Play interactive tour

Edit tour

Analysis Report https://onedrive.live.com/download?cid=F9306F27ACC5AABA&resid=F9306F27ACC5AABA%21278&authkey=AEXuJUX0kEgNwa0

Overview

General Information

Sample URL:	https://onedrive.live.com/download?cid=F9306F27ACC5AABA&resid=F9306F27ACC5AABA%21278&authkey=AEXuJUX0kEgNwa0
Analysis ID:	341895
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Nanocore Rat

Detected unpacking (changes PE section rights)

Malicious sample detected (through community Yara rule)

Sigma detected: NanoCore

Sigma detected: Scheduled temp file as task from temp location

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AntiVM_3

Yara detected Nanocore RAT

.NET source code contains potential unpacker

Allocates memory in foreign processes

Connects to many ports of the same IP (likely port scanning)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

PE file contains section with special chars

PE file has nameless sections

Protects its processes via BreakOnTermination flag

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file contains strange resources

Potential browser exploit detected (process start blacklist hit)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

iexplore.exe (PID: 5152 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 5168 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5152 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

unarchiver.exe (PID: 3440 cmdline: 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\TKK3637920031.jpeg.z' MD5: 8B435F8731563566F3F49203BA277865)

7za.exe (PID: 4848 cmdline: 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\TKK3637920031.jpeg.z' MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 2024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5876 cmdline: 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

FNYVlhLumPogrzL.exe (PID: 2208 cmdline: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe MD5: E2369B4A4D2E2C7F1F8AF4F7743532E9)

schtasks.exe (PID: 1536 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FxuoZREPj' /XML 'C:\Users\user\AppData\Local\Temp\tmpE9ED.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

RegSvcs.exe (PID: 4912 cmdline: {path} MD5: 71369277D09DA0830C8C59F9E22BB23A)

schtasks.exe (PID: 4156 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp7D78.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 4168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5564 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp81FD.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 4840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

RegSvcs.exe (PID: 4868 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe 0 MD5: 71369277D09DA0830C8C59F9E22BB23A)

conhost.exe (PID: 1180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

dhcpmon.exe (PID: 4120 cmdline: 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0 MD5: 71369277D09DA0830C8C59F9E22BB23A)

conhost.exe (PID: 3880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000000E.00000002.473292400.0000000005780000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
0000000E.00000002.473292400.0000000005780000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
0000000E.00000002.473649492.0000000006050000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
0000000E.00000002.473649492.0000000006050000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
0000000E.00000002.473649492.0000000006050000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000E.00000002.473627286.0000000006040000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1646:$x1: NanoCore.ClientPluginHost
0000000E.00000002.473627286.0000000006040000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1646:$x2: NanoCore.ClientPluginHost 0x1724:$s4: PipeCreated 0x1660:$s5: IClientLoggingHost
0000000A.00000002.281072105.00000000041F1000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x30477d:$x1: NanoCore.ClientPluginHost 0x3047ba:$x2: IClientNetworkHost 0x3082ed:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000A.00000002.281072105.00000000041F1000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000A.00000002.281072105.00000000041F1000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x3044e5:$a: NanoCore 0x3044f5:$a: NanoCore 0x304729:$a: NanoCore 0x30473d:$a: NanoCore 0x30477d:$a: NanoCore 0x304544:$b: ClientPlugin 0x304746:$b: ClientPlugin 0x304786:$b: ClientPlugin 0x118bfe:$c: ProjectData 0x30466b:$c: ProjectData 0x119696:$d: DESCrypto 0x305072:$d: DESCrypto 0x30ca3e:$e: KeepAlive 0x30aa2c:$g: LogClientMessage 0x306c27:$i: get_Connected 0x3053a8:$j: #=q 0x3053d8:$j: #=q 0x3053f4:$j: #=q 0x305424:$j: #=q 0x305440:$j: #=q 0x30545c:$j: #=q
0000000E.00000002.472189305.00000000043C2000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000A.00000002.277584166.00000000030D1000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000E.00000002.466149209.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000E.00000002.466149209.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000E.00000002.466149209.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000A.00000002.280831636.0000000004071000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x981a5:$x1: NanoCore.ClientPluginHost 0x981e2:$x2: IClientNetworkHost 0x9bd15:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000A.00000002.280831636.0000000004071000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000A.00000002.280831636.0000000004071000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x97f0d:$a: NanoCore 0x97f1d:$a: NanoCore 0x98151:$a: NanoCore 0x98165:$a: NanoCore 0x981a5:$a: NanoCore 0x97f6c:$b: ClientPlugin 0x9816e:$b: ClientPlugin 0x981ae:$b: ClientPlugin 0x98093:$c: ProjectData 0x98a9a:$d: DESCrypto 0xa0466:$e: KeepAlive 0x9e454:$g: LogClientMessage 0x9a64f:$i: get_Connected 0x98dd0:$j: #=q 0x98e00:$j: #=q 0x98e1c:$j: #=q 0x98e4c:$j: #=q 0x98e68:$j: #=q 0x98e84:$j: #=q 0x98eb4:$j: #=q 0x98ed0:$j: #=q
Process Memory Space: RegSvcs.exe PID: 4912	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xeaffb:$x1: NanoCore.ClientPluginHost 0xed697:$x1: NanoCore.ClientPluginHost 0x1153a3:$x1: NanoCore.ClientPluginHost 0x12b8d3:$x1: NanoCore.ClientPluginHost 0x1320aa:$x1: NanoCore.ClientPluginHost 0x1471ca:$x1: NanoCore.ClientPluginHost 0x18dba1:$x1: NanoCore.ClientPluginHost 0xeb021:$x2: IClientNetworkHost 0x1153c9:$x2: IClientNetworkHost 0x1320ef:$x2: IClientNetworkHost 0x14720f:$x2: IClientNetworkHost 0x18dc02:$x2: IClientNetworkHost 0x193007:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1a0f79:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: RegSvcs.exe PID: 4912	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 4912	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xeaeed:$a: NanoCore 0xeaf8e:$a: NanoCore 0xeaffb:$a: NanoCore 0xeb0bc:$a: NanoCore 0xebf8d:$a: NanoCore 0xebfe0:$a: NanoCore 0xec019:$a: NanoCore 0xec08c:$a: NanoCore 0xed697:$a: NanoCore 0xed711:$a: NanoCore 0xeda7d:$a: NanoCore 0xee53b:$a: NanoCore 0xee581:$a: NanoCore 0xee748:$a: NanoCore 0x115295:$a: NanoCore 0x115336:$a: NanoCore 0x1153a3:$a: NanoCore 0x115464:$a: NanoCore 0x116335:$a: NanoCore 0x116388:$a: NanoCore 0x1163c1:$a: NanoCore
Process Memory Space: FNYVlhLumPogrzL.exe PID: 2208	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1a94ae:$x1: NanoCore.ClientPluginHost 0x1a950f:$x2: IClientNetworkHost 0x1ae914:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1bc886:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: FNYVlhLumPogrzL.exe PID: 2208	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: FNYVlhLumPogrzL.exe PID: 2208	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: FNYVlhLumPogrzL.exe PID: 2208	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1a8fb3:$a: NanoCore 0x1a8fcf:$a: NanoCore 0x1a912a:$a: NanoCore 0x1a9139:$a: NanoCore 0x1a9412:$a: NanoCore 0x1a943e:$a: NanoCore 0x1a94ae:$a: NanoCore 0x1b8ef0:$a: NanoCore 0x1b8f02:$a: NanoCore 0x1b8f3e:$a: NanoCore 0x1a905a:$b: ClientPlugin 0x1a9183:$b: ClientPlugin 0x1a9447:$b: ClientPlugin 0x1a94b7:$b: ClientPlugin 0x1b8f0b:$b: ClientPlugin 0x1b8f47:$b: ClientPlugin 0x1c177:$c: ProjectData 0x1e5a8:$c: ProjectData 0x177209:$c: ProjectData 0x17963a:$c: ProjectData 0x1a92d0:$c: ProjectData
Click to see the 20 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
14.2.RegSvcs.exe.5780000.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
14.2.RegSvcs.exe.5780000.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
14.2.RegSvcs.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
14.2.RegSvcs.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
14.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.2.RegSvcs.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
14.2.RegSvcs.exe.6050000.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
14.2.RegSvcs.exe.6050000.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
14.2.RegSvcs.exe.6050000.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.2.RegSvcs.exe.6050000.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
14.2.RegSvcs.exe.6050000.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
14.2.RegSvcs.exe.6050000.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.2.RegSvcs.exe.6040000.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1646:$x1: NanoCore.ClientPluginHost
14.2.RegSvcs.exe.6040000.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1646:$x2: NanoCore.ClientPluginHost 0x1724:$s4: PipeCreated 0x1660:$s5: IClientLoggingHost
Click to see the 9 entries

Sigma Overview

System Summary:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe, ProcessId: 4912, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Sigma detected: Scheduled temp file as task from temp location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FxuoZREPj' /XML 'C:\Users\user\AppData\Local\Temp\tmpE9ED.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FxuoZREPj' /XML 'C:\Users\user\AppData\Local\Temp\tmpE9ED.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe, ParentImage: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe, ParentProcessId: 2208, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FxuoZREPj' /XML 'C:\Users\user\AppData\Local\Temp\tmpE9ED.tmp', ProcessId: 1536

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000000E.00000002.473649492.0000000006050000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.281072105.00000000041F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.472189305.00000000043C2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.466149209.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.280831636.0000000004071000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4912, type: MEMORY
Source: Yara match	File source: Process Memory Space: FNYVlhLumPogrzL.exe PID: 2208, type: MEMORY
Source: Yara match	File source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.RegSvcs.exe.6050000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.RegSvcs.exe.6050000.5.raw.unpack, type: UNPACKEDPE

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\FxuoZREPj.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Joe Sandbox ML: detected

Source: 14.2.RegSvcs.exe.6050000.5.unpack	Avira: Label: TR/NanoCore.fadte
Source: 14.2.RegSvcs.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Compliance:

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Binary contains paths to debug symbols

Show sources

Source:	Binary string: dbpdbvcs.pdb source: RegSvcs.exe, 0000000E.00000002.468630564.0000000003000000.00000004.00000040.sdmp
Source:	Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\NanoProtectPlugin\NanoProtectClient\obj\Debug\NanoProtectClient.pdb source: RegSvcs.exe, 0000000E.00000002.470342259.0000000003351000.00000004.00000001.sdmp
Source:	Binary string: System.EnterpriseServices.Wrapper.pdb source: dhcpmon.exe, 0000001A.00000002.291671286.0000000005720000.00000002.00000001.sdmp
Source:	Binary string: .pdb71USE source: RegSvcs.exe, 0000000E.00000002.468630564.0000000003000000.00000004.00000040.sdmp
Source:	Binary string: RegSvcs.pdb source: dhcpmon.exe, dhcpmon.exe.14.dr
Source:	Binary string: vcs.pdb source: RegSvcs.exe, 0000000E.00000002.468630564.0000000003000000.00000004.00000040.sdmp
Source:	Binary string: mscorrc.pdb source: FNYVlhLumPogrzL.exe, 0000000A.00000002.281971824.0000000005760000.00000002.00000001.sdmp, RegSvcs.exe, 0000000E.00000002.473472471.0000000005D60000.00000002.00000001.sdmp, RegSvcs.exe, 00000017.00000002.291386372.0000000005120000.00000002.00000001.sdmp, dhcpmon.exe, 0000001A.00000002.291992470.00000000057D0000.00000002.00000001.sdmp

Software Vulnerabilities:

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 02D5097Fh	4_2_02D502A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 02D5097Eh	4_2_02D502A8
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	10_2_0520D8F8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 4x nop then mov esp, ebp	14_2_05558917

Source: C:\Program Files\internet explorer\iexplore.exe

Process created: C:\Windows\SysWOW64\unarchiver.exe

Jump to behavior

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49731 -> 194.5.98.120:58103
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49734 -> 194.5.98.120:58103
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49735 -> 194.5.98.120:58103
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49737 -> 194.5.98.120:58103
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49741 -> 194.5.98.120:58103
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49747 -> 194.5.98.120:58103
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49748 -> 194.5.98.120:58103
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49749 -> 194.5.98.120:58103
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49750 -> 194.5.98.120:58103
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49751 -> 194.5.98.120:58103
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49754 -> 194.5.98.120:58103
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49755 -> 194.5.98.120:58103
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49756 -> 194.5.98.120:58103
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49757 -> 194.5.98.120:58103

Connects to many ports of the same IP (likely port scanning)

Show sources

Source: global traffic

TCP traffic: 194.5.98.120 ports 0,1,3,58103,5,8

Uses dynamic DNS services

Show sources

Source: unknown

DNS query: name: strongodss.ddns.net

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

Code function: 14_2_05672FE2 WSARecv,

14_2_05672FE2

Source: unknown

DNS traffic detected: queries for: onedrive.live.com

Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.277334850.0000000003071000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/experimentDataSet.xsd
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.258338420.000000000559C000.00000004.00000001.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.259181693.000000000559C000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.259925336.000000000559C000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html(
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.259181693.000000000559C000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/v
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.259925336.000000000559C000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersm
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.259679205.000000000559C000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designerst
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.259679205.000000000559C000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersz
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.281721786.0000000005570000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comam
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.281721786.0000000005570000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comion
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.281721786.0000000005570000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.como8
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.257114831.0000000005580000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.257114831.0000000005580000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn7
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.257114831.0000000005580000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnG
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.257114831.0000000005580000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnW
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.256845249.000000000559C000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnv
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.261814632.000000000559C000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.261981799.000000000559C000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmG
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.258413038.000000000559C000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.258338420.000000000559C000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.comp
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.258338420.000000000559C000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.comr
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.257491913.000000000559F000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com(
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.261253439.000000000559C000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.de
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.259111467.000000000559C000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.de2
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.261207771.000000000559C000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deO
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.259111467.000000000559C000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.dey
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Source: RegSvcs.exe, 0000000E.00000002.473649492.0000000006050000.00000004.00000001.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000000E.00000002.473649492.0000000006050000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.281072105.00000000041F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.472189305.00000000043C2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.466149209.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.280831636.0000000004071000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4912, type: MEMORY
Source: Yara match	File source: Process Memory Space: FNYVlhLumPogrzL.exe PID: 2208, type: MEMORY
Source: Yara match	File source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.RegSvcs.exe.6050000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.RegSvcs.exe.6050000.5.raw.unpack, type: UNPACKEDPE

Operating System Destruction:

Protects its processes via BreakOnTermination flag

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

Process information set: 01 00 00 00

Jump to behavior

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 0000000E.00000002.473292400.0000000005780000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000E.00000002.473649492.0000000006050000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000E.00000002.473627286.0000000006040000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000A.00000002.281072105.00000000041F1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000A.00000002.281072105.00000000041F1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000E.00000002.466149209.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000E.00000002.466149209.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000A.00000002.280831636.0000000004071000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000A.00000002.280831636.0000000004071000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: RegSvcs.exe PID: 4912, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: RegSvcs.exe PID: 4912, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: FNYVlhLumPogrzL.exe PID: 2208, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: FNYVlhLumPogrzL.exe PID: 2208, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.RegSvcs.exe.5780000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.RegSvcs.exe.6050000.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.RegSvcs.exe.6050000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.RegSvcs.exe.6040000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth

PE file contains section with special chars

Show sources

Source: FNYVlhLumPogrzL.exe.5.dr	Static PE information: section name: }PT(h{>
Source: FxuoZREPj.exe.10.dr	Static PE information: section name: }PT(h{>

PE file has nameless sections

Show sources

Source: FNYVlhLumPogrzL.exe.5.dr	Static PE information: section name:
Source: FxuoZREPj.exe.10.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_0121ABEE NtQuerySystemInformation,	10_2_0121ABEE
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_0121ABB3 NtQuerySystemInformation,	10_2_0121ABB3
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_05671572 NtSetInformationProcess,	14_2_05671572
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_05671836 NtQuerySystemInformation,	14_2_05671836
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_05671541 NtSetInformationProcess,	14_2_05671541
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_056717FB NtQuerySystemInformation,	14_2_056717FB

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4_2_02D502A8	4_2_02D502A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4_2_02D50299	4_2_02D50299
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_0520B118	10_2_0520B118
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_05203DA8	10_2_05203DA8
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_0520D8F8	10_2_0520D8F8
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_05202660	10_2_05202660
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_05201E68	10_2_05201E68
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_05202EEA	10_2_05202EEA
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_0520ED28	10_2_0520ED28
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_05205D28	10_2_05205D28
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_05200110	10_2_05200110
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_05205D18	10_2_05205D18
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_05206178	10_2_05206178
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_05203D45	10_2_05203D45
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_05201DB8	10_2_05201DB8
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_05205580	10_2_05205580
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_05205590	10_2_05205590
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_052099F0	10_2_052099F0
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_05205831	10_2_05205831
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_0520A060	10_2_0520A060
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_05206C67	10_2_05206C67
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_05205B38	10_2_05205B38
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_05205B48	10_2_05205B48
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_05205FA0	10_2_05205FA0
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_05205F90	10_2_05205F90
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_0520AA40	10_2_0520AA40
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_05201283	10_2_05201283
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_06082182	10_2_06082182
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_060821A6	10_2_060821A6
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_061D2E44	10_2_061D2E44
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_061D1380	10_2_061D1380
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_061D1BE0	10_2_061D1BE0
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_061D1BD0	10_2_061D1BD0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_02E47ABE	14_2_02E47ABE
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_0555B530	14_2_0555B530
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_05553850	14_2_05553850
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_055523A0	14_2_055523A0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_05552FA8	14_2_05552FA8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_05559A68	14_2_05559A68
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_05558E68	14_2_05558E68
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_0555306F	14_2_0555306F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_0555A310	14_2_0555A310
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_05559B2F	14_2_05559B2F

Source: FNYVlhLumPogrzL.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FxuoZREPj.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: 0000000E.00000002.473292400.0000000005780000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000E.00000002.473292400.0000000005780000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000E.00000002.473649492.0000000006050000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000E.00000002.473649492.0000000006050000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000E.00000002.473627286.0000000006040000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000E.00000002.473627286.0000000006040000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000A.00000002.281072105.00000000041F1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000A.00000002.281072105.00000000041F1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000E.00000002.466149209.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000E.00000002.466149209.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000A.00000002.280831636.0000000004071000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000A.00000002.280831636.0000000004071000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: RegSvcs.exe PID: 4912, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: RegSvcs.exe PID: 4912, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: FNYVlhLumPogrzL.exe PID: 2208, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: FNYVlhLumPogrzL.exe PID: 2208, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 14.2.RegSvcs.exe.5780000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.RegSvcs.exe.5780000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 14.2.RegSvcs.exe.6050000.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.RegSvcs.exe.6050000.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.2.RegSvcs.exe.6050000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.RegSvcs.exe.6050000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.2.RegSvcs.exe.6040000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.RegSvcs.exe.6040000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: FNYVlhLumPogrzL.exe.5.dr	Static PE information: Section: }PT(h{> ZLIB complexity 1.00031377097
Source: FxuoZREPj.exe.10.dr	Static PE information: Section: }PT(h{> ZLIB complexity 1.00031377097

Source: 14.2.RegSvcs.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 14.2.RegSvcs.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 14.2.RegSvcs.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.262334538.000000000559C000.00000004.00000001.sdmp	Binary or memory string: c.slnt
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.261981799.000000000559C000.00000004.00000001.sdmp	Binary or memory string: is a registered trademark of Bigelow & Holmes Inc.slnt
Source: FNYVlhLumPogrzL.exe, 0000000A.00000003.262028370.000000000559C000.00000004.00000001.sdmp	Binary or memory string: is a registered trademark of Bigelow & Holmes Inc.slnt

Source: classification engine

Classification label: mal100.troj.evad.win@28/24@16/1

Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_0121A592 AdjustTokenPrivileges,	10_2_0121A592
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_0121A55B AdjustTokenPrivileges,	10_2_0121A55B
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_056713F6 AdjustTokenPrivileges,	14_2_056713F6
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_056713BF AdjustTokenPrivileges,	14_2_056713BF

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

File created: C:\Program Files (x86)\DHCP Monitor

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4840:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5744:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5776:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3880:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4168:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Mutant created: \Sessions\1\BaseNamedObjects\PTXTiysVRkmEztU
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1180:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2024:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{572eb7a9-aedf-4b39-8669-f7563dab8a38}

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFC5EFD22772502ADF.TMP

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.277334850.0000000003071000.00000004.00000001.sdmp

Binary or memory string: select * from PMS;select * from PMS where

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5152 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Windows\SysWOW64\unarchiver.exe 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\TKK3637920031.jpeg.z'
Source: unknown	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\TKK3637920031.jpeg.z'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FxuoZREPj' /XML 'C:\Users\user\AppData\Local\Temp\tmpE9ED.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe {path}
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp7D78.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp81FD.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe 0
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5152 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\TKK3637920031.jpeg.z'	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\TKK3637920031.jpeg.z'	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FxuoZREPj' /XML 'C:\Users\user\AppData\Local\Temp\tmpE9ED.tmp'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe {path}	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp7D78.tmp'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp81FD.tmp'	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Run

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source:	Binary string: dbpdbvcs.pdb source: RegSvcs.exe, 0000000E.00000002.468630564.0000000003000000.00000004.00000040.sdmp
Source:	Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\NanoProtectPlugin\NanoProtectClient\obj\Debug\NanoProtectClient.pdb source: RegSvcs.exe, 0000000E.00000002.470342259.0000000003351000.00000004.00000001.sdmp
Source:	Binary string: System.EnterpriseServices.Wrapper.pdb source: dhcpmon.exe, 0000001A.00000002.291671286.0000000005720000.00000002.00000001.sdmp
Source:	Binary string: .pdb71USE source: RegSvcs.exe, 0000000E.00000002.468630564.0000000003000000.00000004.00000040.sdmp
Source:	Binary string: RegSvcs.pdb source: dhcpmon.exe, dhcpmon.exe.14.dr
Source:	Binary string: vcs.pdb source: RegSvcs.exe, 0000000E.00000002.468630564.0000000003000000.00000004.00000040.sdmp
Source:	Binary string: mscorrc.pdb source: FNYVlhLumPogrzL.exe, 0000000A.00000002.281971824.0000000005760000.00000002.00000001.sdmp, RegSvcs.exe, 0000000E.00000002.473472471.0000000005D60000.00000002.00000001.sdmp, RegSvcs.exe, 00000017.00000002.291386372.0000000005120000.00000002.00000001.sdmp, dhcpmon.exe, 0000001A.00000002.291992470.00000000057D0000.00000002.00000001.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe

Unpacked PE file: 10.2.FNYVlhLumPogrzL.exe.8c0000.0.unpack }PT(h{>:EW;.text:ER;.rsrc:R;.reloc:R;Unknown_Section4:ER; vs Unknown_Section0:EW;Unknown_Section1:ER;Unknown_Section2:R;Unknown_Section3:R;Unknown_Section4:ER;

.NET source code contains potential unpacker

Show sources

Source: 14.2.RegSvcs.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 14.2.RegSvcs.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: FNYVlhLumPogrzL.exe.5.dr	Static PE information: section name: }PT(h{>
Source: FNYVlhLumPogrzL.exe.5.dr	Static PE information: section name:
Source: FxuoZREPj.exe.10.dr	Static PE information: section name: }PT(h{>
Source: FxuoZREPj.exe.10.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_0091D5F0 push edi; iretd	10_2_0091D621
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_01224F2D push esp; ret	10_2_01224F35
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_0520887A push es; retf	10_2_0520887B
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Code function: 10_2_0520347C push edi; iretd	10_2_0520347D
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_02E4ADA8 push cs; retf	14_2_02E4ADBF
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_02E49D72 push 7802E4CBh; retf	14_2_02E49D79
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_02E4AD34 push cs; retf	14_2_02E4AD4B
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_02E4AE1B push cs; retf	14_2_02E4AE33

Source: initial sample	Static PE information: section name: }PT(h{> entropy: 7.99979160938
Source: initial sample	Static PE information: section name: }PT(h{> entropy: 7.99979160938

Source: 14.2.RegSvcs.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 14.2.RegSvcs.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='

Persistence and Installation Behavior:

Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	File created: C:\Users\user\AppData\Roaming\FxuoZREPj.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: unknown

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FxuoZREPj' /XML 'C:\Users\user\AppData\Local\Temp\tmpE9ED.tmp'

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM_3

Show sources

Source: Yara match	File source: 0000000A.00000002.277584166.00000000030D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FNYVlhLumPogrzL.exe PID: 2208, type: MEMORY

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.280276639.0000000003414000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.280276639.0000000003414000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.277334850.0000000003071000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAMEX1KR[R
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.277334850.0000000003071000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLLX1KR

Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum name: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

Window / User API: foregroundWindowGot 692

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 5868	Thread sleep count: 194 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 5868	Thread sleep time: -97000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe TID: 5388	Thread sleep time: -31500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe TID: 1564	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 6184	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

Code function: 14_2_0567161A GetSystemInfo,

14_2_0567161A

Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.280276639.0000000003414000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.277334850.0000000003071000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIX1kr
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.277334850.0000000003071000.00000004.00000001.sdmp	Binary or memory string: kr&%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\X1kr`R
Source: RegSvcs.exe, 0000000E.00000002.474066463.0000000006930000.00000002.00000001.sdmp, RegSvcs.exe, 00000017.00000002.291570681.0000000005180000.00000002.00000001.sdmp, dhcpmon.exe, 0000001A.00000002.292281119.0000000005830000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.277461898.000000000309D000.00000004.00000001.sdmp	Binary or memory string: krA"SOFTWARE\VMware, Inc.\VMware Tools
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.277334850.0000000003071000.00000004.00000001.sdmp	Binary or memory string: vmwareX1kr
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.280276639.0000000003414000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.277334850.0000000003071000.00000004.00000001.sdmp	Binary or memory string: kr#"SOFTWARE\VMware, Inc.\VMware ToolsX1kr"P
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.280276639.0000000003414000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.276452871.00000000010B2000.00000004.00000020.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware3YUN599EWin32_VideoControllerK6E3EGV8VideoController120060621000000.000000-0005627.786display.infMSBDA7FNXXYUPPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsGN93ZUV3
Source: RegSvcs.exe, 0000000E.00000002.474066463.0000000006930000.00000002.00000001.sdmp, RegSvcs.exe, 00000017.00000002.291570681.0000000005180000.00000002.00000001.sdmp, dhcpmon.exe, 0000001A.00000002.292281119.0000000005830000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.277334850.0000000003071000.00000004.00000001.sdmp	Binary or memory string: QEMUX1kr^R
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.280276639.0000000003414000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.280276639.0000000003414000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.280276639.0000000003414000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.277334850.0000000003071000.00000004.00000001.sdmp	Binary or memory string: VMWAREX1krMP
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.280276639.0000000003414000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.280276639.0000000003414000.00000004.00000001.sdmp	Binary or memory string: VMware\|9kr
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.277461898.000000000309D000.00000004.00000001.sdmp	Binary or memory string: VMWAREX1kr
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.277461898.000000000309D000.00000004.00000001.sdmp	Binary or memory string: kr87HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools\.
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.280276639.0000000003414000.00000004.00000001.sdmp	Binary or memory string: VMWARE\|9kr
Source: RegSvcs.exe, 0000000E.00000002.474066463.0000000006930000.00000002.00000001.sdmp, RegSvcs.exe, 00000017.00000002.291570681.0000000005180000.00000002.00000001.sdmp, dhcpmon.exe, 0000001A.00000002.292281119.0000000005830000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.280276639.0000000003414000.00000004.00000001.sdmp	Binary or memory string: VMware \|9kr
Source: RegSvcs.exe, 0000000E.00000002.474066463.0000000006930000.00000002.00000001.sdmp, RegSvcs.exe, 00000017.00000002.291570681.0000000005180000.00000002.00000001.sdmp, dhcpmon.exe, 0000001A.00000002.292281119.0000000005830000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: RegSvcs.exe, 0000000E.00000002.467863584.0000000001384000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllequiredPasswordLength="7" minRequiredNonalphanumericCharacters="1" passwordAttemptWindow="10" passwordStrengthRegularExpression=""/>

Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Show sources

Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe

Code function: 10_2_0121A172 CheckRemoteDebuggerPresent,

10_2_0121A172

Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 420000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 422000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: F81008	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\TKK3637920031.jpeg.z'	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FxuoZREPj' /XML 'C:\Users\user\AppData\Local\Temp\tmpE9ED.tmp'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe {path}	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp7D78.tmp'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp81FD.tmp'	Jump to behavior

Source: unarchiver.exe, 00000004.00000002.467686582.0000000001760000.00000002.00000001.sdmp, RegSvcs.exe, 0000000E.00000002.468229633.0000000001A20000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: unarchiver.exe, 00000004.00000002.467686582.0000000001760000.00000002.00000001.sdmp, RegSvcs.exe, 0000000E.00000002.468229633.0000000001A20000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: unarchiver.exe, 00000004.00000002.467686582.0000000001760000.00000002.00000001.sdmp, RegSvcs.exe, 0000000E.00000002.468229633.0000000001A20000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: unarchiver.exe, 00000004.00000002.467686582.0000000001760000.00000002.00000001.sdmp, RegSvcs.exe, 0000000E.00000002.468229633.0000000001A20000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe

Code function: 10_2_05441586 GetUserNameA,

10_2_05441586

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000000E.00000002.473649492.0000000006050000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.281072105.00000000041F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.472189305.00000000043C2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.466149209.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.280831636.0000000004071000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4912, type: MEMORY
Source: Yara match	File source: Process Memory Space: FNYVlhLumPogrzL.exe PID: 2208, type: MEMORY
Source: Yara match	File source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.RegSvcs.exe.6050000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.RegSvcs.exe.6050000.5.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Detected Nanocore Rat

Show sources

Source: FNYVlhLumPogrzL.exe, 0000000A.00000002.281072105.00000000041F1000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegSvcs.exe, 0000000E.00000002.470342259.0000000003351000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegSvcs.exe, 0000000E.00000002.470342259.0000000003351000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: RegSvcs.exe, 0000000E.00000002.470342259.0000000003351000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoProtectClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoProtectClientClientPluginResourcesNanoProtectClient.My.ResourcesMySettingsMySettingsPropertyFunctionsNanoProtectClient.NanoProtectMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsGetProtectDirectoryGetProtectFileCreateProtectFileKillNanoCoreSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeLogClientMessageSystem.IOFileExistsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedEnvironmentSpecialFolderGetFolderPathPathCombineExceptionDirectoryDirectoryInfoCreateDirectoryFileStreamCreateProjectDataSetProjectErrorClearProjectErrorProcessGetCurrentProcessKillNanoProtectClient.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoProtectClient.dlla[NanoProtect]: Checking for NanoProtect module..

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000000E.00000002.473649492.0000000006050000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.281072105.00000000041F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.472189305.00000000043C2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.466149209.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.280831636.0000000004071000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4912, type: MEMORY
Source: Yara match	File source: Process Memory Space: FNYVlhLumPogrzL.exe PID: 2208, type: MEMORY
Source: Yara match	File source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.RegSvcs.exe.6050000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.RegSvcs.exe.6050000.5.raw.unpack, type: UNPACKEDPE

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_05672B26 bind,		14_2_05672B26
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Code function: 14_2_05672AF6 bind,		14_2_05672AF6

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	Scheduled Task/Job1	Access Token Manipulation1	Disable or Modify Tools1	Input Capture11	Account Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Exploitation for Client Execution1	Boot or Logon Initialization Scripts	Process Injection312	Deobfuscate/Decode Files or Information1	LSASS Memory	File and Directory Discovery1	Remote Desktop Protocol	Input Capture11	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Scheduled Task/Job1	Logon Script (Windows)	Scheduled Task/Job1	Obfuscated Files or Information3	Security Account Manager	System Information Discovery13	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Remote Access Software1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing23	NTDS	Security Software Discovery321	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading2	LSA Secrets	Virtualization/Sandbox Evasion14	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol11	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion14	Cached Domain Credentials	Process Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Access Token Manipulation1	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Process Injection312	Proc Filesystem	System Owner/User Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Hidden Files and Directories1	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://onedrive.live.com/download?cid=F9306F27ACC5AABA&resid=F9306F27ACC5AABA%21278&authkey=AEXuJUX0kEgNwa0	1%	Virustotal		Browse
https://onedrive.live.com/download?cid=F9306F27ACC5AABA&resid=F9306F27ACC5AABA%21278&authkey=AEXuJUX0kEgNwa0	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Roaming\FxuoZREPj.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	0%	Metadefender	Browse
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
14.2.RegSvcs.exe.6050000.5.unpack	100%	Avira	TR/NanoCore.fadte	Download File
14.2.RegSvcs.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
10.2.FNYVlhLumPogrzL.exe.8c0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
strongodss.ddns.net	4%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cnW	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/dennis.htmG	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.founder.com.cn/cnG	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.sakkal.comp	0%	Avira URL Cloud	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.sakkal.comr	0%	Avira URL Cloud	safe
http://www.fontbureau.comam	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnv	0%	Avira URL Cloud	safe
http://www.urwpp.de2	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.tiro.com(	0%	Avira URL Cloud	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.fontbureau.como8	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.urwpp.deO	0%	Avira URL Cloud	safe
http://www.fontbureau.comion	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.urwpp.dey	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn7	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
strongodss.ddns.net	194.5.98.120	true	true	4%, Virustotal, Browse	unknown
onedrive.live.com	unknown	unknown	false		high
rptj2g.sn.files.1drv.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
0	true		low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/frere-jones.html(	FNYVlhLumPogrzL.exe, 0000000A.00000003.259925336.000000000559C000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cnW	FNYVlhLumPogrzL.exe, 0000000A.00000003.257114831.0000000005580000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htmG	FNYVlhLumPogrzL.exe, 0000000A.00000003.261981799.000000000559C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cnG	FNYVlhLumPogrzL.exe, 0000000A.00000003.257114831.0000000005580000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.comp	FNYVlhLumPogrzL.exe, 0000000A.00000003.258338420.000000000559C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://fontfabrik.com	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designersm	FNYVlhLumPogrzL.exe, 0000000A.00000003.259925336.000000000559C000.00000004.00000001.sdmp	false		high
http://www.sakkal.comr	FNYVlhLumPogrzL.exe, 0000000A.00000003.258338420.000000000559C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comam	FNYVlhLumPogrzL.exe, 0000000A.00000002.281721786.0000000005570000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnv	FNYVlhLumPogrzL.exe, 0000000A.00000003.256845249.000000000559C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.de2	FNYVlhLumPogrzL.exe, 0000000A.00000003.259111467.000000000559C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.ascendercorp.com/typedesigners.html	FNYVlhLumPogrzL.exe, 0000000A.00000003.258338420.000000000559C000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fonts.com	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designersz	FNYVlhLumPogrzL.exe, 0000000A.00000003.259679205.000000000559C000.00000004.00000001.sdmp	false		high
http://www.tiro.com(	FNYVlhLumPogrzL.exe, 0000000A.00000003.257491913.000000000559F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.urwpp.de	FNYVlhLumPogrzL.exe, 0000000A.00000003.261253439.000000000559C000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.como8	FNYVlhLumPogrzL.exe, 0000000A.00000002.281721786.0000000005570000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sakkal.com	FNYVlhLumPogrzL.exe, 0000000A.00000003.258413038.000000000559C000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designerst	FNYVlhLumPogrzL.exe, 0000000A.00000003.259679205.000000000559C000.00000004.00000001.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false		high
http://www.galapagosdesign.com/	FNYVlhLumPogrzL.exe, 0000000A.00000003.261814632.000000000559C000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deO	FNYVlhLumPogrzL.exe, 0000000A.00000003.261207771.000000000559C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/v	FNYVlhLumPogrzL.exe, 0000000A.00000003.259181693.000000000559C000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comion	FNYVlhLumPogrzL.exe, 0000000A.00000002.281721786.0000000005570000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false		high
http://www.urwpp.dey	FNYVlhLumPogrzL.exe, 0000000A.00000003.259111467.000000000559C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn	FNYVlhLumPogrzL.exe, 0000000A.00000003.257114831.0000000005580000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn7	FNYVlhLumPogrzL.exe, 0000000A.00000003.257114831.0000000005580000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	FNYVlhLumPogrzL.exe, 0000000A.00000002.282117897.0000000005812000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/	FNYVlhLumPogrzL.exe, 0000000A.00000003.259181693.000000000559C000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.5.98.120	unknown	Netherlands		208476	DANILENKODE	true

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	341895
Start date:	20.01.2021
Start time:	03:53:20
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://onedrive.live.com/download?cid=F9306F27ACC5AABA&resid=F9306F27ACC5AABA%21278&authkey=AEXuJUX0kEgNwa0
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.win@28/24@16/1
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 88% Number of executed functions: 506 Number of non-executed functions: 7
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): taskhostw.exe, BackgroundTransferHost.exe, ielowutil.exe, backgroundTaskHost.exe, SgrmBroker.exe, svchost.exe, UsoClient.exe Excluded IPs from analysis (whitelisted): 104.43.193.48, 52.255.188.83, 88.221.62.148, 13.107.42.13, 104.43.139.144, 13.107.42.12, 152.199.19.161, 2.20.84.85, 51.11.168.160, 92.122.213.247, 92.122.213.194, 67.26.73.254, 67.27.157.254, 8.253.207.121, 8.248.135.254, 8.248.141.254, 20.54.26.129 Excluded domains from analysis (whitelisted): odc-web-brs.onedrive.akadns.net, arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e11290.dspg.akamaiedge.net, l-0004.l-msedge.net, iecvlist.microsoft.com, odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net, go.microsoft.com, l-0003.l-msedge.net, audownload.windowsupdate.nsatc.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, auto.au.download.windowsupdate.com.c.footprint.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, sn-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net, fs.microsoft.com, odc-web-geo.onedrive.akadns.net, ie9comview.vo.msecnd.net, ris-prod.trafficmanager.net, odc-sn-files-geo.onedrive.akadns.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, odc-sn-files-brs.onedrive.akadns.net, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, cs9.wpc.v0cdn.net Execution Graph export aborted for target unarchiver.exe, PID 3440 because it is empty Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:54:36	API Interceptor	1x Sleep call for process: FNYVlhLumPogrzL.exe modified
03:54:44	API Interceptor	743x Sleep call for process: RegSvcs.exe modified
03:54:44	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run DHCP Monitor C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
03:54:45	Task Scheduler	Run new task: DHCP Monitor path: "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe" s>$(Arg0)
03:54:45	Task Scheduler	Run new task: DHCP Monitor Task path: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" s>$(Arg0)

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.7515815714465193
Encrypted:	false
SSDEEP:	384:BOj9Y8/gS7SDriLGKq1MHR5U4Ag6ihJSxUCR1rgCPKabK2t0X5P7DZ+JgWSW72uw:B+gSAdN1MH3HAFRJngW2u
MD5:	71369277D09DA0830C8C59F9E22BB23A
SHA1:	37F9781314F0F6B7E9CB529A573F2B1C8DE9E93F
SHA-256:	D4527B7AD2FC4778CC5BE8709C95AEA44EAC0568B367EE14F7357D72898C3698
SHA-512:	2F470383E3C796C4CF212EC280854DBB9E7E8C8010CE6857E58F8E7066D7516B7CD7039BC5C0F547E1F5C7F9F2287869ADFFB2869800B08B2982A88BE96E9FB7
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....{Z.................P... .......k... ........@.. ...............................[....@..................................k..K................................... k............................................... ............... ..H............text....K... ...P.................. ..`.rsrc................`..............@..@.reloc...............p..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\FNYVlhLumPogrzL.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	655
Entropy (8bit):	5.273171405160065
Encrypted:	false
SSDEEP:	12:Q3LaJU20NaL10U29hJ5g1B0U2ukyrFk70Ug+9Yz9t0U2WUXBQav:MLF20NaL329hJ5g522rWz2p29XBT
MD5:	2703120C370FBB4A8BA08C6D1754039E
SHA1:	EC0DB47BF00A4A828F796147619386C0BBEA66A1
SHA-256:	F95566974BC44F3A757CAFB1456D185D8F333AC84775089DE18310B90C18B1BC
SHA-512:	BC05A2A1BE5B122FC6D3DEA66EF4258522F13351B9754378395AAD019631E312CFD3BC990F3E3D5C7BB0BDBA1EAD54A2B34A96DEE2FCCD703721E98F6192ED48
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\4de99804c29261edb63c93616550f034\System.Management.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RegSvcs.exe.log Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	120
Entropy (8bit):	5.016405576253028
Encrypted:	false
SSDEEP:	3:QHXMKaoWglAFXMWA2yTMGfsbNXLVd49Am12MFuAvOAsDeieVyn:Q3LawlAFXMWTyAGCFLIP12MUAvvrs
MD5:	50DEC1858E13F033E6DCA3CBFAD5E8DE
SHA1:	79AE1E9131B0FAF215B499D2F7B4C595AA120925
SHA-256:	14A557E226E3BA8620BB3A70035E1E316F1E9FB5C9E8F74C07110EE90B8D8AE4
SHA-512:	1BD73338DF685A5B57B0546E102ECFDEE65800410D6F77845E50456AC70DE72929088AF19B59647F01CBA7A5ACFB399C52D9EF2402A9451366586862EF88E7BF
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..2,"System.EnterpriseServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\dhcpmon.exe.log Download File
Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	120
Entropy (8bit):	5.016405576253028
Encrypted:	false
SSDEEP:	3:QHXMKaoWglAFXMWA2yTMGfsbNXLVd49Am12MFuAvOAsDeieVyn:Q3LawlAFXMWTyAGCFLIP12MUAvvrs
MD5:	50DEC1858E13F033E6DCA3CBFAD5E8DE
SHA1:	79AE1E9131B0FAF215B499D2F7B4C595AA120925
SHA-256:	14A557E226E3BA8620BB3A70035E1E316F1E9FB5C9E8F74C07110EE90B8D8AE4
SHA-512:	1BD73338DF685A5B57B0546E102ECFDEE65800410D6F77845E50456AC70DE72929088AF19B59647F01CBA7A5ACFB399C52D9EF2402A9451366586862EF88E7BF
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..2,"System.EnterpriseServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{322791B1-5B16-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	32344
Entropy (8bit):	1.7988366230192592
Encrypted:	false
SSDEEP:	48:Iw5GcprEGwpLGhG/ap8brGIpcxHWGvnZpvxn/Gojqp9xnaOGo4tpmxuaZBGWFb9s:rfZ8Zk2b9WxTtxufxotMxlxl6Ev2
MD5:	A7487A67F1CB3462A5E7EA02EB4F883C
SHA1:	E0D53960F1724B3002F51DF542F04338E1640213
SHA-256:	DA997F577F74485F00B532187927744363FA512DB89829135ADE1DF865EB85D6
SHA-512:	A6E3A820033D9E51BD04BD3E4C035954303FDE22D50609C885F6F6151A5ECD3363831419D5C3D0B280DD5BCDD4A763A81B7CD23BF568BA8A9D2DC41897D3FA13
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{322791B3-5B16-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	19032
Entropy (8bit):	1.5986040283144574
Encrypted:	false
SSDEEP:	48:IwLGcpryGwpaeG4pQChGrapbS/rGQpBoLbGHHpcohPsTGUpQoKpVGcpm:rRZ6Qe60BS/Fjp2Ik6Ng
MD5:	B11D6E0F8AC61F0BB9D78A02AE101162
SHA1:	C8539092773AF6C520BB68D5D3758EE101071655
SHA-256:	73B18FC940E4AD252295C53FFBFE7F34C89C50289DEB6992423492E3125FD440
SHA-512:	27213E8F6F7F4ADEBA86B31DEC319D7C986203A257E5E742B4E725A07B46A430305EEE6EA3869105095A4067A3476ECA441377E9FCF3CD6567977214A14EC111
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\TKK3637920031.jpeg.z.h1ixtx1.partial Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	1135642
Entropy (8bit):	7.999815833560986
Encrypted:	true
SSDEEP:	24576:UExCZp6dTHfYmoNvEo9c+P7lO93tsmMnSTnt/B83qZUJQ96u/KV7tb:/CZp6QmGD9caOrsbnSTnt/BWq0QHQ7V
MD5:	EE856182C24F0FC4FA822F4882E5A2C2
SHA1:	846DA7258045528D385C7197960807558402A235
SHA-256:	86256445950E138455F808B4BF6A086227CC254E5A42AB929626A3DB67218D08
SHA-512:	D8C8B406CB08200490D846605628B4D0E7661F96EEA7F41ED83382CB785E0337E59895E250E9BD4689C9A6012D4B0E53604EC0CAF553326DAAAD7943B9A300D7
Malicious:	false
Reputation:	low
Preview:	Rar!....0.9 .............s!X5........... ]/...#..FNYVlhLumPogrzL.exe...jP........@0c30U.EPeT.T....t.q....o:.Uot.9........E. ....m..A&..$....l...'.......^.........@.C.... .(.....U............ ..d....@......b.p.....'......P..c...a...............w)..9.7..38.6.106..9.0..8.6.4.p...@....\...I.`..?.K....g._.... ........8......~/.u......_..`_.u.....\|_...y...!....../.....HT......D...0......#.....?.^\|OS.(gz=.\.........7K........K{?.6..........'./..H....k.......e25......M...............~..........u........P.8z..g.........d.....Y..QY.<...Y.t.?..U.<.(9..i..Lh.!.J.....<.o......j........(..+..&/.x.;.....%U..g+[..`.I....l5.].r....s..".....O..@....'..V.M.{...q<O..]...iV..)f...b.....N.....f....fPW...?G......J..c.?.e..DTY.....\ybr.Y`&V.@..........E....}r..J.ahLh..8...6..w..._.z...K...#..L.>I.e....A..f.7g........^X..sQ'F0....Qq.....*._.^..`.T../K...1%..O...H.L.Y.4....$u.^..W.s.Z...=2...M.#...w\|.....lc4i<e..;..T...a..........y.....k.7h.....x..P....I..s...PO;b......f

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\TKK3637920031.jpeg.z.h1ixtx1.partial:Zone.Identifier Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:gAWY3n:qY3n
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Reputation:	low
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\TKK3637920031.jpeg.z:Zone.Identifier Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	very short file (no magic)
Category:	modified
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:W:W
MD5:	ECCBC87E4B5CE2FE28308FD9F2A7BAF3
SHA1:	77DE68DAECD823BABBB58EDB1C8E14D7106E83BB
SHA-256:	4E07408562BEDB8B60CE05C1DECFE3AD16B72230967DE01F640B7E4729B49FCE
SHA-512:	3BAFBF08882A2D10133093A1B8433F50563B93C14ACD05B79028EB1D12799027241450980651994501423A66C276AE26C43B739BC65C4E16B10C3AF6C202AEBB
Malicious:	false
Reputation:	low
Preview:	3

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\TKK3637920031.jpeg[1].z Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	1135642
Entropy (8bit):	7.999815833560986
Encrypted:	true
SSDEEP:	24576:UExCZp6dTHfYmoNvEo9c+P7lO93tsmMnSTnt/B83qZUJQ96u/KV7tb:/CZp6QmGD9caOrsbnSTnt/BWq0QHQ7V
MD5:	EE856182C24F0FC4FA822F4882E5A2C2
SHA1:	846DA7258045528D385C7197960807558402A235
SHA-256:	86256445950E138455F808B4BF6A086227CC254E5A42AB929626A3DB67218D08
SHA-512:	D8C8B406CB08200490D846605628B4D0E7661F96EEA7F41ED83382CB785E0337E59895E250E9BD4689C9A6012D4B0E53604EC0CAF553326DAAAD7943B9A300D7
Malicious:	false
Reputation:	low
Preview:	Rar!....0.9 .............s!X5........... ]/...#..FNYVlhLumPogrzL.exe...jP........@0c30U.EPeT.T....t.q....o:.Uot.9........E. ....m..A&..$....l...'.......^.........@.C.... .(.....U............ ..d....@......b.p.....'......P..c...a...............w)..9.7..38.6.106..9.0..8.6.4.p...@....\...I.`..?.K....g._.... ........8......~/.u......_..`_.u.....\|_...y...!....../.....HT......D...0......#.....?.^\|OS.(gz=.\.........7K........K{?.6..........'./..H....k.......e25......M...............~..........u........P.8z..g.........d.....Y..QY.<...Y.t.?..U.<.(9..i..Lh.!.J.....<.o......j........(..+..&/.x.;.....%U..g+[..`.I....l5.].r....s..".....O..@....'..V.M.{...q<O..]...iV..)f...b.....N.....f....fPW...?G......J..c.?.e..DTY.....\ybr.Y`&V.@..........E....}r..J.ahLh..8...6..w..._.z...K...#..L.>I.e....A..f.7g........^X..sQ'F0....Qq.....*._.^..`.T../K...1%..O...H.L.Y.4....$u.^..W.s.Z...=2...M.#...w\|.....lc4i<e..;..T...a..........y.....k.7h.....x..P....I..s...PO;b......f

C:\Users\user\AppData\Local\Temp\JavaDeployReg.log Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	89
Entropy (8bit):	4.406442624860051
Encrypted:	false
SSDEEP:	3:oVXUoV9nT498JOGXnEoV9q4u7n:o9UoV90qEoV9q4m
MD5:	D3502D5124CC72EEADBC026B602DF179
SHA1:	B9B87B7A44940CD0F026A6859C0B83D3BEEE00E6
SHA-256:	DA9E6042C62714DF48DFB11A669BB50650CDD75CCB481FEF2D5BC88781945562
SHA-512:	4EC85300B08B436C63B0CA2B746D147C7A9DCF6D8574AC305077BD97E08E603E4FB46F4D816A2702B53B0647FCF4800B3CBE663E8ABBFE3E331656280E00F7C0
Malicious:	false
Reputation:	low
Preview:	[2021/01/20 03:54:07.301] Latest deploy version: ..[2021/01/20 03:54:07.316] 11.211.2 ..

