2000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameF vs QRP-57843552.exe
              Source: QRP-57843552.exeBinary or memory string: OriginalFilenameF vs QRP-57843552.exe
              Source: QRP-57843552.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
              Source: QRP-57843552.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: UWFDvz.exe.0.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: 5.2.QRP-57843552.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: 5.2.QRP-57843552.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@10/3@0/0
              Source: C:\Users\user\Desktop\QRP-57843552.exeFile created: C:\Users\user\AppData\Roaming\UWFDvz.exeJump to behavior
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4536:120:WilError_01
              Source: C:\Users\user\Desktop\QRP-57843552.exeFile created: C:\Users\user\AppData\Local\Temp\tmp19EB.tmpJump to behavior
              Source: QRP-57843552.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\Desktop\QRP-57843552.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\QRP-57843552.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: QRP-57843552.exeVirustotal: Detection: 45%
              Source: QRP-57843552.exeReversingLabs: Detection: 42%
              Source: C:\Users\user\Desktop\QRP-57843552.exeFile read: C:\Users\user\Desktop\QRP-57843552.exeJump to behavior
              Source: unknownProcess created: C:\Users\user\Desktop\QRP-57843552.exe 'C:\Users\user\Desktop\QRP-57843552.exe'
              Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\UWFDvz' /XML 'C:\Users\user\AppData\Local\Temp\tmp19EB.tmp'
              Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: unknownProcess created: C:\Users\user\Desktop\QRP-57843552.exe {path}
              Source: unknownProcess created: C:\Users\user\Desktop\QRP-57843552.exe {path}
              Source: unknownProcess created: C:\Users\user\Desktop\QRP-57843552.exe {path}
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\UWFDvz' /XML 'C:\Users\user\AppData\Local\Temp\tmp19EB.tmp'Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess created: C:\Users\user\Desktop\QRP-57843552.exe {path}Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess created: C:\Users\user\Desktop\QRP-57843552.exe {path}Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess created: C:\Users\user\Desktop\QRP-57843552.exe {path}Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: QRP-57843552.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
              Source: QRP-57843552.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
              Source: QRP-57843552.exeStatic file information: File size 1074688 > 1048576
              Source: QRP-57843552.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x105a00
              Source: QRP-57843552.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

              Data Obfuscation:

              barindex
              Detected unpacking (changes PE section rights)Show sources
              Source: C:\Users\user\Desktop\QRP-57843552.exeUnpacked PE file: 0.2.QRP-57843552.exe.520000.0.unpack .text:ER;.rsrc:R;.reloc:R; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;
              Detected unpacking (overwrites its own PE header)Show sources
              Source: C:\Users\user\Desktop\QRP-57843552.exeUnpacked PE file: 0.2.QRP-57843552.exe.520000.0.unpack
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_0052304E push es; retf 0_2_0052306F
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_00527331 push edx; retf 0_2_00527332
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_00526CCB push ebx; iretd 0_2_00526CD9
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_005221CF push eax; iretd 0_2_005221E1
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_00524D82 push es; retf 0_2_00524D93
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_09AA01BA push FFFFFFB4h; iretd 0_2_09AA01D3
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_09AA01FC pushad ; retf 0_2_09AA01FD
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_09AA2B67 pushad ; retf 0_2_09AA2B68
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 0_2_09AA3270 pushad ; retf 0_2_09AA3275
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 3_2_001C7331 push edx; retf 3_2_001C7332
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 3_2_001C304E push es; retf 3_2_001C306F
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 3_2_001C4D82 push es; retf 3_2_001C4D93
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 3_2_001C21CF push eax; iretd 3_2_001C21E1
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 3_2_001C6CCB push ebx; iretd 3_2_001C6CD9
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 4_2_00397331 push edx; retf 4_2_00397332
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 4_2_0039304E push es; retf 4_2_0039306F
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 4_2_00394D82 push es; retf 4_2_00394D93
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 4_2_00396CCB push ebx; iretd 4_2_00396CD9
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 4_2_003921CF push eax; iretd 4_2_003921E1
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_00FD21CF push eax; iretd 5_2_00FD21E1
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_00FD6CCB push ebx; iretd 5_2_00FD6CD9
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_00FD4D82 push es; retf 5_2_00FD4D93
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_00FD304E push es; retf 5_2_00FD306F
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_00FD7331 push edx; retf 5_2_00FD7332
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_05FED50A pushad ; retf 5_2_05FED531
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_066580C1 pushad ; retf 0006h5_2_066580C2
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_066580CB pushad ; retf 0006h5_2_066580EA
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_06658128 pushad ; retf 0006h5_2_0665812A
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_06656D71 push ebp; retf 0006h5_2_06656D72
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_06656A51 push edx; retf 0006h5_2_06656A52
              Source: C:\Users\user\Desktop\QRP-57843552.exeCode function: 5_2_06656A31 push ecx; retf 0006h5_2_06656A32
              Source: initial sampleStatic PE information: section name: .text entropy: 7.4437243106
              Source: initial sampleStatic PE information: section name: .text entropy: 7.4437243106
              Source: C:\Users\user\Desktop\QRP-57843552.exeFile created: C:\Users\user\AppData\Roaming\UWFDvz.exeJump to dropped file

              Boot Survival:

              barindex
              Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
              Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\UWFDvz' /XML 'C:\Users\user\AppData\Local\Temp\tmp19EB.tmp'
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion:

              barindex
              Yara detected AntiVM_3Show sources
              Source: Yara matchFile source: 00000000.00000002.358136683.0000000002AE1000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: QRP-57843552.exe PID: 4628, type: MEMORY
              Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
              Source: C:\Users\user\Desktop\QRP-57843552.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
              Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
              Source: C:\Users\user\Desktop\QRP-57843552.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
              Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
              Source: C:\Users\user\Desktop\QRP-57843552.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeWindow / User API: threadDelayed 2925Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeWindow / User API: threadDelayed 6923Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exe TID: 4652Thread sleep time: -31500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exe TID: 4692Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exe TID: 6640Thread sleep time: -15679732462653109s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exe TID: 6648Thread sleep count: 2925 > 30Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exe TID: 6648Thread sleep count: 6923 > 30Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: VMware
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: vmware
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: l%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: VMWARE
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: VMware
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
              Source: QRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmpBinary or memory string: l"SOFTWARE\VMware, Inc.\VMware Tools
              Source: QRP-57843552.exe, 00000005.00000002.705805245.00000000015E1000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeMemory allocated: page read and write | page guardJump to behavior

              HIPS / PFW / Operating System Protection Evasion:

              barindex
              Injects a PE file into a foreign processesShow sources
              Source: C:\Users\user\Desktop\QRP-57843552.exeMemory written: C:\Users\user\Desktop\QRP-57843552.exe base: 400000 value starts with: 4D5AJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\UWFDvz' /XML 'C:\Users\user\AppData\Local\Temp\tmp19EB.tmp'Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess created: C:\Users\user\Desktop\QRP-57843552.exe {path}Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess created: C:\Users\user\Desktop\QRP-57843552.exe {path}Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeProcess created: C:\Users\user\Desktop\QRP-57843552.exe {path}Jump to behavior
              Source: QRP-57843552.exe, 00000005.00000002.706711102.0000000001E10000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
              Source: QRP-57843552.exe, 00000005.00000002.706711102.0000000001E10000.00000002.00000001.sdmpBinary or memory string: Progman
              Source: QRP-57843552.exe, 00000005.00000002.706711102.0000000001E10000.00000002.00000001.sdmpBinary or memory string: &Program Manager
              Source: QRP-57843552.exe, 00000005.00000002.706711102.0000000001E10000.00000002.00000001.sdmpBinary or memory string: Progmanlock
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Users\user\Desktop\QRP-57843552.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Users\user\Desktop\QRP-57843552.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Stealing of Sensitive Information:

              barindex
              Yara detected AgentTeslaShow sources
              Source: Yara matchFile source: 00000005.00000002.708065889.00000000034DC000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.366535440.00000000044BE000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000002.704749590.0000000000402000.00000040.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: QRP-57843552.exe PID: 4628, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: QRP-57843552.exe PID: 2076, type: MEMORY
              Source: Yara matchFile source: 5.2.QRP-57843552.exe.400000.0.unpack, type: UNPACKEDPE
              Tries to harvest and steal browser information (history, passwords, etc)Show sources
              Source: C:\Users\user\Desktop\QRP-57843552.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
              Tries to steal Mail credentials (via file access)Show sources
              Source: C:\Users\user\Desktop\QRP-57843552.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: C:\Users\user\Desktop\QRP-57843552.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
              Source: Yara matchFile source: 00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: QRP-57843552.exe PID: 2076, type: MEMORY

              Remote Access Functionality:

              barindex
              Yara detected AgentTeslaShow sources
              Source: Yara matchFile source: 00000005.00000002.708065889.00000000034DC000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.366535440.00000000044BE000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000002.704749590.0000000000402000.00000040.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: QRP-57843552.exe PID: 4628, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: QRP-57843552.exe PID: 2076, type: MEMORY
              Source: Yara matchFile source: 5.2.QRP-57843552.exe.400000.0.unpack, type: UNPACKEDPE

              Mitre Att&ck Matrix

              Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
              Valid AccountsWindows Management Instrumentation211Scheduled Task/Job1Process Injection112Masquerading1OS Credential Dumping1Security Software Discovery321Remote ServicesEmail Collection1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
              Default AccountsScheduled Task/Job1Boot or Logon Initialization ScriptsScheduled Task/Job1Virtualization/Sandbox Evasion14Input Capture11Virtualization/Sandbox Evasion14Remote Desktop ProtocolInput Capture11Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
              Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Disable or Modify Tools1Security Account ManagerProcess Discovery2SMB/Windows Admin SharesArchive Collected Data11Automated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
              Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection112NTDSApplication Window Discovery1Distributed Component Object ModelData from Local System1Scheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
              Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information1LSA SecretsFile and Directory Discovery1SSHClipboard Data1Data Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
              Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information2Cached Domain CredentialsSystem Information Discovery114VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
              External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing23DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.

              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              QRP-57843552.exe45%VirustotalBrowse
              QRP-57843552.exe43%ReversingLabsWin32.Trojan.AgentTesla
              QRP-57843552.exe100%Joe Sandbox ML

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\Users\user\AppData\Roaming\UWFDvz.exe100%Joe Sandbox ML
              C:\Users\user\AppData\Roaming\UWFDvz.exe43%ReversingLabsWin32.Trojan.AgentTesla

              Unpacked PE Files

              SourceDetectionScannerLabelLinkDownload
              5.2.QRP-57843552.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File
              0.2.QRP-57843552.exe.520000.0.unpack100%AviraTR/Crypt.XPACK.Gen2Download File

              Domains

              No Antivirus matches

              URLs

              SourceDetectionScannerLabelLink
              http://www.carterandcone.comueb0%Avira URL Cloudsafe
              http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
              http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
              http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
              http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
              http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
              http://www.founder.com.cn/cnL0%Avira URL Cloudsafe
              http://www.founder.com.cn/cnv-s0%Avira URL Cloudsafe
              http://www.jiyu-kobo.co.jp/jp/M0%Avira URL Cloudsafe
              http://www.tiro.com0%URL Reputationsafe
              http://www.tiro.com0%URL Reputationsafe
              http://www.tiro.com0%URL Reputationsafe
              http://www.goodfont.co.kr0%URL Reputationsafe
              http://www.goodfont.co.kr0%URL Reputationsafe
              http://www.goodfont.co.kr0%URL Reputationsafe
              http://www.carterandcone.com0%URL Reputationsafe
              http://www.carterandcone.com0%URL Reputationsafe
              http://www.carterandcone.com0%URL Reputationsafe
              https://api.ipify.orgGETMozilla/5.00%URL Reputationsafe
              https://api.ipify.orgGETMozilla/5.00%URL Reputationsafe
              https://api.ipify.orgGETMozilla/5.00%URL Reputationsafe
              http://www.sajatypeworks.com0%URL Reputationsafe
              http://www.sajatypeworks.com0%URL Reputationsafe
              http://www.sajatypeworks.com0%URL Reputationsafe
              http://www.typography.netD0%URL Reputationsafe
              http://www.typography.netD0%URL Reputationsafe
              http://www.typography.netD0%URL Reputationsafe
              http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
              http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
              http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
              http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
              http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
              http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
              http://fontfabrik.com0%URL Reputationsafe
              http://fontfabrik.com0%URL Reputationsafe
              http://fontfabrik.com0%URL Reputationsafe
              http://www.carterandcone.como.n0%Avira URL Cloudsafe
              http://www.jiyu-kobo.co.jp/e00%Avira URL Cloudsafe
              http://www.jiyu-kobo.co.jp/-ca0%Avira URL Cloudsafe
              http://en.wikipO30%Avira URL Cloudsafe
              http://www.jiyu-kobo.co.jp/30%Avira URL Cloudsafe
              http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
              http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
              http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
              http://www.jiyu-kobo.co.jp/(0%URL Reputationsafe
              http://www.jiyu-kobo.co.jp/(0%URL Reputationsafe
              http://www.jiyu-kobo.co.jp/(0%URL Reputationsafe
              http://www.sandoll.co.kr0%URL Reputationsafe
              http://www.sandoll.co.kr0%URL Reputationsafe
              http://www.sandoll.co.kr0%URL Reputationsafe
              http://www.urwpp.deDPlease0%URL Reputationsafe
              http://www.urwpp.deDPlease0%URL Reputationsafe
              http://www.urwpp.deDPlease0%URL Reputationsafe
              http://www.zhongyicts.com.cn0%URL Reputationsafe
              http://www.zhongyicts.com.cn0%URL Reputationsafe
              http://www.zhongyicts.com.cn0%URL Reputationsafe
              http://www.sakkal.com0%URL Reputationsafe
              http://www.sakkal.com0%URL Reputationsafe
              http://www.sakkal.com0%URL Reputationsafe
              https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
              https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
              https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
              http://www.jiyu-kobo.co.jp/of(0%Avira URL Cloudsafe
              http://DynDns.comDynDNS0%URL Reputationsafe
              http://DynDns.comDynDNS0%URL Reputationsafe
              http://DynDns.comDynDNS0%URL Reputationsafe
              https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
              https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
              https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
              http://www.zhongyicts.com.cnx0%Avira URL Cloudsafe
              https://api.ipify.org40%Avira URL Cloudsafe
              http://www.jiyu-kobo.co.jp/M0%Avira URL Cloudsafe
              http://www.carterandcone.com$V_h0%Avira URL Cloudsafe
              http://www.founder.com.cn/cn/$j0%Avira URL Cloudsafe
              http://www.carterandcone.com.n0%Avira URL Cloudsafe
              http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
              http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
              http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
              http://www.carterandcone.comh0%Avira URL Cloudsafe
              http://www.fontbureau.comd0%URL Reputationsafe
              http://www.fontbureau.comd0%URL Reputationsafe
              http://www.fontbureau.comd0%URL Reputationsafe
              http://www.carterandcone.coml0%URL Reputationsafe
              http://www.carterandcone.coml0%URL Reputationsafe
              http://www.carterandcone.coml0%URL Reputationsafe
              http://www.founder.com.cn/cn/0%URL Reputationsafe
              http://www.founder.com.cn/cn/0%URL Reputationsafe
              http://www.founder.com.cn/cn/0%URL Reputationsafe
              http://www.founder.com.cn/cn0%URL Reputationsafe
              http://www.founder.com.cn/cn0%URL Reputationsafe
              http://www.founder.com.cn/cn0%URL Reputationsafe
              http://www.carterandcone.comTCx0%Avira URL Cloudsafe
              http://www.carterandcone.comx0%Avira URL Cloudsafe
              http://www.fontbureau.comasom0%Avira URL Cloudsafe
              http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
              http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
              http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
              http://www.zhongyicts.com.cno.0%URL Reputationsafe
              http://www.zhongyicts.com.cno.0%URL Reputationsafe
              http://www.zhongyicts.com.cno.0%URL Reputationsafe

              Domains and IPs

              Contacted Domains

              No contacted domains info

              URLs from Memory and Binaries

              NameSourceMaliciousAntivirus DetectionReputation
              http://www.carterandcone.comuebQRP-57843552.exe, 00000000.00000003.334948111.0000000007E50000.00000004.00000001.sdmpfalse
              • Avira URL Cloud: safe
              unknown
              http://127.0.0.1:HTTP/1.1QRP-57843552.exe, 00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmpfalse
              • Avira URL Cloud: safe
              low
              http://www.fontbureau.com/designersGQRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                high
                http://www.fontbureau.com/designers/?QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                  high
                  http://www.founder.com.cn/cn/bTheQRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  unknown
                  http://www.founder.com.cn/cnLQRP-57843552.exe, 00000000.00000003.334275061.0000000007E4F000.00000004.00000001.sdmpfalse
                  • Avira URL Cloud: safe
                  unknown
                  http://www.fontbureau.com/designers?QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                    high
                    http://www.founder.com.cn/cnv-sQRP-57843552.exe, 00000000.00000003.334185618.0000000007E2B000.00000004.00000001.sdmpfalse
                    • Avira URL Cloud: safe
                    unknown
                    http://www.jiyu-kobo.co.jp/jp/MQRP-57843552.exe, 00000000.00000003.336005803.0000000007E28000.00000004.00000001.sdmpfalse
                    • Avira URL Cloud: safe
                    unknown
                    http://www.tiro.comQRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    http://www.fontbureau.com/designersQRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                      high
                      http://www.goodfont.co.krQRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      http://www.carterandcone.comQRP-57843552.exe, 00000000.00000003.335023621.0000000007E50000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      https://api.ipify.orgGETMozilla/5.0QRP-57843552.exe, 00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      http://www.sajatypeworks.comQRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      http://www.typography.netDQRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      http://www.founder.com.cn/cn/cTheQRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      http://www.galapagosdesign.com/staff/dennis.htmQRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      https://api.ipify.orgQRP-57843552.exe, 00000005.00000002.707936279.00000000034C2000.00000004.00000001.sdmpfalse
                        high
                        http://fontfabrik.comQRP-57843552.exe, 00000000.00000003.332794815.0000000007E55000.00000004.00000001.sdmp, QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        unknown
                        http://www.carterandcone.como.nQRP-57843552.exe, 00000000.00000003.334777327.0000000007E50000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://www.jiyu-kobo.co.jp/e0QRP-57843552.exe, 00000000.00000003.335599789.0000000007E27000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://www.jiyu-kobo.co.jp/-caQRP-57843552.exe, 00000000.00000003.335299369.0000000007E23000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://en.wikipO3QRP-57843552.exe, 00000000.00000003.335080210.0000000007E2B000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://www.jiyu-kobo.co.jp/3QRP-57843552.exe, 00000000.00000003.336005803.0000000007E28000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://www.galapagosdesign.com/DPleaseQRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        unknown
                        http://www.jiyu-kobo.co.jp/(QRP-57843552.exe, 00000000.00000003.336005803.0000000007E28000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        unknown
                        http://www.fonts.comQRP-57843552.exe, 00000000.00000003.332511872.0000000007E55000.00000004.00000001.sdmpfalse
                          high
                          http://www.sandoll.co.krQRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          unknown
                          http://www.urwpp.deDPleaseQRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          unknown
                          http://www.zhongyicts.com.cnQRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          unknown
                          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameQRP-57843552.exe, 00000000.00000002.359782500.0000000002C65000.00000004.00000001.sdmp, QRP-57843552.exe, 00000005.00000002.707936279.00000000034C2000.00000004.00000001.sdmpfalse
                            high
                            http://www.sakkal.comQRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            unknown
                            https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zipQRP-57843552.exe, 00000000.00000002.366535440.00000000044BE000.00000004.00000001.sdmp, QRP-57843552.exe, 00000005.00000002.704749590.0000000000402000.00000040.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            unknown
                            http://www.jiyu-kobo.co.jp/of(QRP-57843552.exe, 00000000.00000003.336005803.0000000007E28000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            unknown
                            https://api.ipify.org/QRP-57843552.exe, 00000005.00000002.707936279.00000000034C2000.00000004.00000001.sdmpfalse
                              high
                              http://www.apache.org/licenses/LICENSE-2.0QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                                high
                                http://www.fontbureau.comQRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                                  high
                                  http://DynDns.comDynDNSQRP-57843552.exe, 00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%haQRP-57843552.exe, 00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  http://www.zhongyicts.com.cnxQRP-57843552.exe, 00000000.00000003.334845139.0000000007E50000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  https://api.ipify.org4QRP-57843552.exe, 00000005.00000002.707936279.00000000034C2000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  http://www.jiyu-kobo.co.jp/MQRP-57843552.exe, 00000000.00000003.335299369.0000000007E23000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  http://www.carterandcone.com$V_hQRP-57843552.exe, 00000000.00000003.334948111.0000000007E50000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  low
                                  http://www.founder.com.cn/cn/$jQRP-57843552.exe, 00000000.00000003.334405269.0000000007E4E000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  http://www.carterandcone.com.nQRP-57843552.exe, 00000000.00000003.334915296.0000000007E50000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  http://www.jiyu-kobo.co.jp/jp/QRP-57843552.exe, 00000000.00000003.335599789.0000000007E27000.00000004.00000001.sdmp, QRP-57843552.exe, 00000000.00000003.336005803.0000000007E28000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  http://www.carterandcone.comhQRP-57843552.exe, 00000000.00000003.334777327.0000000007E50000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  http://www.fontbureau.comdQRP-57843552.exe, 00000000.00000003.338723745.0000000007E2A000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  http://www.carterandcone.comlQRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  http://www.founder.com.cn/cn/QRP-57843552.exe, 00000000.00000003.334622662.0000000007E50000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  http://www.fontbureau.com/designers/cabarga.htmlNQRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                                    high
                                    http://www.founder.com.cn/cnQRP-57843552.exe, 00000000.00000003.334185618.0000000007E2B000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    unknown
                                    http://www.fontbureau.com/designers/frere-jones.htmlQRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                                      high
                                      http://www.carterandcone.comTCxQRP-57843552.exe, 00000000.00000003.335023621.0000000007E50000.00000004.00000001.sdmpfalse
                                      • Avira URL Cloud: safe
                                      unknown
                                      https://api.telegram.org/bot%telegramapi%/QRP-57843552.exe, 00000000.00000002.366535440.00000000044BE000.00000004.00000001.sdmp, QRP-57843552.exe, 00000005.00000002.704749590.0000000000402000.00000040.00000001.sdmpfalse
                                        high
                                        http://www.carterandcone.comxQRP-57843552.exe, 00000000.00000003.334948111.0000000007E50000.00000004.00000001.sdmpfalse
                                        • Avira URL Cloud: safe
                                        unknown
                                        http://www.fontbureau.comasomQRP-57843552.exe, 00000000.00000003.355904269.0000000007E20000.00000004.00000001.sdmpfalse
                                        • Avira URL Cloud: safe
                                        unknown
                                        http://www.jiyu-kobo.co.jp/QRP-57843552.exe, 00000000.00000003.335299369.0000000007E23000.00000004.00000001.sdmp, QRP-57843552.exe, 00000000.00000003.335599789.0000000007E27000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        unknown
                                        http://www.zhongyicts.com.cno.QRP-57843552.exe, 00000000.00000003.334845139.0000000007E50000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        unknown
                                        http://www.fontbureau.com/designers8QRP-57843552.exe, 00000000.00000002.369860948.0000000009032000.00000004.00000001.sdmpfalse
                                          high
                                          http://www.jiyu-kobo.co.jp/Y0/3QRP-57843552.exe, 00000000.00000003.335820810.0000000007E2A000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          unknown
                                          http://LAucWZ.comQRP-57843552.exe, 00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          unknown
                                          http://www.tiro.comiQRP-57843552.exe, 00000000.00000003.334566180.0000000007E4E000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          unknown
                                          https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------xQRP-57843552.exe, 00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmpfalse
                                            high

                                            Contacted IPs

                                            No contacted IP infos

                                            General Information

                                            Joe Sandbox Version:31.0.0 Red Diamond
                                            Analysis ID:339036
                                            Start date:13.01.2021
                                            Start time:09:45:33
                                            Joe Sandbox Product:CloudBasic
                                            Overall analysis duration:0h 9m 50s
                                            Hypervisor based Inspection enabled:false
                                            Report type:full
                                            Sample file name:QRP-57843552.exe
                                            Cookbook file name:default.jbs
                                            Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                            Number of analysed new started processes analysed:29
                                            Number of new started drivers analysed:0
                                            Number of existing processes analysed:0
                                            Number of existing drivers analysed:0
                                            Number of injected processes analysed:0
                                            Technologies:
                                            • HCA enabled
                                            • EGA enabled
                                            • HDC enabled
                                            • AMSI enabled
                                            Analysis Mode:default
                                            Analysis stop reason:Timeout
                                            Detection:MAL
                                            Classification:mal100.troj.spyw.evad.winEXE@10/3@0/0
                                            EGA Information:Failed
                                            HDC Information:
                                            • Successful, ratio: 3.7% (good quality ratio 1.8%)
                                            • Quality average: 31.8%
                                            • Quality standard deviation: 37.6%
                                            HCA Information:
                                            • Successful, ratio: 96%
                                            • Number of executed functions: 92
                                            • Number of non-executed functions: 1
                                            Cookbook Comments:
                                            • Adjust boot time
                                            • Enable AMSI
                                            • Found application associated with file extension: .exe
                                            Warnings:
                                            Show All
                                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, HxTsr.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
                                            • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                            • Report size getting too big, too many NtQueryValueKey calls found.