C:\Users\user\AppData\Local\Temp\bpkrjtup.j3x\unarchiver.log Download File
Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2503
Entropy (8bit):	5.230675390203555
Encrypted:	false
SSDEEP:	48:kcdDyjcbWcyGncyGbncyGncyGphcyGbncyGncyGpCDyjcyGHxcyGPDyjcyGGicyN:lQde9eUdw0
MD5:	EA43926E4B4D250F520897C7F577A097
SHA1:	9E1545DB57DBE43B041D4DCC1669A91032B165DE
SHA-256:	821DCF685A76A7EC2E87165109A46A790A18089201E7FA3E32B761B5E0BAD1FC
SHA-512:	4CD9F65C789DA016911BED4E82ADF65133C3DA9D3AC0C2B447E1C00CBDECDCEADC02FFBF1C3B03CD606134D988F839221B30090CDD8D33301EC4250965A3E8AB
Malicious:	false
Reputation:	low
Preview:	01/20/2021 3:54 AM: Unpack: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\TKK3637920031.jpeg.z..01/20/2021 3:54 AM: Tmp dir: C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt..01/20/2021 3:54 AM: Received from standard out: ..01/20/2021 3:54 AM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..01/20/2021 3:54 AM: Received from standard out: ..01/20/2021 3:54 AM: Received from standard out: Scanning the drive for archives:..01/20/2021 3:54 AM: Received from standard out: 1 file, 1135642 bytes (1110 KiB)..01/20/2021 3:54 AM: Received from standard out: ..01/20/2021 3:54 AM: Received from standard out: Extracting archive: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\TKK3637920031.jpeg.z..01/20/2021 3:54 AM: Received from standard out: WARNING:..01/20/2021 3:54 AM: Received from standard out: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\TKK3637920031.jpeg.z..01/20/2021 3:54

C:\Users\user\AppData\Local\Temp\tmp7D78.tmp Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	5.135021273392143
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0mn4xtn:cbk4oL600QydbQxIYODOLedq3Z4j
MD5:	40B11EF601FB28F9B2E69D36857BF2EC
SHA1:	B6454020AD2CEED193F4792B77001D0BD741B370
SHA-256:	C51E12D18CC664425F6711D8AE2507068884C7057092CFA11884100E1E9D49E1
SHA-512:	E3C5BCC714CBFCA4B8058DDCDDF231DCEFA69C15881CE3F8123E59ED45CFB5DA052B56E1945DCF8DC7F800D62F9A4EECB82BCA69A66A1530787AEFFEB15E2BD5
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Local\Temp\tmp81FD.tmp Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1310
Entropy (8bit):	5.109425792877704
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0R3xtn:cbk4oL600QydbQxIYODOLedq3S3j
MD5:	5C2F41CFC6F988C859DA7D727AC2B62A
SHA1:	68999C85FC7E37BAB9216E0099836D40D4545C1C
SHA-256:	98B6E66B6C2173B9B91FC97FE51805340EFDE978B695453742EBAB631018398B
SHA-512:	B5DA5DA378D038AFBF8A7738E47921ED39F9B726E2CAA2993D915D9291A3322F94EFE8CCA6E7AD678A670DB19926B22B20E5028460FCC89CEA7F6635E7557334
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Local\Temp\tmpE9ED.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.194281179975877
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBetn:cbh47TlNQ//rydbz9I3YODOLNdq3q
MD5:	4AFEB34191C071F283C4F2BC626AF07E
SHA1:	EAB2F0CF9C862D7F97E9E9921E19266069658424
SHA-256:	CA9238A1CC8E52FAA083A8865A0623EAACCD12F3F95AA96D89CB53E3DFA11737
SHA-512:	2B8E7F57A6F7B64B8C77B8960B445047865BB36B54BCC2A16811ECA1335A65BF3C7685711444EA7974C57EE7F712BBB625A68F49F6EE3F2559C51733AB46F38D
Malicious:	true
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe Download File
Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1505792
Entropy (8bit):	7.429842059066444
Encrypted:	false
SSDEEP:	24576:8+6JbyWvhKxiSA7Xv7z4JNWDxvSNSNb5jNb:dchKiS+vvVYM5D
MD5:	E2369B4A4D2E2C7F1F8AF4F7743532E9
SHA1:	FF73F21E4CA57111DCB38051A92CE59AC48E7498
SHA-256:	CE82DC0464405C155279812B9506998991C7FB74CE59DFCABEE337DA9CDB757A
SHA-512:	26AB837582235DB7300873CEE599FEF96503FB1B80EE9B81AB54B12BDF5C7D4E4FAB660FB7F931AC4F00CC684EC4BC35EF40539A3671907729F0E517CF52FEB6
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....h.`..............0..............@....... ....@.. .......................`............@.....................................K....`....................... .......................................................@..................H...........}PT.(h{>.]... ...^..................@....text...`............b.............. ..`.rsrc........`.......>..............@..@.reloc....... ......................@..B.............@...................... ..`........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFC5EFD22772502ADF.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	12981
Entropy (8bit):	0.44390090907631574
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9loUF9lo09lWvpbWpdL:kBqoIPZvpSpdL
MD5:	F4EC83EB47B455BD5E2BC09BAA0CBC72
SHA1:	05FEF35A8F33B35B3B8A6F22B912BADADB237C77
SHA-256:	95DDC1E3B611A39DE76BA208B601354349D4B332945E53D408A5BC3C40AB2B9D
SHA-512:	B8E253CBAA3F710FF9FD0AB7E7EDCFE020F3F636B3FBCA0B3997E652305812E780D8009B9B926E098CEFA1C0D2B6AC0F0C5F3647FD0184BE2AC60817B9610318
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFE94FC4F1589F59FF.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	29989
Entropy (8bit):	0.3301349720454092
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lRg9lRA9lTS9lTy9lSSd9lSSd9lwtyqv9lwtyqv9l2tyqs:kBqoxKAuvScS+oLoFou+oboKy
MD5:	67E50969A57D1702F83443D98F965B36
SHA1:	4F417FCA16108ADDBE783277DC520E0B15783042
SHA-256:	244970D1466095F000EACF6003A8964EB318311E2D7415B70A3517C9D9361CCF
SHA-512:	C366FD66431A41A3378859B9B7C14E1BEE38BB171B02197C087EE577538CE6DCC0F74E67337BF7EEE51D55D7E85687E01AF966CFE215D1FC20404CD4EFD6C8C4
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
File Type:	data
Category:	dropped
Size (bytes):	1488
Entropy (8bit):	7.094528505897445
Encrypted:	false
SSDEEP:	24:IQnybgCUtvd7RFBFSBvv8UQnybgCUtvd7RFBFSBvv8UQnybgCUtvd7RFBFSBvv8R:Ik/t3FmH8Uk/t3FmH8Uk/t3FmH8Uk/tP
MD5:	FA1E30035440350B350A67A97D629526
SHA1:	F28C5C85A69BDC11296921DD4840F57EA624C5E8
SHA-256:	A1B53D5F3983483EA34CC768A38248F849160EEE6C8477C451CF5CE2985D5DE9
SHA-512:	359FF4147C7C5A0C6331A05E9129C08DCF678285F4DACFBAA86AD33B9D50EE8F028B9836AB6D9E1DAC54E11144EC34020153E2E73158DA0311B278BF446E4069
Malicious:	false
Reputation:	low
Preview:	Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL....f.Z#.\|...@HkG....G..OV..........pz...."....r...w&&\|..c..3}~.....~...os..f.......4..1.gJ.'.d".L...A.t...F.{....C.\|&.wGj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL....f.Z#.\|...@HkG....G..OV..........pz...."....r...w&&\|..c..3}~.....~...os..f.......4..1.gJ.'.d".L...A.t...F.{....C.\|&.wGj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL....f.Z#.\|...@HkG....G..OV..........pz...."....r...w&&\|..c..3}~.....~...os..f.......4..1.gJ.'.d".L...A.t...F.{....C.\|&.wGj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL....f.Z#.\|...@HkG....G..OV..........pz...."....r...w&&\|..c..3}~.....~...os..f.......4..1.gJ.'.d".L...A.t...F.{....C.\|&.wGj.h\.3.

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:6f4:04
MD5:	6262F7C072E709CB42A451761371F212
SHA1:	70CBCCEA7042E0E927B8C3939EB82F73815C6072
SHA-256:	AAC01F2674B55898586C9D2527C7E2835201CDEDBAC46DD3164BC6487111C2D1
SHA-512:	0BA0EB1B54EA34EBD46AE817088AAC38ACA02AF831EDBFB934C60AD8BCFE1BA9C6D0DD9CA82445BE1516BDBFAFDDC81DA42AE2FC9D2AA8AEC7E5CECBC5E0297E
Malicious:	true
Reputation:	low
Preview:	.gb,:..H

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.795707286467131
Encrypted:	false
SSDEEP:	3:oMty8WbSX/MNn:oMLWus
MD5:	D685103573539B7E9FDBF5F1D7DD96CE
SHA1:	4B2FE6B5C0B37954B314FCAEE1F12237A9B02D07
SHA-256:	D78BC23B0CA3EDDF52D56AB85CDC30A71B3756569CB32AA2F6C28DBC23C76E8E
SHA-512:	17769A5944E8929323A34269ABEEF0861D5C6799B0A27F5545FBFADC80E5AB684A471AD6F6A7FC623002385154EA89DE94013051E09120AB94362E542AB0F1DD
Malicious:	false
Reputation:	low
Preview:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

C:\Users\user\AppData\Roaming\FxuoZREPj.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1505792
Entropy (8bit):	7.429842059066444
Encrypted:	false
SSDEEP:	24576:8+6JbyWvhKxiSA7Xv7z4JNWDxvSNSNb5jNb:dchKiS+vvVYM5D
MD5:	E2369B4A4D2E2C7F1F8AF4F7743532E9
SHA1:	FF73F21E4CA57111DCB38051A92CE59AC48E7498
SHA-256:	CE82DC0464405C155279812B9506998991C7FB74CE59DFCABEE337DA9CDB757A
SHA-512:	26AB837582235DB7300873CEE599FEF96503FB1B80EE9B81AB54B12BDF5C7D4E4FAB660FB7F931AC4F00CC684EC4BC35EF40539A3671907729F0E517CF52FEB6
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....h.`..............0..............@....... ....@.. .......................`............@.....................................K....`....................... .......................................................@..................H...........}PT.(h{>.]... ...^..................@....text...`............b.............. ..`.rsrc........`.......>..............@..@.reloc....... ......................@..B.............@...................... ..`........................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv Download File
Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.93892350100959
Encrypted:	false
SSDEEP:	6:zx3M7/LDkRLELQbSBYBXVNYUqKRLipilFWepYF:zKLLDkOcPBFNYUXQpmWeSF
MD5:	B806DB526EF386AF03CC861D9EDAC7F0
SHA1:	752F5CFD27F955733B3C0AA2BD2C93B5F6E04E95
SHA-256:	B6428BBB155A23F61A036BFCFD37556FC1B324CEC458BB9C663501B223EA270E
SHA-512:	C17DB7F8CCB1FB6F6C1AEBDAA8005E63F969BCB5BBF5BE2E39325ED9567E7665A305928948961270C0109EE7BF2808DB630DF9F840C21D1B650BB9C9026A1591
Malicious:	false
Reputation:	low
Preview:	Microsoft (R) .NET Framework Services Installation Utility Version 2.0.50727.8922..Copyright (c) Microsoft Corporation. All rights reserved......The following installation error occurred:..1: Assembly not found: '0'...

Static File Info

No static file info

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/20/21-03:54:48.008225	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49731	58103	192.168.2.3	194.5.98.120
01/20/21-03:54:56.820534	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49734	58103	192.168.2.3	194.5.98.120
01/20/21-03:55:03.342741	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49735	58103	192.168.2.3	194.5.98.120
01/20/21-03:55:09.582405	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49737	58103	192.168.2.3	194.5.98.120
01/20/21-03:55:15.909410	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49741	58103	192.168.2.3	194.5.98.120
01/20/21-03:55:22.587171	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49747	58103	192.168.2.3	194.5.98.120
01/20/21-03:55:29.017083	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49748	58103	192.168.2.3	194.5.98.120
01/20/21-03:55:35.413547	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49749	58103	192.168.2.3	194.5.98.120
01/20/21-03:55:41.772538	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49750	58103	192.168.2.3	194.5.98.120
01/20/21-03:55:48.143018	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49751	58103	192.168.2.3	194.5.98.120
01/20/21-03:55:54.481130	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49754	58103	192.168.2.3	194.5.98.120
01/20/21-03:56:00.951320	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49755	58103	192.168.2.3	194.5.98.120
01/20/21-03:56:07.393192	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49756	58103	192.168.2.3	194.5.98.120
01/20/21-03:56:13.758406	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49757	58103	192.168.2.3	194.5.98.120

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 20, 2021 03:54:47.529011011 CET	49731	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:54:47.830319881 CET	58103	49731	194.5.98.120	192.168.2.3
Jan 20, 2021 03:54:47.831140041 CET	49731	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:54:48.008224964 CET	49731	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:54:48.440855980 CET	58103	49731	194.5.98.120	192.168.2.3
Jan 20, 2021 03:54:48.442153931 CET	49731	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:54:48.956835032 CET	58103	49731	194.5.98.120	192.168.2.3
Jan 20, 2021 03:54:48.957067966 CET	49731	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:54:49.266015053 CET	58103	49731	194.5.98.120	192.168.2.3
Jan 20, 2021 03:54:49.266845942 CET	49731	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:54:49.766807079 CET	58103	49731	194.5.98.120	192.168.2.3
Jan 20, 2021 03:54:49.767000914 CET	49731	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:54:49.937417984 CET	49731	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:54:50.168019056 CET	58103	49731	194.5.98.120	192.168.2.3
Jan 20, 2021 03:54:50.168078899 CET	58103	49731	194.5.98.120	192.168.2.3
Jan 20, 2021 03:54:50.168143988 CET	49731	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:54:50.168407917 CET	49731	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:54:54.082894087 CET	49734	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:54:56.816750050 CET	58103	49734	194.5.98.120	192.168.2.3
Jan 20, 2021 03:54:56.820005894 CET	49734	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:54:56.820533991 CET	49734	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:54:57.237874985 CET	58103	49734	194.5.98.120	192.168.2.3
Jan 20, 2021 03:54:57.240032911 CET	49734	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:54:57.780216932 CET	58103	49734	194.5.98.120	192.168.2.3
Jan 20, 2021 03:54:57.780397892 CET	49734	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:54:58.098011017 CET	58103	49734	194.5.98.120	192.168.2.3
Jan 20, 2021 03:54:58.098129988 CET	49734	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:54:58.597875118 CET	58103	49734	194.5.98.120	192.168.2.3
Jan 20, 2021 03:54:58.597979069 CET	49734	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:54:58.827852964 CET	49734	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:54:58.964821100 CET	58103	49734	194.5.98.120	192.168.2.3
Jan 20, 2021 03:54:58.964873075 CET	58103	49734	194.5.98.120	192.168.2.3
Jan 20, 2021 03:54:58.964911938 CET	49734	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:54:58.964951992 CET	49734	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:03.030318975 CET	49735	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:03.337780952 CET	58103	49735	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:03.337918997 CET	49735	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:03.342741013 CET	49735	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:03.749732018 CET	58103	49735	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:03.749826908 CET	49735	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:04.264760971 CET	58103	49735	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:04.264966011 CET	49735	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:04.602734089 CET	58103	49735	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:04.604691029 CET	49735	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:05.101712942 CET	58103	49735	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:05.101844072 CET	49735	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:05.140908957 CET	49735	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:09.275145054 CET	49737	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:09.580842018 CET	58103	49737	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:09.581091881 CET	49737	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:09.582405090 CET	49737	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:09.997281075 CET	58103	49737	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:09.997512102 CET	49737	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:10.496800900 CET	58103	49737	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:10.497140884 CET	49737	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:10.803798914 CET	58103	49737	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:10.803916931 CET	49737	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:11.310498953 CET	58103	49737	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:11.310585976 CET	49737	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:11.453814030 CET	49737	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:11.687410116 CET	58103	49737	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:11.687463999 CET	58103	49737	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:11.687587023 CET	49737	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:15.585464001 CET	49741	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:15.887204885 CET	58103	49741	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:15.887425900 CET	49741	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:15.909410000 CET	49741	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:16.408720970 CET	58103	49741	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:16.408848047 CET	49741	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:16.442087889 CET	58103	49741	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:16.485321045 CET	49741	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:16.900816917 CET	58103	49741	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:16.900907040 CET	49741	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:17.610424042 CET	49741	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:17.782635927 CET	49741	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:18.011898041 CET	58103	49741	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:18.011975050 CET	49741	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:18.426985979 CET	58103	49741	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:18.427213907 CET	49741	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:22.268893957 CET	49747	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:22.572755098 CET	58103	49747	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:22.572989941 CET	49747	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:22.587171078 CET	49747	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:23.016845942 CET	58103	49747	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:23.017102957 CET	49747	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:23.521816015 CET	58103	49747	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:23.521918058 CET	49747	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:23.827804089 CET	58103	49747	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:23.828015089 CET	49747	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:24.336815119 CET	58103	49747	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:24.337004900 CET	49747	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:24.548867941 CET	49747	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:24.718024015 CET	58103	49747	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:24.718075991 CET	58103	49747	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:24.718169928 CET	49747	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:24.718225002 CET	49747	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:28.702466965 CET	49748	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:29.015722990 CET	58103	49748	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:29.015849113 CET	49748	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:29.017082930 CET	49748	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:29.494072914 CET	58103	49748	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:29.494796038 CET	49748	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:30.006911993 CET	58103	49748	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:30.010883093 CET	49748	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:30.338740110 CET	58103	49748	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:30.338870049 CET	49748	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:30.857769012 CET	58103	49748	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:30.858064890 CET	49748	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:30.971295118 CET	49748	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:31.257067919 CET	58103	49748	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:31.257116079 CET	58103	49748	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:31.257306099 CET	49748	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:35.104715109 CET	49749	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:35.408710003 CET	58103	49749	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:35.409291029 CET	49749	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:35.413547039 CET	49749	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:35.878659010 CET	58103	49749	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:35.878804922 CET	49749	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:36.379756927 CET	58103	49749	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:36.380014896 CET	49749	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:36.686785936 CET	58103	49749	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:36.687149048 CET	49749	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:37.185899973 CET	58103	49749	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:37.185982943 CET	49749	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:37.299812078 CET	49749	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:37.548161983 CET	58103	49749	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:37.548233986 CET	58103	49749	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:37.548355103 CET	49749	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:41.458825111 CET	49750	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:41.761822939 CET	58103	49750	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:41.762003899 CET	49750	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:41.772537947 CET	49750	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:42.227794886 CET	58103	49750	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:42.228117943 CET	49750	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:42.725742102 CET	58103	49750	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:42.725845098 CET	49750	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:43.031776905 CET	58103	49750	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:43.031976938 CET	49750	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:43.535835028 CET	58103	49750	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:43.536072969 CET	49750	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:43.613224983 CET	49750	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:43.909790039 CET	58103	49750	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:43.909859896 CET	58103	49750	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:43.910005093 CET	49750	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:43.916029930 CET	49750	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:47.814876080 CET	49751	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:48.132714033 CET	58103	49751	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:48.132836103 CET	49751	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:48.143018007 CET	49751	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:48.580107927 CET	58103	49751	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:48.580415964 CET	49751	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:49.094826937 CET	58103	49751	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:49.100476027 CET	49751	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:49.421030998 CET	58103	49751	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:49.421245098 CET	49751	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:49.936667919 CET	58103	49751	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:49.936969042 CET	49751	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:50.035406113 CET	49751	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:50.322155952 CET	58103	49751	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:50.322205067 CET	58103	49751	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:50.322330952 CET	49751	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:50.322362900 CET	49751	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:54.156202078 CET	49754	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:54.479881048 CET	58103	49754	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:54.480154037 CET	49754	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:54.481129885 CET	49754	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:54.915853024 CET	58103	49754	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:54.916188955 CET	49754	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:55.433789015 CET	58103	49754	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:55.435096025 CET	49754	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:55.753005981 CET	58103	49754	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:55.753226042 CET	49754	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:56.278058052 CET	58103	49754	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:56.278196096 CET	49754	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:56.379801035 CET	49754	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:56.668047905 CET	58103	49754	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:56.668176889 CET	49754	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:55:56.668946028 CET	58103	49754	194.5.98.120	192.168.2.3
Jan 20, 2021 03:55:56.669042110 CET	49754	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:00.636415005 CET	49755	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:00.949734926 CET	58103	49755	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:00.950177908 CET	49755	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:00.951319933 CET	49755	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:01.424730062 CET	58103	49755	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:01.424840927 CET	49755	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:01.940634966 CET	58103	49755	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:01.940735102 CET	49755	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:02.247021914 CET	58103	49755	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:02.247327089 CET	49755	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:02.753810883 CET	58103	49755	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:02.754017115 CET	49755	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:02.880403042 CET	49755	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:03.131947994 CET	58103	49755	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:03.132108927 CET	49755	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:03.132673979 CET	58103	49755	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:03.132822990 CET	49755	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:07.072005987 CET	49756	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:07.386964083 CET	58103	49756	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:07.387074947 CET	49756	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:07.393192053 CET	49756	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:07.808845997 CET	58103	49756	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:07.808952093 CET	49756	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:08.367944002 CET	58103	49756	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:08.368273020 CET	49756	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:08.701045990 CET	58103	49756	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:08.701334953 CET	49756	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:09.287880898 CET	58103	49756	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:09.288131952 CET	49756	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:09.360347986 CET	49756	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:09.672076941 CET	58103	49756	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:09.672203064 CET	49756	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:09.672877073 CET	58103	49756	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:09.672959089 CET	49756	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:13.441894054 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:13.757731915 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:13.758357048 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:13.758405924 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:14.290184021 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:14.298358917 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:14.298744917 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:14.634735107 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:14.635951996 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:15.029896975 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:15.029953003 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:15.030117035 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:15.351916075 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:15.352962971 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:15.353015900 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:15.353056908 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:15.353663921 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:15.354772091 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:15.672868013 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:15.672914982 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:15.673027039 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:15.673723936 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:15.674026012 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:15.674079895 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:15.682854891 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:15.682899952 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:15.682957888 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:15.683650017 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:15.683717012 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:15.683828115 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.021069050 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.021122932 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.021254063 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.022793055 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.022846937 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.022912979 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.031918049 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.031968117 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.032032013 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.032766104 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.032918930 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.032960892 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.032978058 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.032998085 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.033034086 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.033049107 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.033071041 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.033109903 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.033123970 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.033169031 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.033217907 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.033219099 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.033258915 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.033307076 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.346097946 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.346152067 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.346359968 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.347727060 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.347805977 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.348040104 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.348683119 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.348819017 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.348979950 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.349678040 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.349771023 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.349850893 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.356888056 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.356945038 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.357120991 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.357731104 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.357772112 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.357995033 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.358716965 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.359668016 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.359754086 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.360733032 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.360780954 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.360888004 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.365767956 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.365808010 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.365922928 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.366820097 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.366861105 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.366919994 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.367103100 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.367712975 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.367811918 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.376657963 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.376699924 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.376735926 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.376785994 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.376821995 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.376852989 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.376856089 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.376890898 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.376928091 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.376935005 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.376966000 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.376991987 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.377002001 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.377048016 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.377101898 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.427966118 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.692930937 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.692986012 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.693022966 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.693061113 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.693300009 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.693351984 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.694628954 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.694678068 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.694820881 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.695681095 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.695723057 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.695887089 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.696685076 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.696929932 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.697010994 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.697622061 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.697855949 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.697938919 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.698656082 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.699629068 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.699719906 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.700609922 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.700705051 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.700802088 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.700887918 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.704799891 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.704896927 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.704922915 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.704997063 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.705805063 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.705846071 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.705975056 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.706696033 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.706800938 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.706983089 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.707068920 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.707658052 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.707747936 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.707779884 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.707866907 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.708656073 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.708746910 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.708807945 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.708895922 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.709901094 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.710001945 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.710618019 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.710659027 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.710705996 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.710762024 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.711867094 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.711955070 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.712018967 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.712106943 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.720772028 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.720827103 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.720865965 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.720906019 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.720942974 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.720969915 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.720990896 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.721004963 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.721024036 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.721060038 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.721077919 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.721100092 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.721138000 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.721138954 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.721153021 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.721174955 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.721211910 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.721219063 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.721250057 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.721271038 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.721299887 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.721343040 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.721354961 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.721429110 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.721894026 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.721945047 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.721982002 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.722048998 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.722697973 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.722790956 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:16.756933928 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:16.757246017 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:17.020885944 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:17.020951986 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:17.021040916 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:17.021089077 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:17.021989107 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:17.022037983 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:17.022114992 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:17.031349897 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:17.031409979 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:17.031507969 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:17.031675100 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:17.031896114 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:17.031943083 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:17.031960964 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:17.031984091 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:17.032020092 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:17.032038927 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:17.032057047 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:17.032097101 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:17.032110929 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:17.032131910 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:17.032186985 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:17.040878057 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:17.042921066 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:17.392349958 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:17.392405033 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:17.392435074 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:17.392462969 CET	58103	49757	194.5.98.120	192.168.2.3
Jan 20, 2021 03:56:17.392693996 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:17.394913912 CET	49757	58103	192.168.2.3	194.5.98.120
Jan 20, 2021 03:56:17.399916887 CET	58103	49757	194.5.98.120	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 20, 2021 03:54:02.729190111 CET	64185	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:02.777236938 CET	53	64185	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:03.676873922 CET	65110	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:03.725008011 CET	53	65110	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:05.009159088 CET	58361	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:05.065478086 CET	53	58361	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:05.975086927 CET	63492	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:06.036607981 CET	53	63492	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:06.782747984 CET	60831	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:06.833441019 CET	53	60831	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:07.205457926 CET	60100	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:07.266216040 CET	53	60100	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:07.570934057 CET	53195	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:07.618897915 CET	53	53195	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:08.362644911 CET	50141	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:08.413484097 CET	53	50141	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:08.452466965 CET	53023	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:08.508713007 CET	53	53023	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:08.942565918 CET	49563	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:09.068635941 CET	53	49563	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:09.562359095 CET	51352	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:09.610358000 CET	53	51352	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:11.150671005 CET	59349	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:11.207175970 CET	53	59349	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:12.354487896 CET	57084	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:12.402340889 CET	53	57084	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:13.234826088 CET	58823	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:13.291002989 CET	53	58823	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:37.231033087 CET	57568	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:37.279220104 CET	53	57568	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:37.368045092 CET	50540	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:37.441246986 CET	53	50540	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:38.233452082 CET	57568	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:38.289963961 CET	53	57568	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:38.800327063 CET	54366	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:38.848335028 CET	53	54366	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:39.268102884 CET	57568	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:39.315892935 CET	53	57568	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:41.279442072 CET	57568	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:41.335787058 CET	53	57568	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:45.296365976 CET	57568	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:45.352533102 CET	53	57568	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:47.450515985 CET	53034	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:47.508745909 CET	53	53034	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:51.053227901 CET	57762	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:51.110755920 CET	53	57762	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:51.975824118 CET	55435	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:52.023802042 CET	53	55435	8.8.8.8	192.168.2.3
Jan 20, 2021 03:54:54.022315025 CET	50713	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:54:54.081486940 CET	53	50713	8.8.8.8	192.168.2.3
Jan 20, 2021 03:55:02.969752073 CET	56132	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:55:03.028991938 CET	53	56132	8.8.8.8	192.168.2.3
Jan 20, 2021 03:55:05.512104988 CET	58987	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:55:05.583679914 CET	53	58987	8.8.8.8	192.168.2.3
Jan 20, 2021 03:55:09.214670897 CET	56579	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:55:09.271351099 CET	53	56579	8.8.8.8	192.168.2.3
Jan 20, 2021 03:55:15.236490011 CET	60633	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:55:15.284336090 CET	53	60633	8.8.8.8	192.168.2.3
Jan 20, 2021 03:55:15.525748968 CET	61292	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:55:15.584012985 CET	53	61292	8.8.8.8	192.168.2.3
Jan 20, 2021 03:55:19.599678040 CET	63619	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:55:19.657581091 CET	53	63619	8.8.8.8	192.168.2.3
Jan 20, 2021 03:55:22.181852102 CET	64938	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:55:22.238539934 CET	53	64938	8.8.8.8	192.168.2.3
Jan 20, 2021 03:55:28.639046907 CET	61946	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:55:28.699803114 CET	53	61946	8.8.8.8	192.168.2.3
Jan 20, 2021 03:55:35.047111034 CET	64910	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:55:35.103317022 CET	53	64910	8.8.8.8	192.168.2.3
Jan 20, 2021 03:55:41.396301031 CET	52123	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:55:41.455311060 CET	53	52123	8.8.8.8	192.168.2.3
Jan 20, 2021 03:55:47.752219915 CET	56130	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:55:47.812983990 CET	53	56130	8.8.8.8	192.168.2.3
Jan 20, 2021 03:55:49.185046911 CET	56338	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:55:49.232865095 CET	53	56338	8.8.8.8	192.168.2.3
Jan 20, 2021 03:55:49.798393965 CET	59420	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:55:49.869008064 CET	53	59420	8.8.8.8	192.168.2.3
Jan 20, 2021 03:55:54.105278969 CET	58784	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:55:54.153218031 CET	53	58784	8.8.8.8	192.168.2.3
Jan 20, 2021 03:56:00.576467037 CET	63978	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:56:00.633006096 CET	53	63978	8.8.8.8	192.168.2.3
Jan 20, 2021 03:56:07.011157990 CET	62938	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:56:07.070544004 CET	53	62938	8.8.8.8	192.168.2.3
Jan 20, 2021 03:56:13.384819031 CET	55708	53	192.168.2.3	8.8.8.8
Jan 20, 2021 03:56:13.441323996 CET	53	55708	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 20, 2021 03:54:08.362644911 CET	192.168.2.3	8.8.8.8	0x64e8	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)
Jan 20, 2021 03:54:08.942565918 CET	192.168.2.3	8.8.8.8	0xaff6	Standard query (0)	rptj2g.sn.files.1drv.com	A (IP address)	IN (0x0001)
Jan 20, 2021 03:54:47.450515985 CET	192.168.2.3	8.8.8.8	0x690a	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Jan 20, 2021 03:54:54.022315025 CET	192.168.2.3	8.8.8.8	0xb3dd	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Jan 20, 2021 03:55:02.969752073 CET	192.168.2.3	8.8.8.8	0x23e	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Jan 20, 2021 03:55:09.214670897 CET	192.168.2.3	8.8.8.8	0x15f8	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Jan 20, 2021 03:55:15.525748968 CET	192.168.2.3	8.8.8.8	0xd3bb	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Jan 20, 2021 03:55:22.181852102 CET	192.168.2.3	8.8.8.8	0xa3e3	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Jan 20, 2021 03:55:28.639046907 CET	192.168.2.3	8.8.8.8	0xe619	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Jan 20, 2021 03:55:35.047111034 CET	192.168.2.3	8.8.8.8	0xa1f4	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Jan 20, 2021 03:55:41.396301031 CET	192.168.2.3	8.8.8.8	0x7d01	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Jan 20, 2021 03:55:47.752219915 CET	192.168.2.3	8.8.8.8	0x24af	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Jan 20, 2021 03:55:54.105278969 CET	192.168.2.3	8.8.8.8	0x52c0	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Jan 20, 2021 03:56:00.576467037 CET	192.168.2.3	8.8.8.8	0x5f55	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Jan 20, 2021 03:56:07.011157990 CET	192.168.2.3	8.8.8.8	0x5f4e	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Jan 20, 2021 03:56:13.384819031 CET	192.168.2.3	8.8.8.8	0xd468	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 20, 2021 03:54:08.413484097 CET	8.8.8.8	192.168.2.3	0x64e8	No error (0)	onedrive.live.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Jan 20, 2021 03:54:09.068635941 CET	8.8.8.8	192.168.2.3	0xaff6	No error (0)	rptj2g.sn.files.1drv.com	sn-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)
Jan 20, 2021 03:54:09.068635941 CET	8.8.8.8	192.168.2.3	0xaff6	No error (0)	sn-files.fe.1drv.com	odc-sn-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Jan 20, 2021 03:54:47.508745909 CET	8.8.8.8	192.168.2.3	0x690a	No error (0)	strongodss.ddns.net		194.5.98.120	A (IP address)	IN (0x0001)
Jan 20, 2021 03:54:54.081486940 CET	8.8.8.8	192.168.2.3	0xb3dd	No error (0)	strongodss.ddns.net		194.5.98.120	A (IP address)	IN (0x0001)
Jan 20, 2021 03:55:03.028991938 CET	8.8.8.8	192.168.2.3	0x23e	No error (0)	strongodss.ddns.net		194.5.98.120	A (IP address)	IN (0x0001)
Jan 20, 2021 03:55:09.271351099 CET	8.8.8.8	192.168.2.3	0x15f8	No error (0)	strongodss.ddns.net		194.5.98.120	A (IP address)	IN (0x0001)
Jan 20, 2021 03:55:15.584012985 CET	8.8.8.8	192.168.2.3	0xd3bb	No error (0)	strongodss.ddns.net		194.5.98.120	A (IP address)	IN (0x0001)
Jan 20, 2021 03:55:22.238539934 CET	8.8.8.8	192.168.2.3	0xa3e3	No error (0)	strongodss.ddns.net		194.5.98.120	A (IP address)	IN (0x0001)
Jan 20, 2021 03:55:28.699803114 CET	8.8.8.8	192.168.2.3	0xe619	No error (0)	strongodss.ddns.net		194.5.98.120	A (IP address)	IN (0x0001)
Jan 20, 2021 03:55:35.103317022 CET	8.8.8.8	192.168.2.3	0xa1f4	No error (0)	strongodss.ddns.net		194.5.98.120	A (IP address)	IN (0x0001)
Jan 20, 2021 03:55:41.455311060 CET	8.8.8.8	192.168.2.3	0x7d01	No error (0)	strongodss.ddns.net		194.5.98.120	A (IP address)	IN (0x0001)
Jan 20, 2021 03:55:47.812983990 CET	8.8.8.8	192.168.2.3	0x24af	No error (0)	strongodss.ddns.net		194.5.98.120	A (IP address)	IN (0x0001)
Jan 20, 2021 03:55:54.153218031 CET	8.8.8.8	192.168.2.3	0x52c0	No error (0)	strongodss.ddns.net		194.5.98.120	A (IP address)	IN (0x0001)
Jan 20, 2021 03:56:00.633006096 CET	8.8.8.8	192.168.2.3	0x5f55	No error (0)	strongodss.ddns.net		194.5.98.120	A (IP address)	IN (0x0001)
Jan 20, 2021 03:56:07.070544004 CET	8.8.8.8	192.168.2.3	0x5f4e	No error (0)	strongodss.ddns.net		194.5.98.120	A (IP address)	IN (0x0001)
Jan 20, 2021 03:56:13.441323996 CET	8.8.8.8	192.168.2.3	0xd468	No error (0)	strongodss.ddns.net		194.5.98.120	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: iexplore.exe PID: 5152 Parent PID: 792

General

Start time:	03:54:06
Start date:	20/01/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff6ba4a0000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: iexplore.exe PID: 5168 Parent PID: 5152

General

Start time:	03:54:06
Start date:	20/01/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5152 CREDAT:17410 /prefetch:2
Imagebase:	0xcd0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: unarchiver.exe PID: 3440 Parent PID: 5152

General

Start time:	03:54:23
Start date:	20/01/2021
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\TKK3637920031.jpeg.z'
Imagebase:	0xa30000
File size:	10240 bytes
MD5 hash:	8B435F8731563566F3F49203BA277865
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: 7za.exe PID: 4848 Parent PID: 3440

General

Start time:	03:54:24
Start date:	20/01/2021
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\TKK3637920031.jpeg.z'
Imagebase:	0x1280000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 2024 Parent PID: 4848

General

Start time:	03:54:24
Start date:	20/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 5876 Parent PID: 3440

General

Start time:	03:54:25
Start date:	20/01/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe'
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 5776 Parent PID: 5876

General

Start time:	03:54:25
Start date:	20/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: FNYVlhLumPogrzL.exe PID: 2208 Parent PID: 5876

General

Start time:	03:54:25
Start date:	20/01/2021
Path:	C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\vjk3yugy.hgt\FNYVlhLumPogrzL.exe
Imagebase:	0x8c0000
File size:	1505792 bytes
MD5 hash:	E2369B4A4D2E2C7F1F8AF4F7743532E9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000A.00000002.281072105.00000000041F1000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000A.00000002.281072105.00000000041F1000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000A.00000002.281072105.00000000041F1000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000000A.00000002.277584166.00000000030D1000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000A.00000002.280831636.0000000004071000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000A.00000002.280831636.0000000004071000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000A.00000002.280831636.0000000004071000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 1536 Parent PID: 2208

General

Start time:	03:54:39
Start date:	20/01/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FxuoZREPj' /XML 'C:\Users\user\AppData\Local\Temp\tmpE9ED.tmp'
Imagebase:	0x1030000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 5744 Parent PID: 1536

General

Start time:	03:54:40
Start date:	20/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: RegSvcs.exe PID: 4912 Parent PID: 2208

General

Start time:	03:54:40
Start date:	20/01/2021
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xd80000
File size:	32768 bytes
MD5 hash:	71369277D09DA0830C8C59F9E22BB23A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000E.00000002.473292400.0000000005780000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 0000000E.00000002.473292400.0000000005780000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000E.00000002.473649492.0000000006050000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 0000000E.00000002.473649492.0000000006050000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000E.00000002.473649492.0000000006050000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000E.00000002.473627286.0000000006040000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 0000000E.00000002.473627286.0000000006040000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000E.00000002.472189305.00000000043C2000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000E.00000002.466149209.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000E.00000002.466149209.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000E.00000002.466149209.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 4156 Parent PID: 4912

General

Start time:	03:54:42
Start date:	20/01/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp7D78.tmp'
Imagebase:	0x1030000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 4168 Parent PID: 4156

General

Start time:	03:54:43
Start date:	20/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 5564 Parent PID: 4912

General

Start time:	03:54:43
Start date:	20/01/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp81FD.tmp'
Imagebase:	0x1030000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 4840 Parent PID: 5564

General

Start time:	03:54:44
Start date:	20/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: RegSvcs.exe PID: 4868 Parent PID: 528

General

Start time:	03:54:45
Start date:	20/01/2021
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe 0
Imagebase:	0x690000
File size:	32768 bytes
MD5 hash:	71369277D09DA0830C8C59F9E22BB23A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 1180 Parent PID: 4868

General

Start time:	03:54:46
Start date:	20/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: dhcpmon.exe PID: 4120 Parent PID: 528

General

Start time:	03:54:45
Start date:	20/01/2021
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0
Imagebase:	0xea0000
File size:	32768 bytes
MD5 hash:	71369277D09DA0830C8C59F9E22BB23A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 3880 Parent PID: 4120

General

Start time:	03:54:46
Start date:	20/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: unarchiver.exe PID: 3440 Parent PID: 5152 unarchiver.exeCOMMON

Executed Functions

Function 02D502A8, Relevance: 3.0, Strings: 2, Instructions: 475COMMON

Download Yara Rule

Strings

X1kr, xrefs: 02D506DE
:@Dr, xrefs: 02D50612

Memory Dump Source

Source File: 00000004.00000002.468162963.0000000002D50000.00000040.00000001.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d50000_unarchiver.jbxd

Similarity

API ID:
String ID: :@Dr$X1kr
API String ID: 0-2776031997
Opcode ID: 52e59d6445f71ce898a38ef0f9f4ac46195a0cb3228f802efb22f0e3d49872ee
Instruction ID: 823782ce1cf82f8e8fc996509d1fb3a70aee46b46a7449d2dbb8f6142838ebc0
Opcode Fuzzy Hash: 52e59d6445f71ce898a38ef0f9f4ac46195a0cb3228f802efb22f0e3d49872ee
Instruction Fuzzy Hash: 7222F674E10218CFDB24DFA5D898B9DBBB2FB89301F1091A9E809A7355DB389D81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02D60870, Relevance: 1.0, Instructions: 982COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.468181851.0000000002D60000.00000040.00000040.sdmp, Offset: 02D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d60000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59260fb75e458609a971a23ab1a93a4eb1a5af819945c7a35a7ddea80975c940
Instruction ID: ad23db1aa6f6cf95d8f05d89af48c0b274de8827da659ca05befbca3b870032b
Opcode Fuzzy Hash: 59260fb75e458609a971a23ab1a93a4eb1a5af819945c7a35a7ddea80975c940
Instruction Fuzzy Hash: 7F11886250E3C01FEB4393301CA56E57FB1DD8313071A85DBE8888B9A3E20A080BD7A3

Uniqueness

Uniqueness Score: -1.00%

Function 02D50C28, Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.468162963.0000000002D50000.00000040.00000001.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d50000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08534963a3b9ea58a1f77aa99b0a5ab6a4b5eec7f3c0080a9a9d722c5f87958d
Instruction ID: be6ecda6abacc472b5e70107cd968eefbb3e2853b293468571aa80e30057a888
Opcode Fuzzy Hash: 08534963a3b9ea58a1f77aa99b0a5ab6a4b5eec7f3c0080a9a9d722c5f87958d
Instruction Fuzzy Hash: D551D370E02218DFDB58DFB9D490AAEBBB2BF8A301F209469E405B7354DB399941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02D50C18, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.468162963.0000000002D50000.00000040.00000001.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d50000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19a867da4c213ce52768eb1bb301af2d3c2db93274710339567e1c540ed2c1f1
Instruction ID: 191d57bb23ca3309e9d7f0556d5ebd92f07283c8754ebf3924b74320e3da1cfc
Opcode Fuzzy Hash: 19a867da4c213ce52768eb1bb301af2d3c2db93274710339567e1c540ed2c1f1
Instruction Fuzzy Hash: DB510570E022189FDB58DFB9D480AAEBBB2FF8A300F209469E445B7355CB399941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02D50AAF, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.468162963.0000000002D50000.00000040.00000001.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d50000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cabe8c70087411c167c154243eca14edece6cc8a5815da3223ac1dced7cbdd14
Instruction ID: 0ba43197b1b37607299bd5e06f6d6c67062b4077c4c0913e904aab655498e57e
Opcode Fuzzy Hash: cabe8c70087411c167c154243eca14edece6cc8a5815da3223ac1dced7cbdd14
Instruction Fuzzy Hash: D4217835D04208DFCB00DFA4E8956EEBBB6EB89305F20852AD910B7350DB796E06CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02D50AC0, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.468162963.0000000002D50000.00000040.00000001.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d50000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a09ed303ada7a7e189838bf04be4ca9351554a1d8025b4b77826db9079b7f8e8
Instruction ID: f36052ee3d427ce8f850ca2d61d97920288f5a3b420982f62e1ea02ae39cdc31
Opcode Fuzzy Hash: a09ed303ada7a7e189838bf04be4ca9351554a1d8025b4b77826db9079b7f8e8
Instruction Fuzzy Hash: 46213775D01108CFCB14DFA9D8956EEBBB6EB89305F20852AD910B7350DB786D06CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02D607F8, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.468181851.0000000002D60000.00000040.00000040.sdmp, Offset: 02D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d60000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10b3ee0d2fe96c73291139a42167ad36167638cb997bd72d1120a0bbc5b93ae4
Instruction ID: e00b031f0c617bf2d3923e592d572a7940a7565953871ea845a24087f50e5af5
Opcode Fuzzy Hash: 10b3ee0d2fe96c73291139a42167ad36167638cb997bd72d1120a0bbc5b93ae4
Instruction Fuzzy Hash: 520184B25097906FD301CB15EC41D57FBE8DF86620B09C4ABFD498B202D275BE188BB2

Uniqueness

Uniqueness Score: -1.00%

Function 02D50E20, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.468162963.0000000002D50000.00000040.00000001.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d50000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d867863960ca75ef8b0a92c9d4d3f4da5913429722e9595d2879567747f6f764
Instruction ID: 9bb56ccb3049eb28bb268fcd3d2a16cda2ea0b3b86f1bc5eb7c8c04c09dc4c2f
Opcode Fuzzy Hash: d867863960ca75ef8b0a92c9d4d3f4da5913429722e9595d2879567747f6f764
Instruction Fuzzy Hash: 3401D071C012199FCB14EFA8C485BAEBBB1BF45305F2459A9D405A7380D7B99A80CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02D605CF, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.468181851.0000000002D60000.00000040.00000040.sdmp, Offset: 02D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d60000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 992e816cf786a4f06af0424fe664e7f58f27280774eeb872b8b672ad884768e0
Instruction ID: 0f7fa542e164931195402b9bd1623e1e4715e1d7a386223c69f7a3ba58788d49
Opcode Fuzzy Hash: 992e816cf786a4f06af0424fe664e7f58f27280774eeb872b8b672ad884768e0
Instruction Fuzzy Hash: D2018676509780AFD7128B16EC51862FFF8DF8662070DC4DFED898B612D225B909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 02D50E30, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.468162963.0000000002D50000.00000040.00000001.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d50000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e6abf52438c78f0c54710a3fce20bb962efd0ded2e1ea84a46e7b229cb5fffc
Instruction ID: 6b1b0a2ba4c7b48999061d639dce772ef8a155f10111954e9e755ecd5fb9b6fb
Opcode Fuzzy Hash: 8e6abf52438c78f0c54710a3fce20bb962efd0ded2e1ea84a46e7b229cb5fffc
Instruction Fuzzy Hash: 7D01D270C01319DFCB18EFA8C445BAEBBB1AB45305F2059A9C40567380DBB99A80CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02D50BA7, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.468162963.0000000002D50000.00000040.00000001.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d50000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b96cd689d4ede5ee9625c156fc31b9ffd945631f3725aba2a2b55319e519c80c
Instruction ID: e268f90c8d9d1770aae755dcd05968e70807aee6f2383ea318a1f133108ed30a
Opcode Fuzzy Hash: b96cd689d4ede5ee9625c156fc31b9ffd945631f3725aba2a2b55319e519c80c
Instruction Fuzzy Hash: D801F2B4D0920ADBCF54DFA9C5806AEBFB1EF89300F2084AAC818A7311E7355E04DB51

Uniqueness

Uniqueness Score: -1.00%

Function 02D6081E, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.468181851.0000000002D60000.00000040.00000040.sdmp, Offset: 02D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d60000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bdd0a50cbc26144d3cf41d64ee287c5981b96fc7187f6085e277b733fe50470
Instruction ID: 184a9671f44244dcbd6c4334f37352dd764b3aa6fbe29534b779b2f7157c437d
Opcode Fuzzy Hash: 6bdd0a50cbc26144d3cf41d64ee287c5981b96fc7187f6085e277b733fe50470
Instruction Fuzzy Hash: 0AF082B29052046FD240DF05EC41896F7ECDFC4921B14C56EFC088B300E376BA144AF2

Uniqueness

Uniqueness Score: -1.00%

Function 02D50BB8, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.468162963.0000000002D50000.00000040.00000001.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d50000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a580a91029ffca34d41dc19901fc0e2c375bec429a1c1e425d7dc7dc8c20ba24
Instruction ID: ef0489f5de62d405c2c01e952311d05236f48d60e1929d98d78ce6b7b9b8be42
Opcode Fuzzy Hash: a580a91029ffca34d41dc19901fc0e2c375bec429a1c1e425d7dc7dc8c20ba24
Instruction Fuzzy Hash: 09F0F9B4D05209DBCF04DFA9C5805AEBBF1EF88300F2084AAC818A3314E7715E00DB91

Uniqueness

Uniqueness Score: -1.00%

Function 02D605F6, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.468181851.0000000002D60000.00000040.00000040.sdmp, Offset: 02D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d60000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8089cd21c1ff185bb88cce1dd1555583a9e5d3050480ed32b99ea33ead55bfb2
Instruction ID: 3c1257583f633e74c6dadd46732c358fed3329cd19a6b2f1018b1b51c24e6105
Opcode Fuzzy Hash: 8089cd21c1ff185bb88cce1dd1555583a9e5d3050480ed32b99ea33ead55bfb2
Instruction Fuzzy Hash: C4E06D766006008B9650CF0AEC41452F7D8EB88630B18C06FDC0D8B700E235B5048EA5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02D50299, Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.468162963.0000000002D50000.00000040.00000001.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d50000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c394011c453da329ba35e07d2814ebd521b7f08d6e13df493dda1d02335f62d
Instruction ID: 81302f9d74bbd07f805df396c4994a739531f158a51f30a37d71bcc2dd8fabfd
Opcode Fuzzy Hash: 4c394011c453da329ba35e07d2814ebd521b7f08d6e13df493dda1d02335f62d
Instruction Fuzzy Hash: E4810874D10604DFDB24CFA9E898ADDBBB2FB8D301F1081A9E909A7256CB3D5981CF54

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: FNYVlhLumPogrzL.exe PID: 2208 Parent PID: 5876 FNYVlhLumPogrzL.exeCOMMON

Execution Graph

Execution Coverage:	13.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.2%
Total number of Nodes:	222
Total number of Limit Nodes:	10

Executed Functions

Function 06082182, Relevance: 10.8, Strings: 8, Instructions: 779COMMON

Download Yara Rule

Strings

L, xrefs: 06082AF5
K, xrefs: 06082720
C, xrefs: 06082483
C, xrefs: 060822DC
(, xrefs: 060829DA
C, xrefs: 0608287F
I, xrefs: 06082DE1
L, xrefs: 0608264E

Memory Dump Source

Source File: 0000000A.00000002.284508563.0000000006080000.00000040.00000001.sdmp, Offset: 06080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6080000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID: ($C$C$C$I$K$L$L
API String ID: 0-1992764151
Opcode ID: 0c2b3cd61eec54f1b9a41d2002cc56844f7ef9954b0037531d4df2d9e811b342
Instruction ID: a7f43a4d7eb8a38d8ca2dee1d5efc54c27428dd4e961876991ee5ef0a644ad83
Opcode Fuzzy Hash: 0c2b3cd61eec54f1b9a41d2002cc56844f7ef9954b0037531d4df2d9e811b342
Instruction Fuzzy Hash: 8E72E470D85229CFEBA4EF24C944BEDBBB5AB59300F1091E9C099A7291DB744BC4CF85

Uniqueness

Uniqueness Score: -1.00%

Function 060821A6, Relevance: 10.7, Strings: 8, Instructions: 665COMMON

Download Yara Rule

Strings

L, xrefs: 06082AF5
K, xrefs: 06082720
C, xrefs: 06082483
C, xrefs: 060822DC
(, xrefs: 060829DA
C, xrefs: 0608287F
I, xrefs: 06082DE1
L, xrefs: 0608264E

Memory Dump Source

Source File: 0000000A.00000002.284508563.0000000006080000.00000040.00000001.sdmp, Offset: 06080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6080000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID: ($C$C$C$I$K$L$L
API String ID: 0-1992764151
Opcode ID: c86f99f73f6ccbd0d7e9744e1076a66214998b9c6e68a4b166169d7ef1d364db
Instruction ID: 57e099967ad983aff824fecdba88521c744c15483df73b57970cc37f1d9870e7
Opcode Fuzzy Hash: c86f99f73f6ccbd0d7e9744e1076a66214998b9c6e68a4b166169d7ef1d364db
Instruction Fuzzy Hash: C052D270D85229CFEBA4EF24C944BEDBBB5AB59300F1091E9C19DA6291DB744BC4CF84