                                            Simulations

                                            Behavior and APIs

                                            TimeTypeDescription
                                            09:46:31API Interceptor1067x Sleep call for process: QRP-57843552.exe modified

                                            Joe Sandbox View / Context

                                            IPs

                                            No context

                                            Domains

                                            No context

                                            ASN

                                            No context

                                            JA3 Fingerprints

                                            No context

                                            Dropped Files

                                            No context

                                            Created / dropped Files

                                            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QRP-57843552.exe.log
                                            Process:C:\Users\user\Desktop\QRP-57843552.exe
                                            File Type:ASCII text, with CRLF line terminators
                                            Category:dropped
                                            Size (bytes):1216
                                            Entropy (8bit):5.355304211458859
                                            Encrypted:false
                                            SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
                                            MD5:FED34146BF2F2FA59DCF8702FCC8232E
                                            SHA1:B03BFEA175989D989850CF06FE5E7BBF56EAA00A
                                            SHA-256:123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
                                            SHA-512:1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
                                            Malicious:true
                                            Reputation:high, very likely benign file
                                            Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21
                                            C:\Users\user\AppData\Local\Temp\tmp19EB.tmp
                                            Process:C:\Users\user\Desktop\QRP-57843552.exe
                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                            Category:dropped
                                            Size (bytes):1651
                                            Entropy (8bit):5.160635284664919
                                            Encrypted:false
                                            SSDEEP:24:2dH4+SEqC/S7h2ulNMFp2O/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKB3Ogtn:cbha7JlNQV/rydbz9I3YODOLNdq3c2
                                            MD5:B87E77452DB2830715D0F9F3A2BC970F
                                            SHA1:7B4E2B166A8076C0C8C6C201D016443B7EE52CC5
                                            SHA-256:092D79AED7EB1CA42929AA4775C7BD7DBD60DD1316928241AAEF8546472764B1
                                            SHA-512:8EFD202C582A6D951EF3AF58EA35C5E9AF1D974DD4D2185338D4683D9286AE1BAF2E29A7ECA9A97A289A7027973845576E21D6DDF9CDCAD3818AE32A7822AC4F
                                            Malicious:true
                                            Reputation:low
                                            Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvail
                                            C:\Users\user\AppData\Roaming\UWFDvz.exe
                                            Process:C:\Users\user\Desktop\QRP-57843552.exe
                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                            Category:dropped
                                            Size (bytes):1074688
                                            Entropy (8bit):7.436989234883893
                                            Encrypted:false
                                            SSDEEP:24576:CkCPqWRCEdJrn7Z9sWNASdnIRRh9/rAJug:SrAEbnnsWNA6nARh9AJ
                                            MD5:7DA0FBD98FFD79125BC0373FE2E0C508
                                            SHA1:97FBD05A865E216F1FBA898602A15D9BB02B7E13
                                            SHA-256:C7CCB3CEBA2173FCD6839E02A2E11ABD7D32BD39B932ED74DCF389535BE818F6
                                            SHA-512:85C32E69D9325933A17619EC30D538D8169401EC484C961C2280EF219CAA0813889F538F680CFD2CDFD3D19F50C27D20333EC2E2B9CDD957E93E0E277FB18772
                                            Malicious:true
                                            Antivirus:
                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                            • Antivirus: ReversingLabs, Detection: 43%
                                            Reputation:low
                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...d.._..............0..Z..........ny... ........@.. ....................................@..................................y..O.................................................................................... ............... ..H............text...tY... ...Z.................. ..`.rsrc................\..............@..@.reloc...............d..............@..B................Py......H.......(..................`M...........................................]..Q*....}.F.7.u...|...b6v]VW.iI$..Z<.....,..Y/..&....7^..\.T5.@S.Z.V..p..z...*%._..C<.|.....?.;..C.,p.l.G..70..#6.H.$..w.....R...J.V.......M...za.......y!.:.v.6....27...<]+.z}`.......l..L....../..*....pV/G....4..e..p'..<`[.7N.....\.u..x....0.0.......v.J....',...N,.L...x.(.4.w1a...z........P"=.7....+..pdv..I.....D*&?.. .,.....jd..;..e$z.._.*g..g..O>..#e_zw..H.4.....r..F!xfxf[.C..(..QP.$..n._

                                            Static File Info

                                            General

                                            File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                            Entropy (8bit):7.436989234883893
                                            TrID:
                                            • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                            • Win32 Executable (generic) a (10002005/4) 49.78%
                                            • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                            • Generic Win/DOS Executable (2004/3) 0.01%
                                            • DOS Executable Generic (2002/1) 0.01%
                                            File name:QRP-57843552.exe
                                            File size:1074688
                                            MD5:7da0fbd98ffd79125bc0373fe2e0c508
                                            SHA1:97fbd05a865e216f1fba898602a15d9bb02b7e13
                                            SHA256:c7ccb3ceba2173fcd6839e02a2e11abd7d32bd39b932ed74dcf389535be818f6
                                            SHA512:85c32e69d9325933a17619ec30d538d8169401ec484c961c2280ef219caa0813889f538f680cfd2cdfd3d19f50c27d20333ec2e2b9cdd957e93e0e277fb18772
                                            SSDEEP:24576:CkCPqWRCEdJrn7Z9sWNASdnIRRh9/rAJug:SrAEbnnsWNA6nARh9AJ
                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...d.._..............0..Z..........ny... ........@.. ....................................@................................

                                            File Icon

                                            Icon Hash:00828e8e8686b000

                                            Static PE Info

                                            General

                                            Entrypoint:0x50796e
                                            Entrypoint Section:.text
                                            Digitally signed:false
                                            Imagebase:0x400000
                                            Subsystem:windows gui
                                            Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                            DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                            Time Stamp:0x5FFDC464 [Tue Jan 12 15:46:44 2021 UTC]
                                            TLS Callbacks:
                                            CLR (.Net) Version:v4.0.30319
                                            OS Version Major:4
                                            OS Version Minor:0
                                            File Version Major:4
                                            File Version Minor:0
                                            Subsystem Version Major:4
                                            Subsystem Version Minor:0
                                            Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                            Entrypoint Preview

                                            Instruction
                                            jmp dword ptr [00402000h]
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al

                                            Data Directories

                                            NameVirtual AddressVirtual Size Is in Section
                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x10791c0x4f.text
                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x1080000x618.rsrc
                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x10a0000xc.reloc
                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                            Sections

                                            NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                            .text0x20000x1059740x105a00False0.756094533863data7.4437243106IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                            .rsrc0x1080000x6180x800False0.33349609375data3.50099411438IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                            .reloc0x10a0000xc0x200False0.044921875data0.0980041756627IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                            Resources

                                            NameRVASizeTypeLanguageCountry
                                            RT_VERSION0x1080a00x388data
                                            RT_MANIFEST0x1084280x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                            Imports

                                            DLLImport
                                            mscoree.dll_CorExeMain

                                            Version Infos

                                            DescriptionData
                                            Translation0x0000 0x04b0
                                            LegalCopyrightCopyright Overwolf 2011 - 2020
                                            Assembly Version2.159.0.0
                                            InternalName.exe
                                            FileVersion2.159.0.0
                                            CompanyNameOverwolf Ltd.
                                            LegalTrademarks
                                            CommentsOverwolf Launcher
                                            ProductNameOverwolfLauncher
                                            ProductVersion2.159.0.0
                                            FileDescriptionOverwolfLauncher
                                            OriginalFilename.exe

                                            Network Behavior

                                            No network behavior found

                                            Code Manipulations

                                            Statistics

                                            CPU Usage

                                            Click to jump to process

                                            Memory Usage

                                            Click to jump to process

                                            High Level Behavior Distribution

                                            Click to dive into process behavior distribution

                                            Behavior

                                            Click to jump to process

                                            System Behavior

                                            General

                                            Start time:09:46:24
                                            Start date:13/01/2021
                                            Path:C:\Users\user\Desktop\QRP-57843552.exe
                                            Wow64 process (32bit):true
                                            Commandline:'C:\Users\user\Desktop\QRP-57843552.exe'
                                            Imagebase:0x520000
                                            File size:1074688 bytes
                                            MD5 hash:7DA0FBD98FFD79125BC0373FE2E0C508
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:.Net C# or VB.NET
                                            Yara matches:
                                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.366535440.00000000044BE000.00000004.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.358136683.0000000002AE1000.00000004.00000001.sdmp, Author: Joe Security
                                            Reputation:low

                                            General

                                            Start time:09:46:34
                                            Start date:13/01/2021
                                            Path:C:\Windows\SysWOW64\schtasks.exe
                                            Wow64 process (32bit):true
                                            Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\UWFDvz' /XML 'C:\Users\user\AppData\Local\Temp\tmp19EB.tmp'
                                            Imagebase:0x1170000
                                            File size:185856 bytes
                                            MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high

                                            General

                                            Start time:09:46:34
                                            Start date:13/01/2021
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff61de10000
                                            File size:625664 bytes
                                            MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high

                                            General

                                            Start time:09:46:35
                                            Start date:13/01/2021
                                            Path:C:\Users\user\Desktop\QRP-57843552.exe
                                            Wow64 process (32bit):false
                                            Commandline:{path}
                                            Imagebase:0x1c0000
                                            File size:1074688 bytes
                                            MD5 hash:7DA0FBD98FFD79125BC0373FE2E0C508
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:low

                                            General

                                            Start time:09:46:35
                                            Start date:13/01/2021
                                            Path:C:\Users\user\Desktop\QRP-57843552.exe
                                            Wow64 process (32bit):false
                                            Commandline:{path}
                                            Imagebase:0x390000
                                            File size:1074688 bytes
                                            MD5 hash:7DA0FBD98FFD79125BC0373FE2E0C508
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:low

                                            General

                                            Start time:09:46:36
                                            Start date:13/01/2021
                                            Path:C:\Users\user\Desktop\QRP-57843552.exe
                                            Wow64 process (32bit):true
                                            Commandline:{path}
                                            Imagebase:0xfd0000
                                            File size:1074688 bytes
                                            MD5 hash:7DA0FBD98FFD79125BC0373FE2E0C508
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:.Net C# or VB.NET
                                            Yara matches:
                                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.708065889.00000000034DC000.00000004.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.707418145.0000000003411000.00000004.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.704749590.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                            Reputation:low

                                            Disassembly

                                            Code Analysis

                                            Reset < >

                                              Executed Functions

                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.371216272.0000000009EE0000.00000040.00000001.sdmp, Offset: 09EE0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID: (
                                              • API String ID: 0-3887548279
                                              • Opcode ID: 5b4e55ba44765420d3ad6dc1bcd156f97d3f85c9093b564a061b1e080631e59a
                                              • Instruction ID: 4493ca9ab2eaa024a3f39bff18de396daea3850303fbb7d79b55aad8015a8f32
                                              • Opcode Fuzzy Hash: 5b4e55ba44765420d3ad6dc1bcd156f97d3f85c9093b564a061b1e080631e59a
                                              • Instruction Fuzzy Hash: D072E4B0D09229CFDB64DF64C848BEDB6B5AB4A345F10A1EAC11EA7291DB744EC4CF41
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.371216272.0000000009EE0000.00000040.00000001.sdmp, Offset: 09EE0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID: (
                                              • API String ID: 0-3887548279
                                              • Opcode ID: b5ed16eaecb1ce6d61afe5d6d2ce5bd6b3e50680d4e47d56d71ba8292e121e4d
                                              • Instruction ID: 85169b0066ead81fd9496df6699a93ccb1191f41ab0d486550566ad8859d24d9
                                              • Opcode Fuzzy Hash: b5ed16eaecb1ce6d61afe5d6d2ce5bd6b3e50680d4e47d56d71ba8292e121e4d
                                              • Instruction Fuzzy Hash: BE62F2B0D09229CFDB64DF64C884BEDB6B5AB4A345F10A1EAD11EA7291DB704EC4CF41
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.371216272.0000000009EE0000.00000040.00000001.sdmp, Offset: 09EE0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 7f8fb189d3f7e078943e16a2dcf5e79eaa0590e57681ab10d711f6e696d5f82e
                                              • Instruction ID: b9b4ef7e8b86409294aff14845247d1460fffd727043c4c31218a50b30d99dba
                                              • Opcode Fuzzy Hash: 7f8fb189d3f7e078943e16a2dcf5e79eaa0590e57681ab10d711f6e696d5f82e
                                              • Instruction Fuzzy Hash: C9C18BB1B006009FE729EF65C8507AEB7FAEF89304F54546DE14A9B290DB35ED01CB62
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • CreateProcessW.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 09EE2924
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.371216272.0000000009EE0000.00000040.00000001.sdmp, Offset: 09EE0000, based on PE: false
                                              Similarity
                                              • API ID: CreateProcess
                                              • String ID:
                                              • API String ID: 963392458-0
                                              • Opcode ID: 2e32d7fb87eb99dcfb5f2b1115478d8a6362fd852b156bd2f08c3c47266622c6
                                              • Instruction ID: 8bfb75ffffe9b54645f46aedfdaaf1bbe7a96018849b252891bc5de58a5aaaea
                                              • Opcode Fuzzy Hash: 2e32d7fb87eb99dcfb5f2b1115478d8a6362fd852b156bd2f08c3c47266622c6
                                              • Instruction Fuzzy Hash: 1191F074D0426D8FDB21CFA4C880BEDBBB5BF49304F1491AAE509B7260DB309A89DF54
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • CreateProcessW.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 09EE2924
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.371216272.0000000009EE0000.00000040.00000001.sdmp, Offset: 09EE0000, based on PE: false
                                              Similarity
                                              • API ID: CreateProcess
                                              • String ID:
                                              • API String ID: 963392458-0
                                              • Opcode ID: 5d6f3c86b6e759cf828b03cd9f9a6442c9d91b23ab17bae738f80f260f9dcb77
                                              • Instruction ID: 9205aeb8358f02f3f90d5869fd3d2b13930f1a9531039ef6c311f8ae7be400cb
                                              • Opcode Fuzzy Hash: 5d6f3c86b6e759cf828b03cd9f9a6442c9d91b23ab17bae738f80f260f9dcb77
                                              • Instruction Fuzzy Hash: 9981E175C0426D9FDB20CFA5C880BDDBBB5AF49304F1091AAE509B7260DB309E89CF54
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 09EE2E96
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.371216272.0000000009EE0000.00000040.00000001.sdmp, Offset: 09EE0000, based on PE: false
                                              Similarity
                                              • API ID: MemoryProcessWrite
                                              • String ID:
                                              • API String ID: 3559483778-0
                                              • Opcode ID: 9c33de0a05e59cb8b47ba61370744e8389d04d12733714ff321634a02f84ad73
                                              • Instruction ID: ad5f1f43fcae98d0a3fee139f18ab287880932209b3c2d60a4c31e0d451f884c
                                              • Opcode Fuzzy Hash: 9c33de0a05e59cb8b47ba61370744e8389d04d12733714ff321634a02f84ad73
                                              • Instruction Fuzzy Hash: 244199B5D002589FCB00CFA9D984ADEFBF5BB49314F24902AE918B7310D375AA45CF64
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 09EE2E96
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.371216272.0000000009EE0000.00000040.00000001.sdmp, Offset: 09EE0000, based on PE: false
                                              Similarity
                                              • API ID: MemoryProcessWrite
                                              • String ID:
                                              • API String ID: 3559483778-0
                                              • Opcode ID: 4d733711f794b5cc1cd193e3310f53f8bc2860eb8e36cb8a4fa92803f980d8fe
                                              • Instruction ID: 7e49280fc5daedd862e6e48b15aaa678b6e8870ce66c30e926457daa232bd31d
                                              • Opcode Fuzzy Hash: 4d733711f794b5cc1cd193e3310f53f8bc2860eb8e36cb8a4fa92803f980d8fe
                                              • Instruction Fuzzy Hash: BF4175B5D002589FCB00CFA9D984ADEFBF5BB49314F24A02AE918B7310D375AA45CB64
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 09EE2C45
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.371216272.0000000009EE0000.00000040.00000001.sdmp, Offset: 09EE0000, based on PE: false
                                              Similarity
                                              • API ID: MemoryProcessRead
                                              • String ID:
                                              • API String ID: 1726664587-0
                                              • Opcode ID: d73c7f4a3af144f6be12c94ca0bfd6d28a89bbc67ba27e3a057a2643fbe313b9
                                              • Instruction ID: e3e8978b9143bf80bf8c0facba081d20da36d85d33ca7d057172135cfb005086
                                              • Opcode Fuzzy Hash: d73c7f4a3af144f6be12c94ca0bfd6d28a89bbc67ba27e3a057a2643fbe313b9
                                              • Instruction Fuzzy Hash: 3441ACB9D042589FCF10CFA9D984ADEFBB5BB59310F10902AE914B7310D335A946CF64
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 09EE2C45
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.371216272.0000000009EE0000.00000040.00000001.sdmp, Offset: 09EE0000, based on PE: false
                                              Similarity
                                              • API ID: MemoryProcessRead
                                              • String ID:
                                              • API String ID: 1726664587-0
                                              • Opcode ID: b0e9bf7b3997485658e14111a4a7f7c919a5408389ca1e0e61de6cf3f816e840
                                              • Instruction ID: 2f0d885b1bdead4b35eca3d2bc244b746cf9d561b95ffab68ca10681f52f8ad0
                                              • Opcode Fuzzy Hash: b0e9bf7b3997485658e14111a4a7f7c919a5408389ca1e0e61de6cf3f816e840
                                              • Instruction Fuzzy Hash: 764198B9D042589FCF10CFAAD984ADEFBB5BB19310F10A02AE914B7310D335A946CF64
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 09EE2D5D
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.371216272.0000000009EE0000.00000040.00000001.sdmp, Offset: 09EE0000, based on PE: false
                                              Similarity
                                              • API ID: AllocVirtual
                                              • String ID:
                                              • API String ID: 4275171209-0
                                              • Opcode ID: 8d20a1babf66aafc74d94dcbd6f5ea56eacc2f0df97aaa35cd7c13b8aad9371e
                                              • Instruction ID: 0623a6ac5b0215a71f37ab824e12e6037137098fa3cd35fd42958d72f7c342aa
                                              • Opcode Fuzzy Hash: 8d20a1babf66aafc74d94dcbd6f5ea56eacc2f0df97aaa35cd7c13b8aad9371e
                                              • Instruction Fuzzy Hash: 713198B9D002589FCF10CFA9D880ADEFBB5BB19310F10A02AE915B7310D375A946CF64
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 09EE2D5D
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.371216272.0000000009EE0000.00000040.00000001.sdmp, Offset: 09EE0000, based on PE: false
                                              Similarity
                                              • API ID: AllocVirtual
                                              • String ID:
                                              • API String ID: 4275171209-0
                                              • Opcode ID: 00fc64509d2786c2709d19d8bde2ff733a6b7359e90cd08bc64b0b7af98a3d55
                                              • Instruction ID: e5a2ccbec7666818f02591f1d4a046d8b9a586877f034846d4500fde11872deb
                                              • Opcode Fuzzy Hash: 00fc64509d2786c2709d19d8bde2ff733a6b7359e90cd08bc64b0b7af98a3d55
                                              • Instruction Fuzzy Hash: 9E3187B9D002589FCF10CFA9D880ADEFBB5BB19310F10A02AE914B7310D775A906CF64
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • SetThreadContext.KERNELBASE(?,?), ref: 09EE2B2A
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.371216272.0000000009EE0000.00000040.00000001.sdmp, Offset: 09EE0000, based on PE: false
                                              Similarity
                                              • API ID: ContextThread
                                              • String ID:
                                              • API String ID: 1591575202-0
                                              • Opcode ID: d1bb8afe39fa95ecae84c16ba624aece3d7ca31709c393c2e233261770f05651
                                              • Instruction ID: 0811f3227abec2188c2ee36e008b9d368fde8589b9b8d2e7f42f700f97fe0fdf
                                              • Opcode Fuzzy Hash: d1bb8afe39fa95ecae84c16ba624aece3d7ca31709c393c2e233261770f05651
                                              • Instruction Fuzzy Hash: F941BAB9D012589FCB14CFA9E884ADEFBF5BB49314F24902AE414B7310D778AA45CF64
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • PostMessageW.USER32(?,?,?,?), ref: 09EE3353
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.371216272.0000000009EE0000.00000040.00000001.sdmp, Offset: 09EE0000, based on PE: false
                                              Similarity
                                              • API ID: MessagePost
                                              • String ID:
                                              • API String ID: 410705778-0
                                              • Opcode ID: 6f62fb893f5fb0f4560f792e2853ea4d05f089a1f2e2ede2e6dd488c7b6c5fcf
                                              • Instruction ID: e579e90d1617ee36d0077376e8f9fc4a3ef2c24db9a70226eed77cbcb7a5d730
                                              • Opcode Fuzzy Hash: 6f62fb893f5fb0f4560f792e2853ea4d05f089a1f2e2ede2e6dd488c7b6c5fcf
                                              • Instruction Fuzzy Hash: F83178B9D05218AFCB10CF99E584ADEFBF4EB49320F24A01AE815B7310D775A945CFA4
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • SetThreadContext.KERNELBASE(?,?), ref: 09EE2B2A
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.371216272.0000000009EE0000.00000040.00000001.sdmp, Offset: 09EE0000, based on PE: false
                                              Similarity
                                              • API ID: ContextThread
                                              • String ID:
                                              • API String ID: 1591575202-0