Uniqueness

Uniqueness Score: -1.00%

Function 061D2E44, Relevance: 1.7, Strings: 1, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$ghr, xrefs: 061D2E67

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID: $ghr
API String ID: 0-1352911727
Opcode ID: faafe7b7ca27fd43de5e30415b7cb0ef717e90a905109cdb04136ad9ed8416bd
Instruction ID: 812a05a03301feb108712930b43fae08a0da7769345bfe40647c532fe288632e
Opcode Fuzzy Hash: faafe7b7ca27fd43de5e30415b7cb0ef717e90a905109cdb04136ad9ed8416bd
Instruction Fuzzy Hash: F722AF74E05228CFEBA8CF64C844BEDBBB1BB4A304F1084EAD519A7261DB755E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0121A55B, Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 0121A5DB

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: f156d931e456287acb9cffdac36f0d822546a42fb406a95aee2b6b692f611967
Instruction ID: 61152db5e8286a9c7eed90a3666ff85f414fd0a685551285e2ecd504305b94a6
Opcode Fuzzy Hash: f156d931e456287acb9cffdac36f0d822546a42fb406a95aee2b6b692f611967
Instruction Fuzzy Hash: 7921BF755093C4AFEB13CF25DC44B52BFF4AF56210F08849AEA858B163D270A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05441586, Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,00000E2C), ref: 054415ED

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 0b3d597500d581c4165876ea41a2c05c0fa21b9ee72cef53dedeb0070a0b3ba3
Instruction ID: f2db25df14c103131fb41686ddfc3d62c07b5986192caa51f1085964892820ca
Opcode Fuzzy Hash: 0b3d597500d581c4165876ea41a2c05c0fa21b9ee72cef53dedeb0070a0b3ba3
Instruction Fuzzy Hash: 7111A272540204AFF710DB65DC85FABBB9CEF05710F14846BEE05DB241D674A545CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0121ABB3, Relevance: 1.6, APIs: 1, Instructions: 64nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?), ref: 0121AC29

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: e94c1549e4e7f3ba5536b2271d9d9dd46c01eee28028dfbdbc3cc1d4adcf14b3
Instruction ID: 60a6ac51e1978422b840269d67ae35b8e810e490b5103a6e3404c405d13e4715
Opcode Fuzzy Hash: e94c1549e4e7f3ba5536b2271d9d9dd46c01eee28028dfbdbc3cc1d4adcf14b3
Instruction Fuzzy Hash: 2621AE7540A7C4AFDB238B20DC45A52FFB0EF26214F0980DBEA848B163D265A50DDB62

Uniqueness

Uniqueness Score: -1.00%

Function 0121A592, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 0121A5DB

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 474399045cea593a19ba6ed147ad4bb86bf9f79e04d4de0d60b541b0dbec70a0
Instruction ID: ce2289fbec4fb52029a67b7db514169224ef2b4d3db3b5ab9220846f19a57b39
Opcode Fuzzy Hash: 474399045cea593a19ba6ed147ad4bb86bf9f79e04d4de0d60b541b0dbec70a0
Instruction Fuzzy Hash: B411E031900240AFDB20CF69D884B56FFE4EF54220F08C46ADE458B216D771E408CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0121A172, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,00000E2C,?,?), ref: 0121A1BD

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 816aedebffa59c0ffa7ba9d2c62faeb1d1d4b67c7bd420e3401ae1a74d289478
Instruction ID: 44cb765940ea0aaa360cf1be2a4bb45c82a137646e782c7dd63969fcc6bdc472
Opcode Fuzzy Hash: 816aedebffa59c0ffa7ba9d2c62faeb1d1d4b67c7bd420e3401ae1a74d289478
Instruction Fuzzy Hash: DC01B171900200ABD710DF16DC82B26FBA8EB88A20F14816AED088B741E331B915CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0121ABEE, Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?), ref: 0121AC29

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 7923d648203ba3c896260a94a9e86c5028b9f6b1ac57a2e95c2f80b803d119b2
Instruction ID: d436725165e606157df5e32634c2ff1aed80f6898fa1a92a305bf41f1c8f22c9
Opcode Fuzzy Hash: 7923d648203ba3c896260a94a9e86c5028b9f6b1ac57a2e95c2f80b803d119b2
Instruction Fuzzy Hash: D801AD31910644DFDB21CF59D885B66FFE0EF28720F18C49ADE494B21AD2B5A418CF72

Uniqueness

Uniqueness Score: -1.00%

Function 05202660, Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

D-A], xrefs: 052027D4

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID: D-A]
API String ID: 0-4179597000
Opcode ID: 8611f96cc7d167461aaae2ab846bdcf9f5733929e56512655bc551589782b39a
Instruction ID: 3bbbb1ebe9f03b36b62bbc76bb4c316872df35c618c8d073b259d768c2d071b9
Opcode Fuzzy Hash: 8611f96cc7d167461aaae2ab846bdcf9f5733929e56512655bc551589782b39a
Instruction Fuzzy Hash: 89514679D1521ACFDB08CFA5C4886AEFBB2FF88300F14A12AD415B7291D7749A41CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0520D8F8, Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0208679c1940ff5c56996028085181432f211fed47163ebd09b711de6a41148
Instruction ID: 67a26f9e5f8daa035ff39fc0fa92cae69a7b23ae7f92a6965f5217f0429dd995
Opcode Fuzzy Hash: a0208679c1940ff5c56996028085181432f211fed47163ebd09b711de6a41148
Instruction Fuzzy Hash: CCD126B0D2A219CFDB24CFE5D585AADFBB2BF49300F14A42AE40ABB285D7745945CF04

Uniqueness

Uniqueness Score: -1.00%

Function 05203D45, Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f93f013220f6a40ca49a267880271e91aca2b6187f55cc60860652050adab58e
Instruction ID: 80428ba28420c14efeb87ab3ffafcda6aa7af7eb7e02c49bb2296f7e94ce9726
Opcode Fuzzy Hash: f93f013220f6a40ca49a267880271e91aca2b6187f55cc60860652050adab58e
Instruction Fuzzy Hash: 90C1A37092620ADFCB14DFE4D5848AEFBB2FF59310B14A959C411BB296C770DA81CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05203DA8, Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ccd3138ff7dba2b77575c9638d59f997ebd169e37f3642ebafcad01a6e4fbe1
Instruction ID: 0f8d9e14b268d646b6b28997a25e11af8c998021f1a16b6dbc1fb23f81626d27
Opcode Fuzzy Hash: 5ccd3138ff7dba2b77575c9638d59f997ebd169e37f3642ebafcad01a6e4fbe1
Instruction Fuzzy Hash: 29C16E7092620ADFCB14DFD4D5848AEFBB2FF59310B10A959C412BB255C770EA81CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05201DB8, Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c1fa1b34e09a27e966c3ee8bf87120458513c5fc89ea6120a89768a2c2f2fe
Instruction ID: 61bb3f0025fed7df7d609027f6d6e3061a3ecf0aab301aebc4076088a6b81285
Opcode Fuzzy Hash: 93c1fa1b34e09a27e966c3ee8bf87120458513c5fc89ea6120a89768a2c2f2fe
Instruction Fuzzy Hash: 8DA19A75D26258DFCB04CFE4D8856ADBFB2FF8A300F14A06AD401AB292D7749A11CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0520B118, Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f309f5e3affc407d182e045153c29b6a3da9bbac072d73f42cb1146383596ce6
Instruction ID: bf3779d9540f81be8cb81c3be6dc78459dd9dcec755db5e4166411344edd2095
Opcode Fuzzy Hash: f309f5e3affc407d182e045153c29b6a3da9bbac072d73f42cb1146383596ce6
Instruction Fuzzy Hash: 46A1F374D26209DFCB64DFA4E5886ADBBF2FF49310F20642AD00ABB295DB745940CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05201E68, Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c5f500c9504fc9b42c58f28bde9e626d77d51e70eed1ca57f3698c923b6eb57
Instruction ID: 3839ff9f46bf765b9e8b923795c41eb7fb1394810d76a7236cdcfc2cc4cffc9b
Opcode Fuzzy Hash: 7c5f500c9504fc9b42c58f28bde9e626d77d51e70eed1ca57f3698c923b6eb57
Instruction Fuzzy Hash: 0181EE74D25219DFDB08CFE5D984AAEBBB2FF89300F20906AD405BB294DB795A41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 061D1380, Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c9c19451bcd68eb5529e9946d0b3920d4e0471b8f9ff08b6225f164f7bcfc1c
Instruction ID: aaf28ee1d38ab592d0c6aff8d37bf73685f2fb87c831125bc7a07f8429abb833
Opcode Fuzzy Hash: 2c9c19451bcd68eb5529e9946d0b3920d4e0471b8f9ff08b6225f164f7bcfc1c
Instruction Fuzzy Hash: DB41B471F00219AFEB58DF6ED8416AEBBF7AFC5210F24C4AAD508AB255DB305D01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05202EEA, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84fe2000ccd0a87b7f9bf60fae90bcfe186be645dfbe4cd1b03714e3cbfc47ed
Instruction ID: ad9908d38efaea8a03bac8307e87dd282f1104cdb5bec9c22a4d88048b547427
Opcode Fuzzy Hash: 84fe2000ccd0a87b7f9bf60fae90bcfe186be645dfbe4cd1b03714e3cbfc47ed
Instruction Fuzzy Hash: 84214FB1E112588BDB18CFAAD8447DEFBF3AFC9310F14C06AD408A6254DB741A45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 061D1BD0, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f013b7cb6bf871b88c46b3b948544db183f83f27c061dfe94eb82c56bd95e457
Instruction ID: f0184e16a58eba2c2a9f0d69f853e344a1c5b605f869c8942008b39e2f1df5b2
Opcode Fuzzy Hash: f013b7cb6bf871b88c46b3b948544db183f83f27c061dfe94eb82c56bd95e457
Instruction Fuzzy Hash: 5C11DA71D056499BEB18CFABC8016DEBFF7AFC9200F18C4BAC408A6255EB740645DF61

Uniqueness

Uniqueness Score: -1.00%

Function 061D1BE0, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86c4dee73e5407cef8dba86648145750b52ad067eace35994340b4aec8ea92f
Instruction ID: f07dc86d43128189cee53a95301cb1a7e884a9c70b9a9a54765a06e6301bdfff
Opcode Fuzzy Hash: c86c4dee73e5407cef8dba86648145750b52ad067eace35994340b4aec8ea92f
Instruction Fuzzy Hash: 4D0197B1D05609DBEB08CFABC8416DEFAF7AFC8300F18C479C808A6259EB7416469F51

Uniqueness

Uniqueness Score: -1.00%

Function 0608353A, Relevance: 10.3, Strings: 8, Instructions: 287
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L, xrefs: 060830F1
s, xrefs: 06083291
r, xrefs: 06083298
u, xrefs: 060832C5
r, xrefs: 060832F8
p, xrefs: 06083318
t, xrefs: 060832A6
s, xrefs: 06083258

Memory Dump Source

Source File: 0000000A.00000002.284508563.0000000006080000.00000040.00000001.sdmp, Offset: 06080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6080000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID: L$p$r$r$s$s$t$u
API String ID: 0-1017642656
Opcode ID: ded086868bf4c8aca608d0b63c5d1cde37063a6b18d625790ed68a45a7db5141
Instruction ID: 2100385273bbe427a3030983ca9e01afe930c2d34a0a1af80572a5797564e300
Opcode Fuzzy Hash: ded086868bf4c8aca608d0b63c5d1cde37063a6b18d625790ed68a45a7db5141
Instruction Fuzzy Hash: 65A12D70D8D218DFEB88EFE8D4506FDBBB8AB8AB10F106555C09AA7381C7355985CF84

Uniqueness

Uniqueness Score: -1.00%

Function 060818DD, Relevance: 6.6, Strings: 5, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

u, xrefs: 060815EA
B, xrefs: 0608158B
~, xrefs: 0608189B
?, xrefs: 06081592
}, xrefs: 0608188D

Memory Dump Source

Source File: 0000000A.00000002.284508563.0000000006080000.00000040.00000001.sdmp, Offset: 06080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6080000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID: ?$B$u$}$~
API String ID: 0-554321209
Opcode ID: 98184e64a38fb68c570818422038432368e5266a89345937ef728976c43e9d86
Instruction ID: 4036077fa4ced8aeedd192baecce07ce7e0e2701da4bd9401238895df646d1a8
Opcode Fuzzy Hash: 98184e64a38fb68c570818422038432368e5266a89345937ef728976c43e9d86
Instruction Fuzzy Hash: 98C1F9B0C8E21ACEEB90EF94D4407FCBFB9AF0A314F106195D19BA6282C3744586CF84

Uniqueness

Uniqueness Score: -1.00%

Function 061D41C9, Relevance: 2.9, Strings: 2, Instructions: 408COMMON

Download Yara Rule

Strings

>_Ir, xrefs: 061D48F2
>_Ir, xrefs: 061D472F

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID: >_Ir$>_Ir
API String ID: 0-3345021283
Opcode ID: ade4961ad310ff1505638a01c9b9b4b5cf11f97674b67706ab12e7b772f3857c
Instruction ID: 9859eaa501d32e1281f78595b0ca39671ae617440e747c628ad9cfe37a0f672b
Opcode Fuzzy Hash: ade4961ad310ff1505638a01c9b9b4b5cf11f97674b67706ab12e7b772f3857c
Instruction Fuzzy Hash: 900247B0801684CFEB44DF99C148BACBBF2FB19359F55D465C01A6B252C3BAD888CF95

Uniqueness

Uniqueness Score: -1.00%

Function 06082ED8, Relevance: 2.7, Strings: 2, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L, xrefs: 06082AF5
I, xrefs: 06082DE1

Memory Dump Source

Source File: 0000000A.00000002.284508563.0000000006080000.00000040.00000001.sdmp, Offset: 06080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6080000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID: I$L
API String ID: 0-243827520
Opcode ID: a0af46b804cce5901210d75b6771776872f5f6488803c4e791e1241818b3bd65
Instruction ID: 836cefb318ed39aecdc21440c2c3ea0b42f71c166e4b800ce1cb0c5c892f546a
Opcode Fuzzy Hash: a0af46b804cce5901210d75b6771776872f5f6488803c4e791e1241818b3bd65
Instruction Fuzzy Hash: 60712870D89229CFEBA4EF28C9447ECBBB5AF55311F1095EAC04A66291DB744BC5CF80

Uniqueness

Uniqueness Score: -1.00%

Function 05441526, Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,00000E2C), ref: 054415ED

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 4fc66a0cb8e9c879b2fd96b5218e827a0ab84b470eb62f3c7d80a3a717a3a8e9
Instruction ID: d8326ec84ef2712eac72ee6e3eba8b45ee02f8b1a4c8f86cadbca77159e5f991
Opcode Fuzzy Hash: 4fc66a0cb8e9c879b2fd96b5218e827a0ab84b470eb62f3c7d80a3a717a3a8e9
Instruction Fuzzy Hash: 89417E7214E3C06FE7138B248C51BA6BFB89F03210F0945DBE985CF1A3D6689849CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0544238F, Relevance: 1.6, APIs: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0544243F

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a6e5ccc9d47eb481306b894a926e3e8c52c7e7aa6c17626a0651820370ef3382
Instruction ID: 22605c433d3148511869bd8da5d7151de11109d431949c15159cd909bc7b0140
Opcode Fuzzy Hash: a6e5ccc9d47eb481306b894a926e3e8c52c7e7aa6c17626a0651820370ef3382
Instruction Fuzzy Hash: B031D471404384AFEB228B64DC44FA7BFACEF06310F04849BF984CB152D264A809DB71

Uniqueness

Uniqueness Score: -1.00%

Function 05441C7E, Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE(?,00000E2C,0448F345,00000000,00000000,00000000,00000000), ref: 05441D28

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 6eb8e8d4c0ffb86ea388ef509fdd111b781d8738aca3baca268e494c7ae5e39a
Instruction ID: 43b86545890302499db1ba9d05a1b7c1f1f9ffe6a981639832d2f66f3d3e3db3
Opcode Fuzzy Hash: 6eb8e8d4c0ffb86ea388ef509fdd111b781d8738aca3baca268e494c7ae5e39a
Instruction Fuzzy Hash: 5B31C771509784AFEB228F64DC45FA7BFB8EF06310F0884DBE9849B153D224A949CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0121B68E, Relevance: 1.6, APIs: 1, Instructions: 92
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,00000E2C), ref: 0121B73D

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 9318da4eac6730cf6e4b7c1a7192dd9f4c9dc522b0333a493c287f9d4fe296f4
Instruction ID: 81cf4b4f2771ee75d8bdecf2595d50d1b8064f593df377a42883e6b9b759afa8
Opcode Fuzzy Hash: 9318da4eac6730cf6e4b7c1a7192dd9f4c9dc522b0333a493c287f9d4fe296f4
Instruction Fuzzy Hash: EB31A272544384AFE7228B65CC45F67BFFCEF16710F08849BEE819B152D264A409CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0544180C, Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 054418AD

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1a948476320a4506225d1ad7ff91373dcfffc589d2049238513afb040a1d54cb
Instruction ID: c3f130756636b90c2e791089a746654ebefbfb244ad80d484745a53870195cba
Opcode Fuzzy Hash: 1a948476320a4506225d1ad7ff91373dcfffc589d2049238513afb040a1d54cb
Instruction Fuzzy Hash: AA319C71544380AFE722CF65CC44FA6BFE8EF49610F0884AEE9858B252D375E809CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0121B785, Relevance: 1.6, APIs: 1, Instructions: 89
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,0448F345,00000000,00000000,00000000,00000000), ref: 0121B840

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 5f56382d9de86ec736f7f49a50040f95213b94c7048243a17a53cbcc5bd8f962
Instruction ID: 613d347265459860b1278f290eb4b8eb4594f04b1d7f1be13c2d3113ef19b67b
Opcode Fuzzy Hash: 5f56382d9de86ec736f7f49a50040f95213b94c7048243a17a53cbcc5bd8f962
Instruction Fuzzy Hash: D531B371505380AFE722CF25CC84F52BFF8EF06710F19849AEA84CB153D260E449CB61

Uniqueness

Uniqueness Score: -1.00%

Function 054408CE, Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 05440975

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 2d73057e04a826d38f4fc9514215a074bb24302058d70843cb7efbbb1d940941
Instruction ID: 8c335f93ea85c6fb1904a9f13a7384b3e366dabba5b913418ca6cefbcb68863f
Opcode Fuzzy Hash: 2d73057e04a826d38f4fc9514215a074bb24302058d70843cb7efbbb1d940941
Instruction Fuzzy Hash: 2D3181B15097806FF712CB65DC45F96FFE8EF06210F18849BE9848F292D365A909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0121A7C8, Relevance: 1.6, APIs: 1, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetExitCodeProcess.KERNELBASE(?,00000E2C,0448F345,00000000,00000000,00000000,00000000), ref: 0121A85C

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 1d30ae577144db2010b12679cb639bcdb2e741903969d550bce421bf7e69baa3
Instruction ID: 7f05e5b31346a0e1ad5accf0589923043b195b0d1b9a6a0bd882b9a49af71278
Opcode Fuzzy Hash: 1d30ae577144db2010b12679cb639bcdb2e741903969d550bce421bf7e69baa3
Instruction Fuzzy Hash: 2221F672509380AFE7128B24DC45F96BFA8EF43320F0884EBE944CF193D264A909C761

Uniqueness

Uniqueness Score: -1.00%

Function 054409CC, Relevance: 1.6, APIs: 1, Instructions: 86
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,?,?), ref: 05440A82

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: d405243219351d19652395b29be230a2c3f865efc4267f97cd7bf56f9686e9d6
Instruction ID: ee455e14fcc5bdcde86af0ecefdcf100e465a851be56d7e4efd8a7cddc9c2c29
Opcode Fuzzy Hash: d405243219351d19652395b29be230a2c3f865efc4267f97cd7bf56f9686e9d6
Instruction Fuzzy Hash: 1931D7754497C06FD3038B259C55B62BF74FF47620F0A81DBE9848B663E224691AC7B1

Uniqueness

Uniqueness Score: -1.00%

Function 0121A120, Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,00000E2C,?,?), ref: 0121A1BD

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 932c878dc4c56d55c05b18360afb6b7ee8985fc1ba21ef99091976f68a71d492
Instruction ID: f5bfa28d507cc0930004a0bea1a5a90af9fc2eb2c141dadd436aaa50b8ebf610
Opcode Fuzzy Hash: 932c878dc4c56d55c05b18360afb6b7ee8985fc1ba21ef99091976f68a71d492
Instruction Fuzzy Hash: CC31F37140D3C06FD7028B318C55B62BFB4EF87620F1985CBD9C48F1A3D224A809CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0121AE5A, Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?,00000E2C,?,?), ref: 0121AF02

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3e5090a35b4e73fcf553885710784361377d645d081a8080c6b42042f4f33f3a
Instruction ID: fa3cae56230738bcf816d929247101e890220f880139abdaf08c446eec34f3b7
Opcode Fuzzy Hash: 3e5090a35b4e73fcf553885710784361377d645d081a8080c6b42042f4f33f3a
Instruction Fuzzy Hash: 0F21947154D3C06FD3138B258C51B22BF74EF87614F0A40DBE884CB593D229A819C772

Uniqueness

Uniqueness Score: -1.00%

Function 0544164B, Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

FindWindowA.USER32(?,00000E2C), ref: 054416EE

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 146acdb753633411672c067a69f1ffeaa4c942b71d8c81789e0686ac06811f9a
Instruction ID: ad97b6c4e0f5832498ab4057bc56903c7ea8c1f6fa5f50cdc28df0a823d0c7a2
Opcode Fuzzy Hash: 146acdb753633411672c067a69f1ffeaa4c942b71d8c81789e0686ac06811f9a
Instruction Fuzzy Hash: 3821A871449380AFE7128F24DC41F96BFA8EF46710F1884DBE9449F192D2786949CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05441904, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,0448F345,00000000,00000000,00000000,00000000), ref: 05441999

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: a9af0f9c72097086eb33f92c7ba01f0b9038886087729507b0b4e2ca2e970afb
Instruction ID: 64532dabc18f7ff7eddf0846e668e4d4e7eac61627b07a2cc9ad26be11eedbef
Opcode Fuzzy Hash: a9af0f9c72097086eb33f92c7ba01f0b9038886087729507b0b4e2ca2e970afb
Instruction Fuzzy Hash: 4721F8B54493806FE7128B25DC41FA6BFA8EF47720F1884D7EE848B293D2646909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 054423C2, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0544243F

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cfe59b9d0b9223c3ede2c13850f598cd4fa2d8a0eaaf88a3d0411ba81757b9ef
Instruction ID: 0a55fa0ea834698d0014652941b6cc2c05793563160f1c210b1efedc8c7f00d1
Opcode Fuzzy Hash: cfe59b9d0b9223c3ede2c13850f598cd4fa2d8a0eaaf88a3d0411ba81757b9ef
Instruction Fuzzy Hash: 4021BD72500304AFEB21DF64DC44FABBBACEF04320F14886BFA859B251D6B0A4099B71

Uniqueness

Uniqueness Score: -1.00%

Function 0544182E, Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 054418AD

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 572fbd624f4ff658165a6563fc8655121dc825be1043bf6871fb749dd62529be
Instruction ID: 63fb860f29c9e1afef9abb8573fedf6ff4bb86d1e7d122d58e6d7ae7eae79f0c
Opcode Fuzzy Hash: 572fbd624f4ff658165a6563fc8655121dc825be1043bf6871fb749dd62529be
Instruction Fuzzy Hash: BE219A71500740AFFB21DF65C884FA6FBE8EF08710F1485AAEA858B252E771E448CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0544249D, Relevance: 1.6, APIs: 1, Instructions: 75fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 05442524

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: b1ebe1a0e1af675be62f6e3de51cffcd2686d5552004d038b7d7c1f1775d54fd
Instruction ID: 9b976a76e3d98cad562f463c2fa40816234e47f3d099ee8a5ae83fff500b64df
Opcode Fuzzy Hash: b1ebe1a0e1af675be62f6e3de51cffcd2686d5552004d038b7d7c1f1775d54fd
Instruction Fuzzy Hash: 3A21B0725493C09FEB12CB25DC51A92BFB4EF07210F0984DBEC848F263D675A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0121B6BE, Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E2C), ref: 0121B73D

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 778ea4384b7339ae00dc757de3c1cff50ca4bc2877f892907292dcf07edc1e2e
Instruction ID: 79df7d940cbd716143b13cafc8a7075089d5e139406c5d8c801454d4bc4ba921
Opcode Fuzzy Hash: 778ea4384b7339ae00dc757de3c1cff50ca4bc2877f892907292dcf07edc1e2e
Instruction Fuzzy Hash: C0219D72500204AFE721DB69DC85F6BFBFCEF14720F18885BEE459A241D660E4098B71

Uniqueness

Uniqueness Score: -1.00%

Function 0121AAEF, Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,0448F345,00000000,?,?,?,?,?,?,?,?,72F43C38), ref: 0121AB6A

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: f92c2fdc976ca26776c7475871c0b7262f4da57f9dcc602d29c28aca47cb0463
Instruction ID: 3bc6f27b6a10a269287c14101d2679af53a3de7173e8657995224aca4f08b027
Opcode Fuzzy Hash: f92c2fdc976ca26776c7475871c0b7262f4da57f9dcc602d29c28aca47cb0463
Instruction Fuzzy Hash: E0219DB55093C15FEB12CB25DC44AA2BFE8EF57210F0984DBEA848B163D2659908DB21

Uniqueness

Uniqueness Score: -1.00%

Function 05440902, Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 05440975

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 7d93745d7ab4ed17bd8d7ec8a1b02748df619f715f421a78cfc9c182f40561dc
Instruction ID: 2811335ff889c04e96c3e5c881c497ad65bf852c77d0e23c87320f7285ddf8d2
Opcode Fuzzy Hash: 7d93745d7ab4ed17bd8d7ec8a1b02748df619f715f421a78cfc9c182f40561dc
Instruction Fuzzy Hash: 93217C71544240AFF720DF65D889BAAFBE8EF04620F1484AAEE499F341D671E405CA65

Uniqueness

Uniqueness Score: -1.00%

Function 0121A1F4, Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0121A26C

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: db5219a90350a0513f7179faa992e28586f578da5afc61e67bf04d721f3dc421
Instruction ID: 726c60aa6e61125160190c555967e243176636b832d68da77c762888606a4982
Opcode Fuzzy Hash: db5219a90350a0513f7179faa992e28586f578da5afc61e67bf04d721f3dc421
Instruction Fuzzy Hash: BC216D7140A3C09FD7138B65CC95A96BFB4EF43220F0A84DBD985CF563D279A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05441AB6, Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,0448F345,00000000,00000000,00000000,00000000), ref: 05441B35

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d6b35483e23846a36ed183c5022f24d99dc3bf5e691ced1946f964c920f1a68c
Instruction ID: d9188366ef879816f445ea08d4737719887306710260c870a478bc236d9f9e8f
Opcode Fuzzy Hash: d6b35483e23846a36ed183c5022f24d99dc3bf5e691ced1946f964c920f1a68c
Instruction Fuzzy Hash: AD219272445380AFEB228F65DC45FA7FFB8EF46310F08849BEA449B252D264A408CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0121B7C6, Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,0448F345,00000000,00000000,00000000,00000000), ref: 0121B840

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 83e32999a1755f0d772330fdfb5491bfb3e752e9956f84f7236e1b9fbf3738ef
Instruction ID: 05cbf8b997de8090f5166fa2982a9751f14db39e70c8b85f162cf6566a9f9bcd
Opcode Fuzzy Hash: 83e32999a1755f0d772330fdfb5491bfb3e752e9956f84f7236e1b9fbf3738ef
Instruction Fuzzy Hash: 32218C71610604AFEB20DF29CC85F67FBFCEF14B10F14856AEE459B255D660E408CA71

Uniqueness

Uniqueness Score: -1.00%

Function 05441CBE, Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(?,00000E2C,0448F345,00000000,00000000,00000000,00000000), ref: 05441D28

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 6d4cdfa9d532ad52f30a2b5158752c9b415bc4868e1242bae94f1a1cef183d97
Instruction ID: 66326d43e62e284d27afdbca72c179cc45236d8f474f2ee57afe9c656f38cd23
Opcode Fuzzy Hash: 6d4cdfa9d532ad52f30a2b5158752c9b415bc4868e1242bae94f1a1cef183d97
Instruction Fuzzy Hash: 7D11DCB2500604AFEB21CF65DC85FABFBACEF04720F14886BEA45DB251D670A449CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0121A628, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0121A694

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 262763d589e85aca770496f7ca80813893e9029a79f56ff02f29c262a3ef647f
Instruction ID: b1cc76bf9a766836844793e881517b60fe937b3f3f4d1944bed9b9405b24a59d
Opcode Fuzzy Hash: 262763d589e85aca770496f7ca80813893e9029a79f56ff02f29c262a3ef647f
Instruction Fuzzy Hash: E921A1725093C05FDB138B25DC54692BFE4AF57224F0984DAED858F263D265A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0121A8C0, Relevance: 1.6, APIs: 1, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0121A93D

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: fb5899617148de4093bfec01d127227d729b46cf6d04db2b176a152d1dbbc93f
Instruction ID: 37d32ff620318508733fcd5cfaaf16c81f14213681591bac71ad6c0b1e72e486
Opcode Fuzzy Hash: fb5899617148de4093bfec01d127227d729b46cf6d04db2b176a152d1dbbc93f
Instruction Fuzzy Hash: CA21AC764097C09FDB238B24DC50A62BFB4EF07224F0984DFE9858B163D275A808DB62

Uniqueness

Uniqueness Score: -1.00%

Function 05442760, Relevance: 1.6, APIs: 1, Instructions: 68injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 054427E0

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ec28c3dee505e98ef9cb4e695ec37bfdc28a4170b24e7a9dfb7a6033d000ebb1
Instruction ID: 1c7a28e600ad7255cade06e48f3fd04d2f3156f0ea0dffb480c73e87796e25ed
Opcode Fuzzy Hash: ec28c3dee505e98ef9cb4e695ec37bfdc28a4170b24e7a9dfb7a6033d000ebb1
Instruction Fuzzy Hash: 4921B0765097C09FEB128F25DC45AA6FFF4EF07210F0980DFE9858B263D265A848DB21

Uniqueness

Uniqueness Score: -1.00%

Function 05440AAB, Relevance: 1.6, APIs: 1, Instructions: 67libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E2C), ref: 05440B37

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 769c752de8838e4616d7cd005b2c52e13c14890c0a8a3fc42044002ebdbf2bad
Instruction ID: 88e8a934317482410c369f9b34fbff6ce40d853c730179f9367ee9c97ca73132
Opcode Fuzzy Hash: 769c752de8838e4616d7cd005b2c52e13c14890c0a8a3fc42044002ebdbf2bad
Instruction Fuzzy Hash: CA210571504380AFE721CB10CC85FA6BFA8EF02720F14849AEE445F282C264A948CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0121A34F, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 0121A3BE

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 8fd8f76e48aaf14ad0ed8cad57c226c5b044e11c4020d042960155a361753f66
Instruction ID: 1935a963abe36118c5bc54b9d8f2b334f4d420f638c75b4784e49b49cd5a2591
Opcode Fuzzy Hash: 8fd8f76e48aaf14ad0ed8cad57c226c5b044e11c4020d042960155a361753f66
Instruction Fuzzy Hash: 0521B7715053815FE722CF29DC44B52BFE8EF56220F08849AEE45CB252D274E808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0121BDFD, Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

LoadLibraryShim.MSCOREE(?,?,?,?), ref: 0121BE79

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: LibraryLoadShim
String ID:
API String ID: 1475914169-0
Opcode ID: 272e543f81220110f4b6c1ef0b209597ca8c1949c2a3b3d24964f77749f09d0d
Instruction ID: 77dc79f455700c05292aef000bd5a581cc3d8ea55be692433d952475c707cdd5
Opcode Fuzzy Hash: 272e543f81220110f4b6c1ef0b209597ca8c1949c2a3b3d24964f77749f09d0d
Instruction Fuzzy Hash: 5C2193B5509384AFD722CE25DC45B52BFF8EF16610F08808AEE848B253D275A509CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0121B060, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0121B0D2

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6e939415e532a89e3e4e42ecdd87afff668142d9a64e4e0a9f8a52fe47b1e7cf
Instruction ID: cb4eb7c09f453934dcca30c042230d78434d3a77922d41ccb02e0317d3a7c1aa
Opcode Fuzzy Hash: 6e939415e532a89e3e4e42ecdd87afff668142d9a64e4e0a9f8a52fe47b1e7cf
Instruction Fuzzy Hash: D6219331409380AFDB22CF65DC45A52FFF4EF4A220F0985DEEE858F162C275A459DB61

Uniqueness

Uniqueness Score: -1.00%

Function 054428C1, Relevance: 1.6, APIs: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 05442935

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 70543517fcd4366f9896b143b5fff40bf6a08b350f97b0deb469b2329ab2be08
Instruction ID: 55822e20489ec7b316d6323133e92fc64c37558e5aa4af1d025097d919dd4bca
Opcode Fuzzy Hash: 70543517fcd4366f9896b143b5fff40bf6a08b350f97b0deb469b2329ab2be08
Instruction Fuzzy Hash: 26218C7250D3C0AFDB138B25CC54A92BFB4EF17210F0985DBED848F263D265A958DB62

Uniqueness

Uniqueness Score: -1.00%

Function 0121A806, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E2C,0448F345,00000000,00000000,00000000,00000000), ref: 0121A85C

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 2666e40bd0de0dcb91725baa1d72533ab0aa4bd27e844fe57d9fd6cef2063251
Instruction ID: f3a9be26e822fa72e84a2e75aa2988a22b9c2a8dd39f1ca7d26a1e6b8d76e099
Opcode Fuzzy Hash: 2666e40bd0de0dcb91725baa1d72533ab0aa4bd27e844fe57d9fd6cef2063251
Instruction Fuzzy Hash: 3611E071500240AFEB11DF29DC85BABBBD8EF55320F14C4ABEE05DB245D6B4A8058B71

Uniqueness

Uniqueness Score: -1.00%

Function 05441682, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

FindWindowA.USER32(?,00000E2C), ref: 054416EE

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 629dfd79a6d3787e13df03d897773a5b40317c1fb1271adafb0907cf9852e841
Instruction ID: 580c3fd48db77874d895dd8456d9e3cd98b26c3d4154be266662292138113341
Opcode Fuzzy Hash: 629dfd79a6d3787e13df03d897773a5b40317c1fb1271adafb0907cf9852e841
Instruction Fuzzy Hash: A011B271540200AFFB20DB15DC81FAAFB98EF45710F1484ABEE489B241D6B5A545CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05441AD6, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,0448F345,00000000,00000000,00000000,00000000), ref: 05441B35

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 74c7f44696561c91e8dbd7a04ac0d564a5e7e4a338b46411ec6d17cd99137cf4
Instruction ID: f2c6fe4a40936288e61ce72d326bf2e1099168f3cde250da2942859ebba0b159
Opcode Fuzzy Hash: 74c7f44696561c91e8dbd7a04ac0d564a5e7e4a338b46411ec6d17cd99137cf4
Instruction Fuzzy Hash: 5E11EF71440240AFEB21CF54DC45FABFBA8EF44320F1484ABEE459B211D270A449CB71

Uniqueness

Uniqueness Score: -1.00%

Function 054426BF, Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05442724

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 40b7a95b0c1d3c4aa8f9db355af1e858cf88b69d443c99a90857f7d51e316046
Instruction ID: f1b6c8e5b36fef2b0fd85eda210192f18990a0ce420e7d846ff0c8c85e460878
Opcode Fuzzy Hash: 40b7a95b0c1d3c4aa8f9db355af1e858cf88b69d443c99a90857f7d51e316046
Instruction Fuzzy Hash: FA11E276409780AFDB228F21DC40A52FFB4EF16220F0880DFEE858B663C275A458DB61

Uniqueness

Uniqueness Score: -1.00%

Function 05440ACE, Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E2C), ref: 05440B37

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 678befb3341d129dd07d1de8e3c9fa47c315b3c4bc766a23827359002e72fff9
Instruction ID: 5f4c09b75bff843ae02482c208f77c3e82ff58307af4374f80198cbc20737fe5
Opcode Fuzzy Hash: 678befb3341d129dd07d1de8e3c9fa47c315b3c4bc766a23827359002e72fff9
Instruction Fuzzy Hash: 9D112531540740AFF720DB14DC8AFA6FB98DF04720F24849BEF485E281D6B4A509CE76

Uniqueness

Uniqueness Score: -1.00%

Function 05442618, Relevance: 1.6, APIs: 1, Instructions: 55threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,?), ref: 05442677

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: e69b68dae633a5265ec693b668480c60e00a3e0cc226168f4e5cfa4eb2be3c9b
Instruction ID: e222da348ec869371f3ebbe3f1d29fc87f26ae0723d9b16c5366dde48959ebbb
Opcode Fuzzy Hash: e69b68dae633a5265ec693b668480c60e00a3e0cc226168f4e5cfa4eb2be3c9b
Instruction Fuzzy Hash: ED11B2755083849FD7118F15CC85F56FFE8EF06220F0880DFED458B262D274A918CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0121A376, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 0121A3BE

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 8fc227a1b33d21619762240b20f74208cf879781a270f42b6f68bb93ac935ddb
Instruction ID: fd9103847b59986a2967481c653b0e71f6e399da29c3705bdc1581d4859e9dd2
Opcode Fuzzy Hash: 8fc227a1b33d21619762240b20f74208cf879781a270f42b6f68bb93ac935ddb
Instruction Fuzzy Hash: C011A171A11241DFEB20DF69D885756FFD8EF54220F08C4AADE09CB246D6B4E408CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0121AD2C, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNELBASE(?), ref: 0121AD8C

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: DebugOutputString
String ID:
API String ID: 1166629820-0
Opcode ID: 609d47198005fa018e6479d02cae6303f6af49e18afe8e1185c79841cdbece8c
Instruction ID: d788f41bdaa017ccd1c5f8f4369d0709be243e9489656b12c86078495f18af54
Opcode Fuzzy Hash: 609d47198005fa018e6479d02cae6303f6af49e18afe8e1185c79841cdbece8c
Instruction Fuzzy Hash: 9F11A0715097C09FD712CB25DC45B52BFE8EF16221F0980DADE858F253D274A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05441946, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,0448F345,00000000,00000000,00000000,00000000), ref: 05441999

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: db90a8111b4ad41cd0f3c8144bb816b77ef945c1cdb8adeddc91917719778d35
Instruction ID: d293da869131ad6c0fd228af894b875db38c9905b9e25fbd4b7bfa9afd6c0bdf
Opcode Fuzzy Hash: db90a8111b4ad41cd0f3c8144bb816b77ef945c1cdb8adeddc91917719778d35
Instruction Fuzzy Hash: A7010071540200AFE720CB15CC85FABFB98EF05720F1480ABEE449B341D6B4A449CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 0121B95C, Relevance: 1.6, APIs: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0121B9BC

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a9b971fecee243be89991dda61f077edfcfc7dbe66d8c977bdb36a9b2e3637f9
Instruction ID: 7aa3e458223ebe5282795117553e37bc3dccb14321a22461ab7de5cc04cac111
Opcode Fuzzy Hash: a9b971fecee243be89991dda61f077edfcfc7dbe66d8c977bdb36a9b2e3637f9
Instruction Fuzzy Hash: 34118C76409784AFDB22CF55DC45A56FFF4EF16220F08849EEE854B262C275A418CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0121AF28, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0121AF7C

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 84706c65718e24eded70483825f57ddd03ca4bef8c845c381ae6d89f15852720
Instruction ID: 6a6f6d20a288c4a80cba6b1acec51939d7def1b9931f3b2c6647eceef91ea8c2
Opcode Fuzzy Hash: 84706c65718e24eded70483825f57ddd03ca4bef8c845c381ae6d89f15852720
Instruction Fuzzy Hash: AB115E71409384AFD7128B15DC44B62FFA4DF56624F1880DAEE858B293D275A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0121AB2A, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,0448F345,00000000,?,?,?,?,?,?,?,?,72F43C38), ref: 0121AB6A

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: dbc1ed16ad50849d283f5a37a989027696048538eb6299b8939d8d78948d8c4c
Instruction ID: 36ebd831fa51ecdd52c532f8f1c0d8aac9ae581a4dcf7bc85a42d79f569fd112
Opcode Fuzzy Hash: dbc1ed16ad50849d283f5a37a989027696048538eb6299b8939d8d78948d8c4c
Instruction Fuzzy Hash: 0111A1715112819FDB10CF69D885766FBE4EF64220F08C4AADE09CB216E674E508CB61

Uniqueness

Uniqueness Score: -1.00%

Function 054424EA, Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 05442524

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 6c170fff4c1bb874173d1e082bc834cf5de25c8645279564fc0e7645bb56faa1
Instruction ID: e5fd132945aaf3e39160ed40b6e02d2d11eb3011be89508c4930e51e5229d3e2
Opcode Fuzzy Hash: 6c170fff4c1bb874173d1e082bc834cf5de25c8645279564fc0e7645bb56faa1
Instruction Fuzzy Hash: E7019E75A482409FEB50CF29D8857A6FB98EF00620F18C0ABED09DB352D6B4E408CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0544279A, Relevance: 1.5, APIs: 1, Instructions: 47injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 054427E0

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 338bfd2c4b3f819ffe85325553ba7cfb379b0a34c8921835a6866d1959925f25
Instruction ID: e2eb17190883b611124948ba637eb9ee4c43d882b23ffa219058fea13944eafc
Opcode Fuzzy Hash: 338bfd2c4b3f819ffe85325553ba7cfb379b0a34c8921835a6866d1959925f25
Instruction Fuzzy Hash: B9015B39504600DFEB20CF25D884BA7FBE4EF04620F0881ABED458B656D6B5E458DF72

Uniqueness

Uniqueness Score: -1.00%

Function 0121BE2E, Relevance: 1.5, APIs: 1, Instructions: 46libraryCOMMON

Download Yara Rule

APIs

LoadLibraryShim.MSCOREE(?,?,?,?), ref: 0121BE79

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: LibraryLoadShim
String ID:
API String ID: 1475914169-0
Opcode ID: d5cd528e256bb59b5ce72172bca56c3125331a3ddc42f292383a698252e22c04
Instruction ID: c106bee3966960b3529cc65153a9523a5ab67f2648cf1c44076db8240af3bfc7
Opcode Fuzzy Hash: d5cd528e256bb59b5ce72172bca56c3125331a3ddc42f292383a698252e22c04
Instruction Fuzzy Hash: 360180715106009FEB60DE19D885B12FFF8EF24610F08849ADF498B216D2B1E408CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0121B08E, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0121B0D2

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2073a92c93e910b616d4492bab6dd68e877151413df62156fad19826ba335d28
Instruction ID: 9fb2bec16912efb3a59a65775c4fc8590b6404a11b63bb024fd9863ad09aa4b7
Opcode Fuzzy Hash: 2073a92c93e910b616d4492bab6dd68e877151413df62156fad19826ba335d28
Instruction Fuzzy Hash: EC01AD31410600EFDB21CF55D845B16FFF0EF08320F18C99ADE498B616C2B1A418DF61

Uniqueness

Uniqueness Score: -1.00%

Function 0544263A, Relevance: 1.5, APIs: 1, Instructions: 44threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,?), ref: 05442677

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 8a585eac32f12cbd537c81fec380d1bc81d70b00df10a6ef82ba1bddd0bc867b
Instruction ID: 5a13a6005805fe344997fd180d4578bed4dabd74a837861aaac765e27991e5e0
Opcode Fuzzy Hash: 8a585eac32f12cbd537c81fec380d1bc81d70b00df10a6ef82ba1bddd0bc867b
Instruction Fuzzy Hash: BC01D4396486009FEB10CF19D884BA6FBE4EF04620F08C0ABED458B352D6B4E818CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0121A23A, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0121A26C

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b2dcc53e7e09db582c4393134e51a040c4b0faf39cd9e654061e46578383cdbf
Instruction ID: 88fb359a542cb938679f105066c73ab3e6f2156762d10e8e7f5c433e6fd7d2d1
Opcode Fuzzy Hash: b2dcc53e7e09db582c4393134e51a040c4b0faf39cd9e654061e46578383cdbf
Instruction Fuzzy Hash: F101F2719112409FEB11CF69D8857A6FFD4EF40220F18C0ABDE098F606D6B5A808CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0121A662, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0121A694

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2ab8522792884e97455eeab4ff34838dc05942a63a2703616e7c2471e50c8e16
Instruction ID: 5f68ccc68fe7a95edce2152ef6a2d6a960a75bf8757e7d70f870dca7f1723082
Opcode Fuzzy Hash: 2ab8522792884e97455eeab4ff34838dc05942a63a2703616e7c2471e50c8e16
Instruction Fuzzy Hash: 3101FC715012809FDB10CF29E885756FFE4EF90220F08C4ABDE098B206D6B0A808CF62

Uniqueness

Uniqueness Score: -1.00%

Function 0121AEB2, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?,00000E2C,?,?), ref: 0121AF02

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 33ba6181e3cd2744456d3efa28373de036724713bd4f22499676dc649d9907bc
Instruction ID: 2a9419d279c8250c50a101af8ce36649c84d22c93be9c9855ebb1ae3e7601f6b
Opcode Fuzzy Hash: 33ba6181e3cd2744456d3efa28373de036724713bd4f22499676dc649d9907bc
Instruction Fuzzy Hash: 1701A275500600ABD750DF16DC82F26FBA8FB88B20F14815AED084B741E371F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 05440A32, Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,?,?), ref: 05440A82

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: e69ea59183497553ecc81521a2fc470471cdb35ec04874d43a1c36fffa782f9b
Instruction ID: 7ed499a1b0d270f10e9b5160165f36890485b5e3b3bfc4894f7c90ee121154e7
Opcode Fuzzy Hash: e69ea59183497553ecc81521a2fc470471cdb35ec04874d43a1c36fffa782f9b
Instruction Fuzzy Hash: 5501A276500600ABD350DF16DC82F26FBA8FB88B20F14811AED084B741E371F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 054426E6, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05442724

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 5a4c937a19dca16708424b7c1246064f50990b795f5041b449812f0d89f9af7a
Instruction ID: e0b3961a823a0f131abc93aeeb548b876a9a20667ae071cf96c9d3dcf0bc5db5
Opcode Fuzzy Hash: 5a4c937a19dca16708424b7c1246064f50990b795f5041b449812f0d89f9af7a
Instruction Fuzzy Hash: 4E019E35504600DFEB208F55D884BA7FFA0EF14320F08C0AFEE494A612D6B1A459DF62

Uniqueness

Uniqueness Score: -1.00%

Function 0121A902, Relevance: 1.5, APIs: 1, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0121A93D

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4c5c6b97422d83a48df836201441e5c3fb4a0bcceb31d35fb656d983ff28df09
Instruction ID: ad5afd6f1cbdfd18fe4893525b9e14f7580eb9f09821bcc51698e17da77d3b8c
Opcode Fuzzy Hash: 4c5c6b97422d83a48df836201441e5c3fb4a0bcceb31d35fb656d983ff28df09
Instruction Fuzzy Hash: 3301BC365106809FDB21CF59D885B66FFE0EF14720F08C0AEDE8A4B616D2B1A458CF62

Uniqueness

Uniqueness Score: -1.00%

Function 0121B97E, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0121B9BC

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e85f8509fc09949ee668bdf441997b19adcbb57ecdf65434254a08b02d9b19fd
Instruction ID: 18c27333d5dc5e9482758d8884a3b4a744ce216cb33d85b73184cc511a9e2680
Opcode Fuzzy Hash: e85f8509fc09949ee668bdf441997b19adcbb57ecdf65434254a08b02d9b19fd
Instruction Fuzzy Hash: AB01DF35400604DFDB21CF45D885B66FFF0EF18320F18C49ADE490B216C2B1A019DF62

Uniqueness

Uniqueness Score: -1.00%

Function 0121AD52, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNELBASE(?), ref: 0121AD8C

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: DebugOutputString
String ID:
API String ID: 1166629820-0
Opcode ID: 406a0fdadb9aedd8f7ab0e97e7f4952cf4335d1a4a7365ba8ee7a24bb0865a04
Instruction ID: 37e40b02cb00985b9e65abca7c5742302535359947ce8e45148e478a7ce29561
Opcode Fuzzy Hash: 406a0fdadb9aedd8f7ab0e97e7f4952cf4335d1a4a7365ba8ee7a24bb0865a04
Instruction Fuzzy Hash: 2001D131911A809FDB60DF19D885766FFD4EF15621F58C0AADE098B34AD6B4E408CB62

Uniqueness

Uniqueness Score: -1.00%

Function 054428FA, Relevance: 1.5, APIs: 1, Instructions: 38windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 05442935

Memory Dump Source

Source File: 0000000A.00000002.281694007.0000000005440000.00000040.00000001.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5440000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 7988c15e3141adf4c2beb77b225ba263a57256879540b08765b22885f3d433cc
Instruction ID: 42abece15e18231f76051100ec56c87332f7f50f6a689bc1cbadeb39a3f8aebf
Opcode Fuzzy Hash: 7988c15e3141adf4c2beb77b225ba263a57256879540b08765b22885f3d433cc
Instruction Fuzzy Hash: F2018F35904644DFEB20CF55D845B6AFFA0EF04320F18C49BEE490B216D2B5A459DF62

Uniqueness

Uniqueness Score: -1.00%

Function 0121AF4A, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0121AF7C

Memory Dump Source

Source File: 0000000A.00000002.276506686.000000000121A000.00000040.00000001.sdmp, Offset: 0121A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_121a000_FNYVlhLumPogrzL.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 29a4bc30ed5e77bcb88299ea98eab4694292d7d2c3144c2e128dc086d05fc527
Instruction ID: 059230f84e091d69e2528d79209e7f9c73b6e4a150dae849f0240c51cd6dd5f4
Opcode Fuzzy Hash: 29a4bc30ed5e77bcb88299ea98eab4694292d7d2c3144c2e128dc086d05fc527
Instruction Fuzzy Hash: 23F0AF74911684DFDB50DF19D885766FFE0EF14720F18C0AADE494B296D2B6A408CF62

Uniqueness

Uniqueness Score: -1.00%

Function 0520EAC0, Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

X1kr, xrefs: 0520EBFF

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID: X1kr
API String ID: 0-844551562
Opcode ID: 5775ceb3965b41ae6424d38c93283e2bebac64ef4a4b21ec1d3b4cc821e1f747
Instruction ID: 32821222c4eeb7565a0a4853cebe66bb3e1eb92f1540aa48359f4fae0a547b3d
Opcode Fuzzy Hash: 5775ceb3965b41ae6424d38c93283e2bebac64ef4a4b21ec1d3b4cc821e1f747
Instruction Fuzzy Hash: 5951F4B0E12218DFDB14DFA8E4886ADBBF6FF88300F20A029D416A7384DB759945CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0520E2E0, Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

y@(, xrefs: 0520E3E3

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID: y@(
API String ID: 0-2049997268
Opcode ID: 6346cfb94ea1aae2e4139004216db7bc5b0510f17e3f7cb83be8940ce7deb459
Instruction ID: fa426fbd1b172bcd95eca57d450e07d995673d2c8e9963d307fbd6e891821246
Opcode Fuzzy Hash: 6346cfb94ea1aae2e4139004216db7bc5b0510f17e3f7cb83be8940ce7deb459
Instruction Fuzzy Hash: AE31F474E11209EFDB08DFA9D584AAEBBF2FF88300F209069D405B7395DB359A41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0520629A, Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

f]Ir, xrefs: 05206461

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID: f]Ir
API String ID: 0-3302829692
Opcode ID: 500089017c1d0331bb6c31d3b5f39807a69d335c614b77d7d12fdc7c36f42ffc
Instruction ID: 4925988213f9ded2888ab0fefbcf8302f9f1f3dc66601d11e03e1dcdec0d200b
Opcode Fuzzy Hash: 500089017c1d0331bb6c31d3b5f39807a69d335c614b77d7d12fdc7c36f42ffc
Instruction Fuzzy Hash: 29215370A22259DFDB54CF64D880B9DF7B2FF45310F11A5AAE409AB282C770AE80CF00

Uniqueness

Uniqueness Score: -1.00%

Function 061DA697, Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

6, xrefs: 061DA700

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-498629140
Opcode ID: d5d1a9b800b92cd3abd5e020f3662466cc7d2726ca73b8abce87fa99153e33f3
Instruction ID: b93c4d91b1f33cd490faab160ed99ef8c453ff7dd286f9fd75e50eb315fca000
Opcode Fuzzy Hash: d5d1a9b800b92cd3abd5e020f3662466cc7d2726ca73b8abce87fa99153e33f3
Instruction Fuzzy Hash: 96119174D48228CFEB94CF54C8407FDB3BAAF06224F0195C5C41E6334AC7315A418F92

Uniqueness

Uniqueness Score: -1.00%

Function 052005C0, Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

@, xrefs: 052005F4

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 0cb73db767190600cb911c853440c982501f8b593878f79eaff36f6dd746ef46
Instruction ID: 1c61467533210425d9b388733fc271ebfc2d8e71b468b66134ac32dc65ce0f6f
Opcode Fuzzy Hash: 0cb73db767190600cb911c853440c982501f8b593878f79eaff36f6dd746ef46
Instruction Fuzzy Hash: C3F0CFB0C2562A9FEF24DF91D880BEEBB76BF85300F1061AAD10977240C7745991CF24

Uniqueness

Uniqueness Score: -1.00%

Function 052017B2, Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

f]Ir, xrefs: 052017B7

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID: f]Ir
API String ID: 0-3302829692
Opcode ID: 7a466067414a9615b2ec60d54a46b3c489009066b2d27da8b2e31e20a55bfdd4
Instruction ID: 1a2e4c576593e4a75f97e936028a553fd9f3e99f7982f74c536707d4760fd71f
Opcode Fuzzy Hash: 7a466067414a9615b2ec60d54a46b3c489009066b2d27da8b2e31e20a55bfdd4
Instruction Fuzzy Hash: 0BE03930D1221ACFEB14CF54D800F9AB7F2BF90321F919599D808AB291C3709E80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 061D4083, Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 725a418331ba965a7d212963fc16b95c09c8ec0e60d7e864fb72028e26d4d781
Instruction ID: f282659488b4ae47eee2900a6b1cafd54449a2c3e6374ea0dc469c4c97cf4e0e
Opcode Fuzzy Hash: 725a418331ba965a7d212963fc16b95c09c8ec0e60d7e864fb72028e26d4d781
Instruction Fuzzy Hash: 2DC177B0801644CFEB54CF99C184AADBBF1FF18358F25D565C41AAB252C37AE888CF95

Uniqueness

Uniqueness Score: -1.00%

Function 061D40E5, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae74ba933d9ad6463d801e22f9d8a6ffb7c303639ed85dd713612b24f9986e05
Instruction ID: 62333d2a6add3a692a3648d4e907e07a631b99eb04569cadc3c18bd2e69343da
Opcode Fuzzy Hash: ae74ba933d9ad6463d801e22f9d8a6ffb7c303639ed85dd713612b24f9986e05
Instruction Fuzzy Hash: 1EC15770800644CFEB44CF99C184AADBBF2FF18359F65D565C41AAB252C37AE888CF95

Uniqueness

Uniqueness Score: -1.00%

Function 061D4104, Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e426b5ef01040770610981782343343e66dcc9c0e57f683ac2b32a452136175c
Instruction ID: 6876eacfd5740d0a9981eea99afccfd802dbb63b72a1f56e8af5eb0819cfaeab
Opcode Fuzzy Hash: e426b5ef01040770610981782343343e66dcc9c0e57f683ac2b32a452136175c
Instruction Fuzzy Hash: 82C15870800644CFEB44DF99C184AADBBF1FF18359F25D565C416AB252C37AE888CF95

Uniqueness

Uniqueness Score: -1.00%

Function 061D40DB, Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc73d27702a8cd237dea17af6f1e18cca8e47736f7d6b7a58d6bd748a4f37ca
Instruction ID: e4cc69bc85858d73eadc8ec286e1ec3785c6093f5c625e0015bf3ead07f3d9f8
Opcode Fuzzy Hash: 9cc73d27702a8cd237dea17af6f1e18cca8e47736f7d6b7a58d6bd748a4f37ca
Instruction Fuzzy Hash: FAC16770800644CFEB44CF99C184AADBBF2FF18359F25D565C41AAB252C37AE888CF95

Uniqueness

Uniqueness Score: -1.00%

Function 061D11FD, Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e07fd9279741ec20603ac31acb10a3904099040e0234b26730e328f06db267
Instruction ID: d17131bb7be26720582c29fd4efe62dd177706899d7c67db1a38a372bf3ed8b8
Opcode Fuzzy Hash: f4e07fd9279741ec20603ac31acb10a3904099040e0234b26730e328f06db267
Instruction Fuzzy Hash: C99101B4D04218CFDB84DFA4C8846ADFBF1FB4E305F20961AD419B7245D7389981CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 061D1541, Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 023fbd8688c2b474affd287b613a53894c543f4821154dd5dece46856cf9aa5d
Instruction ID: b0698e7eff3fdaccc206c96f31acafd9f19b2938650c7070bcc150860ff2b7c2
Opcode Fuzzy Hash: 023fbd8688c2b474affd287b613a53894c543f4821154dd5dece46856cf9aa5d
Instruction Fuzzy Hash: 85911874D02228EFEBA4DFA4D845BADBBF2FB49301F2085A9D50AB7245D7748980CF51

Uniqueness

Uniqueness Score: -1.00%

Function 061D5DA2, Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e08ddd19fbd017d614a3595f3b4741a3e79052f37e23056ef7dd94b2b450c289
Instruction ID: f28c1a7782981a0b87c3ee798b10e0ace24bb5d4e2c66ae8cb5c4c39f26c0f36
Opcode Fuzzy Hash: e08ddd19fbd017d614a3595f3b4741a3e79052f37e23056ef7dd94b2b450c289
Instruction Fuzzy Hash: C361E078A09218DFDB48DFA9D5809ADBBF6FF49300F119955E816AB311D730AA42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 061D3858, Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1066f8a730bcca8e1614f15de71467df8538c62b482736972914b62e7f100978
Instruction ID: 7f3faff94150d32708f332edd30bfc8e9fafdc0002dae95f4af76f72ea5a0120
Opcode Fuzzy Hash: 1066f8a730bcca8e1614f15de71467df8538c62b482736972914b62e7f100978
Instruction Fuzzy Hash: 62515B74D0A208DFDF88CF98D484BEDBBF5BB4B310F11A55AE425A3251C7748A85CB92

Uniqueness

Uniqueness Score: -1.00%

Function 061D389F, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 210298e0538ee105e041fdad2e8fb064975cacc50a118ceb770eef554dc96ab2
Instruction ID: 0c142f6b78168a0e541ad820b442c89530d5ce69ed0addd03e18347c573453b0
Opcode Fuzzy Hash: 210298e0538ee105e041fdad2e8fb064975cacc50a118ceb770eef554dc96ab2
Instruction Fuzzy Hash: 7A517E75D09208EFDF88CFA9D4847DCBBF1BF4A300F14909AD465A7252D7749A84CB52

Uniqueness

Uniqueness Score: -1.00%

Function 061D6738, Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b73fa0726fc8ea41f8d0c9aed9f1de5e53b540a011a7d358741f4755008a8eba
Instruction ID: ff9a1a8816fe0b3f8accaea93fe5ed9aa64916591195180c73dece334c80e032
Opcode Fuzzy Hash: b73fa0726fc8ea41f8d0c9aed9f1de5e53b540a011a7d358741f4755008a8eba
Instruction Fuzzy Hash: A451F774D05208DFDB58DFA9D540AAEBBB2FF89300F20806AD905B7391DB35A941DF91

Uniqueness

Uniqueness Score: -1.00%

Function 0520A7D0, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2248e0bc9e31fa3bc0114305002b669888b5074ba1b0e7f6577798a1c6dfc602
Instruction ID: 1fc287d671f923af863ae0ef35f4a0d3db3076b0079e84067429a025a00b208d
Opcode Fuzzy Hash: 2248e0bc9e31fa3bc0114305002b669888b5074ba1b0e7f6577798a1c6dfc602
Instruction Fuzzy Hash: 0E41B371E11208DFDB24CFA9D494AADBBF6FF88300F24902AD41AAB255D7316946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 061D38EC, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f61b5965a99dd4746c6c93c0fac8533ff74187ea228b49ba96abd753588875d8
Instruction ID: 995efebdec38bf4a239210ec22dfc86d7573e97dc1a29f2d78c52442bc77ecab
Opcode Fuzzy Hash: f61b5965a99dd4746c6c93c0fac8533ff74187ea228b49ba96abd753588875d8
Instruction Fuzzy Hash: FD415970E09248DFDF88CFA8D484BDCBBF5AF4B310F14909AE455A7292C7749A85CB52

Uniqueness

Uniqueness Score: -1.00%

Function 061D0228, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 505c946cc8c65dca2d71de79c5490d16969a833d3523866dcef90b9e4a896fbd
Instruction ID: 133a51b79d24106bb357ce35e45b69b94a5730a4832faaa9072eadeb144a6b94
Opcode Fuzzy Hash: 505c946cc8c65dca2d71de79c5490d16969a833d3523866dcef90b9e4a896fbd
Instruction Fuzzy Hash: B8411374E06208DFDB48CFA8E448AADBBF1FB89305F10846AD405B3340C7349941CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 061D6770, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f83f4c76e0135b3cb6ba9969a834a5a7961ec0d9b661b170e086632311c84be
Instruction ID: 452b9d4ad57ad80cc731f350e30f2780a4cffc3cf2928a5a8ffa57b52fd91eb2
Opcode Fuzzy Hash: 4f83f4c76e0135b3cb6ba9969a834a5a7961ec0d9b661b170e086632311c84be
Instruction Fuzzy Hash: B541C474D00208DFDB58DFA9D580AAEBBB2FF89300F208569D905BB391DB359942DF91

Uniqueness

Uniqueness Score: -1.00%

Function 061D4E18, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeadb947cad1fbb78ad264f3973bdbbcf7d71361f60e3caa0afccbee0a874008
Instruction ID: 84f117d55a3a08fdb056ed6ae5569391c872e12d1160b576b5ec6776ddb9e8d1
Opcode Fuzzy Hash: aeadb947cad1fbb78ad264f3973bdbbcf7d71361f60e3caa0afccbee0a874008
Instruction Fuzzy Hash: CF31F234951129AFCB14CFB8D8059EFBBF5EB54200F648665E893A7241CB30DA468BE2

Uniqueness

Uniqueness Score: -1.00%

Function 061D261E, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66db10249b8cbd18e3a4acbac78e35968c3d095b59bcc85cf5c6896ca188ae2d
Instruction ID: 584b32d9c23ba94eb4ded3749627685ed76db44274a36bb916e1273b81ccd52e
Opcode Fuzzy Hash: 66db10249b8cbd18e3a4acbac78e35968c3d095b59bcc85cf5c6896ca188ae2d
Instruction Fuzzy Hash: EC31EF30D113099FCB50CFB8C844AAEBBB2EF99600B1085A5D952F3344DB349A05CF92

Uniqueness

Uniqueness Score: -1.00%

Function 061D57C6, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfdc47010ec64494656056aa165b38de59f1191605d85c9581717b85d9eb876a
Instruction ID: acd49ad7817017c731060ce4aaab4d32f88ba61edb5cb7be12df8a4d5e65a0fd
Opcode Fuzzy Hash: dfdc47010ec64494656056aa165b38de59f1191605d85c9581717b85d9eb876a
Instruction Fuzzy Hash: 2D31B479E05309DFDB88CF99D0809ADBBB6FB49310F119555E81AAB311D730AA41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05202848, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62c95efeec3f21074a8819fca412611f4d18ad214f1da443d4ba1d82e2da3f56
Instruction ID: fcefc22ee7729cece99a2f0ee342f1280517461fc7f21a0ccf7a8a8574533195
Opcode Fuzzy Hash: 62c95efeec3f21074a8819fca412611f4d18ad214f1da443d4ba1d82e2da3f56
Instruction Fuzzy Hash: AF3169B8D15209DFDB44CFA9C484AAEBBF1FF48300F1094AAD815AB355D334AA41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 05200007, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c12e13f8301dd1a599c88dcee74717187023c2572a2b2e91ad279473ce06a39
Instruction ID: b613fb46aed77d860ed6ec5a2b5b77ebdbc941b553a9f69740bf9e0fb7633a25
Opcode Fuzzy Hash: 2c12e13f8301dd1a599c88dcee74717187023c2572a2b2e91ad279473ce06a39
Instruction Fuzzy Hash: 36214C3141A385AFD722CFB4A8596997F70BF0B200F0695D6D045CB1A3D7788A44DB22

Uniqueness

Uniqueness Score: -1.00%

Function 0520431A, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c1b357269136744f84012ea21c5e8226e43d62d73eb36d0b736898392215b86
Instruction ID: 0c196b2fc88320b4d805b2ef75f462c0dbb3227ed9d69f051e275dedaefb4976
Opcode Fuzzy Hash: 2c1b357269136744f84012ea21c5e8226e43d62d73eb36d0b736898392215b86
Instruction Fuzzy Hash: 06215C70D2624AEBCB08DFA5D545AAEFBB5FF44200F20E9AAC515A7255D7309B40CB84

Uniqueness

Uniqueness Score: -1.00%

Function 05202858, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a930f575e42329ade7fb3037893a060989d21f6e67b7b891b3275dd77691694f
Instruction ID: 6a8395159cce651755386e3c60fdb92ede8e5fc039d1cccb10b4e5df67a955b5
Opcode Fuzzy Hash: a930f575e42329ade7fb3037893a060989d21f6e67b7b891b3275dd77691694f
Instruction Fuzzy Hash: CC2117B8D11209DFDB44CF9AC4849AEBBF1FF48300F10A46AD819A7355D774AA41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0520294A, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b609a653f62e5cfbc83147407cbe2acb83f0aaf9c8c99531d87006db9b77a8e
Instruction ID: 8e4e1ac029ba3ae106e0113a28f1b85ae4dc4625e1fad4e720b62453cbced663
Opcode Fuzzy Hash: 6b609a653f62e5cfbc83147407cbe2acb83f0aaf9c8c99531d87006db9b77a8e
Instruction Fuzzy Hash: 4921F374D2520ADFCB04CF99C489AAEFBF1FF89300F6095AAD414AB355D730AA018F91

Uniqueness

Uniqueness Score: -1.00%

Function 02D207DC, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.276694048.0000000002D20000.00000040.00000040.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2d20000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ac03feece0320d82b70d07712bb37aa62cbfa687443450ccc1e4bb46ba22c9c
Instruction ID: 20587f508eae350a462a84404ef8a86b8130e0ea4fa0458406f2557d57708093
Opcode Fuzzy Hash: 0ac03feece0320d82b70d07712bb37aa62cbfa687443450ccc1e4bb46ba22c9c
Instruction Fuzzy Hash: C611AF34204284EFD715DB24D984B26FBA1ABA870DF24C9ADE9491B742C77BD807CA91

Uniqueness

Uniqueness Score: -1.00%

Function 0520B7D0, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e84f8738087dea320186cbf88107efa185fa4cb16d1a5ce985bcaa07df6f892f
Instruction ID: c974304742d0fd3f7c64218913a9aefc1793e5cb84e2df6611c37ba98091f5ca
Opcode Fuzzy Hash: e84f8738087dea320186cbf88107efa185fa4cb16d1a5ce985bcaa07df6f892f
Instruction Fuzzy Hash: 2111E630C26209FFCB28DFA1E1895ADBB76EF46300F20F4A9D006B7290C7349A109B55

Uniqueness

Uniqueness Score: -1.00%

Function 05204428, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56dc114544311081b78d362041ac24ac664791f075d74945b28ecd7b3becfefc
Instruction ID: 2d2db76f30262a975bfe84d0e10ed17d5e7a7fd2ef9d2b7b622e710a2cf24ec6
Opcode Fuzzy Hash: 56dc114544311081b78d362041ac24ac664791f075d74945b28ecd7b3becfefc
Instruction Fuzzy Hash: B0215634D16248EFDB05DFA8C584A9DFFF1EF8A300F15D49AD515AB2A2D734AA00CB41

Uniqueness

Uniqueness Score: -1.00%

Function 06062359, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284408021.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6060000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f810d8023abd90cee07a51c422b160b87fa479cc5cc2df07bd4f8eacd5c41b8
Instruction ID: 1752a03356129d1cced3602c3b2e4500eb8c14401efb9ab3fbc5c6ecd80eeff3
Opcode Fuzzy Hash: 0f810d8023abd90cee07a51c422b160b87fa479cc5cc2df07bd4f8eacd5c41b8
Instruction Fuzzy Hash: FF11E9B5908301AFD340CF59D881A5BFBE4FB98660F14892EF998D7311D371E9048FA2

Uniqueness

Uniqueness Score: -1.00%

Function 0520D4C8, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60b51d6ebddfe1eb3d6357fd29a8e57d688163014198c16997271359058e28c9
Instruction ID: 4d675a1f91e99e15c7b83c8bfa3208684f39736c7e9a53bbe09056b8c2a4234a
Opcode Fuzzy Hash: 60b51d6ebddfe1eb3d6357fd29a8e57d688163014198c16997271359058e28c9
Instruction Fuzzy Hash: 51115C74D16209EBCB14DFE9D0456AEFBB6FF49200F109466D815A7394E7349A018FA1

Uniqueness

Uniqueness Score: -1.00%

Function 061D2670, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f31c3dbdbf5827598bb454b2ebfb8e1d00718e4140488019ec72b4db97dd857
Instruction ID: 1a13b8ab4b426dba1d0509a2f1bf0a924feea74bda5463c7906eeb8e8c250dfe
Opcode Fuzzy Hash: 9f31c3dbdbf5827598bb454b2ebfb8e1d00718e4140488019ec72b4db97dd857
Instruction Fuzzy Hash: F921D374E00209DFCB44DFA9D8849AEBBF2FF98210F208569D916A7354DB359E41DF81

Uniqueness

Uniqueness Score: -1.00%

Function 0520B940, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3171d1d8e7ac72f840da8f3297763b823ca91c0609df86df79774ada0f3f6f70
Instruction ID: 06562db2a6dbf4eb8484634275255aad5a36784e72e92fcbe64198d6f7484cd5
Opcode Fuzzy Hash: 3171d1d8e7ac72f840da8f3297763b823ca91c0609df86df79774ada0f3f6f70
Instruction Fuzzy Hash: 9D114F70D2A10DEFCF14CFA6D1855ADFBF6EF89210F10E4A9C005A7251EB749A518F45

Uniqueness

Uniqueness Score: -1.00%

Function 05204438, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80cc832ad9f903111fab137d9ae444cb1834ab9f0a4f06cf0724963f9be5dd59
Instruction ID: 05893283a0f967dccf6953c3453563df88df6dd58c400418638af5847feda707
Opcode Fuzzy Hash: 80cc832ad9f903111fab137d9ae444cb1834ab9f0a4f06cf0724963f9be5dd59
Instruction Fuzzy Hash: 62112634D16208EFDB54DFA9C588A9DFBF1EF89300F11D499D519AB261D730EA00CB80

Uniqueness

Uniqueness Score: -1.00%

Function 060621F4, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284408021.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6060000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0cb3c8f012a22aba2ff272c855eaf7673d00f356d28978349a9221cc6c894c5
Instruction ID: 2f1b04712b9d2a12a4664c6512ef075250a5995411ae5a77609aedec7b033cd2
Opcode Fuzzy Hash: c0cb3c8f012a22aba2ff272c855eaf7673d00f356d28978349a9221cc6c894c5
Instruction Fuzzy Hash: A511FEB5608301AFD750CF49DC81E5BFBE8EB88660F14891EFD5997311D271E9048FA2

Uniqueness

Uniqueness Score: -1.00%

Function 0122B4E8, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.276512079.0000000001222000.00000040.00000001.sdmp, Offset: 01222000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1222000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e6720ad08c885aad0b3644c9171d3caf75b24dc0fb1054dfe939a2c458956a
Instruction ID: 7470d6b9eb4649648e862fe495170af38ecd24effde37c48657826f5ba51cd30
Opcode Fuzzy Hash: 78e6720ad08c885aad0b3644c9171d3caf75b24dc0fb1054dfe939a2c458956a
Instruction Fuzzy Hash: 1111FEB5608301AFD350CF49DC41E5BFBE8EB98660F14891EFD5897311D271E9048FA2

Uniqueness

Uniqueness Score: -1.00%

Function 0520BA18, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37fadd669f369b1b0951a51506932cbb64ed15b3da77ca1e044d9b5cd3200c50
Instruction ID: 1bd2361b5cb06f9f7d61b26c17df489f7dc501d6105f0a1b5b64103252b4b809
Opcode Fuzzy Hash: 37fadd669f369b1b0951a51506932cbb64ed15b3da77ca1e044d9b5cd3200c50
Instruction Fuzzy Hash: 92018074E15228EBDB24CFA5D8087DEB7B6EF89301F0080A6C51DA3350DB745A558F50

Uniqueness

Uniqueness Score: -1.00%

Function 05204E40, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed8956d997c9ef1916f09a1562e7eeb666414a906625598c2118611bde68dc83
Instruction ID: c3b489b7abdbfb1aec756c79b048c79433782c4eae014d8e9d0b9dd3fdede36e
Opcode Fuzzy Hash: ed8956d997c9ef1916f09a1562e7eeb666414a906625598c2118611bde68dc83
Instruction Fuzzy Hash: A8116174D15289AFCB20EFA8E8449AEBBB5FF08300F109196D958D7382D3309A50CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 02D205D5, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.276694048.0000000002D20000.00000040.00000040.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2d20000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14207864659165b91f4c68de800c9e587eaaa672075063e2be600d20047327ee
Instruction ID: 28fe9e416dec6da3c87e2dabfdf0120e90d28064bd3e16ee267a0f6a065cd9f0
Opcode Fuzzy Hash: 14207864659165b91f4c68de800c9e587eaaa672075063e2be600d20047327ee
Instruction Fuzzy Hash: E6F0A4765097806FD7128B16EC41862FFB8DF86620719C49FED898B612D265B908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 05200070, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd4e2b807abe307309fd025d9f55bfb847325731aba7ed7105ce4bc328ef58aa
Instruction ID: 4f6d1a1c41ee95bce948c04e53f4d2ef6aa8dc79cf1b401de7bbf98455d5424b
Opcode Fuzzy Hash: dd4e2b807abe307309fd025d9f55bfb847325731aba7ed7105ce4bc328ef58aa
Instruction Fuzzy Hash: 3D01D630826309EFD720DFA4F54D66DBB75FF4E201F50A4A5C00AD7145E7349A50DB41

Uniqueness

Uniqueness Score: -1.00%

Function 061D4E90, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bef97187e4b5ceac75148cb39f4f6f6aaa64bee63189f72915c4da9905fd2a4d
Instruction ID: c3b2b6bbd32483ea748541021486692cbd812f7140be0243a691c8468583ba67
Opcode Fuzzy Hash: bef97187e4b5ceac75148cb39f4f6f6aaa64bee63189f72915c4da9905fd2a4d
Instruction Fuzzy Hash: 6A01E874E0020AEFCB44EFA8D5445ADFBB2FF44300F2082AAA915A7354DB719A41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06080D20, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284508563.0000000006080000.00000040.00000001.sdmp, Offset: 06080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6080000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6190dead153a151e50e77da518546c52a568fb2c9cb36935cac22f8debf5c003
Instruction ID: b4b8a260df75243691fcab6f1bc7391b6667f080be426cc22b847dc5c774b11b
Opcode Fuzzy Hash: 6190dead153a151e50e77da518546c52a568fb2c9cb36935cac22f8debf5c003
Instruction Fuzzy Hash: F7F08234986348EFD754EBB4B806AEABF79D702201F100196D8465B291D6312AD8CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0520D350, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c789202f1ef6f5a1ed45b73223fec315280b0c628d1be37bdf0098839f0db1e
Instruction ID: 6c6066f74cc3e4e5f723030737f4121db9fdd0e677648dd0244d8feb1dbb94bd
Opcode Fuzzy Hash: 8c789202f1ef6f5a1ed45b73223fec315280b0c628d1be37bdf0098839f0db1e
Instruction Fuzzy Hash: E9F09AB0D2A218EBDB18EFE4E14865EFBBAEF85200F10E0B9C40567289D77496408F55

Uniqueness

Uniqueness Score: -1.00%

Function 05204E50, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e814107bcddd670fe3e0bd721329ac357b00faf8fc5e13a788809da950361c1
Instruction ID: 76f009f6d2ff1802d8f4f1075f2e932c362e108148d65b8e279a6a026289fc3a
Opcode Fuzzy Hash: 9e814107bcddd670fe3e0bd721329ac357b00faf8fc5e13a788809da950361c1
Instruction Fuzzy Hash: 2E01F678D01259AFCB64EFA8D444AAEFBF4BF48300F108196E954A3385D734AA40CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02D20898, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.276694048.0000000002D20000.00000040.00000040.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2d20000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525cef522958239b2deb72ab7ac90410e2832b06fb356f1b7ca8807ee3c9392c
Instruction ID: a59851b5bdd1401c8b5f8d3e65aa210d3a11f4c3ddc4e1746573693fb1eefcac
Opcode Fuzzy Hash: 525cef522958239b2deb72ab7ac90410e2832b06fb356f1b7ca8807ee3c9392c
Instruction Fuzzy Hash: 22F01D35144644DFC305DF40D940B26FBA2EB99718F24C6ADE9490B752C337D813DA81

Uniqueness

Uniqueness Score: -1.00%

Function 05203BCB, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a67e06ed6c49d0032f03ed10fe634e4c4085146ddf68770d79a90c437246c0cb
Instruction ID: 6b6c2b73d5e8574a3b81abf97a37ca89bed4f4be007a312a0cdf831e8ddb8018
Opcode Fuzzy Hash: a67e06ed6c49d0032f03ed10fe634e4c4085146ddf68770d79a90c437246c0cb
Instruction Fuzzy Hash: C2019A78A16318DFCB61CFA4D984BCCBBB2BB48310F601199E409AB395C735AE80CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0520150C, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5628f381de5cc5eeed286e6003e6c8d16dd2c3d65d9a8ce6391b4d4b7019eee
Instruction ID: c0450996c71ca430e185fe377eacd6c3e8f3651cb7af1f46892ad2b1320b63e1
Opcode Fuzzy Hash: a5628f381de5cc5eeed286e6003e6c8d16dd2c3d65d9a8ce6391b4d4b7019eee
Instruction Fuzzy Hash: B201C474E122289BEB54DF28DD90B9DBBB6BF94200F1042A9D409A7294CA345E84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 052039ED, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b0cc08cd3d40986020c988c0c28d896c6a3e0033c4d19f9482461b893257ce7
Instruction ID: 7e4bbccb4785f062732347beefe4478ef7a73be814933eaaf215439d858806f8
Opcode Fuzzy Hash: 2b0cc08cd3d40986020c988c0c28d896c6a3e0033c4d19f9482461b893257ce7
Instruction Fuzzy Hash: FA01727495122ACFCB64CF68D984BADB7B1BF48304F1051E9D419A7754E730AE80CF11

Uniqueness

Uniqueness Score: -1.00%

Function 061D1B88, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920b93513482b2dc2d55a0b05cc0d68aa6ad043683fb241dccfe0461b2bb2298
Instruction ID: 2e57616338029a606f563069f3f47bba3ebb30e5c7de5b9c0690ca2f131b97be
Opcode Fuzzy Hash: 920b93513482b2dc2d55a0b05cc0d68aa6ad043683fb241dccfe0461b2bb2298
Instruction Fuzzy Hash: 4FF0A9B0C06348BFCB11DFA4E9815ACBFB9AB4A310F1081EAD8405A381E3359A42DF90

Uniqueness

Uniqueness Score: -1.00%

Function 02D205F6, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.276694048.0000000002D20000.00000040.00000040.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2d20000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1509707048eb6f3cbfbcc1fac471649557ba3d5a412fdedf2e881cbebd538b6
Instruction ID: 481b3eb083fc99eb1f1f74202245eaeb322ca440162695185f91610389318db1
Opcode Fuzzy Hash: f1509707048eb6f3cbfbcc1fac471649557ba3d5a412fdedf2e881cbebd538b6
Instruction Fuzzy Hash: BBE09276A406008BD650DF0BEC41456F7D8EB88630B18C07FDD0D8B700E575B508CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 06062243, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284408021.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6060000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f17b0324d26ad14c6de504d0f755eb09d3a0968af64d9974bcc1e523de49c49c
Instruction ID: 28a34a7e7452488bf98d887154c51cba8ef4018dd637daac42c54a802be591a6
Opcode Fuzzy Hash: f17b0324d26ad14c6de504d0f755eb09d3a0968af64d9974bcc1e523de49c49c
Instruction Fuzzy Hash: 51E0D8729413046BD6509E069C86B53FF98DB50A30F14C45BEE0D1B702E1B2B5048AF1

Uniqueness

Uniqueness Score: -1.00%

Function 06061C67, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284408021.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6060000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 675cc1803aa1cc6a3ad88ced6b4b77c26c03ceddb0191df11040d4f42fae74b6
Instruction ID: fda69d98964644347aab297a75bb37c3331e973aa44dbc88851b55db7e90324c
Opcode Fuzzy Hash: 675cc1803aa1cc6a3ad88ced6b4b77c26c03ceddb0191df11040d4f42fae74b6
Instruction Fuzzy Hash: 82E0D872A513006BD2509E069C46B57FB98DB50A30F14C45BEE081B702E1B2B514CEE1

Uniqueness

Uniqueness Score: -1.00%

Function 060623BB, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284408021.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6060000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a3970c1431907c60b8dd4e380dc720c72939b7109539050cd7507ef0ea6d34
Instruction ID: 0fc9bdb6d2da3d87406bf1fff1b1cbf68a1f95508d6f55ec08606d2c2633983a
Opcode Fuzzy Hash: 07a3970c1431907c60b8dd4e380dc720c72939b7109539050cd7507ef0ea6d34
Instruction Fuzzy Hash: 75E0D8B29413006BD2509E469C46B53FB98DB54A30F14C46BEE081B741E1B1B5148AF1

Uniqueness

Uniqueness Score: -1.00%

Function 0122B537, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.276512079.0000000001222000.00000040.00000001.sdmp, Offset: 01222000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1222000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 911af0e96dfccf0fa1420b55ebf22568893ee9c1cd99eede20c518505d7bfe94
Instruction ID: 94a551b5cc614878dc1dc4c5ecb8151d35b27342dc5957440051c4da2ba6f4d6
Opcode Fuzzy Hash: 911af0e96dfccf0fa1420b55ebf22568893ee9c1cd99eede20c518505d7bfe94
Instruction Fuzzy Hash: 40E0D8729413046BD2509E469C46B53FB58DB50A30F14C55BEE081B701E1B1B5048AF1

Uniqueness

Uniqueness Score: -1.00%

Function 061D1AC7, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33a927e151f71acd3c6ba399d9acd51786fe57132ab9457af06ac087b5c8e36
Instruction ID: fef7d5b8d07713d1e5d6fc41d4e375b8e604ef75fdc5e2a028acfd75a646898b
Opcode Fuzzy Hash: a33a927e151f71acd3c6ba399d9acd51786fe57132ab9457af06ac087b5c8e36
Instruction Fuzzy Hash: A5F01C34D05248EFCB55DFA8D55569CBBB4EF46300F1080EAD80897352D6719A06CB41

Uniqueness

Uniqueness Score: -1.00%

Function 061D01E0, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4428370aa8ce29fa6476a5aff86cf1214cd54e7944830e54a574044fbf04d2c5
Instruction ID: a59e3f6045801c2af0c9790922b0c92483f4209bc1ea23c4fbc66b842db46f1b
Opcode Fuzzy Hash: 4428370aa8ce29fa6476a5aff86cf1214cd54e7944830e54a574044fbf04d2c5
Instruction Fuzzy Hash: 23F01530D06348AFCB55DFA8D80559CBFB0EF4A310F1081AAD804A7352D3709A48CF92

Uniqueness

Uniqueness Score: -1.00%

Function 061D04A8, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bb943296a72d2a942caf356a3aa9a1f49738b31a053da0a92068289240d8a43
Instruction ID: 7be6b9d752c7efe943e2164aab8270b95b5fd5758f6fa96f7c14abf319b64865
Opcode Fuzzy Hash: 4bb943296a72d2a942caf356a3aa9a1f49738b31a053da0a92068289240d8a43
Instruction Fuzzy Hash: D5F03074D04208AFCB44DF94E54499CBBB0EF58310F10C0AADC049B341D3359E55DF91

Uniqueness

Uniqueness Score: -1.00%

Function 061D0E69, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02543dee715711fbfa00f025949536360eda9a477befa5a4fc572e688ec78dc
Instruction ID: e79ba3116f3a733065ba85fe164ea48d22a53ef73b35ded1ca8bf0d0ae043ebb
Opcode Fuzzy Hash: a02543dee715711fbfa00f025949536360eda9a477befa5a4fc572e688ec78dc
Instruction Fuzzy Hash: 76F06534D0A388AFCB21DFA4E84859CBFB0AB5A201F0090EED81897342D2708A44EF52

Uniqueness

Uniqueness Score: -1.00%

Function 061D0518, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0f3b407b1700c3e2fe0e56dbb3bb71d291d991c11a09223f1be2c8c85a3a4c0
Instruction ID: 688f3c8b6f420156ca71f83531322ae53884741b37cfae2dff406afb52a297a9
Opcode Fuzzy Hash: a0f3b407b1700c3e2fe0e56dbb3bb71d291d991c11a09223f1be2c8c85a3a4c0
Instruction Fuzzy Hash: 51E09AB0815388EFCBA2CFA4E44A2DDBFB0AF07211F0040EAD84893242E3704A44CB52

Uniqueness

Uniqueness Score: -1.00%

Function 06081EF0, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284508563.0000000006080000.00000040.00000001.sdmp, Offset: 06080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6080000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaa68eab28f36651aaea3048d533c397b6db41cca562f04a11db83d99e354074
Instruction ID: c8c8f3dab464d41f1ed84ffbef7476ead39953fe805acce5581ce4eb6332a1a8
Opcode Fuzzy Hash: aaa68eab28f36651aaea3048d533c397b6db41cca562f04a11db83d99e354074
Instruction Fuzzy Hash: 7EF03975954268DEDB20DB90CC48BECBBB8AB49312F0000D5A209BA381C7741AC8CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05206E0B, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66303de0801d15a18590a51a7d36714f17bf573d0a6b0fe014eea6ddb288f978
Instruction ID: 03382dc2ca38d0c20e1ab3de7acb8f595824d7e80f31a51c36aa6fe6d29ff471
Opcode Fuzzy Hash: 66303de0801d15a18590a51a7d36714f17bf573d0a6b0fe014eea6ddb288f978
Instruction Fuzzy Hash: 66F06570E34228DFEB50CF60C940F9EB7B6BF9A310F00A0E6C509A6281D7349E508F65

Uniqueness

Uniqueness Score: -1.00%

Function 061D0E28, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfe603d1cb7d39981fe2c31453a6c73a2ad7d7c0788766b28b0dd92cc6296b02
Instruction ID: 2695dfeacde55fbdca34b97e9db4d32acac7884fd185191886d6760dbeb297c2
Opcode Fuzzy Hash: dfe603d1cb7d39981fe2c31453a6c73a2ad7d7c0788766b28b0dd92cc6296b02
Instruction Fuzzy Hash: 97E09A308093C8AFC716DFB4801968CBFB5DB06205F1440EECC884B282E675DA04DB92

Uniqueness

Uniqueness Score: -1.00%

Function 061D0171, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1c307d712ce24084ae309938729fcf8f94dc0695a264d19d22f538595dd4cb
Instruction ID: ef6b3d7ccf450dd350122049633c2c28e4f4af39772bc5e1444746da10854de3
Opcode Fuzzy Hash: ce1c307d712ce24084ae309938729fcf8f94dc0695a264d19d22f538595dd4cb
Instruction Fuzzy Hash: C3E06D349043489FCB15CF68D54069CBFB0EF86304F2481DACC045B342C2319A16DB91

Uniqueness

Uniqueness Score: -1.00%

Function 06080D30, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284508563.0000000006080000.00000040.00000001.sdmp, Offset: 06080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6080000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0e754b9e9a6e1da0d2b22a3d6f84e58d33255e17c89d46fc36c52fe11861dc1
Instruction ID: 8b7e707c1fd04d715f4e038be7a44bbaa8cc2da19e0a85dc77ee7a434ff5c626
Opcode Fuzzy Hash: b0e754b9e9a6e1da0d2b22a3d6f84e58d33255e17c89d46fc36c52fe11861dc1
Instruction Fuzzy Hash: 61E04F30981208EFD704EFA4E5066ADBB75E702701F104169C90627241DB726984DF95

Uniqueness

Uniqueness Score: -1.00%

Function 061D0478, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 572f137f8545d23561daf225e1f808d31e06c6ff5aa8d8c3eab23273b11f340b
Instruction ID: ce469091d5e39cdbe9ff865b124156edcf105be66c8762f3e9e74b0e10cc20cf
Opcode Fuzzy Hash: 572f137f8545d23561daf225e1f808d31e06c6ff5aa8d8c3eab23273b11f340b
Instruction Fuzzy Hash: A1D0A78286AB840FCA661AA038187F87FDD5F77117F491DD6C544865A3DB4849D4C632

Uniqueness

Uniqueness Score: -1.00%

Function 061D04B8, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 391078271c4503a26df5e7a5c520530c852f6c5a3ad589f570b4ee64cb8b22dc
Instruction ID: 5bb14a465c733d46b61ce3833190fe33bb1699d98e5a096f98a712635940c177
Opcode Fuzzy Hash: 391078271c4503a26df5e7a5c520530c852f6c5a3ad589f570b4ee64cb8b22dc
Instruction Fuzzy Hash: 23E09A74D00208EFCB54DF98D585A9CFBB5EB58310F10C1A9DC0867341D732AA51DF95

Uniqueness

Uniqueness Score: -1.00%

Function 0520E1D8, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a29e8833e72bf0106da6228266b7e0a3c8e9f7f30f9cf037cbfb2529bdb71631
Instruction ID: deb9ba9ae8bbb1678be65faac6dbdbe915833f720a0c1e1f563b32e594398ee6
Opcode Fuzzy Hash: a29e8833e72bf0106da6228266b7e0a3c8e9f7f30f9cf037cbfb2529bdb71631
Instruction Fuzzy Hash: 24E0EE78E00218EFCB04EFA8D448AADBBF4FF08300F1085AAD818A3350D7716A40CF92

Uniqueness

Uniqueness Score: -1.00%

Function 061D1AD8, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04793bb588542fcfab491613d4f2adc35780d6ba860d7ad0dfa012b988744ca3
Instruction ID: 6c6a9f704fcdf9ed8c2f50fb03c7488204eba9030f8db8f84e4092244172b267
Opcode Fuzzy Hash: 04793bb588542fcfab491613d4f2adc35780d6ba860d7ad0dfa012b988744ca3
Instruction Fuzzy Hash: 92E09274D00208ABCB54DF98D54569CBBB8EB88304F2081AAD80897381D632AA46DF81

Uniqueness

Uniqueness Score: -1.00%

Function 061D1B98, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6af5f615b2808be13bd0e9df6f9338f406b916b7d366a1bc1c3f32c31afbbaba
Instruction ID: f96bb4b12e974c174af413c3dfc2b715dadfb1df6650adbb88114e099d0b73ae
Opcode Fuzzy Hash: 6af5f615b2808be13bd0e9df6f9338f406b916b7d366a1bc1c3f32c31afbbaba
Instruction Fuzzy Hash: FAE0B674D0130CEBCB14DFA8D54569DBBB9FB54300F5081E9D80467340D735AA90DF95

Uniqueness

Uniqueness Score: -1.00%

Function 0520B0D0, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cabe5e5d7a60f5f7867b101e1ddebe67da94182cf03537e742e9f5d2776d43a9
Instruction ID: ab858a4e60cb84aafb8c432c5056a1709ff08c2f74e55dbef1a6fde76e251693
Opcode Fuzzy Hash: cabe5e5d7a60f5f7867b101e1ddebe67da94182cf03537e742e9f5d2776d43a9
Instruction Fuzzy Hash: 26E0EC74D05308EBC768EFB8D50565DBBB5AB44300F1095A9C81853354D635AA50DF81

Uniqueness

Uniqueness Score: -1.00%

Function 061D0E78, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3203e765054337b4e975bf591b2827a02d034e22bb62c7c6a4a1e5c4fe912dd9
Instruction ID: 4205b52c50948d38b2643fe7b84186d2f32d7be3f820f7aabca70651dddb713e
Opcode Fuzzy Hash: 3203e765054337b4e975bf591b2827a02d034e22bb62c7c6a4a1e5c4fe912dd9
Instruction Fuzzy Hash: 16E0E274D01208EBCB24EFA8E549A9DBBB8FB48301F1091A9D81863345D730AA40DF95

Uniqueness

Uniqueness Score: -1.00%

Function 061D0180, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f9f1e389ce675405a42097c9e2c1b52ef2bd24e55866745d70f955221b36a2
Instruction ID: 392649fb1ec04b35664469732bc3b2f79e2da5ff3096e12b70d9c07df14559d2
Opcode Fuzzy Hash: 08f9f1e389ce675405a42097c9e2c1b52ef2bd24e55866745d70f955221b36a2
Instruction Fuzzy Hash: 84E01238904208EBC714DF94E54565CBBB4EB45305F6091DDCC0817341C732EE46DB91

Uniqueness

Uniqueness Score: -1.00%

Function 061D01F0, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f8bb5f1a72795fb0856a9270cb45dc68e9c1dd012db145f9457108369302e73
Instruction ID: 5bcb50bf4d5ad4dc8e0c2433fa147a65cc2f14b430e068e438f3ef1c63a6403b
Opcode Fuzzy Hash: 2f8bb5f1a72795fb0856a9270cb45dc68e9c1dd012db145f9457108369302e73
Instruction Fuzzy Hash: 6BE0E274D02308EFCB24EFA8E54969DBBB8EB48301F1081A9D80863344D734AA40DF96

Uniqueness

Uniqueness Score: -1.00%

Function 05200571, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61a078d176ffa100f83c09b346facfedb1d4aea248ade38f1f4556abc127c8f7
Instruction ID: cc7538de26984b09332d759a19ef92357dc30d738e5be9744aad648b439ca77a
Opcode Fuzzy Hash: 61a078d176ffa100f83c09b346facfedb1d4aea248ade38f1f4556abc127c8f7
Instruction Fuzzy Hash: 40E0E570C12229CFDB54DFA0C8415DDBBB2AF8A300F5064E9844A7B250DB755A91CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0520A9C0, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09ebbc077527e5f293d60a01d62dfccb8ce45c4cf06107a9a6d779aaf091fc57
Instruction ID: 02d898e1319b52628d7f863f92a4694b105636b35835220a0b313d991b766ac6
Opcode Fuzzy Hash: 09ebbc077527e5f293d60a01d62dfccb8ce45c4cf06107a9a6d779aaf091fc57
Instruction Fuzzy Hash: 32E0E270E1130CEFCB68EFB8904439CBBB4AB44200F5040AAC818A3350E73AAA90DF91

Uniqueness

Uniqueness Score: -1.00%

Function 0520AA00, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3d50de37b93e6b2c9c68730fe3ad444d4611b87b2eb42c3dd4c15ab60f42531
Instruction ID: ad2b4e0704f312237a7841220f7ea20a0f296afd402effca62796c4ed9798302
Opcode Fuzzy Hash: d3d50de37b93e6b2c9c68730fe3ad444d4611b87b2eb42c3dd4c15ab60f42531
Instruction Fuzzy Hash: C9E0E270D01308EFCB68EFB8D10839CBBB4AB04200F5044B9C808A2390E736AA90CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0520A6B8, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d13ae446864eb2c312d7d539fbd4a34d9433d5eef91c1f857c398747d444505
Instruction ID: 4872f345eea3665a4ff41b633524d2283583a706de5f9922cb1947126495ab44
Opcode Fuzzy Hash: 4d13ae446864eb2c312d7d539fbd4a34d9433d5eef91c1f857c398747d444505
Instruction Fuzzy Hash: 4AE0EC34911208AFD724EFA8E44876C77B4EB04215F1001A9C906A3355D6756994DB92

Uniqueness

Uniqueness Score: -1.00%

Function 012123F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.276498862.0000000001212000.00000040.00000001.sdmp, Offset: 01212000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1212000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e44b8fdb80a759e03a163a68eb5a844b8760a637dc1823d4771e25e2851af0d
Instruction ID: f855e2df127bae1eba7434308fdbe2a9650020dc11f1680ee81da99e0f23fd8b
Opcode Fuzzy Hash: 1e44b8fdb80a759e03a163a68eb5a844b8760a637dc1823d4771e25e2851af0d
Instruction Fuzzy Hash: 0AD05E79265A928FE326CA1CC1A8B953FE4EB61B04F5644FDF9008B667C368E981D200

Uniqueness

Uniqueness Score: -1.00%

Function 061D0E38, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78b93a2991ab586851dea8ec0c341ae763ea4f0dd08dc0fd311a78fb37b51299
Instruction ID: bef63bd0b0920253f0634f8d222b63e48dee3beacdc33ceb5b67eeb0dbb61f55
Opcode Fuzzy Hash: 78b93a2991ab586851dea8ec0c341ae763ea4f0dd08dc0fd311a78fb37b51299
Instruction Fuzzy Hash: 3ED05E30C01308EBC768EFA8D10565CBBB8EB00705F5001EDC80817380D731EA44DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 061DA4BB, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f46ed88c51529374bd309a58b4e065c50ff0c80fe2fe0306df6edc80d16975f
Instruction ID: 166ecd1e220e5897576e56d9af1937dae0075090d6e4f1ae6cbb87350405aec2
Opcode Fuzzy Hash: 5f46ed88c51529374bd309a58b4e065c50ff0c80fe2fe0306df6edc80d16975f
Instruction Fuzzy Hash: DAE04F7080A265CFEB81DF28C868B6CFBB4FF16204F1141EAC5089B147C7310A01CF55

Uniqueness

Uniqueness Score: -1.00%

Function 061D0528, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7756fd1e18833ed33e70d14ed9636410c78832de30dcbbb49dff0fa72e2ef68
Instruction ID: 11c9c9686df29aa750e29460b8ea3604b7a99fe298cedc3f0528b1b4074b1b3c
Opcode Fuzzy Hash: a7756fd1e18833ed33e70d14ed9636410c78832de30dcbbb49dff0fa72e2ef68
Instruction Fuzzy Hash: 1FD05E74D01208EBC760EFA4E50965CBBB8EB04205F1050A9CC0863340D7309A40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 052011A2, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05c42264fd424039712c0517a5f12ee0a8a80d2643f4486d9a2978b6afa21074
Instruction ID: a875bc33ae3778aa83aa967e073e367cf6380002ee5fcd4a31af60721cfc3bc8
Opcode Fuzzy Hash: 05c42264fd424039712c0517a5f12ee0a8a80d2643f4486d9a2978b6afa21074
Instruction Fuzzy Hash: F3E0B670D26229DFDB69DF70C8906EEBBB2BF59300F5055AA8009AB250DB356A81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05201099, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ded61998aa3d1647427222d21a830223fc834499be68ca4c329f175e40d49500
Instruction ID: 84b245cd5cad172c93fef7751241c1556e9183b3cc2167983fb7fc356ff824a4
Opcode Fuzzy Hash: ded61998aa3d1647427222d21a830223fc834499be68ca4c329f175e40d49500
Instruction Fuzzy Hash: D2E09270C26229CFDB24DF60C851AADBBB2BB45310F1056A9C10AAB254D7386A81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 012123BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.276498862.0000000001212000.00000040.00000001.sdmp, Offset: 01212000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1212000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50f7d0879db64ed24d6a0025c32726d65de4adb1b2221101fd621106f483f7dc
Instruction ID: 0967330960231bba018446aa10f5f0c5a024eeda04d43f6ab177925e9833f381
Opcode Fuzzy Hash: 50f7d0879db64ed24d6a0025c32726d65de4adb1b2221101fd621106f483f7dc
Instruction Fuzzy Hash: BCD05E342102828FD715DB0CC594F593BD4AB51B00F2644E8BE008B666C3A5D881D600