                                              • Opcode ID: 39b680b31e04824c1d8da5626f40f4d545bb1f7cec31dce779334ccce202f9e4
                                              • Instruction ID: 9affef24ab100e809c0e8431e8cacd965a3fe06ba6fc81cc37e76942f72218d6
                                              • Opcode Fuzzy Hash: 39b680b31e04824c1d8da5626f40f4d545bb1f7cec31dce779334ccce202f9e4
                                              • Instruction Fuzzy Hash: 7031ABB5D012589FCB10CFA9D884ADEFBF5BB49314F24902AE414B7310D778AA45CF64
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • PostMessageW.USER32(?,?,?,?), ref: 09EE3353
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.371216272.0000000009EE0000.00000040.00000001.sdmp, Offset: 09EE0000, based on PE: false
                                              Similarity
                                              • API ID: MessagePost
                                              • String ID:
                                              • API String ID: 410705778-0
                                              • Opcode ID: a7fbf56039171a46fa2de1da63cef061ee3947c158745bce26a1af1b85f70d8d
                                              • Instruction ID: 2d8ad8c1222880241d716850ec3c7035e67f773101fedbc448f084e6a07fe6fc
                                              • Opcode Fuzzy Hash: a7fbf56039171a46fa2de1da63cef061ee3947c158745bce26a1af1b85f70d8d
                                              • Instruction Fuzzy Hash: 623187B9D00218AFCB10CFA9E484ADEFBF4BB49310F24A01AE825B7310D775A945CF64
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • ResumeThread.KERNELBASE(?), ref: 09EE2F86
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.371216272.0000000009EE0000.00000040.00000001.sdmp, Offset: 09EE0000, based on PE: false
                                              Similarity
                                              • API ID: ResumeThread
                                              • String ID:
                                              • API String ID: 947044025-0
                                              • Opcode ID: f3416261ff676d3e473323556dcd4e62e035b9050df431868bfe56c0e39bc093
                                              • Instruction ID: 3a34138bf15c67dbb897f67bcdc5c25000da6ae157835b9b3fceebc19ed2f91a
                                              • Opcode Fuzzy Hash: f3416261ff676d3e473323556dcd4e62e035b9050df431868bfe56c0e39bc093
                                              • Instruction Fuzzy Hash: 113189B9D042189FCB10CFA9E485ADEFBF4BB49324F24901AE915B3300D775A945CFA5
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • ResumeThread.KERNELBASE(?), ref: 09EE2F86
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.371216272.0000000009EE0000.00000040.00000001.sdmp, Offset: 09EE0000, based on PE: false
                                              Similarity
                                              • API ID: ResumeThread
                                              • String ID:
                                              • API String ID: 947044025-0
                                              • Opcode ID: 62b420daaee2d498209a004991f7fac344239a7233affcace130b426aa7db1bd
                                              • Instruction ID: 1c1d86d2a78a9dd8eb7e09d56be97bc037e12c4cae1f6c2e6f3430c991d3e172
                                              • Opcode Fuzzy Hash: 62b420daaee2d498209a004991f7fac344239a7233affcace130b426aa7db1bd
                                              • Instruction Fuzzy Hash: 482199B5D002189FCB10CFA9D484ADEFBF4BB49324F24901AE918B3300D775A945CFA4
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 54e460e1061ac63a3c83272203f118998f3828b70106f35dade5fbe3ebc73661
                                              • Instruction ID: 732e772abe5d597d13722903434d41c26d5159d556cbf8d1f5664b4fcb9ac3f3
                                              • Opcode Fuzzy Hash: 54e460e1061ac63a3c83272203f118998f3828b70106f35dade5fbe3ebc73661
                                              • Instruction Fuzzy Hash: A1227DB0905B428BD7705F64D6CC39EF6D4AB06B10F34895BD0FBCB259E73498868B46
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: b0140382608f1cc57dfda5bab4ecb8875fda858e39534d73f94add3cf277cd76
                                              • Instruction ID: b9d2a01d7a286e2b2a3047c179fe375c6600554e63e4ca95a77ac6e38efaaa13
                                              • Opcode Fuzzy Hash: b0140382608f1cc57dfda5bab4ecb8875fda858e39534d73f94add3cf277cd76
                                              • Instruction Fuzzy Hash: E5C15A387106108FDB18EF68D498A6D77FAFF88A14B1544A9E506CB371DB71EC06CB90
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 2072c31663d2b6dbe245d81594d1d74ff1f786abec47dee0d151b30ccc3fd9e7
                                              • Instruction ID: fae672b805708ac480ef5d32780d88d386daf397d25eb8e2fb854fdd6b2c064f
                                              • Opcode Fuzzy Hash: 2072c31663d2b6dbe245d81594d1d74ff1f786abec47dee0d151b30ccc3fd9e7
                                              • Instruction Fuzzy Hash: 2C718935B041088FCF58EBA4C4549ADB3F6EF8C714B2540A9E806AB3A1CB35ED05CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 89181d122d6fc321df69c5957b4597b5d2aff13b27ad118ed43989f384d1b325
                                              • Instruction ID: 496f38afa435454cffc6308ef8d17a6883bcd5639b871a2b543d46f7824e81a8
                                              • Opcode Fuzzy Hash: 89181d122d6fc321df69c5957b4597b5d2aff13b27ad118ed43989f384d1b325
                                              • Instruction Fuzzy Hash: 1851A332A006098FCF01DFA5D884AEEB7B6FF45715F058066F905EB261D775E906CB90
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 67367e0372bc39452c60db69536e16c39b5ea2aed40bc9dcd6ae2055cde8b875
                                              • Instruction ID: fbf4561f0fbfc03abdeda76b2cd9dc8aa69e9ce006617eb02a383c43eb7f47cd
                                              • Opcode Fuzzy Hash: 67367e0372bc39452c60db69536e16c39b5ea2aed40bc9dcd6ae2055cde8b875
                                              • Instruction Fuzzy Hash: 5F61C474A102099FDB08DFA9D985BADB7F6FF48704F208159E905AB3A0DB71AD41CF60
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 463a351c0ee6231215d2b66bea8c31c93840b21f0eba687f5b964361f476a50c
                                              • Instruction ID: 8d37ce321238741fcb4e7a4fb4573dcd30918aedd15d90df94dbe5c14a7b4e42
                                              • Opcode Fuzzy Hash: 463a351c0ee6231215d2b66bea8c31c93840b21f0eba687f5b964361f476a50c
                                              • Instruction Fuzzy Hash: 3F41A0B5E00218CBEB14EBB9D4553ED7BB5EF88764F14542AD501AB380DB384886CBA5
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 2ab21071c972915b085a4bc0a82e45ce64a3e78b90557acbdbf716087fccf75d
                                              • Instruction ID: 73bc21ae4aaec1efdf629df80e710d6882f6c17d0cce61082e1eaba7720b29b7
                                              • Opcode Fuzzy Hash: 2ab21071c972915b085a4bc0a82e45ce64a3e78b90557acbdbf716087fccf75d
                                              • Instruction Fuzzy Hash: 5641D0357042048FDB05DF60D854AAE7BF6EF89301F1580AAE405AB3A2DB39ED05CBA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 16f254a72fb89de3f73c64230fa001ef857b45b77fe710b9568bc56e27a04315
                                              • Instruction ID: 701ff56a76f82020a55e7a41a31e6e753e5fc7bce410462877183537430b768b
                                              • Opcode Fuzzy Hash: 16f254a72fb89de3f73c64230fa001ef857b45b77fe710b9568bc56e27a04315
                                              • Instruction Fuzzy Hash: 5A412974904258CFE720DF24E849AECBBB5FF48340F0099E9E58AA3356D7791981CF11
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 5991d741f42b9a6b001564b238be4a2e7744e970b66f0d06058621d7d6513990
                                              • Instruction ID: 6eff501efb6cd04e8022e0fae577ca96ea118c6e0efe229c31be0e2ebb20ccf8
                                              • Opcode Fuzzy Hash: 5991d741f42b9a6b001564b238be4a2e7744e970b66f0d06058621d7d6513990
                                              • Instruction Fuzzy Hash: 50215B757002149FCB64DF19D584A6B77BAFB88B21B10842EFA8687B90CB31FC41CB60
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 4b3125705b89806064c865600e8633656cab9793dd79f4423ca038a5ee72026e
                                              • Instruction ID: e56180a5cf4ec98d2c62202ee5427042df5170d1eca499f12d334cf2ddd294de
                                              • Opcode Fuzzy Hash: 4b3125705b89806064c865600e8633656cab9793dd79f4423ca038a5ee72026e
                                              • Instruction Fuzzy Hash: 5D21FFB5A10219EFDB05EFA1D8449DEBBB6FFC9304F448515E002BB320EB75A854CB80
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: ee6468038a4419c3125571a0f198bf2cb4f39a3f231381867dc228323f49786c
                                              • Instruction ID: 2e4fadc0e4d9ca734324adf93cf506316e856f1dd347048705c39c34fd54e936
                                              • Opcode Fuzzy Hash: ee6468038a4419c3125571a0f198bf2cb4f39a3f231381867dc228323f49786c
                                              • Instruction Fuzzy Hash: 4F21B4749093959FDB06CBB0D8106EEBFB5FF86300F0580ABE554A7255E7B80986CBA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 8358b418a6a94aa0a67eaea9e8f10ed501dd97d10b5ca7d1c707360cb3ccf2c1
                                              • Instruction ID: 99b644c330402d7c516743cbdfabfe3b17dddf217103959e42d369ea0beb9b12
                                              • Opcode Fuzzy Hash: 8358b418a6a94aa0a67eaea9e8f10ed501dd97d10b5ca7d1c707360cb3ccf2c1
                                              • Instruction Fuzzy Hash: B721FC71E0020A9FCB04DFADC8448AFFBF9FF98200B10855AE518E7211E770A952CB90
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 1e82dea5c436872a8fa7c33bf51bc829dff035cc0daa33f1c5caa91b59121218
                                              • Instruction ID: 0ba968f5631526b07b604cca11a7fdde8e7fd097669e3179872831a6d05d9d38
                                              • Opcode Fuzzy Hash: 1e82dea5c436872a8fa7c33bf51bc829dff035cc0daa33f1c5caa91b59121218
                                              • Instruction Fuzzy Hash: 1E31A0B8D053AC9FEB208F6099445DDBBB2BF48380F1084D9E989A3348DBB45ED1CE11
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: e2882943f8607a558462442101601f628cf1ea9402025edd8578f45c589da093
                                              • Instruction ID: 5c7f3fc410a9bf9d27c609f156c4174b78ebe17ec3c4112fb9ca6061e1273eb4
                                              • Opcode Fuzzy Hash: e2882943f8607a558462442101601f628cf1ea9402025edd8578f45c589da093
                                              • Instruction Fuzzy Hash: BA016D74E002199BDB14CFA5D5006EEBBB6FF89750F00847AEA08A3344DBB44991CEA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 48dfcb3be2bf6575ac44d9cd1830ef6dae8e9db5ec88b63118ffd89ce408a9a3
                                              • Instruction ID: 4714c265b226838af30b655d6aa42cdcf03946cf5cab0f976a2e063603004fe7
                                              • Opcode Fuzzy Hash: 48dfcb3be2bf6575ac44d9cd1830ef6dae8e9db5ec88b63118ffd89ce408a9a3
                                              • Instruction Fuzzy Hash: 8E0186303042149BD728AB65D451A6EB3EEAFC6A19705C87EE549CBBE0DF71EC02C791
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: d0b26bb0b03465acd9e8c24f0f466cac399c201957e58deb6adbb90028b24285
                                              • Instruction ID: bac70be4a79df742d106e1a377e437a6b2fda76eed8fc9fdd16a2c4743ad83cc
                                              • Opcode Fuzzy Hash: d0b26bb0b03465acd9e8c24f0f466cac399c201957e58deb6adbb90028b24285
                                              • Instruction Fuzzy Hash: D3114C30E007199FDB20DF64C845BE9B7B1FF8A340F5085D9E049A7255EB70AA81CF41
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 3068a5ff3644420b3e1af2f41babc71dcea5ada75317f1ea771328542a102347
                                              • Instruction ID: 07c0e542630ffaf7a26a4f97e53eae99c9b7cc55d415f3b3df14b62d354b556e
                                              • Opcode Fuzzy Hash: 3068a5ff3644420b3e1af2f41babc71dcea5ada75317f1ea771328542a102347
                                              • Instruction Fuzzy Hash: 84016D342002048FC764DB29D45592AB3EAEF85A18B16C9BEE559CBBA0DB71EC02CB50
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 74b3127a933c81015259df293a51ce0ff8e941723e943d938e2382a436b6cc42
                                              • Instruction ID: 31f934012c693e756cb8cc3a63bd07c25e4476301ab5fdddc6c8f3e006bd6836
                                              • Opcode Fuzzy Hash: 74b3127a933c81015259df293a51ce0ff8e941723e943d938e2382a436b6cc42
                                              • Instruction Fuzzy Hash: EC011AB4E0011ADFCB44EFA8D444AAEBBB1FF48700F20845AD919E7361DB35A901CF91
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: ddfce1f76e15bdca087cd7cca5619847b1d2483e7274b7af2572d39806524f32