Uniqueness

Uniqueness Score: -1.00%

Function 05206F3F, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98cac5cbc26cacae2ed8c39fa2d4ae335815485b48e136e6eb179d6b560c395d
Instruction ID: cdba03b5ec2bf192b22cccd9c48d1edcb92fedb158cb41a276e836228977529a
Opcode Fuzzy Hash: 98cac5cbc26cacae2ed8c39fa2d4ae335815485b48e136e6eb179d6b560c395d
Instruction Fuzzy Hash: 91D017B4D143689BDB80DF94C4446DEBBB2BFA9320F14B069C009B2244D7306A85CF26

Uniqueness

Uniqueness Score: -1.00%

Function 05207E15, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a24d994d43ecfe37ea66d80a0dc93f4aefcd3b485b75337d5773966b20316b92
Instruction ID: e53ee7460a691410e0a2c68cbb8cc5e422ff257d382ab94fb4d15a74ef89d2bc
Opcode Fuzzy Hash: a24d994d43ecfe37ea66d80a0dc93f4aefcd3b485b75337d5773966b20316b92
Instruction Fuzzy Hash: 9FD02E30D2832C9BCB40DB50C480B8EB3B4EF9A210F1028D5C007A3294CB388B42CF10

Uniqueness

Uniqueness Score: -1.00%

Function 052073AD, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29940013b6b33b743b2270a09dc918b505f618cc823f3f87f1bcf9977faff32b
Instruction ID: 5d5393df15d4872728555fef8f4a165b1dd0107791eab4e2d57285961d75f1fb
Opcode Fuzzy Hash: 29940013b6b33b743b2270a09dc918b505f618cc823f3f87f1bcf9977faff32b
Instruction Fuzzy Hash: 10D0A774C352249EC724CF20C902F9FF6B4EF52300F0075ED84009A041E37856608E51

Uniqueness

Uniqueness Score: -1.00%

Function 0520736E, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a396de36d40108805a1ef3489f1335f977255efab40222dbd3d3e1d131c97023
Instruction ID: 5b74324d4bed492bf0dad60d742121d0819f3bb372551c36946b56a71a6da8af
Opcode Fuzzy Hash: a396de36d40108805a1ef3489f1335f977255efab40222dbd3d3e1d131c97023
Instruction Fuzzy Hash: A5D0A774C24228EFCB10DF60C900F9EF7B5BF85300F0024958004E7140D3389A90CF52

Uniqueness

Uniqueness Score: -1.00%

Function 05201949, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f04ad6de3b18ecc6e13656cc39f9dfaeab58b177f2a1c390952ec47a9f8fa4fa
Instruction ID: ee260dea053fde67f0c66752c7973d08d872db7738563e2135a89a590783d234
Opcode Fuzzy Hash: f04ad6de3b18ecc6e13656cc39f9dfaeab58b177f2a1c390952ec47a9f8fa4fa
Instruction Fuzzy Hash: CED01774D15229DECBA4CF98D88069DB7B6BB94200F20A59A9449A6204CB305A85CF01

Uniqueness

Uniqueness Score: -1.00%

Function 0520335D, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26d4259e1b786625cc6465e06ec3e31cf9ae26eac0ec280468b17f9cb4ed21c4
Instruction ID: e8af5dff75c0d2bbaafc3a9024b09ab207faae329b6d5f63dc6b21dd6ccce800
Opcode Fuzzy Hash: 26d4259e1b786625cc6465e06ec3e31cf9ae26eac0ec280468b17f9cb4ed21c4
Instruction Fuzzy Hash: 92D01774421184DFCB21CFD0D48C66DBB71BF04348F006887D446AA24AC7B00580CF66

Uniqueness

Uniqueness Score: -1.00%

Function 05207C4C, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1707c45fabfbba96265bbd2053b19778291dd352c90a825078f5f46965ebaa3
Instruction ID: 977f72c0dcee5a81a79b5a31580e7bd25b157511a9e5cf0f4f34d027c6e3a9d3
Opcode Fuzzy Hash: b1707c45fabfbba96265bbd2053b19778291dd352c90a825078f5f46965ebaa3
Instruction Fuzzy Hash: C8D092789192A8DFDB14DBA4D940B9EBBB6AF5A320F042495D505B7340C338AA908F26

Uniqueness

Uniqueness Score: -1.00%

Function 052032D6, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808bed0504b1beff0b9dea561c8ea1d5ed4bb898dde6a8cfd23e1299753dba7f
Instruction ID: d70f03616fe5211bf73951d20280daed1fea1f2b8a27dbc0d3ae3f8db1532ced
Opcode Fuzzy Hash: 808bed0504b1beff0b9dea561c8ea1d5ed4bb898dde6a8cfd23e1299753dba7f
Instruction Fuzzy Hash: A9D06C75602394CFC725DF60E5A88A87B72AF4931AF112598E40A6B365CB31DA80CF04

Uniqueness

Uniqueness Score: -1.00%

Function 061D0488, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 251f1d0cabc2146e8a04bb1e90e48fea23bd48ad396b63fd54ff859ae1ae8c43
Instruction ID: 62f03195a7e30ca1b197a7135154b408538dccfbc8707af8a30df2f85657237b
Opcode Fuzzy Hash: 251f1d0cabc2146e8a04bb1e90e48fea23bd48ad396b63fd54ff859ae1ae8c43
Instruction Fuzzy Hash: 31B09B5415671457D5783994750C73C72CD5B60505F441C68CA0C116D58E55D4D0C576

Uniqueness

Uniqueness Score: -1.00%

Function 061D1150, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355196c362280e9cfcd5663f353709c97ba9ab818c62fe61009365d2693937ad
Instruction ID: 40d11868d81766d483720f342b211a0a47e2b30e29de3a72b84ea5a3da990e81
Opcode Fuzzy Hash: 355196c362280e9cfcd5663f353709c97ba9ab818c62fe61009365d2693937ad
Instruction Fuzzy Hash: F7C01238A04108EFDB00CF80E1A89ACFBB0EF09300F20C942EC051B34ADB309A0A9B80

Uniqueness

Uniqueness Score: -1.00%

Function 0520ECF8, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6191cf28ae02742a8058688527d003aea9a491baee31ffaebcd361cc1bfb362a
Instruction ID: 98d4ca4b7e01085859f26a11e78066392ba3c0a596ca9fdcedec80e7fb290f9b
Opcode Fuzzy Hash: 6191cf28ae02742a8058688527d003aea9a491baee31ffaebcd361cc1bfb362a
Instruction Fuzzy Hash: 38C02B3000270857D2742A90720C33C33CCF7C4201F846814C70D012C2CE24D040CB71

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0520ED28, Relevance: 5.2, Strings: 4, Instructions: 156COMMON

Download Yara Rule

Strings

:@Dr, xrefs: 0520EE69
f]Ir, xrefs: 0520ED72
`5kr, xrefs: 0520EF42
>_Ir, xrefs: 0520EE86

Memory Dump Source

Source File: 0000000A.00000002.281573300.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5200000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID: :@Dr$>_Ir$`5kr$f]Ir
API String ID: 0-3492759196
Opcode ID: aa79cc756f23954ee4147cc59d05f420fca308566d4e5da175630f2ee9f88da9
Instruction ID: e30e34d690b8982a4be123a76eec682c1df5023066b851e19cec12acf26a1880
Opcode Fuzzy Hash: aa79cc756f23954ee4147cc59d05f420fca308566d4e5da175630f2ee9f88da9
Instruction Fuzzy Hash: CD616870E00609CBD758DF6AE84469EBBF3FFC4310F24D539D509AB258EBB958068B52

Uniqueness

Uniqueness Score: -1.00%

Function 061D9251, Relevance: 6.5, Strings: 5, Instructions: 201COMMON

Download Yara Rule

Strings

X1kr, xrefs: 061D93C5
X1kr, xrefs: 061D93FE
`5kr, xrefs: 061D939D
Q, xrefs: 061D92DB
$ghr, xrefs: 061D936D

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID: $ghr$X1kr$X1kr$`5kr$Q
API String ID: 0-1636417527
Opcode ID: 2e4e0f6087bf1844edfac40553470169b7793402ad13bb8f919e63d58d7390d3
Instruction ID: c1c06d9d630f6561a8a7701106becaaf264eaf077ae33b3f5467a9750abb0744
Opcode Fuzzy Hash: 2e4e0f6087bf1844edfac40553470169b7793402ad13bb8f919e63d58d7390d3
Instruction Fuzzy Hash: 4861D435A00505AFCB54DF78C844BAE7BF6EF49320F144659E516EB3E1CB35A840CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 061D92D0, Relevance: 6.4, Strings: 5, Instructions: 135COMMON

Download Yara Rule

Strings

X1kr, xrefs: 061D93C5
X1kr, xrefs: 061D93FE
`5kr, xrefs: 061D939D
Q, xrefs: 061D92DB
$ghr, xrefs: 061D936D

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID: $ghr$X1kr$X1kr$`5kr$Q
API String ID: 0-1636417527
Opcode ID: 51e2b1e525be66029ac314461b7c24a8e791fefa361adaf7df5056ccaf3dd002
Instruction ID: eeb4b9ec5e0f2b6f4e068c86d9ba673ad067f1ac888e0fc04b244767d09a2662
Opcode Fuzzy Hash: 51e2b1e525be66029ac314461b7c24a8e791fefa361adaf7df5056ccaf3dd002
Instruction Fuzzy Hash: D5513A30B00505DFCB54DF79C854AAEBBF2AF89310F244669E516EB7E0CB35A840CB95

Uniqueness

Uniqueness Score: -1.00%

Function 061D9469, Relevance: 5.1, Strings: 4, Instructions: 61COMMON

Download Yara Rule

Strings

`5kr, xrefs: 061D94D1
X1kr, xrefs: 061D94AB
`5kr, xrefs: 061D94C1
T, xrefs: 061D9471

Memory Dump Source

Source File: 0000000A.00000002.284830047.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61d0000_FNYVlhLumPogrzL.jbxd

Similarity

API ID:
String ID: T$X1kr$`5kr$`5kr
API String ID: 0-3460261500
Opcode ID: 52543c72c907448ffd7c4de4e5ca57b5a429995cd22ca94b8c59a0fce65bc231
Instruction ID: 5e4477cd117b7e1d3f663717dbd648cd6e30c235bdd96cd88b62fc1e69a2904a
Opcode Fuzzy Hash: 52543c72c907448ffd7c4de4e5ca57b5a429995cd22ca94b8c59a0fce65bc231
Instruction Fuzzy Hash: F121A674E04209DFCB54DFA8C284AAEBBB1EF44301F2185AAD815AB351D7749E45CFA2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegSvcs.exe PID: 4912 Parent PID: 2208 RegSvcs.exeCOMMON

Execution Graph

Execution Coverage:	24.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5%
Total number of Nodes:	121
Total number of Limit Nodes:	10

Executed Functions

Function 0555B530, Relevance: 2.3, Strings: 1, Instructions: 1089COMMON

Download Yara Rule

Strings

r, xrefs: 0555C1EC

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID: r
API String ID: 0-1812594589
Opcode ID: f3a122d6d3c55f471c757f05902f56fe896defcbffa30a0f70382999a7e06b77
Instruction ID: 0115dd4bc13ee8214b6cd3475e4e7bb4ced603f4fdb465c35cf40506b23df971
Opcode Fuzzy Hash: f3a122d6d3c55f471c757f05902f56fe896defcbffa30a0f70382999a7e06b77
Instruction Fuzzy Hash: 68A25A70A00609DFCB15CF68C494AADBBF2FF88320F15C56AD85AAB655D734E941CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05553850, Relevance: 2.0, Strings: 1, Instructions: 749
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

>_Ir, xrefs: 05553F9D

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID: >_Ir
API String ID: 0-3386957151
Opcode ID: 900115ec9575fb64de49643049a2001f8acf28ce11f6e79011d7c3233ed5d230
Instruction ID: bf91132bd3893fe2d6911de785201f2b12f194e1ef78ab3359b9ed99ae5d4c46
Opcode Fuzzy Hash: 900115ec9575fb64de49643049a2001f8acf28ce11f6e79011d7c3233ed5d230
Instruction Fuzzy Hash: 9C42C471A04215CFCB15CF68C4A49A9BBF2FF85360B16C9A7D9199F252D731EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05672AF6, Relevance: 1.6, APIs: 1, Instructions: 79networkCOMMON

Download Yara Rule

APIs

bind.WS2_32(?,00000E2C,430DA086,00000000,00000000,00000000,00000000), ref: 05672B87

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: bind
String ID:
API String ID: 1187836755-0
Opcode ID: bac612e4df4bf866a888725c60ba3c42c97c0afc06f194c575f65304cc3de081
Instruction ID: ae321e643f63a6ff0181730026c3f425598d221ca709e4e1baad92d4d13a467d
Opcode Fuzzy Hash: bac612e4df4bf866a888725c60ba3c42c97c0afc06f194c575f65304cc3de081
Instruction Fuzzy Hash: 4621A175408384AFE712CF25DC94F96BFA8EF46710F08859BEA84DB252D364A908CB71

Uniqueness

Uniqueness Score: -1.00%

Function 056713BF, Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 0567143F

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 0e0c220133e335d7481932b7982563a8f3a73a16c76b7cbcb8ba819d804cef22
Instruction ID: c6aaaa7f695846dade46376e75c35a22d548e57768d57a016ee70f32a1ada53e
Opcode Fuzzy Hash: 0e0c220133e335d7481932b7982563a8f3a73a16c76b7cbcb8ba819d804cef22
Instruction Fuzzy Hash: 1F21BF76509384AFDB228F25DC40B52BFF4EF06210F09859BE9858B663D2749908DB62

Uniqueness

Uniqueness Score: -1.00%

Function 05672FE2, Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,00000E2C,430DA086,00000000,00000000,00000000,00000000), ref: 05673052

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: Recv
String ID:
API String ID: 4192927123-0
Opcode ID: 859905bc1d464c9f396406df595d674c4841e27299a29cad63e2bc5f6886f4c5
Instruction ID: ee0ce83d96e9e1316220b6270b05d5fe9eae226773f4c46b94d662f82f0eabe8
Opcode Fuzzy Hash: 859905bc1d464c9f396406df595d674c4841e27299a29cad63e2bc5f6886f4c5
Instruction Fuzzy Hash: F811CD72500204EFEB21CF65DC44FA7FFA8EF44320F04896BEA459B211D275A409CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 056717FB, Relevance: 1.6, APIs: 1, Instructions: 64nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?), ref: 05671871

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: b0b636e8561098c33269c9ddcc3c6a14cd76cc0d946ecf69e15e79de3aa861ad
Instruction ID: 9d80b09190e5167b595493e6bae9c15b971a96a4d1144ae5f958f777bc656186
Opcode Fuzzy Hash: b0b636e8561098c33269c9ddcc3c6a14cd76cc0d946ecf69e15e79de3aa861ad
Instruction Fuzzy Hash: EF21AE724097C4AFDB238B20DC45A62FFB0EF17314F0981DBE9844B1A3D275A509DB62

Uniqueness

Uniqueness Score: -1.00%

Function 05672B26, Relevance: 1.6, APIs: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

bind.WS2_32(?,00000E2C,430DA086,00000000,00000000,00000000,00000000), ref: 05672B87

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: bind
String ID:
API String ID: 1187836755-0
Opcode ID: 33b0eb0a7174618a42e4b500044317b9bfae0f95cf317054e71a8a99ebeec36d
Instruction ID: ac66b20cee4c76191571c077686176cead00460b20708d64644b5e171c1d1efa
Opcode Fuzzy Hash: 33b0eb0a7174618a42e4b500044317b9bfae0f95cf317054e71a8a99ebeec36d
Instruction Fuzzy Hash: 9111BF75500204AFE720CF65DC84FA6FBE8EF44B20F1485ABEE499B241D774A409CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 05671541, Relevance: 1.6, APIs: 1, Instructions: 57nativeCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL(?,?,?,?), ref: 056715AD

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: InformationProcess
String ID:
API String ID: 1801817001-0
Opcode ID: 7e490e2e950400985e0269e203c31adc8eefcb7c9230716a71fb80c0b7cfbb10
Instruction ID: 2d5f1f55afe199e337a056af58cf7e10b6fc7f98cc19d32b89040f3aa39524a9
Opcode Fuzzy Hash: 7e490e2e950400985e0269e203c31adc8eefcb7c9230716a71fb80c0b7cfbb10
Instruction Fuzzy Hash: 8511BE724093C4AFDB228F25DC40A52FFB4EF06320F0980DAE9854B263C275A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 056713F6, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 0567143F

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 0c281020ae744f7777061c6f37b3d5dac892bd6b5e4345d680599e697a4f77f8
Instruction ID: 14a73c0459afd8ed66e95aca427e038c27c1da4112fc67be72c08173532d1b3a
Opcode Fuzzy Hash: 0c281020ae744f7777061c6f37b3d5dac892bd6b5e4345d680599e697a4f77f8
Instruction Fuzzy Hash: 28119E715006049FDB20CF65D844B66FFE4EF05320F08C56BED458B616D375E408DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0567161A, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0567164C

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: f9ad05a19fbc51c8ed58edf9a7bef2febbac70c4767d991edeb27c22bddaa353
Instruction ID: 91cfcb417125a22a82b4c3cb931f401e0f682c161e99685a5cbec06caf866c20
Opcode Fuzzy Hash: f9ad05a19fbc51c8ed58edf9a7bef2febbac70c4767d991edeb27c22bddaa353
Instruction Fuzzy Hash: D301A270800244DFDB10CF19D885766FFD4EF45320F18C4ABDD088F212D275A444CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05671572, Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL(?,?,?,?), ref: 056715AD

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: InformationProcess
String ID:
API String ID: 1801817001-0
Opcode ID: 92acc01e5e110c174d31dc10c324bf46643277579d42d7639baa95c050a21b61
Instruction ID: 3e7a68e1b98887ba95800ca67c3f866b7845334b0df8eef13f6be5b4fc307c99
Opcode Fuzzy Hash: 92acc01e5e110c174d31dc10c324bf46643277579d42d7639baa95c050a21b61
Instruction Fuzzy Hash: 71017C75400644DFEB208F15D884B26FFA0EF45320F18C19ADE8A0A612C275A418CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05671836, Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?), ref: 05671871

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 92acc01e5e110c174d31dc10c324bf46643277579d42d7639baa95c050a21b61
Instruction ID: 902818d1d427dec730b4aa887ea0eb8ecdfd4d7de4adf8055bc2f5bb5b9069bb
Opcode Fuzzy Hash: 92acc01e5e110c174d31dc10c324bf46643277579d42d7639baa95c050a21b61
Instruction Fuzzy Hash: 72018B31800648DFDB60CF19D884B22FFE0EF49320F18C59BDE490B612D2B5A418CB62

Uniqueness

Uniqueness Score: -1.00%

Function 055523A0, Relevance: .5, Instructions: 505COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b20cc7f11295000333220938599b25d652aebd44305f59ec6bf60d9c8b28e61
Instruction ID: fa317b7592e013f3fd748fb631026ee9d53570d4f13ea5f143c16d22b0c0531e
Opcode Fuzzy Hash: 1b20cc7f11295000333220938599b25d652aebd44305f59ec6bf60d9c8b28e61
Instruction Fuzzy Hash: F3129038E04215CFCB24CF65C4A466DBBF7FB88324F64896AD816DB251DB749C86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05558E68, Relevance: .5, Instructions: 505COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 800785849b15775ae5cc12751a11c1fb6ccef3cdf572435663b2ae9421874a00
Instruction ID: 8b457157fa8fd75088564ddf514bfffd90ee83221542dd103542000a6daf8453
Opcode Fuzzy Hash: 800785849b15775ae5cc12751a11c1fb6ccef3cdf572435663b2ae9421874a00
Instruction Fuzzy Hash: AA12AB30E14215CBDB14CF64D89566DBBF7FF88320F64896AE8169B290DB789941DF80

Uniqueness

Uniqueness Score: -1.00%

Function 05552FA8, Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40afc1de6872934d70eabcb7dcf41d0cd723ac515a0ad549aabc604813b7025a
Instruction ID: 1cdfb4b225957750fd212dab18dc4584e1fe21dca5c29b2660888b97de9ee240
Opcode Fuzzy Hash: 40afc1de6872934d70eabcb7dcf41d0cd723ac515a0ad549aabc604813b7025a
Instruction Fuzzy Hash: DA818031F011159BDB18DB69D854A6EBBE3BFC8360F2A8576D8099B365DE31AC018B90

Uniqueness

Uniqueness Score: -1.00%

Function 05559A68, Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7265eebdac1b1fe1bb6e3b20da5295df87780edf58a3026d194a4afe358dad1b
Instruction ID: b661479d46f748d91758342758b8cc159a47cc327ff21790fd0396226fa23bb3
Opcode Fuzzy Hash: 7265eebdac1b1fe1bb6e3b20da5295df87780edf58a3026d194a4afe358dad1b
Instruction Fuzzy Hash: 3B816D31F05115DBDB18DB69D890A6EBBF3BFC8360F298566E80A9B355DE349C01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05559B2F, Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e588d0c4f39d6766d1054100667e6d3be33713e0c5ae921ec4fa42c06afa2eba
Instruction ID: e9ebe4eb47c5bdec9fa2d56c72ecedabc3d0c5b32720ced498e2a4332003abd9
Opcode Fuzzy Hash: e588d0c4f39d6766d1054100667e6d3be33713e0c5ae921ec4fa42c06afa2eba
Instruction Fuzzy Hash: 09516E72F014159BD718DB6DC990A6EBBF3AFC4320F2A8165D8099B3A9DE34DD01DB84

Uniqueness

Uniqueness Score: -1.00%

Function 05558917, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703abf0c938c44ceb37428f7c97a67c0b13cb214f86f65e2b4b3d4c8731537f7
Instruction ID: 07bf5bd4c75327ac193c976c0b308f7d9de8711da04c20e33421db90a75d1468
Opcode Fuzzy Hash: 703abf0c938c44ceb37428f7c97a67c0b13cb214f86f65e2b4b3d4c8731537f7
Instruction Fuzzy Hash: B5016534C45344CFC305EFB0E468ABA7BB9EB0E311F10A996D85A53251DB380E40CF81

Uniqueness

Uniqueness Score: -1.00%

Function 055509A0, Relevance: 5.2, Strings: 4, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X1kr, xrefs: 05550A98
X1kr, xrefs: 05550AA2
X1kr, xrefs: 05550A5A
X1kr, xrefs: 05550A50

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID: X1kr$X1kr$X1kr$X1kr
API String ID: 0-2451847431
Opcode ID: 3e4ea687933c4240009a4746c48270967812b4f6e9eade1bc0588f5400755841
Instruction ID: ee36bc0a30adc3e63d4aedd22308d9447237068f262cd3886dd7e78f9912d418
Opcode Fuzzy Hash: 3e4ea687933c4240009a4746c48270967812b4f6e9eade1bc0588f5400755841
Instruction Fuzzy Hash: C651C831B40115DFCB15DB64D8A8ABEB7F3BF44324F218556D9469B2A0DB30AD02CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 05559D7B, Relevance: 2.7, Strings: 2, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 05559EBB
>_Ir, xrefs: 05559DEF

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID: $>_Ir
API String ID: 0-1787506450
Opcode ID: e8cb6cd702b68163022719b0add23068f734a0ba240017921a2f445ef332f3e9
Instruction ID: 9dba240cfbf9341596c822fbf98ffe9eace07fc7a031a6679586f3eceecfe1d3
Opcode Fuzzy Hash: e8cb6cd702b68163022719b0add23068f734a0ba240017921a2f445ef332f3e9
Instruction Fuzzy Hash: D851E331F04244CFCB14CB68D8945BEBBB3FBC5224729887BD90ADB245DE399802CB91

Uniqueness

Uniqueness Score: -1.00%

Function 055502E8, Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@Dr, xrefs: 05550537
`5kr, xrefs: 055503A5

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID: :@Dr$`5kr
API String ID: 0-2548079215
Opcode ID: 88b23e4f4ec3d88eebad36539cf242fc384853ffd9f1935e4cc9f047b1d3457d
Instruction ID: aa1fb854be3bf82a691e1e26916b2a357999c274f6a59edf55f61cd17ef16e72
Opcode Fuzzy Hash: 88b23e4f4ec3d88eebad36539cf242fc384853ffd9f1935e4cc9f047b1d3457d
Instruction Fuzzy Hash: BA519D30A05205CFDB09DF68D064B6E7BF2FF89320F15846AD906AB3A1DB71AC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06920EC8, Relevance: 2.6, Strings: 2, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X1kr, xrefs: 06920FD9
lir, xrefs: 06921080

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID: X1kr$lir
API String ID: 0-1919655118
Opcode ID: 5305c5dafb0ee05138888e9510b9ff164a84d96ee8156a82ece81842efde234f
Instruction ID: 92bf1cb60d01273d443daba379ebcbc54ecf595d82a57d84151d934b641c5740
Opcode Fuzzy Hash: 5305c5dafb0ee05138888e9510b9ff164a84d96ee8156a82ece81842efde234f
Instruction Fuzzy Hash: DF51F634E44256CFDB44CFB9D0546AEBBF6BB88300F608A6ED4069BB48DB349C51DB85

Uniqueness

Uniqueness Score: -1.00%

Function 06921049, Relevance: 2.6, Strings: 2, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X1kr, xrefs: 06920FD9
lir, xrefs: 06921080

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID: X1kr$lir
API String ID: 0-1919655118
Opcode ID: 4478e49444380c592df45fad735619df731ef3a2f49a5d8191a6c0065b896753
Instruction ID: 86a3980bbc663f1be65646292e37a25ccc5c50875ebe1ce50b2574504a156448
Opcode Fuzzy Hash: 4478e49444380c592df45fad735619df731ef3a2f49a5d8191a6c0065b896753
Instruction Fuzzy Hash: F631A034F452458BDB05DFB9D0142AEB7E6BBC8304F64855AC50A9B794DF349C45CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0692103D, Relevance: 2.6, Strings: 2, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X1kr, xrefs: 06920FD9
lir, xrefs: 06921080

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID: X1kr$lir
API String ID: 0-1919655118
Opcode ID: 4478e49444380c592df45fad735619df731ef3a2f49a5d8191a6c0065b896753
Instruction ID: 86a3980bbc663f1be65646292e37a25ccc5c50875ebe1ce50b2574504a156448
Opcode Fuzzy Hash: 4478e49444380c592df45fad735619df731ef3a2f49a5d8191a6c0065b896753
Instruction Fuzzy Hash: F631A034F452458BDB05DFB9D0142AEB7E6BBC8304F64855AC50A9B794DF349C45CB81

Uniqueness

Uniqueness Score: -1.00%

Function 055512A0, Relevance: 1.7, Strings: 1, Instructions: 460
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$ghr, xrefs: 05551349

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID: $ghr
API String ID: 0-1352911727
Opcode ID: 2e363ffcb894da05963e60aec0df820c737d37064adbf17c701bcdd2a3fac620
Instruction ID: a7ed7c38e5e2c34a428b69abbb739ea18914b29c0f0bb6230d7601a27fe55eeb
Opcode Fuzzy Hash: 2e363ffcb894da05963e60aec0df820c737d37064adbf17c701bcdd2a3fac620
Instruction Fuzzy Hash: B0220734A00A05CFCB24DF28C490A6ABBF6FF88314F14CA9AD85A9B755DB34AD45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05672335, Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 05672445

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: e7e02ac8aca1796723bf6f51df4f49e9454a8ce79de6fe68e0ec1378473e494f
Instruction ID: 6f614887f51366a01b74875d174bd5690fba4dffbdbd553f0ddfee07c899edbc
Opcode Fuzzy Hash: e7e02ac8aca1796723bf6f51df4f49e9454a8ce79de6fe68e0ec1378473e494f
Instruction Fuzzy Hash: 7841D2B15093C0AFE7128B25DC55F92FFB8EF42220F18859BE9849F293D365A408C761

Uniqueness

Uniqueness Score: -1.00%

Function 05672908, Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(?,00000E2C), ref: 056729EB

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: f639c3d10671165182f746c0c078418c355cd189d3a3456865054d844198d1a5
Instruction ID: 1d4bf62ea50829e1f3ca233a189865d0feb33300be59ec3714c870f58c7a2f28
Opcode Fuzzy Hash: f639c3d10671165182f746c0c078418c355cd189d3a3456865054d844198d1a5
Instruction Fuzzy Hash: E631E7B2504340AFE7228B21DC45FA6FFACEF46710F14899AE9849F193D375A909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05671E9B, Relevance: 1.6, APIs: 1, Instructions: 104
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketW.WS2_32 ref: 05671F56

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 5f13062670de756189587210bbc0901eec474f92438f8929a1bc2a6821498015
Instruction ID: 0f5027cdb3651ea5d02631eaaea745441d6a86fee7008a6f0a43b6987f33196d
Opcode Fuzzy Hash: 5f13062670de756189587210bbc0901eec474f92438f8929a1bc2a6821498015
Instruction Fuzzy Hash: D2318F7140D3C0AFE7128B609C54B56BFF4EF47210F0985DBE9848B6A3C229A809CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05671AAC, Relevance: 1.6, APIs: 1, Instructions: 101
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,?,?), ref: 05671B7E

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 5da84d11ffaa5b471147f41680892c06c84e70549454e1b1d34f1554aa779747
Instruction ID: 2287e9cd67e2e6c701ec9aae9881d8bc64b0ea05353817f593453431712d92ea
Opcode Fuzzy Hash: 5da84d11ffaa5b471147f41680892c06c84e70549454e1b1d34f1554aa779747
Instruction Fuzzy Hash: 86314B6540E3C05FD7138B319C61A61BF74EF87614B0E85CBE884CF5A3D269691AC772

Uniqueness

Uniqueness Score: -1.00%

Function 05670EB8, Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 05670F5B

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: abd646dadba29a9dd113c62c4c3eee6fd458044738295c63f56b06a91087c2ea
Instruction ID: 87d9e3437d0f526dd110416cd03f9c9f19ae200c2591154ed3c3055a3759a3e4
Opcode Fuzzy Hash: abd646dadba29a9dd113c62c4c3eee6fd458044738295c63f56b06a91087c2ea
Instruction Fuzzy Hash: 2031B572404344AFEB228B65DC44F67BFACEF46320F04899AFD85DB152D224A915CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05670C58, Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempFileNameW.KERNELBASE(?,00000E2C,?,?), ref: 05670D1A

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: FileNameTemp
String ID:
API String ID: 745986568-0
Opcode ID: e0eb6b7f8b826869ea21fc0f3d86eef2a0e1429b1359fe34dd834f63655cd0b9
Instruction ID: f1848156822cb490bd91f841b69798e8bd32f6f3731843d739a809ad518c8386
Opcode Fuzzy Hash: e0eb6b7f8b826869ea21fc0f3d86eef2a0e1429b1359fe34dd834f63655cd0b9
Instruction Fuzzy Hash: F2317E6140D3C06FD7038B258C51B62BFB4EF87610F0E85DBD9848F5A3D2256819C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 05670390, Relevance: 1.6, APIs: 1, Instructions: 93
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExA.KERNELBASE(?,00000E2C), ref: 0567045E

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 630d34829711bcbe01296597afa2f51724443dc8b755cda4a63716f85ca527f5
Instruction ID: 6b11e13e4cf9e94b09a6c4011d448afa7878ebc155e708841cb1221894c4b426
Opcode Fuzzy Hash: 630d34829711bcbe01296597afa2f51724443dc8b755cda4a63716f85ca527f5
Instruction Fuzzy Hash: 5131D7B2004344AFE7228F20CC45FA6FFB8EF06720F14859EE9859B152D365A949CB71

Uniqueness

Uniqueness Score: -1.00%

Function 056707F4, Relevance: 1.6, APIs: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 05670899

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 620c91bbfb11bb4463ac1119211b901b7102ac6558626f69f5f53d5c22502e52
Instruction ID: 83432df0476c028a850cbf4a12714190407d7dd7fb3251666ea1152d61785ed0
Opcode Fuzzy Hash: 620c91bbfb11bb4463ac1119211b901b7102ac6558626f69f5f53d5c22502e52
Instruction Fuzzy Hash: 1431A1B1504384AFE722CF65DC44F66BFE8EF45220F0884AEE9858B652D375E805CB71

Uniqueness

Uniqueness Score: -1.00%

Function 02E3AA02, Relevance: 1.6, APIs: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E2C), ref: 02E3AAB1

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 5404668ae489787a03cf4e80d52911b0adc2b7bb6d1e8ed48e3739c9ee797970
Instruction ID: e2038338a26a49f39142995429258de314c31429ced9c480d54eb9642971ac53
Opcode Fuzzy Hash: 5404668ae489787a03cf4e80d52911b0adc2b7bb6d1e8ed48e3739c9ee797970
Instruction Fuzzy Hash: C031B472544384AFE7228B25CC45F67BFECEF46710F0885ABED819B252D364A849CB71

Uniqueness

Uniqueness Score: -1.00%

Function 056700F6, Relevance: 1.6, APIs: 1, Instructions: 89synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0567019D

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: e46849ff77fc0b569b840a8f29b4d80ff6d5d2f9da496045f377435cb3edcf95
Instruction ID: 1f18279d0b4922b3d222d420618edf969143b6c4abdce3f6b01bfb2c9fb35fc2
Opcode Fuzzy Hash: e46849ff77fc0b569b840a8f29b4d80ff6d5d2f9da496045f377435cb3edcf95
Instruction Fuzzy Hash: C83191B1509784AFE712CB65DC84F56FFE8EF46210F08849AE984CB292D375A909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 02E3AAF9, Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,430DA086,00000000,00000000,00000000,00000000), ref: 02E3ABB4

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: d198c902415db8fd06f9eeb3ebbd63098b7bc8d6cee983771b7ca781c394fb7b
Instruction ID: aa7b768ebaafe8569d7bd13fd8ce68f4c981cf5df556659a332cf29cf78f6685
Opcode Fuzzy Hash: d198c902415db8fd06f9eeb3ebbd63098b7bc8d6cee983771b7ca781c394fb7b
Instruction Fuzzy Hash: F931B371108384AFD722CB25DC54FA2BFF8EF46314F08849AE9858B252D364E448CB61

Uniqueness

Uniqueness Score: -1.00%

Function 056721FE, Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E2C), ref: 0567229B

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 1e75c8f74e6b20ddb5e44775768d1bbb4ef65dd85557e002bb0db4cc2dc2d539
Instruction ID: 27f7fc191b8234d22caa8c933c6e48d4674cbbf65ef674f5a7e4f77d129fb77e
Opcode Fuzzy Hash: 1e75c8f74e6b20ddb5e44775768d1bbb4ef65dd85557e002bb0db4cc2dc2d539
Instruction Fuzzy Hash: 8921C172504344AFE7218B65DC44F6BBFACEF45320F0885AAE944DB242D324E808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05672CBF, Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,00000E2C,430DA086,00000000,00000000,00000000,00000000), ref: 05672D65

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: d5b237db6867407080571f61b326767e75296d3d273e5768f9fa456060cf3c3d
Instruction ID: 4525b8e4ffdff64b77e78f567f8a9e7e3893901bf0af9d41083caa31e68239bf
Opcode Fuzzy Hash: d5b237db6867407080571f61b326767e75296d3d273e5768f9fa456060cf3c3d
Instruction Fuzzy Hash: 88316D71409384AFD722CB25DC54F96BFB8EF46310F0885DAE9849B263D265A909C761

Uniqueness

Uniqueness Score: -1.00%

Function 05670FB9, Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E2C,430DA086,00000000,00000000,00000000,00000000), ref: 0567105C

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: fe333efee8d9a27ea1924f4d45e511fed0fb04a4e63996b819352952efe6e8be
Instruction ID: 2ab397cce9b019f342f7497002e3db18517a0c0c2b12f834d55cf5b4ab60d9ff
Opcode Fuzzy Hash: fe333efee8d9a27ea1924f4d45e511fed0fb04a4e63996b819352952efe6e8be
Instruction Fuzzy Hash: D331E372509384AFEB128B25DC51FA6BFB8EF46310F0884DBED849F193C624A909C761

Uniqueness

Uniqueness Score: -1.00%

Function 0567249C, Relevance: 1.6, APIs: 1, Instructions: 87fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 0567254E

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 920da4a512cba7c523b02a315aa8b6d4a92b35f94bce77aa9c69de588c718fe9
Instruction ID: 1aa707202430cbc4f560ae6f400b06a369e403ad8a6033b75f3e04576eed261b
Opcode Fuzzy Hash: 920da4a512cba7c523b02a315aa8b6d4a92b35f94bce77aa9c69de588c718fe9
Instruction Fuzzy Hash: 5E31D4B2404784AFE722CB65DC45F96FFF8EF06320F04859AE9849B252D375A509CB61

Uniqueness

Uniqueness Score: -1.00%

Function 056704AB, Relevance: 1.6, APIs: 1, Instructions: 86registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,430DA086,00000000,00000000,00000000,00000000), ref: 0567055C

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 31dec79b7b8bf72e6e9159fbe308f666c548350e634ee44ce3ef80002ae104a1
Instruction ID: 6a2142afe720d033a4edef26c2c9c967a262d3720a179d8721898d801e83c5e1
Opcode Fuzzy Hash: 31dec79b7b8bf72e6e9159fbe308f666c548350e634ee44ce3ef80002ae104a1
Instruction Fuzzy Hash: 5F318471509784AFD722CB65DC44F52FFF8AF07320F0885DAE9859B652D264A809CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05672946, Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000E2C), ref: 056729EB

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 436c44aa313baca0b5305d760fb076c1e81249415319634dbc3cdeee2f180c26
Instruction ID: 02b5c6a7a97964b2477de36c4e5cf09949f94f4947370e075059e7c3764d35fb
Opcode Fuzzy Hash: 436c44aa313baca0b5305d760fb076c1e81249415319634dbc3cdeee2f180c26
Instruction Fuzzy Hash: 9421BFB1500304AFFB21DB24CC85FA6FBACEB44710F14895AFA449A281D7B5A509CB71

Uniqueness

Uniqueness Score: -1.00%

Function 056708F0, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,430DA086,00000000,00000000,00000000,00000000), ref: 05670985

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 427fdcbd274782fe8b9e723a7c3df7696e51664a7cb59e06849bf82aed56bdcd
Instruction ID: 7702e4f156679b05bea5f46ae2c49a21bb2991fca758ccbe9a500efe182b12c5
Opcode Fuzzy Hash: 427fdcbd274782fe8b9e723a7c3df7696e51664a7cb59e06849bf82aed56bdcd
Instruction Fuzzy Hash: 4621FBB54093846FE7128B25DC41FA2BFA8EF47730F1881D7ED848B293D2646909C771

Uniqueness

Uniqueness Score: -1.00%

Function 05672EC9, Relevance: 1.6, APIs: 1, Instructions: 80networkCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,00000E2C,430DA086,00000000,00000000,00000000,00000000), ref: 05672F5E

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: Send
String ID:
API String ID: 121738739-0
Opcode ID: fe6a3f98f2260c00731f9df29d47b4d267990388e09918951cfa82e4f8437265
Instruction ID: cae595cf52a79874165f3286666cf80d7d67ade65936017cd53c783632285694
Opcode Fuzzy Hash: fe6a3f98f2260c00731f9df29d47b4d267990388e09918951cfa82e4f8437265
Instruction Fuzzy Hash: 62218372404344AFEB228F55DC40FA7BFBCEF45310F04896AEA859B252D275A515CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05670EDE, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 05670F5B

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f4271e4e3f5d5278be0a8c3dc8c1fd425f83ec0409d980709f613d2439d19fc5
Instruction ID: 28960e84452521ae3772d4d9c13e8d0c860fb5f426e7ff0d4dbaade4384756c6
Opcode Fuzzy Hash: f4271e4e3f5d5278be0a8c3dc8c1fd425f83ec0409d980709f613d2439d19fc5
Instruction Fuzzy Hash: 8B21B072500304AFEB21DF64DC44F6BFBACEF44320F14896AEE459B651D674A509CB71

Uniqueness

Uniqueness Score: -1.00%

Function 056730B4, Relevance: 1.6, APIs: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNELBASE(?,00000E2C,?,?), ref: 05673156

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 08bc2cee2aa34816cde35844b8a2a7b811210c67a6754dfd8fb61a4e44e97228
Instruction ID: b7d2bed1dd74e6076e1fc80ffd1dca7e46084295f878057711fdb53ccfe2fcaa
Opcode Fuzzy Hash: 08bc2cee2aa34816cde35844b8a2a7b811210c67a6754dfd8fb61a4e44e97228
Instruction Fuzzy Hash: DA21D37250D3C06FD3028B658C51B66BFB4EF87610F0980CBD8848F2A3D224A919C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 056702AB, Relevance: 1.6, APIs: 1, Instructions: 79registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(?,00000E2C), ref: 05670353

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: c43cba3abac75cf2f3cc556bdb9a9b6075a981093f736893b32021afcd1e2b42
Instruction ID: 508951e47e253c970933013f180b05f1199f0f3bbcec4ec49af6813f98e87f8a
Opcode Fuzzy Hash: c43cba3abac75cf2f3cc556bdb9a9b6075a981093f736893b32021afcd1e2b42
Instruction Fuzzy Hash: 3821B775009384AFE7228F20DC45FA6FFB4EF46310F1884DAE9849B193D265A909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05672FC2, Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,00000E2C,430DA086,00000000,00000000,00000000,00000000), ref: 05673052

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: Recv
String ID:
API String ID: 4192927123-0
Opcode ID: 6521574e865127ad56ea8d9b540c4900de5b8c1060ec7b9474834beb5110c2d0
Instruction ID: bb1a594bce45ecf537009e0fcb95b834577fb7829699878ce3d0d2bd45c7645c
Opcode Fuzzy Hash: 6521574e865127ad56ea8d9b540c4900de5b8c1060ec7b9474834beb5110c2d0
Instruction Fuzzy Hash: B5219272404344AFDB228F65DC44FA7FFB8EF45310F04899BEA859B252D275A508CB71

Uniqueness

Uniqueness Score: -1.00%

Function 02E3AF50, Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?,00000E2C,?,?), ref: 02E3AFEA

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 654127ab90b5243e17e07ffbb8e280eb7e05c2a9dca88fc7d36457716d8b6449
Instruction ID: 437e1a619aad519ae294ce6d99386b1a4fb593b2c0a50e9d7c386b3febdc1abc
Opcode Fuzzy Hash: 654127ab90b5243e17e07ffbb8e280eb7e05c2a9dca88fc7d36457716d8b6449
Instruction Fuzzy Hash: 0E21B67144D7C06FD3138B259C51B22BFB4EF87610F0A81DBE884CB653D225A919C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0567222A, Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E2C), ref: 0567229B

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 7835497ead9ede424ed5e66ccecc92a38873c9e525cb243e603bf05cffc0a0a0
Instruction ID: b3c9885d15522519600b86f6e7cc39a1796afc9bc8691633a8482381acb84fa3
Opcode Fuzzy Hash: 7835497ead9ede424ed5e66ccecc92a38873c9e525cb243e603bf05cffc0a0a0
Instruction Fuzzy Hash: 70219F76500204AFEB20DB29DC85F6BFBACEF44720F14856AED45DB641D764E805CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0567081A, Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 05670899

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b5519353ba4ace5df3c6064b161fdc3676b8a20ef9a49a4d937f0c0ddce23e16
Instruction ID: 691425d3b362fd9c6b2aa4593a12b4be69985a9f9cbf3d0c801f6c3cb884aa54
Opcode Fuzzy Hash: b5519353ba4ace5df3c6064b161fdc3676b8a20ef9a49a4d937f0c0ddce23e16
Instruction Fuzzy Hash: 98219A71500304AFEB21DF65C888F66FBE8FF08320F14846AEA858B652D371E404CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 05670B79, Relevance: 1.6, APIs: 1, Instructions: 75registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E2C,430DA086,00000000,00000000,00000000,00000000), ref: 05670C10

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 687e5264d799fa954e69e5b0e840cc7aee1c2cdd7f952bbf4c6ee8982a01dc68
Instruction ID: c86b7eac826ff5ee26d93595442791a96098b926fc0829e50a874b339a050177
Opcode Fuzzy Hash: 687e5264d799fa954e69e5b0e840cc7aee1c2cdd7f952bbf4c6ee8982a01dc68
Instruction Fuzzy Hash: 7D21BDB2508344AFE7218F25DC84F67FFECEF45720F08859AE9859B252D264E808CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0567123E, Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 056712BE

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: a4174402cbc5c79df81ee26a5cfb0b1326270f64e0c804e3ea7b812f8632dfba
Instruction ID: 1d6f112d2ee8e11ddc41987ba474f6bd080e910e7485b9022c6d82c1a0a45883
Opcode Fuzzy Hash: a4174402cbc5c79df81ee26a5cfb0b1326270f64e0c804e3ea7b812f8632dfba
Instruction Fuzzy Hash: 3B218EB25093849FD7228B25DC85A92BFE8EF46220F0984EBD985CB653D235D848CB61

Uniqueness

Uniqueness Score: -1.00%

Function 056709C0, Relevance: 1.6, APIs: 1, Instructions: 75fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,430DA086,00000000,00000000,00000000,00000000), ref: 05670A51

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 608819d7357548b0262d55659b90e0261497450eb4b36c73095b7cb333d83c3e
Instruction ID: 27fa21dc9efa042f4ec3e59d9de3de41422dc5b1a46f661b31e1c16c188dbc75
Opcode Fuzzy Hash: 608819d7357548b0262d55659b90e0261497450eb4b36c73095b7cb333d83c3e
Instruction Fuzzy Hash: E421A471409384AFD7228F65DC44F56BFB8EF46314F08859BE9449B153C265A409CB71

Uniqueness

Uniqueness Score: -1.00%

Function 056703CA, Relevance: 1.6, APIs: 1, Instructions: 75registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNELBASE(?,00000E2C), ref: 0567045E

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: e57c25376bb7045108fd669e39967c49353a7362f823089c24f1e35e636d5b04
Instruction ID: 4b724e45eed4938c0b152062f3750dd7821b5a425398fbfc2f5832385a2ecc67
Opcode Fuzzy Hash: e57c25376bb7045108fd669e39967c49353a7362f823089c24f1e35e636d5b04
Instruction Fuzzy Hash: 2A21B072100204AFEB21DF15DC45FA6FBACEF04720F14895AEE459A281D6B5A549CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 02E3AA32, Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E2C), ref: 02E3AAB1

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 789bf012f59891e89d67fc08750a6d0c079130da3c17ae2c9ec9759729701514
Instruction ID: bb9cfdc27bf0b20ca2fdf7bf922001269741058ed021797938554fb808c8604e
Opcode Fuzzy Hash: 789bf012f59891e89d67fc08750a6d0c079130da3c17ae2c9ec9759729701514
Instruction Fuzzy Hash: 30219F72500604AEEB219B25DD88FABFBECEF44710F14C56AEE859A241D664E848CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0567012A, Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0567019D

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: b6f782d54f16e2d9e8cebee6e7446168c5b1c2dbe615b62aa89e408ac30b93f3
Instruction ID: 0c7ace863f120e530591f843cf4e9af12b098afc61736d0e9d788175e9586bdc
Opcode Fuzzy Hash: b6f782d54f16e2d9e8cebee6e7446168c5b1c2dbe615b62aa89e408ac30b93f3
Instruction Fuzzy Hash: D021AC71504244AFE720DB65D888F6AFBE8EF44220F14846AED458B641D770E504CA75

Uniqueness

Uniqueness Score: -1.00%

Function 05670723, Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0567079F

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: d5146e8b26ca9473be7371995133c1bf4edbe803e46fb9b2421006a2a4d7299b
Instruction ID: 03684db33613b88fa229252dda65003479ca6991e2f1f52366c6407507a64eb7
Opcode Fuzzy Hash: d5146e8b26ca9473be7371995133c1bf4edbe803e46fb9b2421006a2a4d7299b
Instruction Fuzzy Hash: B121B3B15093849FD711CB25DC48B52BFE8EF46220F0984EAE945CF653D234D908CB71

Uniqueness

Uniqueness Score: -1.00%

Function 056710BF, Relevance: 1.6, APIs: 1, Instructions: 71fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNELBASE(?,00000E2C), ref: 0567114B

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 4a0cefa525ae63d21333abbb72110a6d23b958c710830771763816f14ac3d3f4
Instruction ID: cc90c75764dbca56f9267fccccf79aa5b557008c3ac68087cbb12406d8c62d70
Opcode Fuzzy Hash: 4a0cefa525ae63d21333abbb72110a6d23b958c710830771763816f14ac3d3f4
Instruction Fuzzy Hash: 3321D571504384AFE7218B25DC45FA6FFA8EF46720F18C09AFD459F292D374A948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05670A9B, Relevance: 1.6, APIs: 1, Instructions: 71fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 05670B1E

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 2d057230a5431b6a3d7606b9b104d46c9b13bc2cb2fcd6e394b60627159f7fc0
Instruction ID: add8902d84e03ab184fd0d5271bd0d2cc609b5fe28cd7863650c7af53b01b3a3
Opcode Fuzzy Hash: 2d057230a5431b6a3d7606b9b104d46c9b13bc2cb2fcd6e394b60627159f7fc0
Instruction Fuzzy Hash: 3921C2B15083845FD722CF29DC55B62BFE8AF46724F0880EAED84DB653D225D908CB71

Uniqueness

Uniqueness Score: -1.00%

Function 02E3AB3A, Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,430DA086,00000000,00000000,00000000,00000000), ref: 02E3ABB4

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: f6226b88cd368b619892add362d81a2ab1a273dd838c913b22f96466fc72f615
Instruction ID: 2524261d6a175426f96a9dce75f91383d20506af1564eb0d5961fede74a91c20
Opcode Fuzzy Hash: f6226b88cd368b619892add362d81a2ab1a273dd838c913b22f96466fc72f615
Instruction Fuzzy Hash: 1F219A71640204AFE721CF29DC88FA6FBECEF04725F04C56AEA858B351D760E448CA71

Uniqueness

Uniqueness Score: -1.00%

Function 056701F4, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 05670264

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 8910cfc34449785949c6293e46dc78c486bc1fc1c2d8926d9cf45e547a72fd31
Instruction ID: 0d9365aed93cae8e271630a7edc74240ae082c4f751f4d950a4e944d97ceee94
Opcode Fuzzy Hash: 8910cfc34449785949c6293e46dc78c486bc1fc1c2d8926d9cf45e547a72fd31
Instruction Fuzzy Hash: 7C21C3B2409784AFD712CB24DC89B51BFA8FF42320F0985DBED449F663D274A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 056723DA, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 05672445

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: 75d0c5f98dfe31dfc58e8be6c77c43d84ca237624ce5ab6c7a94c49126f7c800
Instruction ID: 1b262b1e88f69f6e6d86cc778d42199e56bf681251a915241d3d3fe1c48f82bc
Opcode Fuzzy Hash: 75d0c5f98dfe31dfc58e8be6c77c43d84ca237624ce5ab6c7a94c49126f7c800
Instruction Fuzzy Hash: 8021DCB5500244AFE720DF25CC84F66FBE8EF44320F18856AEE899B646D375E804CA75

Uniqueness

Uniqueness Score: -1.00%

Function 0567148C, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 056714F8

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: ff60a7fcb67efcffd9c030956c91c7fe8e9744189aea4be30ef59471c9b53bda
Instruction ID: d36f8c4f867de5549eecd6f3560ed5f3010389e3dbed357977208ef1961c18b1
Opcode Fuzzy Hash: ff60a7fcb67efcffd9c030956c91c7fe8e9744189aea4be30ef59471c9b53bda
Instruction Fuzzy Hash: 3321A1B25093C45FEB128B25DC54A92BFB4AF47224F0980DBED858F663D2749908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05672EEE, Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,00000E2C,430DA086,00000000,00000000,00000000,00000000), ref: 05672F5E

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: Send
String ID:
API String ID: 121738739-0
Opcode ID: 859905bc1d464c9f396406df595d674c4841e27299a29cad63e2bc5f6886f4c5
Instruction ID: 63875d4226e8fc68893f2a4b3e65eb2a77f2a9c663aed423f7e18491b2c51752
Opcode Fuzzy Hash: 859905bc1d464c9f396406df595d674c4841e27299a29cad63e2bc5f6886f4c5
Instruction Fuzzy Hash: EF11AF72400604AFEB21CF65DC80FA7FBE8EF45320F14896BEA459B251D775A419CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05671EEA, Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32 ref: 05671F56

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 51a5986c466ea91c26d5eab93305ab78015bd899e9dd484e1e665bf7c9419a1d
Instruction ID: 5a85ae806ddf0800caf08da1b1fa30bb9b5d715687a70a7bb89a555a8a0432a1
Opcode Fuzzy Hash: 51a5986c466ea91c26d5eab93305ab78015bd899e9dd484e1e665bf7c9419a1d
Instruction Fuzzy Hash: AB21CA71400204AFEB21DF65DC44FA6FFE9EF49320F14896AEE858A652D3B5A408CB61

Uniqueness

Uniqueness Score: -1.00%

Function 056724DA, Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 0567254E

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: fdea072a1fd2ec9959f45f732b3aaaa553034c374824918fca616f1deafd58f6
Instruction ID: dea44b6d642c797b55f6236ee418fd902f7339892875028a79f9847fa18ee1f4
Opcode Fuzzy Hash: fdea072a1fd2ec9959f45f732b3aaaa553034c374824918fca616f1deafd58f6
Instruction Fuzzy Hash: 5C21DC71400204AFE721CF29DC84FA6FBE9EF08320F04845AEA889B241D3B1A509CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 056704EA, Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,430DA086,00000000,00000000,00000000,00000000), ref: 0567055C

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c141a05799b464acdf9fddca8a8b2e305c1d414c77863fa4bf665f256b7ab87f
Instruction ID: a70670c1de1c6a88b063609e603b9fb41dda8051ab215fbe2e65cdd9d2fafc6f
Opcode Fuzzy Hash: c141a05799b464acdf9fddca8a8b2e305c1d414c77863fa4bf665f256b7ab87f
Instruction Fuzzy Hash: F0117C72500604EEEB20CF29DD84F67FBE8EF08720F14856AEA469B652D664E449CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05670B9E, Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E2C,430DA086,00000000,00000000,00000000,00000000), ref: 05670C10

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 751c28712c158aff5647399f0dc2950e1401d3ccd44610a2ced0bada32c6644a
Instruction ID: 0791e8a7d6730d513401b14219ce7f2cd3691a6a78712e73dc8745371d970559
Opcode Fuzzy Hash: 751c28712c158aff5647399f0dc2950e1401d3ccd44610a2ced0bada32c6644a
Instruction Fuzzy Hash: 9D11ACB2500608AEEB209F25DC85F67FBECEF04720F04855AEE459A741D670E409CA71

Uniqueness

Uniqueness Score: -1.00%

Function 05672CFE, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,00000E2C,430DA086,00000000,00000000,00000000,00000000), ref: 05672D65

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 4f006025fb1910026ff161625ab671de413a3f797e84f960b7b4bf2220f78da2
Instruction ID: 547452497c686e62ce066ca009a1a9e0ff1ac9c8239ecd1891c5effc864ab7fc
Opcode Fuzzy Hash: 4f006025fb1910026ff161625ab671de413a3f797e84f960b7b4bf2220f78da2
Instruction Fuzzy Hash: 3311BB75500204AFEB20CF25DC80FA6FBE8EF44320F14846AEE499B251C374E909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0567118F, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

SetKernelObjectSecurity.KERNELBASE(?,?,?), ref: 05671202

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: KernelObjectSecurity
String ID:
API String ID: 3015937269-0
Opcode ID: 6e8a9642346cf61aebbbd3ab2d1c7c29c1352c85d55e20f526ce5e1aa7d5d3ab
Instruction ID: f7fd938adddbdda6cee88a034af9ed07b3c32fc8c858fae40e14080919860b32
Opcode Fuzzy Hash: 6e8a9642346cf61aebbbd3ab2d1c7c29c1352c85d55e20f526ce5e1aa7d5d3ab
Instruction Fuzzy Hash: D221AF751093C49FD7228B25DC44A62FFB4EF07224F0980DFED858B6A3D275A949CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05671006, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E2C,430DA086,00000000,00000000,00000000,00000000), ref: 0567105C

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: d1d527068a0e6deea66194ebaa27318dd2efd12937848a906d4e64d4c9a89584
Instruction ID: b843cea7c318ea18941afaa82831a00e3022a34240cc586ccb605fec57770994
Opcode Fuzzy Hash: d1d527068a0e6deea66194ebaa27318dd2efd12937848a906d4e64d4c9a89584
Instruction Fuzzy Hash: B211A071500244AFEB20DF29DC85FABBFA8EF45320F1484ABEE05DB241DA74A845CB71

Uniqueness

Uniqueness Score: -1.00%

Function 02E3B7CA, Relevance: 1.6, APIs: 1, Instructions: 61windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 02E3B841

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 2d07037d82d08fe7a198b5b263de6295c9147439f441d784cd2c26b9c7e77bc1
Instruction ID: 3660cba981ae7ba9a867b43054ac93a572bd56fb87e57b415b05268cbe9621ef
Opcode Fuzzy Hash: 2d07037d82d08fe7a198b5b263de6295c9147439f441d784cd2c26b9c7e77bc1
Instruction Fuzzy Hash: 7B21AE714093C09FDB238B21DC54A92BFB4EF07224F0D84CAEDC44F163D265A958DB61

Uniqueness

Uniqueness Score: -1.00%

Function 02E3A51F, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02E3A58A

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a6a7a74bbb7fad641d178332a2ecd925bab5d561f1f9c85c5f41959656986cf5
Instruction ID: 5df9057e3933e5953ee17efc7c9b751405e2e9b1588fe4cd562ea0cad98c1758
Opcode Fuzzy Hash: a6a7a74bbb7fad641d178332a2ecd925bab5d561f1f9c85c5f41959656986cf5
Instruction Fuzzy Hash: 6A117572405380AFDB228F55DC44B52FFF4EF4A210F08C59AED858B152C375A518DB61

Uniqueness

Uniqueness Score: -1.00%

Function 05671750, Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,430DA086,00000000,?,?,?,?,?,?,?,?,72F43C38), ref: 056717B2

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: 95380b4f34de7e76789b327adb58fa099144333004c9cf4ae143e9e5eace133d
Instruction ID: d60351e06e68b014ad74629a5393c1c0da875352402b4048f85e046ad4b4b6c8
Opcode Fuzzy Hash: 95380b4f34de7e76789b327adb58fa099144333004c9cf4ae143e9e5eace133d
Instruction Fuzzy Hash: BF117F715053849FD721CF65DC84B96FFE8EF46220F0884AAED458B262D274E908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 056710E2, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNELBASE(?,00000E2C), ref: 0567114B

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 6c58626622a91c8b71136cbe84485beb36bbca2d1de9e290d9f32ae360e42173
Instruction ID: 1f15cdf849c5d3d4c6629654de139b43e5fcea6cdcaac140cae3f3dfff047e34
Opcode Fuzzy Hash: 6c58626622a91c8b71136cbe84485beb36bbca2d1de9e290d9f32ae360e42173
Instruction Fuzzy Hash: 33110271600204AFF720DB29DC86FB6FB98DF45720F14C06BEE059E281D6B4A949CA61

Uniqueness

Uniqueness Score: -1.00%

Function 056709F2, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,430DA086,00000000,00000000,00000000,00000000), ref: 05670A51

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f870ed3a07f3701d3894017eab30ab331726f3e4712bcc6dc93fc8dbc3c46ba6
Instruction ID: fbb6e25fc9260f9d033d20732db4a74ab2c0637303630099746d33e99f2644fc
Opcode Fuzzy Hash: f870ed3a07f3701d3894017eab30ab331726f3e4712bcc6dc93fc8dbc3c46ba6
Instruction Fuzzy Hash: B511BF71400604AFEB21CF69DC44F66FFA8EF44320F14856BEE499B252C675A409CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 056702DE, Relevance: 1.6, APIs: 1, Instructions: 60registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(?,00000E2C), ref: 05670353

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 12f5b042c7b7c21dc9b83e199ba6d01640da1be2a2771ef07af53a4716fff334
Instruction ID: adede79298f2b379c163d3e44a8a4487bb4411a9e803c66b8bab0eb469ff440f
Opcode Fuzzy Hash: 12f5b042c7b7c21dc9b83e199ba6d01640da1be2a2771ef07af53a4716fff334
Instruction Fuzzy Hash: 4C110E71000704EFEB21DF14DC85F66FFA8EF04720F14849AEE455A292C2B5A509CFB2

Uniqueness

Uniqueness Score: -1.00%

Function 02E3BB4F, Relevance: 1.6, APIs: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 02E3BBB9

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 5c34460acebad246a0fb67edb39115b6d1b4cc8cfda0036723aaf31a06824fd7
Instruction ID: 86f340703d20e78902052204dfa5ebc48855ce4921ddc69bfc740982a2c13041
Opcode Fuzzy Hash: 5c34460acebad246a0fb67edb39115b6d1b4cc8cfda0036723aaf31a06824fd7
Instruction Fuzzy Hash: 5811EE314093C0AFDB228F25DC45B52FFB4EF06220F0885DEED858B163C265A408CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02E3BE05, Relevance: 1.6, APIs: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?), ref: 02E3BE70

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 2c4c3dc8d517e6bf8e63325c4d65b0cf6817507fd2c978433339977c94d52867
Instruction ID: 78334e01144a4c822452f47c32a1582e5f9f96662ac5c07597c622a57960284f
Opcode Fuzzy Hash: 2c4c3dc8d517e6bf8e63325c4d65b0cf6817507fd2c978433339977c94d52867
Instruction Fuzzy Hash: 49117C754093C4AFD7238B259C44B61BFB4DF47624F0980DEED858F263D2696908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02E3B71E, Relevance: 1.6, APIs: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32 ref: 02E3B78A

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 8cf47c68d0cc63e149d39b4d2f5bee11b383aa9301b831eec7285a52c371171f
Instruction ID: 75fc002b239aee1670c9ab60904107b27505ef6b8f89f4e5162bcb4e6f9f6fa6
Opcode Fuzzy Hash: 8cf47c68d0cc63e149d39b4d2f5bee11b383aa9301b831eec7285a52c371171f
Instruction Fuzzy Hash: D3116071404384AFDB228F65DC44A52FFF4EF49320F09859EEE858B562C375A458DB61

Uniqueness

Uniqueness Score: -1.00%

Function 02E3BEB4, Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 02E3BF0C

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 4b4027ca6aa232f7ba88ed3420d52d225976cbde8d83fa28eaf31445e49a4aad
Instruction ID: bd93ce5f4bd50e42783923cb01d6333e9c1305cd494b335b2bb9e191f67f7e9e
Opcode Fuzzy Hash: 4b4027ca6aa232f7ba88ed3420d52d225976cbde8d83fa28eaf31445e49a4aad
Instruction Fuzzy Hash: 8D118F715053849FD721CF2ADC85B56BFE8EF46224F08C4AAED45CF252D274E848CB61

Uniqueness

Uniqueness Score: -1.00%

Function 056715EB, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0567164C

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 8e1086893473be43d4ec3185483783eea28940a7c708ed6e560abf93bdb8a3c2
Instruction ID: ceafba8b00c0c90fcfe7a0da8c9887138fb6ae531a2f5487cd61cc328b3d3f28
Opcode Fuzzy Hash: 8e1086893473be43d4ec3185483783eea28940a7c708ed6e560abf93bdb8a3c2
Instruction Fuzzy Hash: 8D116D714093C4AFD7128B65D845A52BFF4EF47220F0D85EBDD888F263C279A948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05671276, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 056712BE

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: b14c197d431c72aad0f4e9be4c3431894b0d2315312d80b4317fa03e8d571638
Instruction ID: d1f61b8ac457b497e0e8e574a1cba51b79b98c43cc3bd46db906a0a6f5f70ed9
Opcode Fuzzy Hash: b14c197d431c72aad0f4e9be4c3431894b0d2315312d80b4317fa03e8d571638
Instruction Fuzzy Hash: 37118E71A042449FEB20CF2AD885B66FBD8EF45220F18C5ABDD59CB742D674E444CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05670AD6, Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 05670B1E

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: b14c197d431c72aad0f4e9be4c3431894b0d2315312d80b4317fa03e8d571638
Instruction ID: 6335388623f56881aed302ae9b7ef23988e7b8c7f4c7a754cd09ecddf301be2c
Opcode Fuzzy Hash: b14c197d431c72aad0f4e9be4c3431894b0d2315312d80b4317fa03e8d571638
Instruction Fuzzy Hash: 31117CB16042089FDB20CF29D889B66FBD8EB44724F1884AADD09CB742D675E504CE71

Uniqueness

Uniqueness Score: -1.00%

Function 0567075A, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0567079F

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: c55b88f5c73c86ed0957a502d2aadaab8a45e9244ec5000d960439b44573a766
Instruction ID: 2abdcde86d6305660494fd2762e1a2ee72bf930ae1738e634afb149265513389
Opcode Fuzzy Hash: c55b88f5c73c86ed0957a502d2aadaab8a45e9244ec5000d960439b44573a766
Instruction Fuzzy Hash: A2116D756042489FEB50CF29D888B66FBD8EF44220F18C4AADD49DB742E674E804CF71

Uniqueness

Uniqueness Score: -1.00%

Function 05670932, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,430DA086,00000000,00000000,00000000,00000000), ref: 05670985

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: e829c92538a1c80b0ccba952965e21b53cf0dc110e2e25f5b663039ed11efaa5
Instruction ID: af8524b1631cdc6da9fba804d5ad7f8fcbc23fa2da1941750089dc8459d80f7d
Opcode Fuzzy Hash: e829c92538a1c80b0ccba952965e21b53cf0dc110e2e25f5b663039ed11efaa5
Instruction Fuzzy Hash: E901C071500644EEE720DB19DC85FA6FBA8EF45730F149097EE449B341D6B4A409CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 02E3A75B, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 02E3A7BC

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 2270787582247a3d0a90c0368e3348ae63e585a8e9118af91718ef5e6a2156a2
Instruction ID: 5197ed07e62c6c8ecd1dc2595f6f53ab1695a8151b4d000a7ebbdfa53377c5dd
Opcode Fuzzy Hash: 2270787582247a3d0a90c0368e3348ae63e585a8e9118af91718ef5e6a2156a2
Instruction Fuzzy Hash: C2119171449384AFD712CF15DC84B52BFB4EF46225F08C4AAED449F253D375A548CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05671772, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,430DA086,00000000,?,?,?,?,?,?,?,?,72F43C38), ref: 056717B2

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: 3820131f5026d1704dcda33322ad2ff38f7c328f24eda50ff49b6d7f6446ad00
Instruction ID: 3a5371d251a11fa66df8b26f7408c1eca2c831545d74629020eb46f0de0c5aa3
Opcode Fuzzy Hash: 3820131f5026d1704dcda33322ad2ff38f7c328f24eda50ff49b6d7f6446ad00
Instruction Fuzzy Hash: 8A116D759002489FDB20CF69D884BA6FFE8EF45220F18C5ABDD498B652D675E408CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02E3A8CC, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 02E3A926

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 1e64a81d366b7a1ea881a5e4ca92efd6d48793c9e4d9d37bce60a26411d7e74c
Instruction ID: bbac9c90685ab2afc7031e1319e8a6cf4e1beaf6cdb9b29517db3e540d31a3ad
Opcode Fuzzy Hash: 1e64a81d366b7a1ea881a5e4ca92efd6d48793c9e4d9d37bce60a26411d7e74c
Instruction Fuzzy Hash: CF11A031409784AFC7228F15DC85B52FFF4EF46320F09C49AED854B262C375A448CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05673106, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNELBASE(?,00000E2C,?,?), ref: 05673156

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: cc9b5f6dc609e9c27cf36f00bff7a455b4de5d151c3f7cbf4a42e436a8282256
Instruction ID: 8ce1858c125bc266b045597a1ae6483f8df33f05a75b1b5e07b9f390472c278b
Opcode Fuzzy Hash: cc9b5f6dc609e9c27cf36f00bff7a455b4de5d151c3f7cbf4a42e436a8282256
Instruction Fuzzy Hash: 06017172900600ABD710DF16DC85F26FBA8EBC8B20F14C56AED089B741E335B915CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 05670CCA, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNELBASE(?,00000E2C,?,?), ref: 05670D1A

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: FileNameTemp
String ID:
API String ID: 745986568-0
Opcode ID: 891ca86b08aebd3f15ddb6be9c9e4d3eb282c2f36197895c80f78a78d2290836
Instruction ID: a20551065971f3f8b30871666bb7e8e360097927097befdb9d6b4b5bba6c7722
Opcode Fuzzy Hash: 891ca86b08aebd3f15ddb6be9c9e4d3eb282c2f36197895c80f78a78d2290836
Instruction Fuzzy Hash: A5017172900600ABD710DF16DC85F26FBA8FBC8B20F14C56AED089B741E335B915CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02E3BED2, Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 02E3BF0C

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 09df492760b799cbff46a6f9fc5f2bc5eb3aceb14c4e370e02c761702594181f
Instruction ID: 8a9ba13220b56da4821836d79ce582c24b977947d17f8921048f76d5662f13ef
Opcode Fuzzy Hash: 09df492760b799cbff46a6f9fc5f2bc5eb3aceb14c4e370e02c761702594181f
Instruction Fuzzy Hash: F60180715002409FD721DF2AD888766FBD4DF40225F08D0AADD4ACF242D674D404CA61

Uniqueness

Uniqueness Score: -1.00%

Function 056711C2, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

SetKernelObjectSecurity.KERNELBASE(?,?,?), ref: 05671202

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: KernelObjectSecurity
String ID:
API String ID: 3015937269-0
Opcode ID: e2a056033b35091602e961e89eefc6b1839a6323a08e20cea85b0897c4e99127
Instruction ID: 3d2ea90099625d40cbf729f1d183ec116e08b2bc2726bfd30569fb22c259701e
Opcode Fuzzy Hash: e2a056033b35091602e961e89eefc6b1839a6323a08e20cea85b0897c4e99127
Instruction Fuzzy Hash: 38019E756006449FDB20CF69D884B66FBE4EF06320F08C0ABDD498B752D275E549CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02E3A546, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02E3A58A

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 61f2b5a7a081bb81b927e30bd451210f9eb1037ca06d698bab257a7fbae6c151
Instruction ID: 72a046cf327a06f25acbcd8568171326414299066ed2ebad6dd1b5fd0ed33222
Opcode Fuzzy Hash: 61f2b5a7a081bb81b927e30bd451210f9eb1037ca06d698bab257a7fbae6c151
Instruction Fuzzy Hash: B5016D72400640EFDB228F55D848B56FFE4EF48321F08C5AADE894A612C375A458DF61

Uniqueness

Uniqueness Score: -1.00%

Function 02E3B746, Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32 ref: 02E3B78A

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: f9297810dad8de82795a1b7423347df7257bed3eb57be30e8d34b7bfef4f2761
Instruction ID: a91e9d0dbe8ba1876b3971bcdfd66a2cde8c20502efe1d33ab95c242bbabef0a
Opcode Fuzzy Hash: f9297810dad8de82795a1b7423347df7257bed3eb57be30e8d34b7bfef4f2761
Instruction Fuzzy Hash: 91016D71400640EFDB218F55D884B66FFE0EF48325F08C6AEEE4A4A622D375A418DF61

Uniqueness

Uniqueness Score: -1.00%

Function 05671B2E, Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,?,?), ref: 05671B7E

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 3289f97cc58a40dd42d7fc10c1d6515242b73432ba9522192e1285285e7733b8
Instruction ID: 3126e6ea0ef920fe188bd9884f780e32c6ae126e6013ee159a150640435d7cb4
Opcode Fuzzy Hash: 3289f97cc58a40dd42d7fc10c1d6515242b73432ba9522192e1285285e7733b8
Instruction Fuzzy Hash: 16014F76500604ABD210DF16DC86F26FBA8EBC8B20F14815AED085B741E375B515CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 05670232, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 05670264

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2aa6029c5503cc14075fa0c4ff50a1d0f773d09c8c3d75a4af5cfcc2ea7c8736
Instruction ID: 90125d55d13b0cf12fba86cd95128ce38f313fd94457011115d591b28b554c04
Opcode Fuzzy Hash: 2aa6029c5503cc14075fa0c4ff50a1d0f773d09c8c3d75a4af5cfcc2ea7c8736
Instruction Fuzzy Hash: 86017C769002449FDB20CF29D888766FF94EF84220F18C4ABDD598B656D6B5A448CE71

Uniqueness

Uniqueness Score: -1.00%

Function 056714C6, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 056714F8

Memory Dump Source

Source File: 0000000E.00000002.472969150.0000000005670000.00000040.00000001.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5670000_RegSvcs.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2cd0b7f941397f4db6b0730beeaf0d41cffb5a5e1044abb77031d79de9e76936
Instruction ID: 359b09c4d2bca4133b1aabc3dbe3602c281ba89b9d311c93abc945ed7224cc4a
Opcode Fuzzy Hash: 2cd0b7f941397f4db6b0730beeaf0d41cffb5a5e1044abb77031d79de9e76936
Instruction Fuzzy Hash: 6201D4715002449FDB10CF29E884756FFE4EF41220F08C0ABDD0A8B702D274E408CB72

Uniqueness

Uniqueness Score: -1.00%

Function 02E3AF9A, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?,00000E2C,?,?), ref: 02E3AFEA

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0a3da32468cf17a492d3a5a23bbe2c26dc3f564af78dc589e7eafa255d8c8f42
Instruction ID: 8e3703f6d27454a9ed44f5ffc0afe32d18971a929750512a1c430b85ad8b9f0b
Opcode Fuzzy Hash: 0a3da32468cf17a492d3a5a23bbe2c26dc3f564af78dc589e7eafa255d8c8f42
Instruction Fuzzy Hash: 75014F76500600ABD610DF16DC86B26FBA8EBC8B20F14815AED085B741E375B515CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 02E3BB7E, Relevance: 1.5, APIs: 1, Instructions: 42windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 02E3BBB9

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: bd59157f217489c1724847508f7fbf596f542d7f26b3750748e89b3fabbaa15d
Instruction ID: 95fe98b8b5e6d1195a85a1c89e40108e016ec91d449e861e576c5b8a541c695d
Opcode Fuzzy Hash: bd59157f217489c1724847508f7fbf596f542d7f26b3750748e89b3fabbaa15d
Instruction Fuzzy Hash: BA01B135500640DFDB218F15D844BA6FFA4EF44325F08C09EDD468B626C775A418CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02E3A78A, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 02E3A7BC

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 25c14bd81bc7971c9183ae61a64672e770cc260fb157c9463963477f743d3539
Instruction ID: 18a06fc4789686a6c0d679e07b56d23e41115b99cc5364c016155c7680bbcb0c
Opcode Fuzzy Hash: 25c14bd81bc7971c9183ae61a64672e770cc260fb157c9463963477f743d3539
Instruction Fuzzy Hash: A101AD748002409FDB21DF19D888766FFE4EF44321F18D4AADE488F312D2B9A448CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02E3B806, Relevance: 1.5, APIs: 1, Instructions: 38windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 02E3B841

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: cf1a0595c86df909f4c0d812ccee955122f9b876d9e6d18245952a4f19ff1b47
Instruction ID: 4241c9acf337b2e8e2e941fcc6ce04faaa52c633d6bbb6b0feb22a53a416b433
Opcode Fuzzy Hash: cf1a0595c86df909f4c0d812ccee955122f9b876d9e6d18245952a4f19ff1b47
Instruction Fuzzy Hash: E6018F35800644DFDB218F15D888B66FFA4EF04325F08D19EDE4A0B222D375A418CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02E3A8EE, Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 02E3A926

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 6d0eb3740c80b0e403628028b804e04d72226353403443500a20f2bcba10026d
Instruction ID: 49383199e7c92f0ac9b45bd69aaae1d65169f7f64d741e0f9ec906a7457c1654
Opcode Fuzzy Hash: 6d0eb3740c80b0e403628028b804e04d72226353403443500a20f2bcba10026d
Instruction Fuzzy Hash: 5801AD31800644DFDB218F19E889752FFA0EF05321F08D1AADE8A1B352C3B5A448CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02E3A372, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 02E3A3A4

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: ac1a4a108f2044d605f4b4447571cdd60fc90104117f12273a06bfa12ec2f426
Instruction ID: 1500fcbe9dd861cf1fd957098e868a079531b52d44e9c677da329601417f706f
Opcode Fuzzy Hash: ac1a4a108f2044d605f4b4447571cdd60fc90104117f12273a06bfa12ec2f426
Instruction Fuzzy Hash: 36F0AF74840744DFDB218F19D88876AFFA0EF44325F18D0AADD894B712D7B9A448CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02E3BE3E, Relevance: 1.5, APIs: 1, Instructions: 35windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?), ref: 02E3BE70

Memory Dump Source

Source File: 0000000E.00000002.468305895.0000000002E3A000.00000040.00000001.sdmp, Offset: 02E3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e3a000_RegSvcs.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: ac1a4a108f2044d605f4b4447571cdd60fc90104117f12273a06bfa12ec2f426
Instruction ID: 4a52afa6c893ce8953411b8aaceaf70d3e3001d2ea22c66325a88fe215689182
Opcode Fuzzy Hash: ac1a4a108f2044d605f4b4447571cdd60fc90104117f12273a06bfa12ec2f426
Instruction Fuzzy Hash: F9F0A435904644DFD7218F1AD889761FFD4DF44325F18D09ADE494B212D3B9A408CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 06920070, Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

MOC, xrefs: 06920236

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID: MOC
API String ID: 0-624257665
Opcode ID: bf7a051c696497c84af741c7ef664725a804071978942ce1cfec91714f221d7a
Instruction ID: 9f1e47a051b966de623fdde7cb438c3a106e4ab786def2b227eb8b1e21810b97
Opcode Fuzzy Hash: bf7a051c696497c84af741c7ef664725a804071978942ce1cfec91714f221d7a
Instruction Fuzzy Hash: 2D717E70B00A16DFD759CF69C99496AFBF6FF88204B24892ED55687B58CB31F841CB80

Uniqueness

Uniqueness Score: -1.00%

Function 055520D0, Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

r*+, xrefs: 0555230F

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID: r*+
API String ID: 0-3221063712
Opcode ID: e6e58390389c7cf40f4b6d671600089868e1ea1f21e003175382580895a81e7d
Instruction ID: 1e2573e547ad3e5e46e9a0a831ca2d4b2f215add057755fe3efc0a5602153834
Opcode Fuzzy Hash: e6e58390389c7cf40f4b6d671600089868e1ea1f21e003175382580895a81e7d
Instruction Fuzzy Hash: 18715E38E08209DFCB44DFA9C4A56BEBBB6FF85310F5084ABC90697254DB749D41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05551458, Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

$ghr, xrefs: 055514C7

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID: $ghr
API String ID: 0-1352911727
Opcode ID: f487a0e31031b4befaa0058225ebe2ad21ae4fde1723e0072a5c3c0194c5b4fb
Instruction ID: 5b7799eccb2ce523a7c4ecf4952b1ab533e6c8414b556e628716d1308b22cc79
Opcode Fuzzy Hash: f487a0e31031b4befaa0058225ebe2ad21ae4fde1723e0072a5c3c0194c5b4fb
Instruction Fuzzy Hash: 3151D234A00218CFDB54DF68D894BADBBB6BF48304F1041AAD90AAB365DB35AD85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05551290, Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

$ghr, xrefs: 05551349

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID: $ghr
API String ID: 0-1352911727
Opcode ID: 2b8c0dcf039eb67728921156b78f29770ebebea12510e8acc4668f813b562614
Instruction ID: fa287b9553ebede6b5cd0875ddacb57d8d25518ff4b05d264000249f4d98ca51
Opcode Fuzzy Hash: 2b8c0dcf039eb67728921156b78f29770ebebea12510e8acc4668f813b562614
Instruction Fuzzy Hash: 44411834E04218CFCB14DF68D8A4BADBBB6BF49350F0045AAD94AAB750DB349D84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05558CC0, Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

r*+, xrefs: 05558DD7

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID: r*+
API String ID: 0-3221063712
Opcode ID: be21f36ff5d43b830be1453dddc2a2fff5a9888dc2b5412d421e3c4e131b7471
Instruction ID: 87f5ba47b9b1a8b4d9b99f7ff7365ef24965e3a92b56b977072b039cb60ede24
Opcode Fuzzy Hash: be21f36ff5d43b830be1453dddc2a2fff5a9888dc2b5412d421e3c4e131b7471
Instruction Fuzzy Hash: A141FA30E04209DFDB44DFA4D5566AEBBF2FB54310F2088ABD802DB260DB355945DF91

Uniqueness

Uniqueness Score: -1.00%

Function 0555E2D9, Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

lir, xrefs: 0555E393

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID: lir
API String ID: 0-3872640509
Opcode ID: f0e2dc00a5157f42732a9f3401a7bd90e2c9ad0567095d38a17270a6f41ab12f
Instruction ID: f4b89b7abc627a8fdd39770b4411636fcff41f8aaf6ccd86bdc9523c00fe6c9b
Opcode Fuzzy Hash: f0e2dc00a5157f42732a9f3401a7bd90e2c9ad0567095d38a17270a6f41ab12f
Instruction Fuzzy Hash: 6A21E531604214CBCB15CB78D0116BEBBEABB89320F1548AFEA46DB340DB31AE41CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 055561D1, Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

X1kr, xrefs: 05556251

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID: X1kr
API String ID: 0-844551562
Opcode ID: adf257734888bf57ad4fc71062d81b5b261e1e2e84fdac05ab842dc523696dd2
Instruction ID: 7393d331122cfdce6937725dc09236d8d077c62d4b1dc9b80c846376dfca23e7
Opcode Fuzzy Hash: adf257734888bf57ad4fc71062d81b5b261e1e2e84fdac05ab842dc523696dd2
Instruction Fuzzy Hash: 3D218E31B040849FCB11DAF894247BE3BE3BBC8230FE4447BDD46A7680DE209C4287A6

Uniqueness

Uniqueness Score: -1.00%

Function 0555A6F0, Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

Huir, xrefs: 0555A723

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID: Huir
API String ID: 0-669697419
Opcode ID: cf5039d4418c142e47343ba7b650c8897654c795c1e832d29b1837b25d939ab5
Instruction ID: aca55e8ffd02ee78120c08e7762d72bceff227a245affba816e90690884c0c45
Opcode Fuzzy Hash: cf5039d4418c142e47343ba7b650c8897654c795c1e832d29b1837b25d939ab5
Instruction Fuzzy Hash: 38F0442030828057C7016A3CACA092E7E6BBBC2270328872FED46CF2D6ED205C0583E2

Uniqueness

Uniqueness Score: -1.00%

Function 05557868, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

Huir, xrefs: 0555789B

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID: Huir
API String ID: 0-669697419
Opcode ID: c8b4e4504ef8af5bd4da0d4580b233d3dfae415362752174d0c64021b1966f71
Instruction ID: 3843d44c8f0ac4e328fe273cb80fba3f103efde8a88b0b5c850bf763940b10f6
Opcode Fuzzy Hash: c8b4e4504ef8af5bd4da0d4580b233d3dfae415362752174d0c64021b1966f71
Instruction Fuzzy Hash: 25F0282134825053C6016A6C6C9093D7E57FBC96F0368437BAA168B2C9DD556C01C3A2

Uniqueness

Uniqueness Score: -1.00%

Function 05554710, Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

X1kr, xrefs: 05554747

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID: X1kr
API String ID: 0-844551562
Opcode ID: faecc8f3407cb88a128a80cfb202797ef5a3b6b6071c3923332bda2792b1eba4
Instruction ID: 3f5a116b555c7c3529642c02561e1f69ea794d472634a35d81b18b5f2b419f7f
Opcode Fuzzy Hash: faecc8f3407cb88a128a80cfb202797ef5a3b6b6071c3923332bda2792b1eba4
Instruction Fuzzy Hash: 32F0B4363112509BCE2566B9A4207BE32DFABC6671F64047FEA0AC7B80DD76DC825391

Uniqueness

Uniqueness Score: -1.00%

Function 05557878, Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

Huir, xrefs: 0555789B

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID: Huir
API String ID: 0-669697419
Opcode ID: 58bf655e9ac1a67a98e3315c5cf6f2a1e58b7c319afc293af285ad5da632212d
Instruction ID: 9b22f277547176c194ff4197e9e106df73a60d1f0508d17a023737a7c8430505
Opcode Fuzzy Hash: 58bf655e9ac1a67a98e3315c5cf6f2a1e58b7c319afc293af285ad5da632212d
Instruction Fuzzy Hash: E9F0B43174811053C5447A6DA89092E7A8BFBC96B0774572BAA1A8B3D8DD65AC0183E6

Uniqueness

Uniqueness Score: -1.00%

Function 055563B8, Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

lir, xrefs: 055563D6

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID: lir
API String ID: 0-3872640509
Opcode ID: 035e2cbadb48bec0e961c43784ddfdc4c1ae6b092c091e81d34c361bf434be0a
Instruction ID: 8ac56347989b3008796b782cc82e7079f3751c215a1a5b8e457e66927758a1df
Opcode Fuzzy Hash: 035e2cbadb48bec0e961c43784ddfdc4c1ae6b092c091e81d34c361bf434be0a
Instruction Fuzzy Hash: C7E0261134E2D01BCB125EBA58112AF3F8D9E8260034884ABF982CB281CD018C0383D9

Uniqueness

Uniqueness Score: -1.00%

Function 055563C8, Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

lir, xrefs: 055563D6

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID: lir
API String ID: 0-3872640509
Opcode ID: 30d28411111966b274aa3d8817b8701cc71951e71d89482a9fdcefdb577f7e79
Instruction ID: 6c4ea3b6ce20d5ee5b52ba5883e47ee6f1c9b11c5763d7fb69cc86e4a6ddb2f1
Opcode Fuzzy Hash: 30d28411111966b274aa3d8817b8701cc71951e71d89482a9fdcefdb577f7e79
Instruction Fuzzy Hash: 45D0A725785154234904AD7F681463F378EABC0951745982FFA07CB380DD159C0283DE

Uniqueness

Uniqueness Score: -1.00%

Function 069205A8, Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900efcf21414f6e351009e327baabaddc9dba91af9c64bb911609369e177861f
Instruction ID: a4761e03269f8666bf849d9072ac057683e2ee2b5353ff4c4faea137413ffd54
Opcode Fuzzy Hash: 900efcf21414f6e351009e327baabaddc9dba91af9c64bb911609369e177861f
Instruction Fuzzy Hash: E6E17E34E00129CFDB55CF68C484A9EBBB2BF84314F258599D90AAB705DB71ED86CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0555B190, Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbf009ce38ac76ff1874ee40b86a4e1187a2f335decbcf1c4e8cdfc6dabf78b3
Instruction ID: 618e16e118fa301754971a4dad92c8c53f72391c5cecba17ec5ee2eb3911eef4
Opcode Fuzzy Hash: bbf009ce38ac76ff1874ee40b86a4e1187a2f335decbcf1c4e8cdfc6dabf78b3
Instruction Fuzzy Hash: 9A81CE30700605CFC709EB68C858A6D7FA3FF85310F50856AE6469B699CFB09D06CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 055564D0, Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d4f04b9f7371d6d65713b337100cc495fc6b8ff8f08fd2e720624ec0019efd3
Instruction ID: b3814acffa544096c7d7d031bc407f55d3c2e0cb3ea9bff9be1a9f6954a36123
Opcode Fuzzy Hash: 9d4f04b9f7371d6d65713b337100cc495fc6b8ff8f08fd2e720624ec0019efd3
Instruction Fuzzy Hash: DD817231A00659CFCF15CF14C890AAAB7B3BF85314F458596DC0AAF215DB71AE86CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0555A950, Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb0e8dde92a1250a4c642c397fde9b988e35b977444eed560f3cb391dc6e006
Instruction ID: 7dcfe7577d351fb1dee6f1554c8085995c6be3044f8a5d723bf1180e6491cd90
Opcode Fuzzy Hash: ffb0e8dde92a1250a4c642c397fde9b988e35b977444eed560f3cb391dc6e006
Instruction Fuzzy Hash: CB519D30B042058BC714DB64D5A066EBBB3FF85321B20CA6BD9579B649DB74E846CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0555EBC8, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c19dabf2ac789daeee720d37b1db574af9b6a12f53a7f33bd393f9ff3552405
Instruction ID: 45f998640d636af202e9f61a76f95935401f9d889627130d4a994f26e4135fcb
Opcode Fuzzy Hash: 6c19dabf2ac789daeee720d37b1db574af9b6a12f53a7f33bd393f9ff3552405
Instruction Fuzzy Hash: 7B714034A04604CFDB14CF69C4A5BADBBF6BF48320F1488AAD816A7751CB31E981CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06920B31, Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a8802b10d5f7ebc73331724f73ef57543e7bede7864bde2e34fe60dfb9cdc09
Instruction ID: a78f5049f373e020b4679fac7ed1525e46b1b9c24daa6b54295ec6e10de4b9ad
Opcode Fuzzy Hash: 8a8802b10d5f7ebc73331724f73ef57543e7bede7864bde2e34fe60dfb9cdc09
Instruction Fuzzy Hash: 4E51C331A001259FCF55DF68C4909AEFBB7FF843147158596E90AAB61ADB30EC05CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 055579E0, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5758f9f0c2190a69c81f2c1ff4c5eff5a211646ab67deca84fb3094d26864045
Instruction ID: 5e9d54a33137153ee53d3ec4daedcc596b1b1d0f4b229374c61ccbb94a2d8160
Opcode Fuzzy Hash: 5758f9f0c2190a69c81f2c1ff4c5eff5a211646ab67deca84fb3094d26864045
Instruction Fuzzy Hash: 9231073191021ACBDF11CF54C864ADABBB6FF89314F5185A5D909BB205DBB06B8ACFC0

Uniqueness

Uniqueness Score: -1.00%

Function 055575D8, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe422898cc4ce4af68921da2b7686ed7664255927da5ca8dfafe9c207b4bbec4
Instruction ID: 543335ea1199516f869784d366c2065c355b131b26b684e40b5df81ee68ba956
Opcode Fuzzy Hash: fe422898cc4ce4af68921da2b7686ed7664255927da5ca8dfafe9c207b4bbec4
Instruction Fuzzy Hash: 76515131B102158BCB04DBB9C464AAEB7F7FFC8350B65856AC80AAB355DE35AC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05557EC8, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 905ebf48035e87f47126d0c1e606ed654fa3539b9b02d7debd61456023e35864
Instruction ID: f82cfd4e4085ac48243da987155484fc72bd38039e0b28f27ef5a76b2549f870
Opcode Fuzzy Hash: 905ebf48035e87f47126d0c1e606ed654fa3539b9b02d7debd61456023e35864
Instruction Fuzzy Hash: 98511775D00618CFCB14CFA8D99469DBBF2FF48320F20896AD85AA7294E7316D46CF80

Uniqueness

Uniqueness Score: -1.00%

Function 05558199, Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cd91ed54e3f1626e69b2767373fe60900b998a3bd16873be612ce5d16062212
Instruction ID: b324efe5ea382c691ac7a93abbd75af3d3ce0eb896b4e76bf30fc9c5ec64a90f
Opcode Fuzzy Hash: 7cd91ed54e3f1626e69b2767373fe60900b998a3bd16873be612ce5d16062212
Instruction Fuzzy Hash: 32513E34A04219CFCF14DBB4C4A8AAD7BF2BF85310F6586BAD84A9B395DB309C45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05550681, Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d88df87863fc1297d2bd82b25c65c8e5fe5fdefa54a0b0719eafe2891edc0b28
Instruction ID: e90259e4ad3d48e3fb4069938f9f9ac5a5490fb32e13dff78491ede831083a78
Opcode Fuzzy Hash: d88df87863fc1297d2bd82b25c65c8e5fe5fdefa54a0b0719eafe2891edc0b28
Instruction Fuzzy Hash: 24417F34AC02008BC7046B7AE82C56D7BA6FF81716B959D6AF906C72A0DF704C96CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 06920006, Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a2f31744d95381c86b9e0e89a3d41798c350c9f6fa92267364d322942a3ca2
Instruction ID: 535fba21e50f9d5ec9ffb18488658d75bab6d48ff66518f3014aa2691973e157
Opcode Fuzzy Hash: 67a2f31744d95381c86b9e0e89a3d41798c350c9f6fa92267364d322942a3ca2
Instruction Fuzzy Hash: 0141F57094D7A2CFD753CF24CC949AABFF1AF42200B19499BD082CBA67C634AC45C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05550BC0, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b18b99b583037658be0e4dd67bc959bb86874f3f23544091e60e5ddd60da99f
Instruction ID: ecdd205c7b940a8abe26bca0bb09f80a2c51ed0cbdbc4ea6faffe6dfd08a5b66
Opcode Fuzzy Hash: 5b18b99b583037658be0e4dd67bc959bb86874f3f23544091e60e5ddd60da99f
Instruction Fuzzy Hash: ED416431B041149FC715DE68C428AAEBBE7BF86320F15846BED06AF3E5DEB19C058791

Uniqueness

Uniqueness Score: -1.00%

Function 0555FB90, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e773d5acf6ca1a53a0a3ff76217ca724c622016a556a9f986db031e952f7c34c
Instruction ID: c5082a03bfa1bdce0220e1ca9c61526a435990bafe7dfe2314e51a64988c87eb
Opcode Fuzzy Hash: e773d5acf6ca1a53a0a3ff76217ca724c622016a556a9f986db031e952f7c34c
Instruction Fuzzy Hash: D651E875A04205DFDB05DF68C490EADBBB2BF88330F1585AAD911AB365DB35EC81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0555EBB8, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90593bbc904a85a8e52112f4c44ededa44df507f02b737501fe3c5743512596b
Instruction ID: 9e6cb09db407ff1c36a13a3a2f4a69afa3c76ba748cd01a2f82ada4ec89e8819
Opcode Fuzzy Hash: 90593bbc904a85a8e52112f4c44ededa44df507f02b737501fe3c5743512596b
Instruction Fuzzy Hash: B7518531A04644CFD725CF68C495BA9BBF6BF48320F1488AFD85697751CB30E985CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0555F0CE, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5502b0dfed05828d90395ad26b7de05938c7ed8525dd128ac6db8ab04f0d6430
Instruction ID: da027e2e2c5cff4ddb2aaed24ac41bdc1f9e270f3b13256fb9d9e2b08a6b2e5e
Opcode Fuzzy Hash: 5502b0dfed05828d90395ad26b7de05938c7ed8525dd128ac6db8ab04f0d6430
Instruction Fuzzy Hash: F841B574E042449FCB42DFB8D8509EEBFF6AF89310B1584ABD945EB252DB314941CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05555920, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b29ab277500976470a9f849081ef9f54b1107baa109e32ecea8affb73dcb1b0
Instruction ID: 1a93b0d5048cdbd402565367d3008b0f5ac1dfc7d3b9571e27c9505a6cde4aee
Opcode Fuzzy Hash: 8b29ab277500976470a9f849081ef9f54b1107baa109e32ecea8affb73dcb1b0
Instruction Fuzzy Hash: 57418F34B452018BDB05A776942873E67E77FC8631F95486BAD06C7684FF388C428B95

Uniqueness

Uniqueness Score: -1.00%

Function 055587C0, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3109544f6036343acb04c6e1e8566a1dbf6f691bd414cd8b21540f0fa82c132
Instruction ID: fa58786797087ec54ae072a123d343ae88f8f858760d4758c4a82dfecd963380
Opcode Fuzzy Hash: b3109544f6036343acb04c6e1e8566a1dbf6f691bd414cd8b21540f0fa82c132
Instruction Fuzzy Hash: 6D41C175A00109DFC704DFB8C498AAEFBB1FF44320F208AA7D916A7651D731E856CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05557158, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b6d7c8cb6cf29da9b72da49e29399f585e15f7cc1ee891d30b6f33151f4f2dd
Instruction ID: 1a601368b730ebadf200fadfbe31d3fbcb8352f66288040f2e7beabb45f00854
Opcode Fuzzy Hash: 1b6d7c8cb6cf29da9b72da49e29399f585e15f7cc1ee891d30b6f33151f4f2dd
Instruction Fuzzy Hash: 7641F138B00200CFCB05AB39E06456D7BFAFB8C310B5541A9ED4A9B786CF359C15DB91

Uniqueness

Uniqueness Score: -1.00%

Function 069210D8, Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1d97e39f68ab12f03770e919c4342184ca66dce8bc718c36ebe6d727bc820f6
Instruction ID: 9d7f5f43e2af6e0e5ac186dca679f530b7644146804c54d32abec4e0619e60de
Opcode Fuzzy Hash: f1d97e39f68ab12f03770e919c4342184ca66dce8bc718c36ebe6d727bc820f6
Instruction Fuzzy Hash: 9F414670E0025ADFDB44CFA8D480ADDBBF1AF49310F24856AE505EB61AD731AD82CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06920498, Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a2e5ec857cbb2f7fadf9d50692d89235e67ff8eab52a7a0cdda056874ab237
Instruction ID: 50f4e85922f3f9af3f529f326678aa10b95624444e21f7705aa20097cf2e57cc
Opcode Fuzzy Hash: 49a2e5ec857cbb2f7fadf9d50692d89235e67ff8eab52a7a0cdda056874ab237
Instruction Fuzzy Hash: 0B31CB32B04322AFDB9097BDD8009AAFFF5EB893107148477D108C7912D622EC41C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 05557168, Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1301b70fd034d185f1b9574a876d8f3348d91dc87e0b34bfb1dff139c86b9003
Instruction ID: 5eb794b9e7c0bdf2f1178d9d34b9adbf478111cc5b40ea55b63dc7d8fb431112
Opcode Fuzzy Hash: 1301b70fd034d185f1b9574a876d8f3348d91dc87e0b34bfb1dff139c86b9003
Instruction Fuzzy Hash: A441D138B00200CFCB05AF69E05466D7BFAFB8C311B9541A9EE0A97785CF35AC55DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0555EF80, Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579087c32bd0080fbad72d38a8a8431b936d416ed02ac90983c599c67a6c4881
Instruction ID: 3890edf831f7ec65d198dd5ae08265962f9be6f9d072934c1de5577a85f81e3e
Opcode Fuzzy Hash: 579087c32bd0080fbad72d38a8a8431b936d416ed02ac90983c599c67a6c4881
Instruction Fuzzy Hash: 3131F636A051159FCF01DBA8D8148EEBFB7FF89320B0508A7E942AB161DB716949CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 055502D9, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06191f2f5e2f8b43ba408dc6f1dea76e8103075fb050b8d0d335839fdca4e7b6
Instruction ID: c303b7b8fc961473d5c887817bfeb538579f3ea3dba440f4e5af30e2e49bd707
Opcode Fuzzy Hash: 06191f2f5e2f8b43ba408dc6f1dea76e8103075fb050b8d0d335839fdca4e7b6
Instruction Fuzzy Hash: 20413E30A01205CFDB14CB68D468BBE7BB3FF89721F15446AD902AB7A1DB71AC41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05555B51, Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78b0923673f62f4541773fef7deb2d386993a9227ff46230d1d18170fdd99c6d
Instruction ID: 08eb30e5693e9fc41505c092d3897a3b3cb146e0d5608ffdde7a0a38adf6037f
Opcode Fuzzy Hash: 78b0923673f62f4541773fef7deb2d386993a9227ff46230d1d18170fdd99c6d
Instruction Fuzzy Hash: 0531B131F151059BCB09DAB9C4641BEBBE3BFC9230B55847BD807A7781ED308C4287A0

Uniqueness

Uniqueness Score: -1.00%

Function 0555EF90, Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0e056b1583b55d3945a62123da6989f1568bb22f6982e62d9507187ce976321
Instruction ID: f0f38f3cf79173770d44fdcf3831165c418a9f22ee29f96dc811ca6821c2cf70
Opcode Fuzzy Hash: b0e056b1583b55d3945a62123da6989f1568bb22f6982e62d9507187ce976321
Instruction Fuzzy Hash: 2031D636A00114DBCF05DFA8D8549AEBBB7FF88320B050866E903AB260DB71BD55CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0555E628, Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6990169964cbc64604e3c15afc206b390ae217db9280016b55d8e6864670955
Instruction ID: 4e7804b714d9a66a718d15e6fdeb1216f56bda9e925ac2b908af2e346ade4cde
Opcode Fuzzy Hash: c6990169964cbc64604e3c15afc206b390ae217db9280016b55d8e6864670955
Instruction Fuzzy Hash: 0C31D571A00204DFC714CFA8D555AAEFBF6BF48260F1485AAD80AE7241DB30DD45CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 055543C0, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79a99946163f74c08ca5fa3b34f2beaa4608c9b9ffcc6c8da212e336c7cc2a93
Instruction ID: 68c33f7508937df654d8a025baa89dfb4bb2bfdc9fe12d57c7543c64cad833c1
Opcode Fuzzy Hash: 79a99946163f74c08ca5fa3b34f2beaa4608c9b9ffcc6c8da212e336c7cc2a93
Instruction Fuzzy Hash: DA310535A44200CFCF01DF68E8549AD7BFAFF48318B5489A6E9065B365CB35AC96CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0692059B, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41627a747c94d453172276074b2dba6bd30b3b99fd8f1b41d642f9ffa920f6a
Instruction ID: e1327fd30625a0786bfff3a0fed3052ea616cd6123e97db2ada971d73ccc69cf
Opcode Fuzzy Hash: a41627a747c94d453172276074b2dba6bd30b3b99fd8f1b41d642f9ffa920f6a
Instruction Fuzzy Hash: 49311270E0422ADFDB94CF64C484A9DBBB1BF48310F608969D50AEB645D6319D868F91