                                              • Instruction ID: 4e0891615f64530b6efae59b5ab8a8c8a9d43cb397d9462de8e04b21f6873d21
                                              • Opcode Fuzzy Hash: ddfce1f76e15bdca087cd7cca5619847b1d2483e7274b7af2572d39806524f32
                                              • Instruction Fuzzy Hash: 48F01D7291411A8FDB90DFB8D8467BDBBF4FB04305F0489B6E458D3681EA38D6059B81
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: baba301b3d87369c7c5ca1b23be7019f2e06d062459ba20094bc053fa552f888
                                              • Instruction ID: 7d9e0893adc27e940cbd86c2d07dff08db221dc5df96066ccb11c634518ed304
                                              • Opcode Fuzzy Hash: baba301b3d87369c7c5ca1b23be7019f2e06d062459ba20094bc053fa552f888
                                              • Instruction Fuzzy Hash: 3AF0F471A006068BD31DDF2CD44261ABBE5FB05310B1109A6E068CF782D720E8C0CBE2
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 6c72373e818b7d73dab24846d3b879e4c30b0b9604616352dce9cdfad2d3951e
                                              • Instruction ID: cef1155a6832c7be4e182a2f0865940b8ef626d0a3cd0f6b86d300f6c063d681
                                              • Opcode Fuzzy Hash: 6c72373e818b7d73dab24846d3b879e4c30b0b9604616352dce9cdfad2d3951e
                                              • Instruction Fuzzy Hash: 7B014B349102488FDB10DB64C850AEAB770FF4A350F0091AAD88DA7296EB709A95CF61
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 4951e51c4984e78bddcb744992bdd2e3f6f411cebe29044bb8d2cc054db89392
                                              • Instruction ID: e15b7fd0105939410b287d761bb858c946fe77a9334a0bf5a1c3619353be101f
                                              • Opcode Fuzzy Hash: 4951e51c4984e78bddcb744992bdd2e3f6f411cebe29044bb8d2cc054db89392
                                              • Instruction Fuzzy Hash: 71E0923321163487C310EB48F8856BEB3A8E788A763198067F90DDBA21E737D852C7C0
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 231470255fcb4e3cafba28f5be66e1f1da63080bced1c4e3d7d33ab0afe64759
                                              • Instruction ID: fb39e3c69df3836702fa1c0dbb42f4f1528546df147701ce3bb3a7c67f37d26a
                                              • Opcode Fuzzy Hash: 231470255fcb4e3cafba28f5be66e1f1da63080bced1c4e3d7d33ab0afe64759
                                              • Instruction Fuzzy Hash: 1FF01434A013288FCB60CF64C889AD9B7B1FF89341F5050E5E88A9721ADB355A86CF90
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: d3690b6e21627307fc8797bce74cea615be7b08845968779dbdf9511bbf3f44c
                                              • Instruction ID: 3582a3ce6d2c0fe7c13b305bb5b01503bd5e48d51aaf935f93fba7737c7cc022
                                              • Opcode Fuzzy Hash: d3690b6e21627307fc8797bce74cea615be7b08845968779dbdf9511bbf3f44c
                                              • Instruction Fuzzy Hash: DCF06D30D046188ECB20DB64C840ADDB770FF4A340F40D2DAC84A67251EB709A85DF90
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 073e1c8d7f1e770697c1efd84e53771e7b8463bf9e62f82bfbb0b477b94dc813
                                              • Instruction ID: 922538f1cb27f434c97dddbbcc4722c3798679a04565dafbae3abd3c1988be89
                                              • Opcode Fuzzy Hash: 073e1c8d7f1e770697c1efd84e53771e7b8463bf9e62f82bfbb0b477b94dc813
                                              • Instruction Fuzzy Hash: 74F01D30914619CEDB14EB64C841AADBBB4FF89340F40D196D89D67255EF305A94CF90
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: c9a42ca16612d7232fc782e56cdf3e113657a9f6c7f9842ea25a00edf3c08987
                                              • Instruction ID: f821288e32926546c69545cebd27fba0958a22fdc9739d9ebc5bd149f7ed70e2
                                              • Opcode Fuzzy Hash: c9a42ca16612d7232fc782e56cdf3e113657a9f6c7f9842ea25a00edf3c08987
                                              • Instruction Fuzzy Hash: A9F05E349006A98FDB14DF64C89579EB7B1FF4A301F54A0E5D89EA720ACF344A46CF60
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: e0eef86224264bc8f068eb122bafa9594ed45190b10643b45f0584a96cb3ff44
                                              • Instruction ID: 23c13fa5312417e235eb2ebef3d70d273cb2741fc5e940e5a10e9c71d6957525
                                              • Opcode Fuzzy Hash: e0eef86224264bc8f068eb122bafa9594ed45190b10643b45f0584a96cb3ff44
                                              • Instruction Fuzzy Hash: 03E012513D422853F98C31A8545176E11CF57D5B52E40836ADA4D9B7C5CCE66C0107D3
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 082f62357063776f796b36e4d62921149c1469a27e555663949554125e3855f1
                                              • Instruction ID: 33541e317c5cc34aafdd061e0dd9fe14bbcd3d9fb7b202f53fdc0517c30abf9e
                                              • Opcode Fuzzy Hash: 082f62357063776f796b36e4d62921149c1469a27e555663949554125e3855f1
                                              • Instruction Fuzzy Hash: 75F05E74D08215CFCBA0DF24E44529DBBB1FF44300F10A4EA898EA674AD73C5981CF96
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 32e74c2b3212354faffa807fad56ab7da77ae1e70055667b0bbea040f565888e
                                              • Instruction ID: 004ca90d0a2b4adc96fabd94c361c65d6811312fdc15b3f37e1a5a34d12cca30
                                              • Opcode Fuzzy Hash: 32e74c2b3212354faffa807fad56ab7da77ae1e70055667b0bbea040f565888e
                                              • Instruction Fuzzy Hash: 73F0F934A013188FCB60CF50C889AD9B7B2BF89341F1051E8E44A97315CB346E96CF90
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 54edfe3a540834a4fd7675e51c285b4c4d0ceb498ac27e6d0a6336de1fe547f2
                                              • Instruction ID: a2831c168baa8203bbded2f6c0dc5862b8e24f1fa9cc9b3a1cd9c164c833e181
                                              • Opcode Fuzzy Hash: 54edfe3a540834a4fd7675e51c285b4c4d0ceb498ac27e6d0a6336de1fe547f2
                                              • Instruction Fuzzy Hash: DAF03430D1031ADEDB24DB64C840BA9FBB0FF8A300F5192A6D408B7250EB706AC1CF41
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 743398033e62cd63b6a8a5a5d6e0e574896bd997231ab4d16713ff962b957bbe
                                              • Instruction ID: ab411dd475a7bdeb2628c08231930f9c81b38d5405f0ec84ec7ef755eda3083a
                                              • Opcode Fuzzy Hash: 743398033e62cd63b6a8a5a5d6e0e574896bd997231ab4d16713ff962b957bbe
                                              • Instruction Fuzzy Hash: 6CE0E539910208EFCB41DFA4D948E89BFF9FF09311F0581A5EA098B271D731D960EB51
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 1d8744a5d0c36536e4d891c4f41964959e185094a1acaf943c898fe86631a875
                                              • Instruction ID: 56a867ee29384bcd0227086cf8e0d89c4760b68fec79c13d9e8bd3f120b72ec8
                                              • Opcode Fuzzy Hash: 1d8744a5d0c36536e4d891c4f41964959e185094a1acaf943c898fe86631a875
                                              • Instruction Fuzzy Hash: C2F03430D2421ECFDB64DBA0C9806E9B7B5FF89340F1082A6D009B7650EB706AC98F61
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: dba55cb3d4c633d70b241e926c10a871a2208ab862fb87e58b493bd515c76958
                                              • Instruction ID: f390272beef24c7b2cbc825c0cca480df21197ba7e9e4a23d31f3bde47ce9df4
                                              • Opcode Fuzzy Hash: dba55cb3d4c633d70b241e926c10a871a2208ab862fb87e58b493bd515c76958
                                              • Instruction Fuzzy Hash: 34E04630821208EFC705FFB8E90569DBBB8AB41201F5042AED84467250EB319A98CBA2
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: be0a666f849a5d0030f5bb644bccf198571bb4e594536ea354ec3cac4a110fcb
                                              • Instruction ID: 18084d90944304b928cd19cfca0bb1639fb546b5294139df2ee18ff5dc9fb03d
                                              • Opcode Fuzzy Hash: be0a666f849a5d0030f5bb644bccf198571bb4e594536ea354ec3cac4a110fcb
                                              • Instruction Fuzzy Hash: 89E04630821208DFC704FFB8E90869DBBB8EB05601F5086AED80467210EB309698CB92
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: bb4e24b1ec1f06a362fa610536e54a1ac1d3c162f69ddb0f57522096a7e0dc32
                                              • Instruction ID: 8b235e0089236cbfacf84e7574ced3ad16d5838623856e0bfd0c108223afdbca
                                              • Opcode Fuzzy Hash: bb4e24b1ec1f06a362fa610536e54a1ac1d3c162f69ddb0f57522096a7e0dc32
                                              • Instruction Fuzzy Hash: 9CE0B634E10208EFC744EFA9E444A9DBBB8FB49705F5081E9E80897360D7359951CB81
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: a21170c9b0a3a95f94d8c0e20707e9445dfa0e689495a6003aa8cc56ec698272
                                              • Instruction ID: 20b3110e3f69d780a59772286efeb3dd632bbb981d8fa9afb78739f5bbe5703d
                                              • Opcode Fuzzy Hash: a21170c9b0a3a95f94d8c0e20707e9445dfa0e689495a6003aa8cc56ec698272
                                              • Instruction Fuzzy Hash: B9E0B634E10208EFC744DFA8E544A9DBBB4FB49305F1085E9E91897360D735AA15CB81
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 813c942082ecd4e821271e09000e90e1fc5094dcb80137ad53e65078ce456144
                                              • Instruction ID: cbca4df229fc50bc13033b8cdac2d3d6a1aa6640fe91924d3a21ad6964534b5f
                                              • Opcode Fuzzy Hash: 813c942082ecd4e821271e09000e90e1fc5094dcb80137ad53e65078ce456144
                                              • Instruction Fuzzy Hash: 4BF015759001589FCB15CF90CA89D89BBB6FF09340F0084D5E10AA7271D770AE80DF00
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 45e3c706083d0e4044e9861266a71d0310c2ae7cf83c77fa42d7f7b1e35ae43a
                                              • Instruction ID: 8e1304257c9b2ad2e84230cec0df079f1631619e2d064915dd9c9dafddd1b511
                                              • Opcode Fuzzy Hash: 45e3c706083d0e4044e9861266a71d0310c2ae7cf83c77fa42d7f7b1e35ae43a
                                              • Instruction Fuzzy Hash: 7FE0ECB0914248EFC750EFF8D85439DBBF8FB84608F1001A9994897250EB301A95CB91
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: fa956c613c55ad716843fe768786274a51e1626d37671d661edaf8728ea578de
                                              • Instruction ID: f559f12a351cd93b3bbf358f33c22773b76ff1d33a54c7ac186b4aca2a2b4833
                                              • Opcode Fuzzy Hash: fa956c613c55ad716843fe768786274a51e1626d37671d661edaf8728ea578de
                                              • Instruction Fuzzy Hash: F7E0E574A003298FCB68CF54C9845EEBBF1BB48300F5090A9960DA7614DA345E86CF50
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 90f9d498e54643cb882a15e0561be0c6acd38afcec4f3b17bad193a40ab31e02
                                              • Instruction ID: 37f6c8fb6c80da4f9002f2bf62ec920941dea83d7bb0c7c74596fdd29ce32ee2
                                              • Opcode Fuzzy Hash: 90f9d498e54643cb882a15e0561be0c6acd38afcec4f3b17bad193a40ab31e02
                                              • Instruction Fuzzy Hash: 31D0C936285108BFDA80AA948944DAA376AEB19B04F50A446BA084B241C632E966DBA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 73cfcc76c6065fb7916f7aaae0a83bb7761104ad940347c1e28ea4010bd55bf3
                                              • Instruction ID: c86fc256124959534ddd224add69738ad9168c412a5f3c690b95d3b9ff7d0177
                                              • Opcode Fuzzy Hash: 73cfcc76c6065fb7916f7aaae0a83bb7761104ad940347c1e28ea4010bd55bf3
                                              • Instruction Fuzzy Hash: C0D0C932145108BBCB816A90C840A6A7B2ABB05754F109416F6444E551D773A962DBA4
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 0be66155a45dc4302f602fe20fa6730d2cd79abbb9d9ae3b8ff1f95364e1a177
                                              • Instruction ID: ad169eaf0b98b15884e38dd9ebc2be34008edbdae7e0962e0c2e56d7e491e805
                                              • Opcode Fuzzy Hash: 0be66155a45dc4302f602fe20fa6730d2cd79abbb9d9ae3b8ff1f95364e1a177
                                              • Instruction Fuzzy Hash: 92D05E3081420A9BCB809FA4C68625DFF30FF02341F04DAA68C9A8A007D6298180CF65
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.370659031.0000000009AA0000.00000040.00000001.sdmp, Offset: 09AA0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: f6d55b9e8b0231942fe88b9fca920a90fafb0ed9c3ed93f3db9d0e8fc5906dbf
                                              • Instruction ID: 445090b1c0fc2fe1eea64a3be7106bc4aea687b97b5ee5b0e646a0a01c132985
                                              • Opcode Fuzzy Hash: f6d55b9e8b0231942fe88b9fca920a90fafb0ed9c3ed93f3db9d0e8fc5906dbf
                                              • Instruction Fuzzy Hash: DFD01230D04309DBE705CB61C5550AFBBB2BF8A740F54DC69C0459B168D7389541CF94
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Non-executed Functions

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.371216272.0000000009EE0000.00000040.00000001.sdmp, Offset: 09EE0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: c9dd6a6d32af3f92014b4d54fa3bd858b21acf9456d899cfd2380ed90c79c5ab
                                              • Instruction ID: df094575540bbf6ae2cadd95f3b08e795e8595dcd9144d070df6d88f3214be80
                                              • Opcode Fuzzy Hash: c9dd6a6d32af3f92014b4d54fa3bd858b21acf9456d899cfd2380ed90c79c5ab
                                              • Instruction Fuzzy Hash: 52D1AD74B052149FEB18DFA4D990BAEBBF6AF88704F1440A9E505EB3A1DB34ED01CB51
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Executed Functions

                                              Memory Dump Source
                                              • Source File: 00000005.00000002.711691988.0000000006650000.00000040.00000001.sdmp, Offset: 06650000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 0b4bd643a8583ebc996524604f1cad32794ba4f23ea69115e90bcf5222845466
                                              • Instruction ID: 08fa9df01e2b57bc61a58a35710d543a60503c09056375dd969b667f43c00259
                                              • Opcode Fuzzy Hash: 0b4bd643a8583ebc996524604f1cad32794ba4f23ea69115e90bcf5222845466
                                              • Instruction Fuzzy Hash: 39F14D30A00209CFDB54DFA9C885B9DBBF1BF84304F168569E805AB3A5DB70E946CB84
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • GetCurrentProcess.KERNEL32 ref: 032369A0
                                              • GetCurrentThread.KERNEL32 ref: 032369DD
                                              • GetCurrentProcess.KERNEL32 ref: 03236A1A
                                              • GetCurrentThreadId.KERNEL32 ref: 03236A73
                                              Memory Dump Source
                                              • Source File: 00000005.00000002.706814912.0000000003230000.00000040.00000001.sdmp, Offset: 03230000, based on PE: false
                                              Similarity
                                              • API ID: Current$ProcessThread
                                              • String ID:
                                              • API String ID: 2063062207-0
                                              • Opcode ID: 3a9480a78eed20d975553844f988e1f0bb6e96a235b0a819fdac88226ef734f1
                                              • Instruction ID: b709f7445bae6ce04469600de6fb2925f15f03df4de48c9527fcca7631e49694
                                              • Opcode Fuzzy Hash: 3a9480a78eed20d975553844f988e1f0bb6e96a235b0a819fdac88226ef734f1
                                              • Instruction Fuzzy Hash: A85198B19007499FDB10CFAAD98879EBBF4FF49314F24805AE149A7250D7745884CF62
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • GetCurrentProcess.KERNEL32 ref: 032369A0
                                              • GetCurrentThread.KERNEL32 ref: 032369DD
                                              • GetCurrentProcess.KERNEL32 ref: 03236A1A
                                              • GetCurrentThreadId.KERNEL32 ref: 03236A73
                                              Memory Dump Source
                                              • Source File: 00000005.00000002.706814912.0000000003230000.00000040.00000001.sdmp, Offset: 03230000, based on PE: false
                                              Similarity
                                              • API ID: Current$ProcessThread
                                              • String ID:
                                              • API String ID: 2063062207-0
                                              • Opcode ID: 976d0b09c23f4686413e47efc812850ec1bf43704c17b82f1e30d416fd8b214b
                                              • Instruction ID: d7245255ea43171a8856edb2fe1b047f8716f66dfd1f69ea86f7b77368e4733b
                                              • Opcode Fuzzy Hash: 976d0b09c23f4686413e47efc812850ec1bf43704c17b82f1e30d416fd8b214b
                                              • Instruction Fuzzy Hash: 065164B49106499FDB10CFAAD588BDEBBF4FF89314F248059E409A7350D7749884CF66
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 032351A2
                                              Memory Dump Source
                                              • Source File: 00000005.00000002.706814912.0000000003230000.00000040.00000001.sdmp, Offset: 03230000, based on PE: false
                                              Similarity
                                              • API ID: CreateWindow
                                              • String ID:
                                              • API String ID: 716092398-0
                                              • Opcode ID: a61d252fb7f7f3bd62686574e14b0496095c7f838c2608006aa99b3ee85331cd
                                              • Instruction ID: 0bc8836ba4f0296c05f5368e3afdc27ab7e085e4dbd30cce66ae918697885daf
                                              • Opcode Fuzzy Hash: a61d252fb7f7f3bd62686574e14b0496095c7f838c2608006aa99b3ee85331cd
                                              • Instruction Fuzzy Hash: 9251DFB1D103499FDF14CF99C984ADEBBB1BF89314F64812AE819AB210D7B49985CF90
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 032351A2
                                              Memory Dump Source
                                              • Source File: 00000005.00000002.706814912.0000000003230000.00000040.00000001.sdmp, Offset: 03230000, based on PE: false
                                              Similarity
                                              • API ID: CreateWindow
                                              • String ID:
                                              • API String ID: 716092398-0
                                              • Opcode ID: 8bcd9a3e0a1fcb3d2ef82a480d8ef7fe1482dcaf7e6eca393d609e0ef01235aa
                                              • Instruction ID: ef38a197aeebaf4f729f601dfe91f13b8adf5a569cae56c34795a6bcfdfdcd31
                                              • Opcode Fuzzy Hash: 8bcd9a3e0a1fcb3d2ef82a480d8ef7fe1482dcaf7e6eca393d609e0ef01235aa
                                              • Instruction Fuzzy Hash: 7141D2B1D103099FDB14CF99C884ADEFBB5BF49314F64812AE819AB210D7749885CF90
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 03236BEF
                                              Memory Dump Source
                                              • Source File: 00000005.00000002.706814912.0000000003230000.00000040.00000001.sdmp, Offset: 03230000, based on PE: false
                                              Similarity
                                              • API ID: DuplicateHandle
                                              • String ID:
                                              • API String ID: 3793708945-0
                                              • Opcode ID: 3b8cade1d0a9a298ef24e0664b21a83444fe7fb634a6724ea42a3b5ca1f9e0e6
                                              • Instruction ID: d8c293f2a606f67caff50eb7593326b31bafed0b68d88bfcd18ea3dc1777e88c
                                              • Opcode Fuzzy Hash: 3b8cade1d0a9a298ef24e0664b21a83444fe7fb634a6724ea42a3b5ca1f9e0e6
                                              • Instruction Fuzzy Hash: 6841A6B46402889FE705EF64F588BA97BF5FB49714F108059E9029B7D9CB788845CF22
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • CallWindowProcW.USER32(?,?,?,?,?), ref: 03237F09
                                              Memory Dump Source
                                              • Source File: 00000005.00000002.706814912.0000000003230000.00000040.00000001.sdmp, Offset: 03230000, based on PE: false
                                              Similarity
                                              • API ID: CallProcWindow
                                              • String ID:
                                              • API String ID: 2714655100-0
                                              • Opcode ID: a847ffd20d266a10902213e06d64455a793337a68993a74a162a9ddacf9696dd
                                              • Instruction ID: d76db3a8231827a1b7f68cbb9bc34ad7fee493ff7e29f9f901a9de7d37e8817c
                                              • Opcode Fuzzy Hash: a847ffd20d266a10902213e06d64455a793337a68993a74a162a9ddacf9696dd
                                              • Instruction Fuzzy Hash: B5415BB5910709CFCB14CF99C488AAABBF5FF89314F258459E519A7321D774A881CFA0
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • RtlEncodePointer.NTDLL(00000000), ref: 0323C222
                                              Memory Dump Source
                                              • Source File: 00000005.00000002.706814912.0000000003230000.00000040.00000001.sdmp, Offset: 03230000, based on PE: false
                                              Similarity
                                              • API ID: EncodePointer
                                              • String ID:
                                              • API String ID: 2118026453-0
                                              • Opcode ID: 064d168bb24b7e153368ef5d1eb990e4641c97eb3a0185110a36be1658a85f5c
                                              • Instruction ID: b360100f1a0559bc83785946150799c1bc9e0faa01a5e14f21d5aef546cc8c8e
                                              • Opcode Fuzzy Hash: 064d168bb24b7e153368ef5d1eb990e4641c97eb3a0185110a36be1658a85f5c
                                              • Instruction Fuzzy Hash: 413100B58253858FCB10EFA9E94439EBFF4EB46314F248059D444B7256C3799449CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 03236BEF
                                              Memory Dump Source
                                              • Source File: 00000005.00000002.706814912.0000000003230000.00000040.00000001.sdmp, Offset: 03230000, based on PE: false
                                              Similarity
                                              • API ID: DuplicateHandle
                                              • String ID:
                                              • API String ID: 3793708945-0
                                              • Opcode ID: edf930d71066519dd1dde835c19e88794a60fa9bc6f5d5671d17b19915329566
                                              • Instruction ID: c1e01963f90b7f39c95abe7ff4a9d3ef050853f70bda35e59b4a9daa58f199c3
                                              • Opcode Fuzzy Hash: edf930d71066519dd1dde835c19e88794a60fa9bc6f5d5671d17b19915329566
                                              • Instruction Fuzzy Hash: 6321E3B5900249AFDB10CFA9D984ADEFBF9FF48324F14841AE915A7310D374A945CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 03236BEF
                                              Memory Dump Source
                                              • Source File: 00000005.00000002.706814912.0000000003230000.00000040.00000001.sdmp, Offset: 03230000, based on PE: false
                                              Similarity
                                              • API ID: DuplicateHandle
                                              • String ID:
                                              • API String ID: 3793708945-0
                                              • Opcode ID: 79edbe0b639fb411c36c9ad6b8b9a922bb1831e957747845538d14477b0dacc0
                                              • Instruction ID: b95df5fa9dd8c99eaa0d90253201b25e278cc6736ece7cb182d426067cc5f5ea
                                              • Opcode Fuzzy Hash: 79edbe0b639fb411c36c9ad6b8b9a922bb1831e957747845538d14477b0dacc0
                                              • Instruction Fuzzy Hash: DC21D3B5900249AFDB10CFAAD984ADEFBF8FF48324F14841AE915A7310D374A954CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,00000000,?,06659489,00000800), ref: 0665951A
                                              Memory Dump Source
                                              • Source File: 00000005.00000002.711691988.0000000006650000.00000040.00000001.sdmp, Offset: 06650000, based on PE: false
                                              Similarity
                                              • API ID: LibraryLoad
                                              • String ID:
                                              • API String ID: 1029625771-0
                                              • Opcode ID: 4fcfd01f9712d57e3c1892b19ffd33ca7f17d0150bb059e0125555d7ff7cd726
                                              • Instruction ID: ab133ddd84de1ca4603fd15d952c42d2b8d04e97be3aee31b958daecf45661aa
                                              • Opcode Fuzzy Hash: 4fcfd01f9712d57e3c1892b19ffd33ca7f17d0150bb059e0125555d7ff7cd726
                                              • Instruction Fuzzy Hash: 891106B69002499FDB10CF9AC444ADEFBF4EB48314F15852AE925A7300C375A945CFA5
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • RtlEncodePointer.NTDLL(00000000), ref: 0323C222
                                              Memory Dump Source
                                              • Source File: 00000005.00000002.706814912.0000000003230000.00000040.00000001.sdmp, Offset: 03230000, based on PE: false
                                              Similarity
                                              • API ID: EncodePointer
                                              • String ID:
                                              • API String ID: 2118026453-0
                                              • Opcode ID: 455b910490185533c89ad340232708f5f075ede611c9bedfc98dc7398e095ff4
                                              • Instruction ID: f8620326f6f137ede0773b17872d32e7773a10681fe8bad76231a1b4ca7f1e16
                                              • Opcode Fuzzy Hash: 455b910490185533c89ad340232708f5f075ede611c9bedfc98dc7398e095ff4
                                              • Instruction Fuzzy Hash: 941186B29113098FCF10EFAAD9487DEBBF8EB49314F248129D405B3614D779A489CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • GetModuleHandleW.KERNELBASE(00000000), ref: 03234116
                                              Memory Dump Source
                                              • Source File: 00000005.00000002.706814912.0000000003230000.00000040.00000001.sdmp, Offset: 03230000, based on PE: false
                                              Similarity
                                              • API ID: HandleModule
                                              • String ID:
                                              • API String ID: 4139908857-0
                                              • Opcode ID: d28ed0eb4c015c826396b6e39bfaea356ba95dd0658fe9dac5c45afa15c074d7
                                              • Instruction ID: 0302f17f7124b8f525b4c12c50196cea641f23af151de2d3225b80f68cb8a268
                                              • Opcode Fuzzy Hash: d28ed0eb4c015c826396b6e39bfaea356ba95dd0658fe9dac5c45afa15c074d7
                                              • Instruction Fuzzy Hash: EF1134B2D006498FCB10DF9AC444BDEFBF4EF49224F14806AD819B7200D375A545CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • GetModuleHandleW.KERNELBASE(00000000), ref: 03234116
                                              Memory Dump Source
                                              • Source File: 00000005.00000002.706814912.0000000003230000.00000040.00000001.sdmp, Offset: 03230000, based on PE: false
                                              Similarity
                                              • API ID: HandleModule
                                              • String ID:
                                              • API String ID: 4139908857-0
                                              • Opcode ID: 08aca162d76cf45a49ab3a42a9283c832546ac4ccf97004edd8ed87b737c7f59
                                              • Instruction ID: efdecab8c9014c521197b8cf962599bfbc95573b4b09d0ed10dd1ca68c086a66
                                              • Opcode Fuzzy Hash: 08aca162d76cf45a49ab3a42a9283c832546ac4ccf97004edd8ed87b737c7f59
                                              • Instruction Fuzzy Hash: 661113B6C006498FCB10DF9AC544BDEFBF4EF89224F15845AD819B7600D379A545CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • GetModuleHandleW.KERNELBASE(00000000), ref: 03234116
                                              Memory Dump Source
                                              • Source File: 00000005.00000002.706814912.0000000003230000.00000040.00000001.sdmp, Offset: 03230000, based on PE: false
                                              Similarity
                                              • API ID: HandleModule
                                              • String ID:
                                              • API String ID: 4139908857-0
                                              • Opcode ID: 8f6178fa46ccc891704cd14df3c112ae08f3956d38e3d7e132812622029d8829
                                              • Instruction ID: ba55a0f74c91a1f40bba15eeb2f42e8b2524733b5ce78ca6a427650d0b473be9
                                              • Opcode Fuzzy Hash: 8f6178fa46ccc891704cd14df3c112ae08f3956d38e3d7e132812622029d8829
                                              • Instruction Fuzzy Hash: 37F08CF69006088FCB10DF8AD4043DEFBF0EB4A314F248149C559A3200C379A446CF61
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000005.00000002.711547273.0000000005FE0000.00000040.00000001.sdmp, Offset: 05FE0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 54c19a19dbf12401f85543ab37ff0c9527cf3392a0b841e0bd6cf536c2fab86a
                                              • Instruction ID: 2d63be784a5cb883e5051dde9cea51104f870a5cc1618b961f288f59790e21a5
                                              • Opcode Fuzzy Hash: 54c19a19dbf12401f85543ab37ff0c9527cf3392a0b841e0bd6cf536c2fab86a
                                              • Instruction Fuzzy Hash: 6F31E9326085C8CFE309DA18F99486877BEFB472157850496F202FB692C77CEC44CB92
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000005.00000002.711547273.0000000005FE0000.00000040.00000001.sdmp, Offset: 05FE0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: db5d7414ae41b40f72eb9a598b89abb4f1316cc57f7fdca85195b784b430dec0
                                              • Instruction ID: 8681f7b9c17b4cf7b632e8ecc9533e1ccb6cdc3e5605bbfffac453cfc0411325
                                              • Opcode Fuzzy Hash: db5d7414ae41b40f72eb9a598b89abb4f1316cc57f7fdca85195b784b430dec0
                                              • Instruction Fuzzy Hash: 7EB17D30B043098BCB14DBB5C8546AEB7A7FF85304F208569D8099F755EF79A84ACB91
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000005.00000002.711547273.0000000005FE0000.00000040.00000001.sdmp, Offset: 05FE0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 71b0e6d5bd2623bbfcea46711d9bf63769e624b1fac4adce82b9600d4c4bd98e
                                              • Instruction ID: a2689145fd0f574f543934cf146fbcb1c17bfc9fafed1d40d7145af08d6a1607
                                              • Opcode Fuzzy Hash: 71b0e6d5bd2623bbfcea46711d9bf63769e624b1fac4adce82b9600d4c4bd98e
                                              • Instruction Fuzzy Hash: F451E575B041088FCB18EBB8D8646AE73B7AFC5204B1584ACD50ADB795EF398D0787E1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000005.00000002.711547273.0000000005FE0000.00000040.00000001.sdmp, Offset: 05FE0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: c8ab3b5d3404cc379ffab5db029d320e015467513dbbf25ebd4874886fa07620
                                              • Instruction ID: e39273388c7b3c9828baa66cec52841a5ea1d90d16417a93d6931c0ba7fdd797
                                              • Opcode Fuzzy Hash: c8ab3b5d3404cc379ffab5db029d320e015467513dbbf25ebd4874886fa07620
                                              • Instruction Fuzzy Hash: 8B517A31E007198BCB14EFB5C4546AEB7B3BFC5304F618929D806AB744EF74A94ACB91
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000005.00000002.711547273.0000000005FE0000.00000040.00000001.sdmp, Offset: 05FE0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 79d119af5b290146540cbaa4c0f948e86a29a8c4ea374d3b01e05d675bb71e9d
                                              • Instruction ID: 8e7f1ca0bd7f22bf50cf52966ce37f59081cde6aa9b26a167791b99e081252a5
                                              • Opcode Fuzzy Hash: 79d119af5b290146540cbaa4c0f948e86a29a8c4ea374d3b01e05d675bb71e9d
                                              • Instruction Fuzzy Hash: C3515A75B04599CFE718DF28E98496D73BAFB4A311B4104A5F612EB3A1CB38EC01CB91
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000005.00000002.711547273.0000000005FE0000.00000040.00000001.sdmp, Offset: 05FE0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: a4cdcb7b867f5cf24adb9a40ec65c7fc56012820783f423ab64bbc002fdc95da
                                              • Instruction ID: 9e812a48799d716c962ec2c269c016b441b8e4586f4ec34fa5b73723f22e5dc1
                                              • Opcode Fuzzy Hash: a4cdcb7b867f5cf24adb9a40ec65c7fc56012820783f423ab64bbc002fdc95da
                                              • Instruction Fuzzy Hash: 76416B35B14200CFCB14DB68E958AAD7BF6AF88714F254069E502EB361DB35DC46CB90
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000005.00000002.711547273.0000000005FE0000.00000040.00000001.sdmp, Offset: 05FE0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: ced2a6cf160daf9cc1e3e961e2b4410be3a01004242afc7ad0a34a3ecfad9b1f
                                              • Instruction ID: f649ed969e3532e3a1128f224c62fcd97937cfdd10f67c545cfa67aa06ffe786
                                              • Opcode Fuzzy Hash: ced2a6cf160daf9cc1e3e961e2b4410be3a01004242afc7ad0a34a3ecfad9b1f
                                              • Instruction Fuzzy Hash: 3C415B35B14204CFCB54DB68D558AAE7BFAAF89705F210069E502EB3A4DF39DC41CBA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000005.00000002.711547273.0000000005FE0000.00000040.00000001.sdmp, Offset: 05FE0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: b714cc0587280fe35d03701d62189e38619bfdda13cfe25465829a8e1cca7eb1
                                              • Instruction ID: e611569fafc2f4fe61768a9ecf245aae04a853b2d200391650814da0993ab802
                                              • Opcode Fuzzy Hash: b714cc0587280fe35d03701d62189e38619bfdda13cfe25465829a8e1cca7eb1
                                              • Instruction Fuzzy Hash: 8241C335B043458FCB41DFB8D8056AE7BF2FF8A204B5444A6D009EB3A5EB389D06CB91
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000005.00000002.706446749.000000000199D000.00000040.00000001.sdmp, Offset: 0199D000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 64d294f2b39f32c8b4119795ee8de444a461a7b8077fe587467bbdcb6733e709
                                              • Instruction ID: c23868d5081aac44e1e38240b256e438802997a667d1945dbcfe4d1d0d1e0d6c
                                              • Opcode Fuzzy Hash: 64d294f2b39f32c8b4119795ee8de444a461a7b8077fe587467bbdcb6733e709
                                              • Instruction Fuzzy Hash: 1B2106B1504244DFDF05DF58D9C0F67BFA9FB84724F248569E9094B24AC336E846CBA2
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000005.00000002.706446749.000000000199D000.00000040.00000001.sdmp, Offset: 0199D000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 476872981be35fefec7a6a7c59447d149d29c288ddf109cbd266720ed6e4f78d
                                              • Instruction ID: 90ef415375560f8b4d31847ded4da22614dc4b0fbc854a47cf24b3b1e7a770d7
                                              • Opcode Fuzzy Hash: 476872981be35fefec7a6a7c59447d149d29c288ddf109cbd266720ed6e4f78d
                                              • Instruction Fuzzy Hash: 8B21F8B1504244EFDF05DF58D9C0F26BFA9FB84328F248569E9094B24AC336D856CBA2
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000005.00000002.706484386.00000000019AD000.00000040.00000001.sdmp, Offset: 019AD000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: c8d11ee48fea65c9205f67ade8ae094108850ecf5fc4ff18ed2407292e15170b
                                              • Instruction ID: 63176ff4579019e98f8d9934d72c685aa404ad20af51b146f204ee580069f169
                                              • Opcode Fuzzy Hash: c8d11ee48fea65c9205f67ade8ae094108850ecf5fc4ff18ed2407292e15170b
                                              • Instruction Fuzzy Hash: 0B2142B1544204DFDB14CF64D8C0B22BBA9FB88358F60C9ADE80D4B646C336D80BCBA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000005.00000002.706484386.00000000019AD000.00000040.00000001.sdmp, Offset: 019AD000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 1c786e499dbe781a7cd9a13ed70ef1d74aca0bd880a37699e3d5edab98247c8e
                                              • Instruction ID: c27dd1684158072de1b9ec74604b4ff24ab056abbee8ad2cc4958198266968d4
                                              • Opcode Fuzzy Hash: 1c786e499dbe781a7cd9a13ed70ef1d74aca0bd880a37699e3d5edab98247c8e
                                              • Instruction Fuzzy Hash: 2521C375548380CFDB12CF24D994B15BFB1EB45314F28C5DAD8498B697C33AD44ACBA2
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000005.00000002.706446749.000000000199D000.00000040.00000001.sdmp, Offset: 0199D000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: a4288b8d1924a243b74452ed9894bda5974195c5eafdb5ecf84050c0b22077c9
                                              • Instruction ID: 3abf69729313fe04f4d881d587eb126a29f423c45edee55f506606b89a9ddcc5
                                              • Opcode Fuzzy Hash: a4288b8d1924a243b74452ed9894bda5974195c5eafdb5ecf84050c0b22077c9
                                              • Instruction Fuzzy Hash: F411AF76404280CFDF12CF58D5C4B16BFB1FB85324F2886A9D9090B65BC336D45ACBA2
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000005.00000002.706446749.000000000199D000.00000040.00000001.sdmp, Offset: 0199D000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: a4288b8d1924a243b74452ed9894bda5974195c5eafdb5ecf84050c0b22077c9
                                              • Instruction ID: 27b2f14d34c321b4e4cfc054cf80e920452deb8c1b85de2a9b396e15e0ecc732
                                              • Opcode Fuzzy Hash: a4288b8d1924a243b74452ed9894bda5974195c5eafdb5ecf84050c0b22077c9
                                              • Instruction Fuzzy Hash: 0211B176404280DFCF02CF58D5C4B16BFB2FB84324F28C6A9D8094B61AC336D45ACBA2
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000005.00000002.711547273.0000000005FE0000.00000040.00000001.sdmp, Offset: 05FE0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 5058d138d4f11681c252665ee1e8c6b73fdc42ba5402d484cc7b2f121d552f58
                                              • Instruction ID: 2bc5c53516a1bc763c0678ff88425cd30c388a2178d6ab4eb064eac3af0ca907
                                              • Opcode Fuzzy Hash: 5058d138d4f11681c252665ee1e8c6b73fdc42ba5402d484cc7b2f121d552f58
                                              • Instruction Fuzzy Hash: D5111B31F002598F8B90EFBCD8459AEB7F6FF8D610B508429D519E7354EB389D068BA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000005.00000002.711547273.0000000005FE0000.00000040.00000001.sdmp, Offset: 05FE0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 7082065f6d4235cf019548e6b55a78b991526667818a9b6cadd5e5582cf65425
                                              • Instruction ID: 280bffe301aab4b360d2a630ed81f4e8adcaaf038b40e97b93f64864934cfb08
                                              • Opcode Fuzzy Hash: 7082065f6d4235cf019548e6b55a78b991526667818a9b6cadd5e5582cf65425
                                              • Instruction Fuzzy Hash: 79E0C935B101188B8F84EBE8D8559DDB3B2AF89215B004065D50AE7354EA689D418B61
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000005.00000002.711547273.0000000005FE0000.00000040.00000001.sdmp, Offset: 05FE0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 39e3fc42bf37789bafefa33435b655a6d932a7e239788da87918b46f772af76c
                                              • Instruction ID: fc304eb54b5bdc2c0a38c65f8691dd8880e770260cc3b1cac58e7872b0070120
                                              • Opcode Fuzzy Hash: 39e3fc42bf37789bafefa33435b655a6d932a7e239788da87918b46f772af76c
                                              • Instruction Fuzzy Hash: 8CD0A96280D3898FC7224BA0E8140243B20AE812003CA44C2885286064EA298C08CBA3
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Non-executed Functions