Uniqueness

Uniqueness Score: -1.00%

Function 055575C8, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c741379329572c36a660acb8bb3413cbae8b0f8d6b602126f524a1a13b790bd5
Instruction ID: 4280a6fe5db503d2618b7267d0b458f3355ada77a8df0bcfcb3bf3148d07ebe2
Opcode Fuzzy Hash: c741379329572c36a660acb8bb3413cbae8b0f8d6b602126f524a1a13b790bd5
Instruction Fuzzy Hash: B5315231F002098FCB04DBB9C4649DEBBF7FF88314B54856AC806AB355EA31AD06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 055545C8, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 893abc96d27b24686fd822e44408ecd13f5990f4401a31c5928c75eeb8ed2f33
Instruction ID: 3e38bb8925879c0a8eb8fcaa13722ea90d2bb61564146e5d5154f29e7c7f1926
Opcode Fuzzy Hash: 893abc96d27b24686fd822e44408ecd13f5990f4401a31c5928c75eeb8ed2f33
Instruction Fuzzy Hash: 2E217571F04119DBDF04DA95D951BFFB3BEFB88320F205527EA19D3140EA7099488BA1

Uniqueness

Uniqueness Score: -1.00%

Function 06920DA0, Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea3525a507ec5ddec943a584a1ae79d06a05d787426f1832c7ea61760a750dda
Instruction ID: a628884a33e81bb15f566339c7662c4e0114fee50364bb77546b83d391c0add9
Opcode Fuzzy Hash: ea3525a507ec5ddec943a584a1ae79d06a05d787426f1832c7ea61760a750dda
Instruction Fuzzy Hash: 8A411C30905B62CFE379DB2AC544766BBF2BF84305F14C86EC19A46EA4CB75B881CB40

Uniqueness

Uniqueness Score: -1.00%

Function 05555831, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34b981fe303dd6336a9a2df8bf9643f8ebb30f0b3409e0907663f07131d679da
Instruction ID: c714569f7ecb4580569e6d182e74c2895026000fc043eb2b3afce0ed098ab3aa
Opcode Fuzzy Hash: 34b981fe303dd6336a9a2df8bf9643f8ebb30f0b3409e0907663f07131d679da
Instruction Fuzzy Hash: 4221E135B040148BCB04A7F9D8649BEBBB7BFC8230BA0497BD9039B661EE605C0587E1

Uniqueness

Uniqueness Score: -1.00%

Function 0555E8A7, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9dba3445df139fc1ebe5452f190bc976b999400abbb3d249f61c19a15672d6b
Instruction ID: 9fd84280e486c078a23376261465faa477bcc440ed75948cd81a9d04515d4f32
Opcode Fuzzy Hash: a9dba3445df139fc1ebe5452f190bc976b999400abbb3d249f61c19a15672d6b
Instruction Fuzzy Hash: 17319E30B00204CFCB54DF79C491AAEBBF6BF88310B50846EE946A7751DA75DD46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 055550E0, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edad6eeff2cf51a0f049578a701b0bb63d98abc52bad2c8888fbe10344f37d32
Instruction ID: 870523fa3a8ab939f0bd31040b0457971df2726853ae32933491daadad949378
Opcode Fuzzy Hash: edad6eeff2cf51a0f049578a701b0bb63d98abc52bad2c8888fbe10344f37d32
Instruction Fuzzy Hash: BC214D31E003099BDB04DBA9C4646AEFFF7BFC8310F55492AD906AB251EB706945CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 0555E43C, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0336ca4d6e4f7cb3bceea9d790640baed3ec60271c459efcfbc510b37105cb91
Instruction ID: 355e8704cfc64212b235286b4e6e4592a537620c85b789fdf2adb5cae8524296
Opcode Fuzzy Hash: 0336ca4d6e4f7cb3bceea9d790640baed3ec60271c459efcfbc510b37105cb91
Instruction Fuzzy Hash: A7314D30340301CFC659AB78D49066A7BE3AFC53087A4992CD6869F758DEB6ED07CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0555D808, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3249cb61ed0d20012e3e7cbbe349b770d820a91218da2e6769b94e46a71fe52
Instruction ID: 4b3b2dbb7bce1c81bcef30f368237f38edabb29dbab279de2a7677370c5da85b
Opcode Fuzzy Hash: d3249cb61ed0d20012e3e7cbbe349b770d820a91218da2e6769b94e46a71fe52
Instruction Fuzzy Hash: DC31AE316053448BC7099F34E4191297FB5EB4631872489AEE4459B352CF369D07CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 05558B08, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b39e4012a2862f5d8d76a5ea98ff384bf5fbaca172bdc248587c8e0157615cc
Instruction ID: f5fbd6cb8278cb32e68db08e4b7bd7158ea328e48c32a6025a0a851c1cd4f6eb
Opcode Fuzzy Hash: 1b39e4012a2862f5d8d76a5ea98ff384bf5fbaca172bdc248587c8e0157615cc
Instruction Fuzzy Hash: 93318E70B14204CFC748EB78E46A52D3BABFF84325B65C96AE506CB290DF349C42DB81

Uniqueness

Uniqueness Score: -1.00%

Function 055543D0, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b436cbeedd8a648c116fddd88f6454480ec2d1a650a1bbd4bc1c6471cbf8e6c
Instruction ID: 94287fe518903c3af04e8c81694ed2fae0b895748bea2ff6ee302f584424408f
Opcode Fuzzy Hash: 1b436cbeedd8a648c116fddd88f6454480ec2d1a650a1bbd4bc1c6471cbf8e6c
Instruction Fuzzy Hash: 26313A35940201CFCF00DF68D8448AD7BFAFF48318B5089A6E9065B364DB35AC96CF80

Uniqueness

Uniqueness Score: -1.00%

Function 055555E8, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31f91f7935c1158013d08447af556b806baeb6744c5ab778872d67c4459f07ed
Instruction ID: 5c56c6c840c517f358a9d61ebc94387e192713d72bc364695ff6e4bf4ae6d38d
Opcode Fuzzy Hash: 31f91f7935c1158013d08447af556b806baeb6744c5ab778872d67c4459f07ed
Instruction Fuzzy Hash: 4821C130B502458BDB14AF78C4657FE7AE6BB88720F19046AE902EB3D0EEB54D458B91

Uniqueness

Uniqueness Score: -1.00%

Function 06920380, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4335130d9332e3ab16177788683ade44055d802cbde91d8ad2c490694f076be4
Instruction ID: f1e1223009302b00472ae931e66cc057c635d8686aaa852a711a3b8088034d60
Opcode Fuzzy Hash: 4335130d9332e3ab16177788683ade44055d802cbde91d8ad2c490694f076be4
Instruction Fuzzy Hash: 3C21F93094922ACFD7995B14E408A793FBAFB55341F14C86AE4868BD96EF309C81C791

Uniqueness

Uniqueness Score: -1.00%

Function 0555EE81, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48da6e118e73b97d77e8bc1d467d90a1bf9c6c122a1ea0f8504324843f63e98b
Instruction ID: 18cd9760fdbd04640dedded56273b7ce8404fb2b5567042c85717b1761e47b2e
Opcode Fuzzy Hash: 48da6e118e73b97d77e8bc1d467d90a1bf9c6c122a1ea0f8504324843f63e98b
Instruction Fuzzy Hash: C6217F31A05255DBC755CF68C4116AAFBE6BF88320F2845BFE849E7241DB319A42CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0555002C, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7528134e20bda3a2555652598932c16eb9575c79f8767aa958488b4a23e98138
Instruction ID: d9616abab05b14e10ffb8aebc5b11ceb65018f3cec5f6f2f764d301d4082fd1e
Opcode Fuzzy Hash: 7528134e20bda3a2555652598932c16eb9575c79f8767aa958488b4a23e98138
Instruction Fuzzy Hash: 0221E734548341CFCB01EB74D8691693FEAFF82310F44986AE985C7255EE749C46DB42

Uniqueness

Uniqueness Score: -1.00%

Function 05556F92, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7da04b16d92f631d39187b4f226b64a81848db3c3c7bbdfd70016cf19c80644
Instruction ID: ecf144ec1c05c0158b0f697cbefa4f4702f0176c8cb813acfa9d5aef885482c0
Opcode Fuzzy Hash: a7da04b16d92f631d39187b4f226b64a81848db3c3c7bbdfd70016cf19c80644
Instruction Fuzzy Hash: 6A317E34710204CBCB15AB38E05952D3FAAEB85359394EA7DE6068B358DF75AC07DF81

Uniqueness

Uniqueness Score: -1.00%

Function 055521E9, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c4d46e625f9a9db7fcdfc1888fa0cc799cb4c14d364b3a5970c74a4436009ad
Instruction ID: 8236aa16a7b3155d9aed1688769d1804155bd419bc7ccdc0fd73dad7e18820c1
Opcode Fuzzy Hash: 4c4d46e625f9a9db7fcdfc1888fa0cc799cb4c14d364b3a5970c74a4436009ad
Instruction Fuzzy Hash: 3F314B38D08209DFCB44DFE8C0656BD7BB2BF45310F90849BD80297654DA359A45CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0555AAF0, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12865b9a9af10a923c4b0edbe22fd62fd886104187f0e627f99025d999d69c6f
Instruction ID: dcc82f66b7f07657298e582c8c424b5f8ab754990aa32fd27b7fe16100c8c6bc
Opcode Fuzzy Hash: 12865b9a9af10a923c4b0edbe22fd62fd886104187f0e627f99025d999d69c6f
Instruction Fuzzy Hash: 00216970B042549BCB14DB74DC51A6F77A7BB89771F108B6BE902DB280EF70A80187E1

Uniqueness

Uniqueness Score: -1.00%

Function 0555B521, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3066bede29af51d3c7a8c116ca52cdf046d1e019e0069df37871fcd1057e1da
Instruction ID: c98cd0c1e9f6ab53491d5dd536d701f7e3f4cbe591c5e53fb5dd263def11540b
Opcode Fuzzy Hash: f3066bede29af51d3c7a8c116ca52cdf046d1e019e0069df37871fcd1057e1da
Instruction Fuzzy Hash: D72186B5E142658FCB09CB99D8945AEFBF2FF8C321B20856AE856E3250D7309911CB90

Uniqueness

Uniqueness Score: -1.00%

Function 055525DE, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8f6499f963e6825a208216873aeae1c1a0b2c05ee8632f22a564271693dbbf8
Instruction ID: 07a1e34abdddace79646baaec6a438f61d1ab597b92379835e99fc4d006f4e8e
Opcode Fuzzy Hash: b8f6499f963e6825a208216873aeae1c1a0b2c05ee8632f22a564271693dbbf8
Instruction Fuzzy Hash: 79319038E40245CFDB60CF66D45475ABBF6FF84324F20D96AC8099B254DBB4948ACF85

Uniqueness

Uniqueness Score: -1.00%

Function 055550D0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8547b95f335ebc8701eaa5e7cee068045d410357d16374dd977f8c9e48658dad
Instruction ID: cea13ed231f6dee8a89fbba16b2e522a36ca85ca8289a163aa3150f0b42f82b5
Opcode Fuzzy Hash: 8547b95f335ebc8701eaa5e7cee068045d410357d16374dd977f8c9e48658dad
Instruction Fuzzy Hash: F3116731E003499FEF00CFA5D4656EEBFB2EF89320F104866C909AB251E770694ACB80

Uniqueness

Uniqueness Score: -1.00%

Function 055590A6, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86c7bec6565e5b78f25162266bd9029a73ac53bd5c34d962044b67973cfa0fbc
Instruction ID: fb5fe3349e08722cdade09ee7f28001dfd0c60b2f6046cd10e556f263835dffa
Opcode Fuzzy Hash: 86c7bec6565e5b78f25162266bd9029a73ac53bd5c34d962044b67973cfa0fbc
Instruction Fuzzy Hash: 0F317830E10209CBDB60CF65E45575ABFB2FF88324F14D52AD406AB254DFB89889DF85

Uniqueness

Uniqueness Score: -1.00%

Function 05554F10, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5774fb991ba00accb90996b25b46adf6b44150bee46333ee4d6227dc8df236d7
Instruction ID: 9c50dd8a316353e6e76b981279466eaec7e80007f96d2c9d345f9825b0d6c420
Opcode Fuzzy Hash: 5774fb991ba00accb90996b25b46adf6b44150bee46333ee4d6227dc8df236d7
Instruction Fuzzy Hash: 86219F30619244CBCB04D669E8A09793B5BFFC8721B509A67E9424B789DB246C8287D1

Uniqueness

Uniqueness Score: -1.00%

Function 05558CB0, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e01f301d8c8c2c9a1a750c3d38c1cdee09881b080a8381d70b5b0fe57ef75b6
Instruction ID: de3c4ba51669c9161d1c106f8daf3f23967fbc1040832cb4140f4f0f1864a39f
Opcode Fuzzy Hash: 7e01f301d8c8c2c9a1a750c3d38c1cdee09881b080a8381d70b5b0fe57ef75b6
Instruction Fuzzy Hash: 4F314730A08209DFCB44DFA8C1656BDBBF2BF55310F2088ABD802DB290DA359945DB92

Uniqueness

Uniqueness Score: -1.00%

Function 055548B9, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3350c70ba91c8b109ce6a6b00060b13c6fb8da46a4bc8555962e8a25e6e3178
Instruction ID: c966afa3c1b4017a9d41e582484fd5fb5a202fe6bf6a615589e15a7b83d720cc
Opcode Fuzzy Hash: b3350c70ba91c8b109ce6a6b00060b13c6fb8da46a4bc8555962e8a25e6e3178
Instruction Fuzzy Hash: 8F11D331B05159DBCF19DA78C8729FEBBB7BFC5720B04442ADD02B7251DD201A4687D1

Uniqueness

Uniqueness Score: -1.00%

Function 0555B670, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a80e9ee8a9d510af76cf997e3981fd18b3b531bb2bef4bf11aa02b8fdb81b61
Instruction ID: d750d5512f6a98fa2826d7f8b86e1ec35127475728431c65d63227ba006bf539
Opcode Fuzzy Hash: 2a80e9ee8a9d510af76cf997e3981fd18b3b531bb2bef4bf11aa02b8fdb81b61
Instruction Fuzzy Hash: EC11563120C3904FC3228B39842452DBFB6BEC263072885AFC486CB542CB289C49C7E6

Uniqueness

Uniqueness Score: -1.00%

Function 069202C3, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b7ae51545f37545a1ad2034dce9fc8046829039b0e95aa08ff676ff5bee68a
Instruction ID: 8b28d9db26094b95d14b122efdf1e2a5d1ab7e7cbdc543f4fbb0225fb4d935bc
Opcode Fuzzy Hash: 98b7ae51545f37545a1ad2034dce9fc8046829039b0e95aa08ff676ff5bee68a
Instruction Fuzzy Hash: DB211A36905119EFCF068F90E848CE9BF72FF49311B068496F2556B032D732D929EB91

Uniqueness

Uniqueness Score: -1.00%

Function 05555840, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feeceef132a0e515a7553a8db222935a4c573b094c94aadb006fa5f43e8d3a04
Instruction ID: 363e12f000bebedc1fbb1d081ec3bfdc1d99b261634b363d1d612b3664a4969b
Opcode Fuzzy Hash: feeceef132a0e515a7553a8db222935a4c573b094c94aadb006fa5f43e8d3a04
Instruction Fuzzy Hash: 6E11BC3171011597CB08E7B9C46497FB6EBBFC8234BA0493B99179B751ED745C0487E1

Uniqueness

Uniqueness Score: -1.00%

Function 0555FCF6, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a910de54c7652f6b92f4a713cf30411899996c047c5e359851978c16b088c13
Instruction ID: 859034b160b2d7f302f67a4f3ae3ce2633b8c1a6de39981e1fca13ddef034987
Opcode Fuzzy Hash: 2a910de54c7652f6b92f4a713cf30411899996c047c5e359851978c16b088c13
Instruction Fuzzy Hash: 3331A375A04204CFDB01DB68C580EADBBF2BF88320F1645A5DA01AB366D735EC81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0555D87F, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53744dd838cd130f37061e555ac389c527b3627778a44cbdb241534ea95ec89
Instruction ID: 5d4b162e8d2cae338d34a3e83a82d5e12d74dfe2cb87fb25c85da626fb3f4610
Opcode Fuzzy Hash: f53744dd838cd130f37061e555ac389c527b3627778a44cbdb241534ea95ec89
Instruction Fuzzy Hash: 492126707002058BCB489F28E459519BFA6EB8931D364D9BCA50A9F365DF72DC0BCF80

Uniqueness

Uniqueness Score: -1.00%

Function 0555E750, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7edc8009bc094fb93491a69b31b7f825f0e49cdbeb906ff2e667f3d7b3d70ff
Instruction ID: 13c7c6613629b68fcc38055792f79427e66fe01241d9a3516e9e8a2c11b9bf41
Opcode Fuzzy Hash: e7edc8009bc094fb93491a69b31b7f825f0e49cdbeb906ff2e667f3d7b3d70ff
Instruction Fuzzy Hash: 8B216234A14154DFCB54DFB8C5629BEB7FAFB88620B20849BD80AE7240D730AE01CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 05554511, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41a6b98e443b2147131fdba343e71757715e021aa1bc3eb5e8cd7cec7d381b5f
Instruction ID: 3012924900c797f88ee1667f20d083c665aab895d6aa28ec327e91347e4977b6
Opcode Fuzzy Hash: 41a6b98e443b2147131fdba343e71757715e021aa1bc3eb5e8cd7cec7d381b5f
Instruction Fuzzy Hash: 8111A332E081558BCF05DA5994202EFB7A6AFC6321F05457BAD069B380DAA19C5587D1

Uniqueness

Uniqueness Score: -1.00%

Function 05555000, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5628c6dffcc336a40d15beec8d5114c1a183f94364e6cc3e69131de9c37b2fb
Instruction ID: 735ae586559f806e904a65db37e430e09b2c5563b7c8df9ba6ac74bde005218f
Opcode Fuzzy Hash: b5628c6dffcc336a40d15beec8d5114c1a183f94364e6cc3e69131de9c37b2fb
Instruction Fuzzy Hash: 26118435B00215CFCB44EBB9D86027E7BE6FB88624B545976C906D7290EF34AD02CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 0555FED0, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01e5c1f9c1c9966493e86635ee2e44fb882051640449dcbdc6702fafce1658ec
Instruction ID: 18742bed87ff5313ff2a00af29b45e5b74f7613e04bc59e4e392a6562614af1f
Opcode Fuzzy Hash: 01e5c1f9c1c9966493e86635ee2e44fb882051640449dcbdc6702fafce1658ec
Instruction Fuzzy Hash: FB1106B19093C0AFC7529B78A8106DEBFF6AF4A220F1484DBE588DB053D6304955D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0555AB00, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cb44f76998fc8799d1f1f18c06506085d305d82be61004999d40bd072d4c540
Instruction ID: 7a445aed36bc8e361cbce508b0e104ef76fb729a6997dd11fe7639b2ee8634c3
Opcode Fuzzy Hash: 0cb44f76998fc8799d1f1f18c06506085d305d82be61004999d40bd072d4c540
Instruction Fuzzy Hash: EF118970B042149BCB14DA74D851A6EB7B7BB89771F108B6BE902DB280EF709C0087D0

Uniqueness

Uniqueness Score: -1.00%

Function 0555E740, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f06f5beb546606efb86b27139d4c2a400d0ec7f23f3c1638f98be4e2fb2398
Instruction ID: 778f7dff20f4235ffe6c1a6bbce9c7dd8b0ac20b246e4f72bc68fdf4cad80d04
Opcode Fuzzy Hash: 19f06f5beb546606efb86b27139d4c2a400d0ec7f23f3c1638f98be4e2fb2398
Instruction Fuzzy Hash: 98211D34915185DFCB54CF78C5669BABBFEFB48620B2084ABD849A7241D331AA42CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0555CD68, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118790229a5b1d86eb1eabfcef9b16a42b726b37ce6a3d39dac1d2c6fc2eac20
Instruction ID: 78da8a06abddde2c9c29d045290213241fc0f311e37287400db6114877644166
Opcode Fuzzy Hash: 118790229a5b1d86eb1eabfcef9b16a42b726b37ce6a3d39dac1d2c6fc2eac20
Instruction Fuzzy Hash: 91115435B002109BC748EB69C464A7EB7EBAFC8760715807AE806DB350CF31AC12C7D5

Uniqueness

Uniqueness Score: -1.00%

Function 01460845, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.468086206.0000000001460000.00000040.00000040.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21dc2e7ffb5a3d695d6ded961e80202798eb0b2a86f297853cb0954b58c243a6
Instruction ID: 6d11d9d14d68378a0377dd3efef1a97f80baa1a412758821678d35ec562bb676
Opcode Fuzzy Hash: 21dc2e7ffb5a3d695d6ded961e80202798eb0b2a86f297853cb0954b58c243a6
Instruction Fuzzy Hash: BD212F351493C58FD707CB24C850756BFB1AF47318F1986EED8899B6A3D33A880ADB52

Uniqueness

Uniqueness Score: -1.00%

Function 05555730, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf96cfb2992c41ae85db87f9cdb0e7bbd244adf9a3ddf8f5ffb2064c0fbb899f
Instruction ID: 734af4d2f7ec2401539c350f0bbd8d457dbff30ef84c02ae4dc2677e5a9d64a5
Opcode Fuzzy Hash: cf96cfb2992c41ae85db87f9cdb0e7bbd244adf9a3ddf8f5ffb2064c0fbb899f
Instruction Fuzzy Hash: 0F118230A11304CFCB10DFB4E4917BE7BBAFB48350F60462BD801A6280E7359D42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0555FA88, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c511087e5f8c7ab1b127f74963811e65919af35e4d8b2459f7a6be3672adc32
Instruction ID: 139400a26ce8803feb948a90873f02be4abe7014a4e515e55afbfe3307bca0f0
Opcode Fuzzy Hash: 7c511087e5f8c7ab1b127f74963811e65919af35e4d8b2459f7a6be3672adc32
Instruction Fuzzy Hash: 46119DB1A08209CBDB14DA64D4747AEBFB2BF88338F14487FC906A7640CAB55844CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0146087C, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.468086206.0000000001460000.00000040.00000040.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e423e4739fc0ec925b6ad74bcb986e43ef78e4e3783e2da3ef77d70b5568dd19
Instruction ID: 813ca8afa5900a64bf35b52da91027d00c1cc15fb0271ae4344fc55e0cb8c91e
Opcode Fuzzy Hash: e423e4739fc0ec925b6ad74bcb986e43ef78e4e3783e2da3ef77d70b5568dd19
Instruction Fuzzy Hash: 1911E434204384DFE315CB14C540B26BB99AB8870CF24C99EF9490B763C777D803CA92

Uniqueness

Uniqueness Score: -1.00%

Function 0555CE98, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab077e0e0328e51f748955147e42b6855564f1dee0615c5800242fcaddc69691
Instruction ID: ceed464b9e8a82ecbe4917020b91a8de6887f517fa541b1f74b853cc58ac9df3
Opcode Fuzzy Hash: ab077e0e0328e51f748955147e42b6855564f1dee0615c5800242fcaddc69691
Instruction Fuzzy Hash: 67118630348304CBC615E738A4A453EBB93AFC1714398DD7EA95B8B740DF72AC028B96

Uniqueness

Uniqueness Score: -1.00%

Function 069202D0, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4dd21f24c3d71010e59e5560626e4984444c3196a4a3966192b954a25b4ac91
Instruction ID: bdf0fe8ab51b42f57a7ca016249966a09b9f95e8e98903c300bf340770677b37
Opcode Fuzzy Hash: a4dd21f24c3d71010e59e5560626e4984444c3196a4a3966192b954a25b4ac91
Instruction Fuzzy Hash: 2F11063650111AEFCF0A8F80EC08CA9BFB6FF49310B068495F2156B032D732D925EB91

Uniqueness

Uniqueness Score: -1.00%

Function 0555E149, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af949881767f71d56d32e766494872dd9dd031d5efa7a0a0f2ec106cb44e528e
Instruction ID: f0218d9733fc2a0908deb4099f6fa223a9743157fd6e0b53fcd95bc6d85cd5b6
Opcode Fuzzy Hash: af949881767f71d56d32e766494872dd9dd031d5efa7a0a0f2ec106cb44e528e
Instruction Fuzzy Hash: 5501C434B052519BCB152BB9981892F7FABBBC9220764497FE946CB382DD358C41C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 055511DF, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc7c5eb0fc52757e1f571fbe70aa169fd157c006a1a5ebf020faf744dcb12243
Instruction ID: 1826d31c0fa40a2b8ac1ee66de086f432f4333ee86ebfc51d13229cd1b373d07
Opcode Fuzzy Hash: cc7c5eb0fc52757e1f571fbe70aa169fd157c006a1a5ebf020faf744dcb12243
Instruction Fuzzy Hash: 87117034708580CFC7068779D478AA97FFABF8A21075945EBD882CB276CE655C0ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 05557EB8, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a429ff71469c073a6361c6b8a830977d1bcb2e11b6904add063dffcc2890df2
Instruction ID: c5c56228c7c25a1992ed7227f11a3a59d6759d1add687cfcd9ad76ef4a1e0e58
Opcode Fuzzy Hash: 0a429ff71469c073a6361c6b8a830977d1bcb2e11b6904add063dffcc2890df2
Instruction Fuzzy Hash: 9811BF31908244DFCB11CBA8D854AEDBFF2FF8D310F1448AAD942A71A1E7316D5ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 0555CA80, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bee0c0001189fdcbdfef8d2f2ee901c57206084494ae334e8bedbe5b9a0b817
Instruction ID: 14cabb5053f3378267d9a68a7dbac6e9de772c42e10e448cd108cfb9d37d9408
Opcode Fuzzy Hash: 5bee0c0001189fdcbdfef8d2f2ee901c57206084494ae334e8bedbe5b9a0b817
Instruction Fuzzy Hash: F4119E30B443549FC3059A29E85573A3BAFFB89711F555869F80ADB384CA749C42CB84

Uniqueness

Uniqueness Score: -1.00%

Function 069203F8, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 626824fef9bfef31b7f2941b6e859fc773735ac4d019fee6813a9b6a4847fc76
Instruction ID: fc3526c4666c7645d4461ec255dbd8c80b0a4d8084c3ffe1f69f67f933f174ea
Opcode Fuzzy Hash: 626824fef9bfef31b7f2941b6e859fc773735ac4d019fee6813a9b6a4847fc76
Instruction Fuzzy Hash: 9B11E93090D352CFD7594764A4087757FB9AB65300F14C99FC48297DA6EB388C85C791

Uniqueness

Uniqueness Score: -1.00%

Function 055554F8, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 441e6d9cf629c0921bbde8600329b0ecb0777bb2c3ad4b12c6984ee4dfbb6d3a
Instruction ID: 115714f99e0ab445d18d51310a88a13e8c02e636f3157b807ef479c29b01d83d
Opcode Fuzzy Hash: 441e6d9cf629c0921bbde8600329b0ecb0777bb2c3ad4b12c6984ee4dfbb6d3a
Instruction Fuzzy Hash: 0B114C30A113058BCB54EFB9D851BBE7BBAEB88310F504A2AD50597291EB359D41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05554FF0, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 690bde246df2793add3659cc73934584dd8f84c51499ec51b84ce15aa4d6ec24
Instruction ID: 3c7f1d3edf053d6d71b480e3c9740e68991f116436611c7886db069d2f68d965
Opcode Fuzzy Hash: 690bde246df2793add3659cc73934584dd8f84c51499ec51b84ce15aa4d6ec24
Instruction Fuzzy Hash: 1101C431E142058FCB40DBB998622FE7BE6FB84220B448577C919D7681EB205906CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 055564C1, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b16ceef0a45683168dc4738328f28cd1864dfbd4f80e3ac445228997d6debca
Instruction ID: a0a39c7590fbed8b29613f006055dbab4b162fc98fa6a43a0238ef5fb103ff57
Opcode Fuzzy Hash: 8b16ceef0a45683168dc4738328f28cd1864dfbd4f80e3ac445228997d6debca
Instruction Fuzzy Hash: 35118421A4E3C08FC723433418745B97FB66B87160B8905E7CC85DB1D7E5294D1AC7A2

Uniqueness

Uniqueness Score: -1.00%

Function 05554789, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0f1b87a5f6039029faa9348d38cea8517ea1440d0a9974d54beaa10f3e8747a
Instruction ID: f428cd1d92ebbf7c2304bb0445661f81505003fbc3b810e0204443a55da7dc40
Opcode Fuzzy Hash: b0f1b87a5f6039029faa9348d38cea8517ea1440d0a9974d54beaa10f3e8747a
Instruction Fuzzy Hash: F8016931F011188FCB55EBBC98612EE7FF2EF89310F20847BD549E7281EA3449468B95

Uniqueness

Uniqueness Score: -1.00%

Function 05556E88, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555103db57e53f1cad8f9e8f100f6ec7ae92a19124bc1a3a4a7fa44939bfa591
Instruction ID: dc922cace09b6d88ef7a23b90d7e25ee995e52ac16f3848ef30021391f031689
Opcode Fuzzy Hash: 555103db57e53f1cad8f9e8f100f6ec7ae92a19124bc1a3a4a7fa44939bfa591
Instruction Fuzzy Hash: 79018772E012889FDB10DBB8A8617FABFB9FB84220F100276D94892281E7305946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 055505B9, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e304dd614a6f9ca4033ac9d39fa42456928fa71073cfc0d35f106c420fd2bf7
Instruction ID: 35dd88e702af173cbdafdcfe6d5fb3772ce14842e320bf4fcb43596d8af695d9
Opcode Fuzzy Hash: 0e304dd614a6f9ca4033ac9d39fa42456928fa71073cfc0d35f106c420fd2bf7
Instruction Fuzzy Hash: 110128217051200BC649667DA4223BF279B9FC6660758916BD246DF3D4CD744C0747E7

Uniqueness

Uniqueness Score: -1.00%

Function 0555A8AB, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3989b4825c59e4346e27938af138e98465b8ce2cdd05687f234b86f24ecca5a9
Instruction ID: e518b4cba2d1aa7efdf87df9e87637b4ccde8b4994e34b35c5b3bf82e54ca541
Opcode Fuzzy Hash: 3989b4825c59e4346e27938af138e98465b8ce2cdd05687f234b86f24ecca5a9
Instruction Fuzzy Hash: C001C430A082558BC715DA68C864A7FBFB2BB85221F154A6FD843A7241DA706D42C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 0555CA71, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac583185f324abdb271a198f773bd252716698cea6a8a4513733f4c07c02cf33
Instruction ID: ac0f77d2f6d1319f5ad661a2cd58dba58f47b28ba04bdad28213f1c30c894299
Opcode Fuzzy Hash: ac583185f324abdb271a198f773bd252716698cea6a8a4513733f4c07c02cf33
Instruction Fuzzy Hash: 151108307083949FC302DB38E4656293FAFFB8A721F5504AAF446CB255CA345C45C794

Uniqueness

Uniqueness Score: -1.00%

Function 02E4AEC0, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.468330170.0000000002E42000.00000040.00000001.sdmp, Offset: 02E42000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e42000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe0f068ff29e2690d34a81fdbd271c1f9bcf4037397669069b24c03cc868ec3e
Instruction ID: 6a1be3d3dc72c1f26c5b8c86afe89351ebfd9459f09d034fc3eaa4f2659fa0c2
Opcode Fuzzy Hash: fe0f068ff29e2690d34a81fdbd271c1f9bcf4037397669069b24c03cc868ec3e
Instruction Fuzzy Hash: 3111ECB5A08301AFD350CF19DC40E57FBE8EB88660F14891EFD9897311D371E9048BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0555E158, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd1c2d38bd42f75a4aa11c8a893a0a87a7565c950588e4e631835b6e5b0984be
Instruction ID: 3ac34eb1e8a36a16c7442a7c4473aa287c78edecb58557a8cda599ccaf810f2f
Opcode Fuzzy Hash: fd1c2d38bd42f75a4aa11c8a893a0a87a7565c950588e4e631835b6e5b0984be
Instruction Fuzzy Hash: CC01A235B002209BCB146BBA981892F7AEFFBC9664B50483AE906C7780DE718C4187E0

Uniqueness

Uniqueness Score: -1.00%

Function 055568C8, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a11ddc6032a9cf79e7cdf1c8e134076c4e183ed4be92f9a2abfea49f5240a1a9
Instruction ID: e733ad1db07cc981c964ba81b59fc73bb4c7148ad43fb82755182ea2415f54fe
Opcode Fuzzy Hash: a11ddc6032a9cf79e7cdf1c8e134076c4e183ed4be92f9a2abfea49f5240a1a9
Instruction Fuzzy Hash: C3012636B081D49BDB3092B9A4315FE7FF2B7852B0F8848BBCD4AD7641EA20090283C1

Uniqueness

Uniqueness Score: -1.00%

Function 0555A8B8, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 015db519307193c1a34c30f09506e980631517bb0fddd28144b3d2089cff9b33
Instruction ID: 92d629741c3879b568a59244fa2f21f3a65de5eb02ba887b20a10032c3785799
Opcode Fuzzy Hash: 015db519307193c1a34c30f09506e980631517bb0fddd28144b3d2089cff9b33
Instruction Fuzzy Hash: 2301F531A08118CBCB14DA98C8606BFBBB2BB84322F114A2FC917A7240DF716D02C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 05555740, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05228b64a941cec4e3ef5de4b10ab85c99bcfec6e9ed1fc9036d064dc56477f2
Instruction ID: 29df6ea9d6dba5e79d1e57aa986a86691a50164b240720fd8a46afbf3e9e9d6b
Opcode Fuzzy Hash: 05228b64a941cec4e3ef5de4b10ab85c99bcfec6e9ed1fc9036d064dc56477f2
Instruction Fuzzy Hash: 3A113C30A14305CFDB14DFB5E990BBE7BBAFB88390F60462BD905A6284E7359D41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0555AF30, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8775d7ec8642e76b4c3ad8dcdf0a2b989fb73b073b25debbcf02d884f8c682e
Instruction ID: 6585c9a0d5ad53bd9101d7fe2aa233c024179de2c18fa873f8e55a46defa9062
Opcode Fuzzy Hash: c8775d7ec8642e76b4c3ad8dcdf0a2b989fb73b073b25debbcf02d884f8c682e
Instruction Fuzzy Hash: 92017174E00205AFCB50EB79E806BAEBFFDFB44320F10412AE944D3240EB3459408BE2

Uniqueness

Uniqueness Score: -1.00%

Function 05557E30, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70185769c99c2eff50dfd9dfec36e38fdb2392e86f200b779309938cb3ec8e67
Instruction ID: ae0211a4e4bdb51f0dab15f2708b9d731e26aa3adfabc15b8f8d940ffa4a30a2
Opcode Fuzzy Hash: 70185769c99c2eff50dfd9dfec36e38fdb2392e86f200b779309938cb3ec8e67
Instruction Fuzzy Hash: 1C015231A14604DBCB28DA74C8646BFBBB6FB886A4F14487FC917A7640CF716D0187D1

Uniqueness

Uniqueness Score: -1.00%

Function 069203E8, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82f3f54210f926b8b1ea022818df2834d518c98227757a1082e8fa51324f1372
Instruction ID: beee077e65d049e793207dead10f3bb915eddc4c435a015cc7b312517e7f5910
Opcode Fuzzy Hash: 82f3f54210f926b8b1ea022818df2834d518c98227757a1082e8fa51324f1372
Instruction Fuzzy Hash: 0F01DB30D4D366CFD7954754A0087357BAAE765300F54C96AD48247D9AFB744C90C791

Uniqueness

Uniqueness Score: -1.00%

Function 05557E20, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1043009056a443fc3f2ebff5886196b572bb40846947d568f4bbc13b3c4babb9
Instruction ID: a3b6ac620de8ddc0a7c5b9e15bbc90aeaf93a8f71024f11ad2e80c7995b04a29
Opcode Fuzzy Hash: 1043009056a443fc3f2ebff5886196b572bb40846947d568f4bbc13b3c4babb9
Instruction Fuzzy Hash: D30180316286458BD728CA788565BBFBBF3EB887A4F1448BAC817A7651CB615C0287C1

Uniqueness

Uniqueness Score: -1.00%

Function 0555B0B0, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34dafdc421d0c088b057ffa06bbefaadf30369ef5b953357dc9eb828cda9e9ff
Instruction ID: 73c4f6c51aade326dfb4b73b13790622819d2d23cf8cbb1023d9b3c2a745f2fa
Opcode Fuzzy Hash: 34dafdc421d0c088b057ffa06bbefaadf30369ef5b953357dc9eb828cda9e9ff
Instruction Fuzzy Hash: 3E01B530300204CBC750A778E81A569BBABEB88330B44957AE907C7254DF359C028B91

Uniqueness

Uniqueness Score: -1.00%

Function 0555AF40, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8636ab3fbda8815c7a67bce7ef1fb09b7916c80a8576c0008cbb21658ec112b
Instruction ID: 146794d4402c6829473b6fb99f49802653c6f19bded08036f58407cab859a798
Opcode Fuzzy Hash: c8636ab3fbda8815c7a67bce7ef1fb09b7916c80a8576c0008cbb21658ec112b
Instruction Fuzzy Hash: 93012175E002099FCB50EBB9E8057AEBBF8FB48325F104536DA19D3240EB3559048BE1

Uniqueness

Uniqueness Score: -1.00%

Function 055505C8, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cb6c66178964f7c5556a00d975cd9182d500d0d6b84d0bf06a8c505b2da1aee
Instruction ID: 649e7b5d0146ef955381705047c1d46763dcb0768def6327390f16c6186be437
Opcode Fuzzy Hash: 3cb6c66178964f7c5556a00d975cd9182d500d0d6b84d0bf06a8c505b2da1aee
Instruction Fuzzy Hash: 54F0B46170012107CA49767DA42177F629F9BC8A517A4A52FE206DB3D4CEB48C0747E6

Uniqueness

Uniqueness Score: -1.00%

Function 05556E98, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 394c90dee9a4ad69a0914fa52228b61593230a20ae79d61c7a9f87617f8aa19c
Instruction ID: a1239a091a8920b79b0a2a84e9c3905f8c9d16e39e6844c12b7698b88a6cead6
Opcode Fuzzy Hash: 394c90dee9a4ad69a0914fa52228b61593230a20ae79d61c7a9f87617f8aa19c
Instruction Fuzzy Hash: 31012C72E002099FDF50DBB9E8517AABBF8FB88360F50417BDA08D3280EB3459458BD1

Uniqueness

Uniqueness Score: -1.00%

Function 014605D1, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.468086206.0000000001460000.00000040.00000040.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9404de6e51dcec9ffc44c65a9fd260ac4225863e24e45bc80e6d9b3078a1c4d
Instruction ID: 55c74a13caf93cd93b15e16deba7f6f7d655f21d3a4dc488a8626b7a81d2bc42
Opcode Fuzzy Hash: b9404de6e51dcec9ffc44c65a9fd260ac4225863e24e45bc80e6d9b3078a1c4d
Instruction Fuzzy Hash: 4BF0F9B65083805FD7128F16EC40862FFF8EE86230749C1DFED898B612D225B908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 05551218, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f666007efaac81818e878b7cd48acb6a13ce34e8352976ea2b7166e048d5da3
Instruction ID: 30cb81224def9fe17cae63faba190017d7c18a23461fc87be5d79367539200ec
Opcode Fuzzy Hash: 1f666007efaac81818e878b7cd48acb6a13ce34e8352976ea2b7166e048d5da3
Instruction Fuzzy Hash: AF014B30304510CBC604DB69D068A6E7BEBBFC9720B6445ABE946CB364CEB59C09CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0555AB91, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f35d5aed6441136583e34d775bb3e5d17c62b8a6dfeecf1ef1e94d0fb4506e5
Instruction ID: 99cc5a413fc39df69ee46a53dea72bf7fe2469c4d9d8aa5f0016749079ab4387
Opcode Fuzzy Hash: 8f35d5aed6441136583e34d775bb3e5d17c62b8a6dfeecf1ef1e94d0fb4506e5
Instruction Fuzzy Hash: CBF03634F002549BCF04EB74DD91AAEB767FF88714F109A66D5059B284DF749D019BD0

Uniqueness

Uniqueness Score: -1.00%

Function 05558A28, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5fcb6595effa9de7f6c006f6853e3e7a63366da759e7e0c1f06b547c13037d0
Instruction ID: de5409307271ebb0a05350f5c497cb0bb041898d534b97eaa596d4b1002362b8
Opcode Fuzzy Hash: b5fcb6595effa9de7f6c006f6853e3e7a63366da759e7e0c1f06b547c13037d0
Instruction Fuzzy Hash: CB0108B5E042099FDB14DFA9D490AEEBFF2EF88310F2080AAD814A3345E7345A41DF91

Uniqueness

Uniqueness Score: -1.00%

Function 05555CD0, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9b318ed46a98e8200373d1181cb46de68eeb64fad755863814eadd370bb4c92
Instruction ID: 258f80c0c88a8a40b2c3d89910f515eaf4e84c61cff365815e861133e198ef0b
Opcode Fuzzy Hash: d9b318ed46a98e8200373d1181cb46de68eeb64fad755863814eadd370bb4c92
Instruction Fuzzy Hash: 44F04F72E051149F8B40EB7C945569E7BF6EF89724F15417AD808E3241EB349A028BD5

Uniqueness

Uniqueness Score: -1.00%

Function 0555B0C0, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e18134b5c12d0d9d80e5841ee7a4f289436934141cbba12b2f5d98e4432c6a4
Instruction ID: d59aa60efc4f89deb54e957f6b15a0730a5183b02ed1d7a7eee281293c2b8c8f
Opcode Fuzzy Hash: 9e18134b5c12d0d9d80e5841ee7a4f289436934141cbba12b2f5d98e4432c6a4
Instruction Fuzzy Hash: A9F03130700204CBCA44EB79E429569BBABEBC8371B54957AEA0BC7354DF71AC069BD1

Uniqueness

Uniqueness Score: -1.00%

Function 0555A681, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8f19ef92a42865a751e685f91ca13bd231aba7454b10ed5937754b4103f6680
Instruction ID: adbb8471f815c2363301f638bb5e6eb5cdf2a300c7ea742994a89bbf9ea37ed8
Opcode Fuzzy Hash: f8f19ef92a42865a751e685f91ca13bd231aba7454b10ed5937754b4103f6680
Instruction Fuzzy Hash: A4F086316092448FC7065778F4285583FB3AFC622531985AFE186CB262CE715C0AD791

Uniqueness

Uniqueness Score: -1.00%

Function 055555D9, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fe7cfd2007dbe28aecea50b396a46f0a02c0da01684a9ad27903a5e43e06824
Instruction ID: bb418bf591c323837b618bb1120fc9dff98293daf3ddf6347605c3bdcde24f6a
Opcode Fuzzy Hash: 5fe7cfd2007dbe28aecea50b396a46f0a02c0da01684a9ad27903a5e43e06824
Instruction Fuzzy Hash: 1EF0A7327151845BCB12497DA8616FFBFB6EFC5230F1840B7D959D3641E921442786A0

Uniqueness

Uniqueness Score: -1.00%

Function 055568D8, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78a1894beb02d59900bd7aea70c65ab366f96f76fcc2813a76ff625d71d86ef5
Instruction ID: 45a0520728de2360f73087482b74e7617608095e8f593066f83656a35fa49f16
Opcode Fuzzy Hash: 78a1894beb02d59900bd7aea70c65ab366f96f76fcc2813a76ff625d71d86ef5
Instruction Fuzzy Hash: 6BF0B430B0419596CB10D26998306BF7BF7B7C5670F8008678D069B280EA241A0142D6

Uniqueness

Uniqueness Score: -1.00%

Function 0555EB59, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62d1f0b5cf5d398ee669d3bafbd042029a431758bd25f0f010a4b89e2ae87e50
Instruction ID: c7eb53b3323688d1b82a51d974d73c3f455c3fbfd38f891b5d802dfe3eda5894
Opcode Fuzzy Hash: 62d1f0b5cf5d398ee669d3bafbd042029a431758bd25f0f010a4b89e2ae87e50
Instruction Fuzzy Hash: 7BF09E7290D3901BDF324168A86A3A56F9E7F86233F0809FBDCC7DB543C4100A4C83A2

Uniqueness

Uniqueness Score: -1.00%

Function 055587B0, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed4cd734c97657f5f854a881fba658259ccd9581500e47208d2180e1d6de18ad
Instruction ID: b6f8faa9a9ddb20d925ddad6e34968d5bd154b12c1ed510bedcc10ae08b060ee
Opcode Fuzzy Hash: ed4cd734c97657f5f854a881fba658259ccd9581500e47208d2180e1d6de18ad
Instruction Fuzzy Hash: 5BF02431A2C145CFC700C77488A48FFBFB2FF85220B2448A7E942EB121D2368902CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0555CD58, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b31bbbb3acbe5c48bb9c03b0f2d5cbb8812e3f798efa2ef44361d273b5871ac
Instruction ID: f936725f8604a8877312a9128e0b6f5e95f16ddd99799d942feff8c895449cb3
Opcode Fuzzy Hash: 3b31bbbb3acbe5c48bb9c03b0f2d5cbb8812e3f798efa2ef44361d273b5871ac
Instruction Fuzzy Hash: C0F0AB727451202B825962AD0824A3F7BEBABC0B7036A007BFD85D7740CE21AC13C3F9

Uniqueness

Uniqueness Score: -1.00%

Function 05559F80, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9820ed4c7834a1bf0b8ab0b33771870f71415f3a351dca62995ee5e7545864b
Instruction ID: a7f0a78fc9d5921ddac6877fed8ffb7515f94aeac7f0e8d6c818dc39ddc395aa
Opcode Fuzzy Hash: b9820ed4c7834a1bf0b8ab0b33771870f71415f3a351dca62995ee5e7545864b
Instruction Fuzzy Hash: C1F0ED3274C216DF8B0BD558B8280A9B77BFE812323008877FD0ECA540F92A6808C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 0555FD08, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c6f4955afe13aaffc2cd2cc6b4694c1353c82ff4071607e339289c4254717d6
Instruction ID: a6650e4674239aad632969975a304e846029a90a8e29f65c1ad6af3f978a06ea
Opcode Fuzzy Hash: 1c6f4955afe13aaffc2cd2cc6b4694c1353c82ff4071607e339289c4254717d6
Instruction Fuzzy Hash: 72F0A7B120D7868EC3269A149430C757B77BD421313545C9FCE838F956C665B84387D2

Uniqueness

Uniqueness Score: -1.00%

Function 055545B9, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37bddd18f4374cf43c6226506f627b5e415dc1e132aa41d7982801b5f3d1f551
Instruction ID: 9d5fe018f239d28c8d760b1938f9fa26c68d905de25a64f30f6ed0c1e406ef8d
Opcode Fuzzy Hash: 37bddd18f4374cf43c6226506f627b5e415dc1e132aa41d7982801b5f3d1f551
Instruction Fuzzy Hash: CCF0B430E052955FCB51CBB89852AFABFB8EF89210F1440AAD558D7142D52019168761

Uniqueness

Uniqueness Score: -1.00%

Function 05550908, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b262dd1b1a039a27076920b124876bf161572a78fb3f1e02cc27accd6f77a4
Instruction ID: c39f41d2cda2a62fc811ee13d1be96f61dcb5e4399777abe3f608a2115fbd051
Opcode Fuzzy Hash: 77b262dd1b1a039a27076920b124876bf161572a78fb3f1e02cc27accd6f77a4
Instruction Fuzzy Hash: 24F027309192848BE3909AB58C3C5AB7FBBABC6320B060C978D43572A5C9745C0782D1

Uniqueness

Uniqueness Score: -1.00%

Function 05556878, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be9f509f1a27ac3330055118cd49a47c6ce22857d2f5ed5660446b869a97eb17
Instruction ID: 86cb7582f2db8e1561e9d5ecb26256fb1b93ab301953f6a986fe41585a70b366
Opcode Fuzzy Hash: be9f509f1a27ac3330055118cd49a47c6ce22857d2f5ed5660446b869a97eb17
Instruction Fuzzy Hash: B0F05537A8C0808FDB1016B974301FC7BEAFB80170B4808A3DE0AD3601CA1108538792

Uniqueness

Uniqueness Score: -1.00%

Function 05554700, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aa227bede145cc25bbc4fadd603a285144b5c0f09056781934be880bfed2737
Instruction ID: 76386b65e44b4c29dadf6fd5d1fdf199f95384b3f549b4c9f1865cd008466e78
Opcode Fuzzy Hash: 1aa227bede145cc25bbc4fadd603a285144b5c0f09056781934be880bfed2737
Instruction Fuzzy Hash: C4F0E532319190DFCF2242B86470BF93B66EBC7270F1904FBE946CB652E51648838390

Uniqueness

Uniqueness Score: -1.00%

Function 05555E20, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02e7819f884224ea01e0447c377452cec2e323aa3e8c2f4b77b8170060f5776
Instruction ID: 2deb4310bbe12146a2b27694082b58031b5cb8f196f30dc9d01fa5857b7be758
Opcode Fuzzy Hash: b02e7819f884224ea01e0447c377452cec2e323aa3e8c2f4b77b8170060f5776
Instruction Fuzzy Hash: 8DF05E71F811054ECF60EBB9A8196EEBFF9AE44224F50017BD90DD3500F63086158BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0555EAD8, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 946d978da69071344bcfaaad165d8a4f843c7b73de9e2bcf7963f5b39982a689
Instruction ID: 8461953a34a1bf4fbc75ab877570be1de765d4d1302de5aa9479dc1e9fa0611f
Opcode Fuzzy Hash: 946d978da69071344bcfaaad165d8a4f843c7b73de9e2bcf7963f5b39982a689
Instruction Fuzzy Hash: EBF02E302452905BC312C778D42145B7F6AEFC363031488DFD84ACB302DD71AD05C790

Uniqueness

Uniqueness Score: -1.00%

Function 06921318, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95a899ffd47678f968f9f416a25feb0f2ae14be9a3725ba5a3e675b29be7166f
Instruction ID: 6055de69d84c92fa37ad23d4143ec92d6b88c9893baa3d77043b11ca60b1fd57
Opcode Fuzzy Hash: 95a899ffd47678f968f9f416a25feb0f2ae14be9a3725ba5a3e675b29be7166f
Instruction Fuzzy Hash: 43F0EC216893E00FC7178378A8121AE7FAA9B8212431984CFD088CB693CA224C0BC391

Uniqueness

Uniqueness Score: -1.00%

Function 05550918, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac22ca948c767f00534858612dca31e021c04d0ca606b65f3885cb7024329619
Instruction ID: 1e66ee97690a51e3949d2c4c97a65861768c1ff834ce10bdb053b18169ce35dd
Opcode Fuzzy Hash: ac22ca948c767f00534858612dca31e021c04d0ca606b65f3885cb7024329619
Instruction Fuzzy Hash: D7E0E532F152189B9B5099F9D8285AFBBBAB7C5770F004C279E07A3294D9708C4542D1

Uniqueness

Uniqueness Score: -1.00%

Function 05558C30, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3300f9befc53932747d2571337fff1c59bdd19a3c78471bf70de764a330b009d
Instruction ID: 8f7e303f262167a0b2724f34c64bfd79330045aaf52b3bb5436c422924f7b533
Opcode Fuzzy Hash: 3300f9befc53932747d2571337fff1c59bdd19a3c78471bf70de764a330b009d
Instruction Fuzzy Hash: C2F0A731E6A3604FDB1616A4D5294647FA9FF0D3E2B154997EC46DB700CA208C41CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 05556120, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28f543b4e15b35064405531a68936ba098a2b430902fcf8dc8a9d6cec6f2f90c
Instruction ID: 3830ebf3f787953e431622637d17fe42823c4b3627a0c95ed41676145dd7a074
Opcode Fuzzy Hash: 28f543b4e15b35064405531a68936ba098a2b430902fcf8dc8a9d6cec6f2f90c
Instruction Fuzzy Hash: 6CE0E5307491D11FC716527D6460669BBA78BCA311B1588BBE185CB291CC615C0387A5

Uniqueness

Uniqueness Score: -1.00%

Function 0555E599, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab5458a7eab5320578f0cf26e6def5f6cfd8563628a89fb2e3ff8c97b397a690
Instruction ID: 7266aef171343d85fd60090743719d0dc3d9b363c9c6b5a969e45b9122601d78
Opcode Fuzzy Hash: ab5458a7eab5320578f0cf26e6def5f6cfd8563628a89fb2e3ff8c97b397a690
Instruction Fuzzy Hash: DFF0A7312492914FC322D73CE52146E7FAADEC257031888EFD48ADF752DD619C0AC791

Uniqueness

Uniqueness Score: -1.00%

Function 055546A9, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6513449a3a0bb97680ff0f75b17dba3c92429c366061608fba015622fe448c3b
Instruction ID: 07fceaada03aeb3f7ed947c069277412df260eeac0c49fbca14cb9831466473f
Opcode Fuzzy Hash: 6513449a3a0bb97680ff0f75b17dba3c92429c366061608fba015622fe448c3b
Instruction Fuzzy Hash: 79F0EC207441909FCB1157F860745FD3FA2AF8121071444D7E446CB662D9168C1787C2

Uniqueness

Uniqueness Score: -1.00%

Function 01460938, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.468086206.0000000001460000.00000040.00000040.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525cef522958239b2deb72ab7ac90410e2832b06fb356f1b7ca8807ee3c9392c
Instruction ID: bbcad2a4417237d01650ec803055bd68b8e39708fe0db3922a27e226d36d6cc3
Opcode Fuzzy Hash: 525cef522958239b2deb72ab7ac90410e2832b06fb356f1b7ca8807ee3c9392c
Instruction Fuzzy Hash: 8BF03135104644DFC306DF04D540B16FBA6FB89718F24CAADE9490B762C337D813DA81

Uniqueness

Uniqueness Score: -1.00%

Function 0555FF18, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f36132c8478747553eeaffdefcb86d5b3be69927a89e27e20b6c711d025b271
Instruction ID: 25763a63efeb7dfab169515ed71e13b1c3f2daf91849f8555827082371256710
Opcode Fuzzy Hash: 8f36132c8478747553eeaffdefcb86d5b3be69927a89e27e20b6c711d025b271
Instruction Fuzzy Hash: B7F09A75900218EF8B41EFA8C8149EEBFF6FF09220B0084A7F958D6120E6318620DB91

Uniqueness

Uniqueness Score: -1.00%

Function 05555FD0, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b9fbfa5389ad36b7dc97fd3ea930c95ba4a89d9b96e3ce096468095980cdd4c
Instruction ID: 9ab5f97adb7951046746ada3e4c2d25c96eaade52c29de5d2fc557b60fe553ae
Opcode Fuzzy Hash: 6b9fbfa5389ad36b7dc97fd3ea930c95ba4a89d9b96e3ce096468095980cdd4c
Instruction Fuzzy Hash: 27F03A71D4524A9FCF50DFB998465EEBFF4EB89210F50447AD059E3202E23505228BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0555AFF3, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15763db7ac430f81da8299694842a3485049ead7677ad9858b3af8c5d5714961
Instruction ID: 6df7e650c5b44061da2e1ea0359438a1ee177c958fb330ae0d7fb24708437d58
Opcode Fuzzy Hash: 15763db7ac430f81da8299694842a3485049ead7677ad9858b3af8c5d5714961
Instruction Fuzzy Hash: 5DE02B207083649FC7426678743D5697FEA6BC637030400A7E817CB362ED359C1153B2

Uniqueness

Uniqueness Score: -1.00%

Function 0555A698, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 287545c99ef290de3b53114833a08fa7789462f0470188e1642af346e140d569
Instruction ID: eead5b72cf9917f4825159856ab4b3c06ab7d23a298757cc24959e9554dcd1f7
Opcode Fuzzy Hash: 287545c99ef290de3b53114833a08fa7789462f0470188e1642af346e140d569
Instruction Fuzzy Hash: 14F0A731300104CB8B05966CF4245693BA7EBC5326354C53EE20AC7310CE729C06DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0555E5E8, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 457433ed4568a78479e967b64680351002c3fa42c35fb2c437a8961b300ca434
Instruction ID: d29ae12266b915cc234dc7ecf04a10ab77cdaf9613a66777accfcdebc1f91736
Opcode Fuzzy Hash: 457433ed4568a78479e967b64680351002c3fa42c35fb2c437a8961b300ca434
Instruction Fuzzy Hash: FEE09B3100D3A08AC726565478375B5BB7EBA061B17184CDBD8C6C6402C511698887D2

Uniqueness

Uniqueness Score: -1.00%

Function 0555D08E, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 664a4be95ac80f1ac7558715a1b0a45bcadcfd59f8a8eeb9db69513456366197
Instruction ID: 7714a7a17f76a4e3e8f0e865b08aae1df6927b4ce44df4a18dd6fc317bc87e9e
Opcode Fuzzy Hash: 664a4be95ac80f1ac7558715a1b0a45bcadcfd59f8a8eeb9db69513456366197
Instruction Fuzzy Hash: 44E0222770C1848BC716A239903047C7BB7AAC21B2319089BC942CB271EC529D06D3D3

Uniqueness

Uniqueness Score: -1.00%

Function 055557A2, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c3f85edd6ab9256666faaf117c8083529c2622f946df5b60c4d5d86f071fcd
Instruction ID: f36f808d8f1ae843d468399e0e70e9b1ead00db4831443348f2f228744c5751c
Opcode Fuzzy Hash: 35c3f85edd6ab9256666faaf117c8083529c2622f946df5b60c4d5d86f071fcd
Instruction Fuzzy Hash: 25F0A034F54104CBDB44EBB8E8603BD7767BF84620F608A67DA069A180FF24080587D2

Uniqueness

Uniqueness Score: -1.00%

Function 055577AF, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97df9f95af06111d8fc116619b3539a0b4e955cdb9f6d5065b928d571d779931
Instruction ID: 67ca7178223c2e29a3b99120e28c5aeaa335ae60c45c82231255ed910ae614ef
Opcode Fuzzy Hash: 97df9f95af06111d8fc116619b3539a0b4e955cdb9f6d5065b928d571d779931
Instruction Fuzzy Hash: 05E06538F411514BDB04B3F998343AE6796AFC0524F9009BACA1ACBA80EF104D028796

Uniqueness

Uniqueness Score: -1.00%

Function 014605F6, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.468086206.0000000001460000.00000040.00000040.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e39b969a78610b2e203ace16ca5531a367f7e7df1ca0a3b0de8d131b65434af
Instruction ID: 7e323de24f6dbd777c08cbe84d95640c1034473ea0d51176d53488a157aeac3f
Opcode Fuzzy Hash: 7e39b969a78610b2e203ace16ca5531a367f7e7df1ca0a3b0de8d131b65434af
Instruction Fuzzy Hash: BBE092B6A006008BD650DF0BFC41452FBD8EB88630B18C17FDC0D8B701E239B504CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 06920A95, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39787dda5538f5c5088ec2d747fb436e457a88eb456fb99ef8a263245686f810
Instruction ID: 85f852ef64e9fdad9f8c180622d34b62471f330507a8ab3b12f29e4c10ed3284
Opcode Fuzzy Hash: 39787dda5538f5c5088ec2d747fb436e457a88eb456fb99ef8a263245686f810
Instruction Fuzzy Hash: 8BF0A031E942A5CFEB608665F80CBA8B7A9BB84328F648492E409934C4C7B44CD0CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05556130, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd6d4ede852a0c306a902bc943c3cc2c4502b0b6470c52f6518da1dda336a398
Instruction ID: b8671a63b765320e93c7b3d13eee50cac9653f614a5c933e9aa92f08faee4398
Opcode Fuzzy Hash: dd6d4ede852a0c306a902bc943c3cc2c4502b0b6470c52f6518da1dda336a398
Instruction Fuzzy Hash: 8FE0863174025567D615A17D642072EF3DF5BC9765F60483BA60A97380CC62AC4247EA

Uniqueness

Uniqueness Score: -1.00%

Function 0555E5A8, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3eb7cb2808277af7ba924ff921cbc4f6a428cd34890f83ff3e950c361b342f8
Instruction ID: ec09f2495e8a68a3805c956e76d8fd01aae95501d35bedde8fc041048bb633ad
Opcode Fuzzy Hash: a3eb7cb2808277af7ba924ff921cbc4f6a428cd34890f83ff3e950c361b342f8
Instruction Fuzzy Hash: F1E0D8312401104B8224D65CE52196F779EEBC1670354C8AFD90ADB344EE72ED0287D0

Uniqueness

Uniqueness Score: -1.00%

Function 05558C40, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 483ed53de33fe7940967e722c33663b265fd3fb93508a099a441e29777e6a749
Instruction ID: f41384c77da1568ee51fff367f5ee93ce389424f68cdd2a4c681eec07ecfa98a
Opcode Fuzzy Hash: 483ed53de33fe7940967e722c33663b265fd3fb93508a099a441e29777e6a749
Instruction Fuzzy Hash: 29E09231F662308BCB645AA8E0285357BEEFB8C7A1B25496BED07D7344DE308C018BD1

Uniqueness

Uniqueness Score: -1.00%

Function 0555EAE8, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2a3f96ff0c3b7c223c88d8c12e1a2f35ea4331b0cfad307ee2f392b4958e8f2
Instruction ID: de4d131f09eeba90a62849a7de84f5bb3df9535aeb5ee1a50c4fb98a26d9c3a2
Opcode Fuzzy Hash: d2a3f96ff0c3b7c223c88d8c12e1a2f35ea4331b0cfad307ee2f392b4958e8f2
Instruction Fuzzy Hash: 85E0D831250110478215D65CE42186B7B9EEBC1631314C86FD91A8B304DE72ED068BD0

Uniqueness

Uniqueness Score: -1.00%

Function 02E4AF0F, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.468330170.0000000002E42000.00000040.00000001.sdmp, Offset: 02E42000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e42000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9b7b71b9987714a388f1f64af750dd185158c8af76a0ab570b1fe62956ac336
Instruction ID: 016ef12ea602f91cc00a67f08b15a9bf178ec09fe4a81d3475525dabc2c6dc9f
Opcode Fuzzy Hash: f9b7b71b9987714a388f1f64af750dd185158c8af76a0ab570b1fe62956ac336
Instruction Fuzzy Hash: 98E0D8B29003046BD2209F0AAC41B63FB9CEB80A30F14C557EE0C1B302D275B5048AF5

Uniqueness

Uniqueness Score: -1.00%

Function 0555B6B8, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5094a59ff33ca2c8e95ed5601401df175ed67851e6742a52ed109ac4315003fc
Instruction ID: 6e1aaa3a1684a0cc704a0af915b9dcccb226da7de8aed0cad555e241dd4d2f1f
Opcode Fuzzy Hash: 5094a59ff33ca2c8e95ed5601401df175ed67851e6742a52ed109ac4315003fc
Instruction Fuzzy Hash: DDE026322193C45BC3210A68DD1A84E7F78F9C327130800ABE881D7512C535A845C7B6

Uniqueness

Uniqueness Score: -1.00%

Function 05558AAA, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a939ea813c21627c68fc4663f48938c4534ca427b7fcc1412ab44629653e3c
Instruction ID: 84add866e2724a8b80e270e8ce81ca9ed8983ec71e36cc38104eae32566a6744
Opcode Fuzzy Hash: e9a939ea813c21627c68fc4663f48938c4534ca427b7fcc1412ab44629653e3c
Instruction Fuzzy Hash: C3F0653160938DCFC700DB18E8A58693F6DFA45335B68D997FC058B915DA746D078781

Uniqueness

Uniqueness Score: -1.00%

Function 0555FD18, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb0f10b51c2653d93a66e8d6e7c0aefb6a31f08c5e816d73a6e883a77fe3f3e4
Instruction ID: bd87438ebb85bc5759d5d1b9fec445b323f530efe6acca8fff75721fe8ebcf6d
Opcode Fuzzy Hash: bb0f10b51c2653d93a66e8d6e7c0aefb6a31f08c5e816d73a6e883a77fe3f3e4
Instruction Fuzzy Hash: 9DE04FB120970ACB8368E951853483673BBBE401713804D5BCE434EA54C6A1F84386D2

Uniqueness

Uniqueness Score: -1.00%

Function 055589D9, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67a99e1643695729a7e9921d28fa16051ae4472f4c7e076ce0d4a7678de7618
Instruction ID: 2c5513c5423aa9438ac421a8bc7c1a5d373bee3754481a6af128f395f7b1c4d4
Opcode Fuzzy Hash: b67a99e1643695729a7e9921d28fa16051ae4472f4c7e076ce0d4a7678de7618
Instruction Fuzzy Hash: DAF03978D04208DFCB04EFA8E159AADBBF5EF48300F20D1A69C1493342E7301A40EF81

Uniqueness

Uniqueness Score: -1.00%

Function 0555D0A0, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2641f3360a5b8dc21960ce261c7424023d154a0496ec71909d81223dc947b79
Instruction ID: 44d3952ed3acd3d1e162b0dad67d8bdd2d49868c5ab959f493836d9dbe0527d0
Opcode Fuzzy Hash: d2641f3360a5b8dc21960ce261c7424023d154a0496ec71909d81223dc947b79
Instruction Fuzzy Hash: DFE0C227308018D74914B12E503087E73ABBAC5672354442B9A078B330ED92AD1283D2

Uniqueness

Uniqueness Score: -1.00%

Function 055589E0, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45e034350917267429aa776b1ae4e06cf45032ca4a633773146746f0fe356ff4
Instruction ID: 640e87ec7ab1df3e3f0df20824ba363e0f2a03fc3e760e6bdbfe4e380326cb86
Opcode Fuzzy Hash: 45e034350917267429aa776b1ae4e06cf45032ca4a633773146746f0fe356ff4
Instruction Fuzzy Hash: BAE0ED78D04208DFCB04EFA9E1556ADBBB5EB48314F20D1A69C1593341DB305A40DF81

Uniqueness

Uniqueness Score: -1.00%

Function 0555C2D8, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc8487d424e5de32f175609e70ce29e4c58bf8b8685685b3e7e842c00a8ba8d2
Instruction ID: 67e616ee3e4d66df15e0c5b226f531d499961a7e331b72fa0d657fa05b953072
Opcode Fuzzy Hash: bc8487d424e5de32f175609e70ce29e4c58bf8b8685685b3e7e842c00a8ba8d2
Instruction Fuzzy Hash: FEF09236204B049FC730DE5AD554C53B7F6BF897203518A5EE99A93A14C670F8048BA5

Uniqueness

Uniqueness Score: -1.00%

Function 05555DE8, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 917a7b889cb40201fba19aace6e247f85e0f41f20fbe39704fb1fccf0a665f97
Instruction ID: 211f12e2d207e9b67055cfd08d970d78e690593aa8cf7b8c65591f804a4e143f
Opcode Fuzzy Hash: 917a7b889cb40201fba19aace6e247f85e0f41f20fbe39704fb1fccf0a665f97
Instruction Fuzzy Hash: 63E0C7307AB0C00FCF26B2B868B00F92F628DC202038A09FBE4D6CB652EC044C0383E1

Uniqueness

Uniqueness Score: -1.00%

Function 05556459, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0848b3cfa0c85c8b8d7daed58ecd61e8ee7483a9ceb3f08c9720f1940b48e3d5
Instruction ID: b9f96d43e80ef4af12e6d5c3d93ef8f0c0be55ef7ad4cddd76861063b099951f
Opcode Fuzzy Hash: 0848b3cfa0c85c8b8d7daed58ecd61e8ee7483a9ceb3f08c9720f1940b48e3d5
Instruction Fuzzy Hash: 4EE07D313402281BC700D968A822DB7374F8BC0200700D48FA405E73D2CC33CC0387D0

Uniqueness

Uniqueness Score: -1.00%

Function 0555EB28, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebb47d5d56e9fdc97d2f8a686e57b21f87076fca12c2fff9154fc933886b1a9d
Instruction ID: ade659849fb9c6f331027933e2b028f521bc31755c1ca726da5665c15ed62e3f
Opcode Fuzzy Hash: ebb47d5d56e9fdc97d2f8a686e57b21f87076fca12c2fff9154fc933886b1a9d
Instruction Fuzzy Hash: 65E0863010F385CFC3268B24A4254B1BF7B6E061323184DDFD4CB87502C6615A49C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 05555D5F, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec47e05e429182ec4f493a8a50969e08e62ae2ac24ad2dec2cbd2590a1f3bf02
Instruction ID: fcbafcd8dd5d0c119601ccda0be8e17c6cae3015386db41578b74849c9633e41
Opcode Fuzzy Hash: ec47e05e429182ec4f493a8a50969e08e62ae2ac24ad2dec2cbd2590a1f3bf02
Instruction Fuzzy Hash: 1FE0C23224C2C48FCB228B3564B52E93FA9EE5213031940E3CC8D8F412E2114117CB11

Uniqueness

Uniqueness Score: -1.00%

Function 05550170, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d4e80e66a1eca8d043eece63882d5245c004fcf60e82c98be1887b1fa7e9c8e
Instruction ID: 694ec2e6c8f5623139950b9c9b8073cbc8976b858ca91d7fc92e4fae07308527
Opcode Fuzzy Hash: 0d4e80e66a1eca8d043eece63882d5245c004fcf60e82c98be1887b1fa7e9c8e
Instruction Fuzzy Hash: EAE0C2705893908FCB0617B0D4194643FA8DF4B20034448FED4418BA62DA36D893C600

Uniqueness

Uniqueness Score: -1.00%

Function 05556888, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9099b1e603e7d30c6cb629e8f49dd3d49c948ff408852b765398ecab2bdd6c23
Instruction ID: 8c31af4117ac38bad70ff110d1ff9d909c28886626f65374a61f7e1862d62c96
Opcode Fuzzy Hash: 9099b1e603e7d30c6cb629e8f49dd3d49c948ff408852b765398ecab2bdd6c23
Instruction Fuzzy Hash: BDD02B35A8C05187EB006295643066832CEBB80670FC80C27DE0BD3240CF848C8143DB

Uniqueness

Uniqueness Score: -1.00%

Function 05558AB8, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4965517e61c10e358af26f19b04fd3adb664fc55bfd01b32a0aad33fb551bd27
Instruction ID: 73c9369ee309cbb0383ecf07088ea3790cc57e72234f9cd7c1ca7fdb6089a4c7
Opcode Fuzzy Hash: 4965517e61c10e358af26f19b04fd3adb664fc55bfd01b32a0aad33fb551bd27
Instruction Fuzzy Hash: DCE0BF3160830ECBC700DB18E8958693B5EF754335FA49E67FD158BA14DBB1AD4687C1

Uniqueness

Uniqueness Score: -1.00%

Function 055502A0, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ef590dcf0464986775aae9c1e51039971d3de2de57d57db85e202efd1b145a6
Instruction ID: 280b4b533eac55855f670f1a58a4a46807523cd7b9fd8fd18490cf32a6e1ad42
Opcode Fuzzy Hash: 5ef590dcf0464986775aae9c1e51039971d3de2de57d57db85e202efd1b145a6
Instruction Fuzzy Hash: 0CE0C230509240CFC35193A9E8698827FF5BE4B320344CE8FD48687A55C6207C028741

Uniqueness

Uniqueness Score: -1.00%

Function 06921328, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8848783eebddae78df232b39a4a7588ac0690f6cd48015ad8e9a10d69eb9752b
Instruction ID: 6a349dc5f3e44bca46b6165ecde4c5f4d009dd2a4cf0c99ccac8eac4a0e96cd9
Opcode Fuzzy Hash: 8848783eebddae78df232b39a4a7588ac0690f6cd48015ad8e9a10d69eb9752b
Instruction Fuzzy Hash: A3D0A721380124175504E6ADE85187B738FDBC5514308D86FB909D7381CD729C06C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 055579A0, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71ce5b8f3674d08fd3a848675a8209d76a3eaf7a22835145cc648f537cdf4a9
Instruction ID: 2cee4deccc653bd699eb3021b7e0b09e0804611cf9727c5dcbabdbbe8d60810c
Opcode Fuzzy Hash: c71ce5b8f3674d08fd3a848675a8209d76a3eaf7a22835145cc648f537cdf4a9
Instruction Fuzzy Hash: FDD0123102D750DBDB358A699414A62BBBEFB497B4F040D5FC98705950C661E484C3F2

Uniqueness

Uniqueness Score: -1.00%

Function 0555A850, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71ce5b8f3674d08fd3a848675a8209d76a3eaf7a22835145cc648f537cdf4a9
Instruction ID: 86578d3e3c7d35fc272b32722411e591b0f6a05887601899066b68a6bd047db1
Opcode Fuzzy Hash: c71ce5b8f3674d08fd3a848675a8209d76a3eaf7a22835145cc648f537cdf4a9
Instruction Fuzzy Hash: E9D0C2314087509BD3368A65D420772BAEA7B45726F044F6FC843069208663E086C3D2

Uniqueness

Uniqueness Score: -1.00%

Function 05556468, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f25ac24bec1e7edab1efa6b551d31b12baf22e4b61d075924147972596ac16b
Instruction ID: 169d0817c61b32a1451493af9d68735e823850beb895e32e9aeaa809e0a518b4
Opcode Fuzzy Hash: 7f25ac24bec1e7edab1efa6b551d31b12baf22e4b61d075924147972596ac16b
Instruction Fuzzy Hash: 43D0A731380124179904E6ADE86187B738FCBC5514314D85FB909D7381CD72DC02C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 055557F6, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a093c61927be3188d49ff1dde866d72fd620801f941fe978e9bc9b9050e9a75d
Instruction ID: 191fad1b1c3f7aaf87f1362a9679140df6e317b7baaa44a91763810896552edd
Opcode Fuzzy Hash: a093c61927be3188d49ff1dde866d72fd620801f941fe978e9bc9b9050e9a75d
Instruction Fuzzy Hash: 45D01239F44004CBCB44E7E4E9251ECBBB3BB84535B605977C60796100EF20145687D2

Uniqueness

Uniqueness Score: -1.00%

Function 0555064F, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eee85db253f7c4a1b8981b9562f00f2cbe63b671e22bc16c27b9914128229f6f
Instruction ID: e35e1fa197f70c63fe70304f524725436187d1c71d6067a42d699e4cbf9f95fd
Opcode Fuzzy Hash: eee85db253f7c4a1b8981b9562f00f2cbe63b671e22bc16c27b9914128229f6f
Instruction Fuzzy Hash: 31D0A77248D2808FC31646711C2E5F97B95DF933107408CE7CC4006532863679A796D2

Uniqueness

Uniqueness Score: -1.00%

Function 06921270, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62db2335ec0dbf69b95becea319c615f03da0b7c1dd96c072390882c2a0a251
Instruction ID: 7e7f0f0e2ffa030a2c00547c8047ba8be85837f34e5849bd720e679dc21342e6
Opcode Fuzzy Hash: a62db2335ec0dbf69b95becea319c615f03da0b7c1dd96c072390882c2a0a251
Instruction Fuzzy Hash: CCD0E2A044C23BCFFBD04148910433173589787215E258E67B707C5C4D86664C7389DB

Uniqueness

Uniqueness Score: -1.00%

Function 0555E5F8, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 052686576206e722149fb79e10b0a9839182f13c6e1047b62cf5bceebca04200
Instruction ID: cedfeeaa1340cd221812bd3c1dda87cf28949f7412c2f80add70403acd01d75d
Opcode Fuzzy Hash: 052686576206e722149fb79e10b0a9839182f13c6e1047b62cf5bceebca04200
Instruction Fuzzy Hash: 0CD05B31104224D7C6699A54B436572B29EB7095B1B004C9BEC4B82100C921F90587D1

Uniqueness

Uniqueness Score: -1.00%

Function 02E323F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.468296113.0000000002E32000.00000040.00000001.sdmp, Offset: 02E32000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e32000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95a1c532f938d5e08891c82923a76983f50e32d022382714d39c9dce687127de
Instruction ID: 8cf9cfe1f68d0801016ed7528fb4fa8b159652d8e419f1943fd45111bbd7fef9
Opcode Fuzzy Hash: 95a1c532f938d5e08891c82923a76983f50e32d022382714d39c9dce687127de
Instruction Fuzzy Hash: D1D05E79255A818FD3278A1CC1A8B953B94AB51B19F4684FDEC408B663C368E981E200

Uniqueness

Uniqueness Score: -1.00%

Function 069212E8, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af4fc61a2c3e8aed6e22ee93be25f71904ec81c3a43abaa5e8456e439168cd59
Instruction ID: 0772f4b40732ee0c42d19e027986802c4a96047fe9f0f92ad659ec3213fc848f
Opcode Fuzzy Hash: af4fc61a2c3e8aed6e22ee93be25f71904ec81c3a43abaa5e8456e439168cd59
Instruction Fuzzy Hash: D9D0A72002C22BCAE3407664B009A383EDA3700642B004C12E24680C58CE918C20F7A3

Uniqueness

Uniqueness Score: -1.00%

Function 0555EB38, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbbdfd0a67dabf9f1c8b175aa6b2fbc93961cf8968c0a756d8b64f76a9e311d
Instruction ID: 83f462244dcd115d6ac9eea4c509f2cdfc325a78ed2ff56cae987e37ca02f7c6
Opcode Fuzzy Hash: 2fbbdfd0a67dabf9f1c8b175aa6b2fbc93961cf8968c0a756d8b64f76a9e311d
Instruction Fuzzy Hash: 4FD0A93000A208CB8324CA00E0224A2B36FBA012333008DABD85F03600ABA2AB058BC0

Uniqueness

Uniqueness Score: -1.00%

Function 055573F8, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a0939ec5680cffb9ecca245d0aafbbebb033a67d769e75d7ec85179cdc98f5e
Instruction ID: 475f668b4601d0f682e7bbaf491c5151d17b363b840b0a4baa8c326862b61b5b
Opcode Fuzzy Hash: 9a0939ec5680cffb9ecca245d0aafbbebb033a67d769e75d7ec85179cdc98f5e
Instruction Fuzzy Hash: 24D0423AA00004CFCB05DB88D5949D9F7F1FB88225F28C1A6D915A7251C732ED56CA50

Uniqueness

Uniqueness Score: -1.00%

Function 02E323BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.468296113.0000000002E32000.00000040.00000001.sdmp, Offset: 02E32000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e32000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6990a2a04b799cce017b0a05473b50d27829d678b8f34136b4363e0fdfe4b02
Instruction ID: 95e02d754b3a71126f6778ab8457f8d22aeb4a1c78223f633bfc73061c9d343f
Opcode Fuzzy Hash: d6990a2a04b799cce017b0a05473b50d27829d678b8f34136b4363e0fdfe4b02
Instruction Fuzzy Hash: 3AD05E342802828BC716DB0CC598F5977D4AB81B09F0694E8AD408B662C3A4DC81C600

Uniqueness

Uniqueness Score: -1.00%

Function 06921360, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f770bc8a9347c752ba7bb6e88713f9481381c3e7173d32088a9571f52029f526
Instruction ID: 8e17e20cd4fb6f3fccfb751b6015f34f9c29642bb99ace8b65140c11b632c31b
Opcode Fuzzy Hash: f770bc8a9347c752ba7bb6e88713f9481381c3e7173d32088a9571f52029f526
Instruction Fuzzy Hash: C3D0C91458E3C54ECF526BF0A42905C7F79199202075809DBC8C98B243DA28484AD7A2

Uniqueness

Uniqueness Score: -1.00%

Function 05555F50, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c6e144355ebae538be736c828acb0604256056f6d61a24bb4684c242c5aade2
Instruction ID: 7d50c90affddedfb1f45070b814e5095c1d0d66dab3a743e7b259e41cd477a61
Opcode Fuzzy Hash: 6c6e144355ebae538be736c828acb0604256056f6d61a24bb4684c242c5aade2
Instruction Fuzzy Hash: 96D0127428E7CD6ECB23A7F26816A663F796C43674B58C4DFEC49C6013F514D8098366

Uniqueness

Uniqueness Score: -1.00%

Function 05558116, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e588c9268c5b47d93957de3d2d5fcf31de5d1fde4cd21f004e9d45b6e790b4ff
Instruction ID: 7eb3a04e649fdbdcd15eb3af5b856115b2d400fc06068635f76730b88608f1ff
Opcode Fuzzy Hash: e588c9268c5b47d93957de3d2d5fcf31de5d1fde4cd21f004e9d45b6e790b4ff
Instruction Fuzzy Hash: 3ED05238E40209DF8B01CFB2E9204AD3BF1FB09220B201B2AD803AB380E7345D018B40

Uniqueness

Uniqueness Score: -1.00%

Function 05555478, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5f758741e042de293b6a44f0dc6f76fc5c26e4b383b4d55c16676e676582ada
Instruction ID: af495387e41096fadc08c69762052e71178db616d34d80ee9c42e9125c8d9e4a
Opcode Fuzzy Hash: c5f758741e042de293b6a44f0dc6f76fc5c26e4b383b4d55c16676e676582ada
Instruction Fuzzy Hash: A4D0C9388C8244CBD62257AA682D73D7BB9B740226FC44982EC0A80411EB2444E5D696

Uniqueness

Uniqueness Score: -1.00%

Function 0555CE68, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e56631f01702ce9c72b169e5064b5f005a4ed8effb725efa3a459c48f63ecddc
Instruction ID: ebb28e383623d93845fa21f92a8628dd6021c38a1f973b84d5dd03ce921ee6c2
Opcode Fuzzy Hash: e56631f01702ce9c72b169e5064b5f005a4ed8effb725efa3a459c48f63ecddc
Instruction Fuzzy Hash: FFD012718472548FD7439A28A4AD0283721FF9531D7A51C66D091E7151CA288452AE02

Uniqueness

Uniqueness Score: -1.00%

Function 05550180, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 699db59f940a4a3a633e36c4b0e03c5949a70dbf9e531746436d62afba5b64a2
Instruction ID: d1aefaf338fe8c0d6580fcb82f937912829bec6df509628337269617efebcf1d
Opcode Fuzzy Hash: 699db59f940a4a3a633e36c4b0e03c5949a70dbf9e531746436d62afba5b64a2
Instruction Fuzzy Hash: B4D01274680304CFCF082B71E01842833ADAB8A2053400C7CD90687740DF3AD8D1CA04

Uniqueness

Uniqueness Score: -1.00%

Function 05555D70, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42661f22eab25ad89af845ce8f1b59c6332e52287edfc0f1d94208bbc6da7c89
Instruction ID: 3f0c6a3457746de99521b0adeb2c637fe93c98d63f8bfaf855e54884ba75bce2
Opcode Fuzzy Hash: 42661f22eab25ad89af845ce8f1b59c6332e52287edfc0f1d94208bbc6da7c89
Instruction Fuzzy Hash: 28C08C316C0A098FCA0067B2682C63AB7A96B400153C00816AC0A8A400FF20845101D9

Uniqueness

Uniqueness Score: -1.00%

Function 055564A0, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c297b471622a4d54410fcaf5d61cb0d77b7db2591113b6a221b029468a3142d
Instruction ID: e35095497532c94f0cdc48d8a6d5f90a524ed616decd621e137b1484aad64d55
Opcode Fuzzy Hash: 8c297b471622a4d54410fcaf5d61cb0d77b7db2591113b6a221b029468a3142d
Instruction Fuzzy Hash: C2C02BC7C48BE4CEC3130550386F650AF4077D2022FCE0CDF84420B6C6F01D90048100

Uniqueness

Uniqueness Score: -1.00%

Function 05550660, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d900dc658c21609914a3810bb2055afa9f83de940091ccdc3b683b470ce2395b
Instruction ID: c6514283ab4a38e5d4515e360dcbf77c882129d967e96379cf4060caa0a35e53
Opcode Fuzzy Hash: d900dc658c21609914a3810bb2055afa9f83de940091ccdc3b683b470ce2395b
Instruction Fuzzy Hash: 92C02B300C5244CEC2049673280C43AB30AB7C1311340CC338C01001308F32F4B688E1

Uniqueness

Uniqueness Score: -1.00%

Function 05555F60, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13a02d15ead2e6f199f64d75682ab3a104ae9d2a1ecd31bfd2318876dbbb0cf6
Instruction ID: c6a108169a810ca40ee539d72bfc3d0ac695c6d0bbd769f190b71bfc29c64109
Opcode Fuzzy Hash: 13a02d15ead2e6f199f64d75682ab3a104ae9d2a1ecd31bfd2318876dbbb0cf6
Instruction Fuzzy Hash: 95B092746C4A09DB86506BB7691D66637DEBE089697840856FD0FC0001FA21986245A6

Uniqueness

Uniqueness Score: -1.00%

Function 06921370, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.474031759.0000000006920000.00000040.00000001.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6920000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e80fbc787dc88410a5bda0d80d1402d49701ef6aa77fb2b2eed83ef7e1ef582e
Instruction ID: 61bc346bb7ee2ac1b90f74d06ed909c4cb95bc9570b5402dab9cf11e230c7c3e
Opcode Fuzzy Hash: e80fbc787dc88410a5bda0d80d1402d49701ef6aa77fb2b2eed83ef7e1ef582e
Instruction Fuzzy Hash: 96B01234EC170C47DD8033F1641D11C738C2AC0420BC004A35D0D47300BE74A8554859

Uniqueness

Uniqueness Score: -1.00%

Function 0555741C, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9331830965d72d12fcbefa973c87c0cf332396a92bd300e1243d284f656f33ac
Instruction ID: 3ca043911662039746affe13cf91708ecca0adb4616e49d3ab1d9395ff2e8575
Opcode Fuzzy Hash: 9331830965d72d12fcbefa973c87c0cf332396a92bd300e1243d284f656f33ac
Instruction Fuzzy Hash: BCB092B7A04008CADF00DA84B4417EDFB20F794275F104433C71092000C232016496D1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0555F248, Relevance: 10.5, Strings: 8, Instructions: 467COMMON

Download Yara Rule

Strings

,:kr, xrefs: 0555F3D3
:@Dr, xrefs: 0555F74D
0jr, xrefs: 0555F5B4
:@Dr, xrefs: 0555F72F
0jr, xrefs: 0555F5AA
,:kr, xrefs: 0555F3DD
X1kr, xrefs: 0555F516
X1kr, xrefs: 0555F520

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID: ,:kr$,:kr$0jr$0jr$:@Dr$:@Dr$X1kr$X1kr
API String ID: 0-3442507050
Opcode ID: 99847de275a00a800e2e817da29f693af186a035e05563d8b8660d6c708e57be
Instruction ID: a1f57f3749f86e74ec52fe71c182d407db23138c59173d37d36b1b8515e50921
Opcode Fuzzy Hash: 99847de275a00a800e2e817da29f693af186a035e05563d8b8660d6c708e57be
Instruction Fuzzy Hash: AC126474A04200DFCB14DF68D194A697BF6FF88725F25849AEC469B3A1CB75EC44CB81

Uniqueness

Uniqueness Score: -1.00%

Function 05550D93, Relevance: 5.2, Strings: 4, Instructions: 249COMMON

Download Yara Rule

Strings

X1kr, xrefs: 05550F1C
0jr, xrefs: 05550F8E
:@Dr, xrefs: 055510CB
,:kr, xrefs: 05550E38

Memory Dump Source

Source File: 0000000E.00000002.472770110.0000000005550000.00000040.00000001.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5550000_RegSvcs.jbxd

Similarity

API ID:
String ID: ,:kr$0jr$:@Dr$X1kr
API String ID: 0-1245831938
Opcode ID: 11e69d27d3be0eb9c92cc29f316f65a0f0301ae4d57fb84b0c21e13b795d30fd
Instruction ID: b6bebc983df3f9412df794e2365e3dc1edb5a616da8176e88c4b077cbac452d7
Opcode Fuzzy Hash: 11e69d27d3be0eb9c92cc29f316f65a0f0301ae4d57fb84b0c21e13b795d30fd
Instruction Fuzzy Hash: 31B1B170A04344CFD3A4DF789160B6ABBE6FB98704F60692EE5898B394DF759C41CB02

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegSvcs.exe PID: 4868 Parent PID: 528 RegSvcs.exeCOMMON

Execution Graph

Execution Coverage:	22.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	28
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 028906E8, Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowDpiAwarenessContext.USER32 ref: 02890735
GetWindowDpiAwarenessContext.USER32 ref: 02890756

Memory Dump Source

Source File: 00000017.00000002.290049037.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2890000_RegSvcs.jbxd

Similarity

API ID: AwarenessContextWindow
String ID:
API String ID: 1792436077-0
Opcode ID: 9a621732e5fcec41292974a7d6fc4b4887b2aae0daea6c570a32b54a063bb9f2
Instruction ID: 7d6fe314ae3513ac87a5e0d05eacba5feeab3cc6c775a5945cab1aab213f0f45
Opcode Fuzzy Hash: 9a621732e5fcec41292974a7d6fc4b4887b2aae0daea6c570a32b54a063bb9f2
Instruction Fuzzy Hash: 8B310C347012508FCB596B7CD52866E3BE29F86309B2404BAD50ACF7E2DE3ADC858795

Uniqueness

Uniqueness Score: -1.00%

Function 028906F8, Relevance: 3.1, APIs: 2, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowDpiAwarenessContext.USER32 ref: 02890735
GetWindowDpiAwarenessContext.USER32 ref: 02890756

Memory Dump Source

Source File: 00000017.00000002.290049037.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2890000_RegSvcs.jbxd

Similarity

API ID: AwarenessContextWindow
String ID:
API String ID: 1792436077-0
Opcode ID: 25821231b8073b8dbd6708eb61f4c688a5840bb15441c7dadace99fbf9eb6561
Instruction ID: ff70dfd8e35b972dc0c675a22dc5d3746b82e69e5c53ba2cbfe1d30f1e2e4c2e
Opcode Fuzzy Hash: 25821231b8073b8dbd6708eb61f4c688a5840bb15441c7dadace99fbf9eb6561
Instruction Fuzzy Hash: 1D211D347012108FCB596B7DD41862E3AE6EFC6309B2404BAE50ACF7E1EE35DC858795

Uniqueness

Uniqueness Score: -1.00%

Function 029D05CF, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000017.00000002.290125937.00000000029D0000.00000040.00000040.sdmp, Offset: 029D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_29d0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c5265b433b2bd5041378a0cde19594bdc1846dab3f08e4459040e5913332c4c
Instruction ID: a88d2e8a19b5013f6e546e08183e30953929da2f0b3dec0a155dcc9b547af957
Opcode Fuzzy Hash: 9c5265b433b2bd5041378a0cde19594bdc1846dab3f08e4459040e5913332c4c
Instruction Fuzzy Hash: 4501DBB6509780AFD7128F16EC40962FFF8EF86260F09C5DFED498B612D265A904CB61

Uniqueness

Uniqueness Score: -1.00%

Function 029D05F6, Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000017.00000002.290125937.00000000029D0000.00000040.00000040.sdmp, Offset: 029D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_29d0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90bdda88a06842789a7b8812a36bd2442cfcaea7cc3dca058ab26fbf67319b97
Instruction ID: e65ee0c7e4b049129633a91706e1232345d284c26d8da4f4a4b1515732f089dc
Opcode Fuzzy Hash: 90bdda88a06842789a7b8812a36bd2442cfcaea7cc3dca058ab26fbf67319b97
Instruction Fuzzy Hash: BFE06D76604A008B9650CF0BEC81456F798EB88631B18C07FDC0D8B700E135F5048FA5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: dhcpmon.exe PID: 4120 Parent PID: 528 dhcpmon.exeCOMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	16
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0166A587, Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SearchPathW.KERNELBASE(?,00000E2C,?,?), ref: 0166A63A

Memory Dump Source

Source File: 0000001A.00000002.290215724.000000000166A000.00000040.00000001.sdmp, Offset: 0166A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_166a000_dhcpmon.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: b167adc62334030396989849ee6d9fe27e38392d4a83d70a533104fa68b2a9e0
Instruction ID: 44bc0d729dfc4f55f513125b744ae71edb79a5de31c61e9ca815d30e70186e87
Opcode Fuzzy Hash: b167adc62334030396989849ee6d9fe27e38392d4a83d70a533104fa68b2a9e0
Instruction Fuzzy Hash: 90317F7250D3C06FD313CB259C51B62BFB4AF87614F1A81DBD8848F193D225A909C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0166A4AA, Relevance: 1.6, APIs: 1, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E2C,1E5A7425,00000000,00000000,00000000,00000000), ref: 0166A53D

Memory Dump Source

Source File: 0000001A.00000002.290215724.000000000166A000.00000040.00000001.sdmp, Offset: 0166A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_166a000_dhcpmon.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 7a7838835abfd221101a8f4338014888c7cbf4c21177d69c60bc1c579e00b9f5
Instruction ID: b3fe925c71c0f02dfc0c7cd7ea497d2ac80758c701896f22733ed678693eeda5
Opcode Fuzzy Hash: 7a7838835abfd221101a8f4338014888c7cbf4c21177d69c60bc1c579e00b9f5
Instruction Fuzzy Hash: 01217171409380AFD7128B65DC54F96BFB8EF46310F0885DBEA849F153D265A509C771

Uniqueness

Uniqueness Score: -1.00%

Function 0166A5C6, Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SearchPathW.KERNELBASE(?,00000E2C,?,?), ref: 0166A63A

Memory Dump Source

Source File: 0000001A.00000002.290215724.000000000166A000.00000040.00000001.sdmp, Offset: 0166A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_166a000_dhcpmon.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: de51278b448947cc440d5ae20d5c3a4547239167aae10166b66532b1c95086a9
Instruction ID: 0e3f81c5e53fd5d4dcaa36d245efe284ade24473d40104352be23ad4c5713e34
Opcode Fuzzy Hash: de51278b448947cc440d5ae20d5c3a4547239167aae10166b66532b1c95086a9
Instruction Fuzzy Hash: D511E2715043406FD311CF25DC41F67FFB8EB85A20F0485AAED488B642D270B915CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0166A1F4, Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleOutputCP.KERNELBASE ref: 0166A269

Memory Dump Source

Source File: 0000001A.00000002.290215724.000000000166A000.00000040.00000001.sdmp, Offset: 0166A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_166a000_dhcpmon.jbxd

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: e3a29be1d847dba0848cb94d75a11c07cca5e4f49c9dbf1086d46e87def1266b
Instruction ID: ecdd3833acd6821ca6f9a7be051992ef5acf3d465038c33888673be7b05a4087
Opcode Fuzzy Hash: e3a29be1d847dba0848cb94d75a11c07cca5e4f49c9dbf1086d46e87def1266b
Instruction Fuzzy Hash: 2B215E3540D7C45FD7138B659C95652BFB4EF03220F0E81DBD9848F163D269A909C762

Uniqueness

Uniqueness Score: -1.00%

Function 0166A4DE, Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E2C,1E5A7425,00000000,00000000,00000000,00000000), ref: 0166A53D

Memory Dump Source

Source File: 0000001A.00000002.290215724.000000000166A000.00000040.00000001.sdmp, Offset: 0166A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_166a000_dhcpmon.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 8bce57acdc9d28a81689441e78052d05951b73d68d6a41e5d36f7ec56ebf0b31
Instruction ID: 3215fb5d4146c8dcbbd240f52f4023efd9e6d81bd706731fd5d247c8fdb2fe45
Opcode Fuzzy Hash: 8bce57acdc9d28a81689441e78052d05951b73d68d6a41e5d36f7ec56ebf0b31
Instruction Fuzzy Hash: DB119D71400200EEEB21CF99DC44FAAFBA8EF44320F14856BEA45AB251D374A4098BB1

Uniqueness

Uniqueness Score: -1.00%

Function 0166A5EA, Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SearchPathW.KERNELBASE(?,00000E2C,?,?), ref: 0166A63A

Memory Dump Source

Source File: 0000001A.00000002.290215724.000000000166A000.00000040.00000001.sdmp, Offset: 0166A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_166a000_dhcpmon.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: f7103e9ace5b663c937199caf6de01f19165aec4877c11cc46085b6cfceed980
Instruction ID: 83656221e8e4cc48f059af45956c23af2ba5bc8e86315394c3d50f5e14d04136
Opcode Fuzzy Hash: f7103e9ace5b663c937199caf6de01f19165aec4877c11cc46085b6cfceed980
Instruction Fuzzy Hash: 26017172500600ABD710DF16DC85F66FBA8FBC8B20F14856AED099B741E371B915CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0166A23A, Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleOutputCP.KERNELBASE ref: 0166A269

Memory Dump Source

Source File: 0000001A.00000002.290215724.000000000166A000.00000040.00000001.sdmp, Offset: 0166A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_166a000_dhcpmon.jbxd

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: 10760b9e7627e4be05333e9f9a19d9e0db28ba664f4bdaecc4b06ca5d7a2fe99
Instruction ID: 1037ada82dae0c17e6f9f658e1be79edb5658322c47e54548243865ec7e2c5a1
Opcode Fuzzy Hash: 10760b9e7627e4be05333e9f9a19d9e0db28ba664f4bdaecc4b06ca5d7a2fe99
Instruction Fuzzy Hash: E9F0AF308046449FDB10CF5ADC84762FFA8EF04620F18C0AADE095B302D2BAA448CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02FB05CF, Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001A.00000002.290316086.0000000002FB0000.00000040.00000040.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2fb0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6be9416a6c2e4602e3bb1d457b7f14cd3c457497de3bb850ae8580902e5f4b82
Instruction ID: 3953788969cfa2d5b0777f2bebed9b6c7f992b8d1be7242c55556dc143bb26cf
Opcode Fuzzy Hash: 6be9416a6c2e4602e3bb1d457b7f14cd3c457497de3bb850ae8580902e5f4b82
Instruction Fuzzy Hash: 6901A7715497805FD3028B16EC40952FFE8DF86630B0980EFED498B212D165A909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02FB05F6, Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001A.00000002.290316086.0000000002FB0000.00000040.00000040.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2fb0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1968397d180d08196da41171ffeb02005f016d8fa4f96e4b8ddaa196884d8d60
Instruction ID: 27b74325ef316a711f64a58fcc6e1bc5b78e7a81f1eade6f3bb4988e28430d2f
Opcode Fuzzy Hash: 1968397d180d08196da41171ffeb02005f016d8fa4f96e4b8ddaa196884d8d60
Instruction Fuzzy Hash: ABE092766006008BD650CF0BEC41456FBD8EB88630B18C07FDD0D8B701E135B504CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 016623F4, Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001A.00000002.290205804.0000000001662000.00000040.00000001.sdmp, Offset: 01662000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_1662000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04a282e0ee64d1270755f3bac3649f7959d64f336d72bdcd61f22b378d1fdeff
Instruction ID: 6b1b3ed27e51c367eb6dcccbbcd5d8c6067cf1aa98a402914f7d9fb000a98024
Opcode Fuzzy Hash: 04a282e0ee64d1270755f3bac3649f7959d64f336d72bdcd61f22b378d1fdeff
Instruction Fuzzy Hash: C1D05E79216A818FE3268A1CC5B8BA53FA8AF52B04F4644FDE8008B763C768D9D1D200

Uniqueness

Uniqueness Score: -1.00%

Function 016623BC, Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001A.00000002.290205804.0000000001662000.00000040.00000001.sdmp, Offset: 01662000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_1662000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3209d7d208a39d95bf23969bfd606fe4b7d4b80d1daa63239989aca9b93b83
Instruction ID: ee2d1ecdc575ba0620d367d23c5a7fd00099bd1316f46a0ff2f2412ac8351c29
Opcode Fuzzy Hash: 2f3209d7d208a39d95bf23969bfd606fe4b7d4b80d1daa63239989aca9b93b83
Instruction Fuzzy Hash: AFD05E342002818BD715DB0CC9A4F593BD8AB41B00F0644EDAD008B762C3A4D881C600

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report https://onedrive.live.com/download?cid=F9306F27ACC5AABA&resid=F9306F27ACC5AABA%21278&authkey=AEXuJUX0kEgNwa0

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

Operating System Destruction:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

No static file info

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre