Play interactive tour

Edit tour

Analysis Report Szallitasi adatok.tar

Overview

General Information

Sample Name:	Szallitasi adatok.tar
Analysis ID:	383998
MD5:	fa2c7acf057d7ecf693cbb13fab9b1b3
SHA1:	b67cd39674b6d039e235fbb9cf0272a103afa475
SHA256:	1b90e29a9f49905ead7832ff25d7ba91fddeb4827d7c8ca506c6c0b6f96acda7
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains very large array initializations

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Antivirus or Machine Learning detection for unpacked file

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains strange resources

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

unarchiver.exe (PID: 6880 cmdline: 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\Desktop\Szallitasi adatok.tar' MD5: DB55139D9DD29F24AE8EA8F0E5606901)

7za.exe (PID: 6916 cmdline: 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s' 'C:\Users\user\Desktop\Szallitasi adatok.tar' MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 6964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 7008 cmdline: 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 7028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Szallitasi adatok.exe (PID: 7056 cmdline: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe MD5: C615C5F811E05D5743CE4DD4AFAD4055)

Szallitasi adatok.exe (PID: 7104 cmdline: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe MD5: C615C5F811E05D5743CE4DD4AFAD4055)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "torremolinos3@copiplus.esvB&6mnT00r3mol2o17smtp.1and1.es"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.590323403.0000000003481000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.590323403.0000000003481000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.586946181.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.344267324.0000000003FF6000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Szallitasi adatok.exe PID: 7104	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Szallitasi adatok.exe PID: 7104	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Szallitasi adatok.exe PID: 7056	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Szallitasi adatok.exe PID: 7056	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
6.2.Szallitasi adatok.exe.4086228.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.2.Szallitasi adatok.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.Szallitasi adatok.exe.4086228.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.Szallitasi adatok.exe.4015208.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 6.2.Szallitasi adatok.exe.4086228.3.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "torremolinos3@copiplus.esvB&6mnT00r3mol2o17smtp.1and1.es"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe

ReversingLabs: Detection: 18%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe

Joe Sandbox ML: detected

Source: 7.2.Szallitasi adatok.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 02EB099Bh	0_2_02EB02A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 02EB099Ah	0_2_02EB02A8
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	6_2_04E697A8
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	6_2_04E69798
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	6_2_04E68288
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	6_2_04E68279

Source: global traffic

TCP traffic: 192.168.2.6:49748 -> 212.227.15.158:587

Source: Joe Sandbox View

IP Address: 212.227.15.158 212.227.15.158

Source: global traffic

TCP traffic: 192.168.2.6:49748 -> 212.227.15.158:587

Source: unknown

DNS traffic detected: queries for: smtp.1and1.es

Source: Szallitasi adatok.exe, 00000007.00000002.590323403.0000000003481000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: Szallitasi adatok.exe, 00000007.00000002.590323403.0000000003481000.00000004.00000001.sdmp	String found in binary or memory: http://CpKupV.com
Source: Szallitasi adatok.exe, 00000007.00000002.590323403.0000000003481000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: Szallitasi adatok.exe, 00000007.00000002.595705814.0000000006FA0000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.geotrust.com/GeoTrustRSACA2018.crt0
Source: Szallitasi adatok.exe, 00000007.00000002.595705814.0000000006FA0000.00000004.00000001.sdmp	String found in binary or memory: http://cdp.geotrust.com/GeoTrustRSACA2018.crl0L
Source: Szallitasi adatok.exe, 00000007.00000002.595705814.0000000006FA0000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: Szallitasi adatok.exe, 00000007.00000002.595705814.0000000006FA0000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0B
Source: Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp, Szallitasi adatok.exe, 00000006.00000002.343135328.0000000002DF1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name4
Source: Szallitasi adatok.exe, 00000007.00000002.592552943.00000000037DC000.00000004.00000001.sdmp	String found in binary or memory: http://smtp.1and1.es
Source: Szallitasi adatok.exe, 00000007.00000002.595705814.0000000006FA0000.00000004.00000001.sdmp	String found in binary or memory: http://status.geotrust.com0=
Source: Szallitasi adatok.exe, 00000007.00000002.590323403.0000000003481000.00000004.00000001.sdmp, Szallitasi adatok.exe, 00000007.00000003.544547709.00000000015E4000.00000004.00000001.sdmp	String found in binary or memory: http://wjANZKRbswl5oYyv5U.com
Source: Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Szallitasi adatok.exe, 00000006.00000003.329128388.0000000005E61000.00000004.00000001.sdmp, Szallitasi adatok.exe, 00000006.00000003.328833893.0000000005E61000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: Szallitasi adatok.exe, 00000006.00000003.328759345.0000000005E61000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com.N
Source: Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Szallitasi adatok.exe, 00000006.00000003.328833893.0000000005E61000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comn-u
Source: Szallitasi adatok.exe, 00000006.00000003.329128388.0000000005E61000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comn-u0
Source: Szallitasi adatok.exe, 00000006.00000003.329128388.0000000005E61000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comr
Source: Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp, Szallitasi adatok.exe, 00000006.00000003.334203954.0000000005E62000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Szallitasi adatok.exe, 00000006.00000003.330798629.0000000005E62000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Szallitasi adatok.exe, 00000006.00000003.330983935.0000000005E62000.00000004.00000001.sdmp, Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Szallitasi adatok.exe, 00000006.00000003.330590528.0000000005E62000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/i
Source: Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Szallitasi adatok.exe, 00000006.00000003.330822847.0000000005E62000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersC
Source: Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Szallitasi adatok.exe, 00000006.00000003.330822847.0000000005E62000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersP
Source: Szallitasi adatok.exe, 00000006.00000003.331212623.0000000005E62000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers~
Source: Szallitasi adatok.exe, 00000006.00000003.341878900.0000000005E3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comaJ
Source: Szallitasi adatok.exe, 00000006.00000003.341878900.0000000005E3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comasc
Source: Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Szallitasi adatok.exe, 00000006.00000003.328398898.0000000005E5D000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cna-e
Source: Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Szallitasi adatok.exe, 00000006.00000003.328148680.0000000005E5D000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Szallitasi adatok.exe, 00000006.00000003.328148680.0000000005E5D000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr-e
Source: Szallitasi adatok.exe, 00000006.00000003.329656338.0000000005E37000.00000004.00000001.sdmp, Szallitasi adatok.exe, 00000006.00000003.329458297.0000000005E34000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Szallitasi adatok.exe, 00000006.00000003.329656338.0000000005E37000.00000004.00000001.sdmp, Szallitasi adatok.exe, 00000006.00000003.329810137.0000000005E3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp//
Source: Szallitasi adatok.exe, 00000006.00000003.329810137.0000000005E3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/C
Source: Szallitasi adatok.exe, 00000006.00000003.329656338.0000000005E37000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/U
Source: Szallitasi adatok.exe, 00000006.00000003.329656338.0000000005E37000.00000004.00000001.sdmp, Szallitasi adatok.exe, 00000006.00000003.329810137.0000000005E3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: Szallitasi adatok.exe, 00000006.00000003.329656338.0000000005E37000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/J
Source: Szallitasi adatok.exe, 00000006.00000003.329810137.0000000005E3A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/n
Source: Szallitasi adatok.exe, 00000006.00000003.329656338.0000000005E37000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/nb-n
Source: Szallitasi adatok.exe, 00000006.00000003.333277327.0000000005E61000.00000004.00000001.sdmp	String found in binary or memory: http://www.monotype.
Source: Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Szallitasi adatok.exe, 00000006.00000003.329984191.0000000005E62000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Szallitasi adatok.exe, 00000006.00000003.328148680.0000000005E5D000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Szallitasi adatok.exe, 00000006.00000003.328148680.0000000005E5D000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr.krt-b
Source: Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: Szallitasi adatok.exe, 00000006.00000003.329144440.0000000005E61000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comslnt
Source: Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: Szallitasi adatok.exe, 00000006.00000003.331404258.0000000005E62000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.de
Source: Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Szallitasi adatok.exe, 00000006.00000003.331404258.0000000005E62000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.derT
Source: Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Szallitasi adatok.exe, 00000006.00000003.328730706.0000000005E61000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cna
Source: Szallitasi adatok.exe, Szallitasi adatok.exe, 00000007.00000000.340920875.0000000000F82000.00000002.00020000.sdmp, Szallitasi adatok.tar	String found in binary or memory: https://dist.nuget.org/win-x86-commandline/latest/nuget.exe
Source: Szallitasi adatok.exe, Szallitasi adatok.tar	String found in binary or memory: https://github.com/Spegeli/Pokemon-Go-Rocket-API/archive/master.zip
Source: Szallitasi adatok.exe, Szallitasi adatok.exe, 00000007.00000000.340920875.0000000000F82000.00000002.00020000.sdmp, Szallitasi adatok.tar	String found in binary or memory: https://github.com/d-haxton/HaxtonBot/archive/master.zip
Source: Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: Szallitasi adatok.exe, 00000007.00000002.595705814.0000000006FA0000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: Szallitasi adatok.exe, 00000006.00000002.344267324.0000000003FF6000.00000004.00000001.sdmp, Szallitasi adatok.exe, 00000007.00000002.586946181.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: Szallitasi adatok.exe, 00000007.00000002.590323403.0000000003481000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 7.2.Szallitasi adatok.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bEC539FFCu002dC2DEu002d4D49u002d9C7Du002d51A304EDDE69u007d/DB0019FBu002dD56Eu002d4258u002d8DEFu002dF1840779C330.cs

Large array initialization: .cctor: array initializer size 11940

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 0_2_02EB02A8	0_2_02EB02A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 0_2_02EB0299	0_2_02EB0299
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_00A32050	6_2_00A32050
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_014C94A8	6_2_014C94A8
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_014CDCF4	6_2_014CDCF4
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_014CC148	6_2_014CC148
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_014CE218	6_2_014CE218
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_014CA748	6_2_014CA748
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_04E60040	6_2_04E60040
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_04E62130	6_2_04E62130
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_04E61C30	6_2_04E61C30
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_04E65AF5	6_2_04E65AF5
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_04E654A8	6_2_04E654A8
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_04E654B8	6_2_04E654B8
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_04E60006	6_2_04E60006
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_04E63007	6_2_04E63007
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_04E61017	6_2_04E61017
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_04E63018	6_2_04E63018
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_04E62120	6_2_04E62120
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_04E61C21	6_2_04E61C21
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_04E60EE0	6_2_04E60EE0
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_04E60ED8	6_2_04E60ED8
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_00F82050	7_2_00F82050
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_017F2020	7_2_017F2020
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_017FAB70	7_2_017FAB70
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_017F2618	7_2_017F2618
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_017FC378	7_2_017FC378
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_01839000	7_2_01839000
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_01833800	7_2_01833800
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_018377A0	7_2_018377A0
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_01831AE0	7_2_01831AE0
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_01831108	7_2_01831108
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_01838820	7_2_01838820
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_0183C7C8	7_2_0183C7C8
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_0183A370	7_2_0183A370
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_0183F204	7_2_0183F204
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_0183BA50	7_2_0183BA50
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_0188F3C0	7_2_0188F3C0
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_0188B7D4	7_2_0188B7D4
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_01885D40	7_2_01885D40
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_01880040	7_2_01880040
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_018871F0	7_2_018871F0
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_0188A740	7_2_0188A740
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_01889180	7_2_01889180
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_01880014	7_2_01880014

Source: Szallitasi adatok.exe.2.dr

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Szallitasi adatok.tar

Binary or memory string: OriginalFilenameIsByValue.exeD vs Szallitasi adatok.tar

Source: Szallitasi adatok.exe.2.dr

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 7.2.Szallitasi adatok.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.2.Szallitasi adatok.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winTAR@11/4@1/1

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Szallitasi adatok.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6964:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7028:120:WilError_01

Source: C:\Windows\SysWOW64\unarchiver.exe

File created: C:\Users\user\AppData\Local\Temp\mcgybaxf.vdb

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	Binary or memory string: Select * from UnmanagedMemoryStreamWrapper WHERE modelo=@modelo;?
Source: Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel5Erro ao listar Banco sql-UnmanagedMemoryStreamWrapper.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO UnmanagedMemoryStreamWrapper VALUES(@modelo, @fabricante, @ano, @cor);
Source: Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);

Source: unknown	Process created: C:\Windows\SysWOW64\unarchiver.exe 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\Desktop\Szallitasi adatok.tar'
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s' 'C:\Users\user\Desktop\Szallitasi adatok.tar'
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process created: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s' 'C:\Users\user\Desktop\Szallitasi adatok.tar'	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process created: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_00A48507 push dword ptr [esi+3Fh]; iretd	6_2_00A48519
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_00A35683 push es; retf	6_2_00A35684
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 6_2_00A49273 push FFFFFFD9h; iretd	6_2_00A49290
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_00F98507 push dword ptr [esi+3Fh]; iretd	7_2_00F98519
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_00F85683 push es; retf	7_2_00F85684
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_017F7A37 push edi; retn 0000h	7_2_017F7A39
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_018368AB push FFFFFF8Bh; iretd	7_2_018368AF
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_01836433 pushad ; retf	7_2_0183643D
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_0183683D push FFFFFF8Bh; iretd	7_2_01836841
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Code function: 7_2_018367C7 push FFFFFF8Bh; iretd	7_2_018367D9

Source: initial sample

Static PE information: section name: .text entropy: 7.53444175386

Source: C:\Windows\SysWOW64\7za.exe

File created: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Szallitasi adatok.exe PID: 7056, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Window / User API: threadDelayed 8291			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Window / User API: threadDelayed 1568			Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6904	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe TID: 7060	Thread sleep time: -99493s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe TID: 7080	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe TID: 7100	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe TID: 5608	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe TID: 6108	Thread sleep count: 8291 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe TID: 6108	Thread sleep count: 1568 > 30	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 0_2_0146B042 GetSystemInfo,

0_2_0146B042

Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Thread delayed: delay time: 99493	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: Szallitasi adatok.exe, 00000007.00000002.595705814.0000000006FA0000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllM
Source: Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe

Code function: 7_2_0183C490 LdrInitializeThunk,

7_2_0183C490

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe

Memory written: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s' 'C:\Users\user\Desktop\Szallitasi adatok.tar'	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Process created: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Jump to behavior

Source: Szallitasi adatok.exe, 00000007.00000002.589689355.0000000001EB0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Szallitasi adatok.exe, 00000007.00000002.589689355.0000000001EB0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Szallitasi adatok.exe, 00000007.00000002.589689355.0000000001EB0000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: Szallitasi adatok.exe, 00000007.00000002.589689355.0000000001EB0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000007.00000002.590323403.0000000003481000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.586946181.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.344267324.0000000003FF6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Szallitasi adatok.exe PID: 7104, type: MEMORY
Source: Yara match	File source: Process Memory Space: Szallitasi adatok.exe PID: 7056, type: MEMORY
Source: Yara match	File source: 6.2.Szallitasi adatok.exe.4086228.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Szallitasi adatok.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Szallitasi adatok.exe.4086228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Szallitasi adatok.exe.4015208.2.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 00000007.00000002.590323403.0000000003481000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Szallitasi adatok.exe PID: 7104, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000007.00000002.590323403.0000000003481000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.586946181.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.344267324.0000000003FF6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Szallitasi adatok.exe PID: 7104, type: MEMORY
Source: Yara match	File source: Process Memory Space: Szallitasi adatok.exe PID: 7056, type: MEMORY
Source: Yara match	File source: 6.2.Szallitasi adatok.exe.4086228.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Szallitasi adatok.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Szallitasi adatok.exe.4086228.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Szallitasi adatok.exe.4015208.2.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection112	Masquerading1	OS Credential Dumping2	Query Registry1	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	Credentials in Registry1	Security Software Discovery311	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion131	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Virtualization/Sandbox Evasion131	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information3	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing3	DCSync	System Information Discovery115	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe	19%	ReversingLabs	Win32.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
7.2.Szallitasi adatok.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://www.carterandcone.comn-u	0%	URL Reputation	safe
http://www.carterandcone.comn-u	0%	URL Reputation	safe
http://www.carterandcone.comn-u	0%	URL Reputation	safe
http://www.carterandcone.comn-u	0%	URL Reputation	safe
http://CpKupV.com	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.goodfont.co.kr-e	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/J	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cna-e	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp//	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp//	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp//	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://www.fontbureau.comasc	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr.krt-b	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/U	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/U	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/U	0%	URL Reputation	safe
http://www.tiro.comslnt	0%	URL Reputation	safe
http://www.tiro.comslnt	0%	URL Reputation	safe
http://www.tiro.comslnt	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://www.carterandcone.comr	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/C	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/C	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/C	0%	URL Reputation	safe
http://www.fontbureau.comaJ	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.urwpp.derT	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/nb-n	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cna	0%	Avira URL Cloud	safe
http://www.monotype.	0%	URL Reputation	safe
http://www.monotype.	0%	URL Reputation	safe
http://www.monotype.	0%	URL Reputation	safe
http://wjANZKRbswl5oYyv5U.com	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/n	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
smtp.1and1.es	212.227.15.158	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	Szallitasi adatok.exe, 00000007.00000002.590323403.0000000003481000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designersG	Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	false		high
http://www.carterandcone.comn-u	Szallitasi adatok.exe, 00000006.00000003.328833893.0000000005E61000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	false		high
http://CpKupV.com	Szallitasi adatok.exe, 00000007.00000002.590323403.0000000003481000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/bThe	Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.goodfont.co.kr-e	Szallitasi adatok.exe, 00000006.00000003.328148680.0000000005E5D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	false		high
https://dist.nuget.org/win-x86-commandline/latest/nuget.exe	Szallitasi adatok.exe, Szallitasi adatok.exe, 00000007.00000000.340920875.0000000000F82000.00000002.00020000.sdmp, Szallitasi adatok.tar	false		high
http://www.jiyu-kobo.co.jp/jp/J	Szallitasi adatok.exe, 00000006.00000003.329656338.0000000005E37000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersC	Szallitasi adatok.exe, 00000006.00000003.330822847.0000000005E62000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cna-e	Szallitasi adatok.exe, 00000006.00000003.328398898.0000000005E5D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name4	Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	false		high
http://www.tiro.com	Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp, Szallitasi adatok.exe, 00000006.00000003.334203954.0000000005E62000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	Szallitasi adatok.exe, 00000006.00000003.328148680.0000000005E5D000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.com	Szallitasi adatok.exe, 00000006.00000003.329128388.0000000005E61000.00000004.00000001.sdmp, Szallitasi adatok.exe, 00000006.00000003.328833893.0000000005E61000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designersP	Szallitasi adatok.exe, 00000006.00000003.330822847.0000000005E62000.00000004.00000001.sdmp	false		high
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp	false		high
http://www.sajatypeworks.com	Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp//	Szallitasi adatok.exe, 00000006.00000003.329656338.0000000005E37000.00000004.00000001.sdmp, Szallitasi adatok.exe, 00000006.00000003.329810137.0000000005E3A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://github.com/Spegeli/Pokemon-Go-Rocket-API/archive/master.zip	Szallitasi adatok.exe, Szallitasi adatok.tar	false		high
http://www.fonts.com	Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	Szallitasi adatok.exe, 00000006.00000003.328148680.0000000005E5D000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.de	Szallitasi adatok.exe, 00000006.00000003.331404258.0000000005E62000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Szallitasi adatok.exe, 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp, Szallitasi adatok.exe, 00000006.00000002.343135328.0000000002DF1000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	Szallitasi adatok.exe, 00000006.00000003.329984191.0000000005E62000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	Szallitasi adatok.exe, 00000006.00000002.344267324.0000000003FF6000.00000004.00000001.sdmp, Szallitasi adatok.exe, 00000007.00000002.586946181.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comasc	Szallitasi adatok.exe, 00000006.00000003.341878900.0000000005E3A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr.krt-b	Szallitasi adatok.exe, 00000006.00000003.328148680.0000000005E5D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://DynDns.comDynDNS	Szallitasi adatok.exe, 00000007.00000002.590323403.0000000003481000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/U	Szallitasi adatok.exe, 00000006.00000003.329656338.0000000005E37000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.tiro.comslnt	Szallitasi adatok.exe, 00000006.00000003.329144440.0000000005E61000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	Szallitasi adatok.exe, 00000007.00000002.590323403.0000000003481000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://smtp.1and1.es	Szallitasi adatok.exe, 00000007.00000002.592552943.00000000037DC000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers~	Szallitasi adatok.exe, 00000006.00000003.331212623.0000000005E62000.00000004.00000001.sdmp	false		high
https://github.com/d-haxton/HaxtonBot/archive/master.zip	Szallitasi adatok.exe, Szallitasi adatok.exe, 00000007.00000000.340920875.0000000000F82000.00000002.00020000.sdmp, Szallitasi adatok.tar	false		high
http://www.carterandcone.comr	Szallitasi adatok.exe, 00000006.00000003.329128388.0000000005E61000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/C	Szallitasi adatok.exe, 00000006.00000003.329810137.0000000005E3A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comaJ	Szallitasi adatok.exe, 00000006.00000003.341878900.0000000005E3A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	Szallitasi adatok.exe, 00000006.00000003.329656338.0000000005E37000.00000004.00000001.sdmp, Szallitasi adatok.exe, 00000006.00000003.329810137.0000000005E3A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.derT	Szallitasi adatok.exe, 00000006.00000003.331404258.0000000005E62000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/nb-n	Szallitasi adatok.exe, 00000006.00000003.329656338.0000000005E37000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn	Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	Szallitasi adatok.exe, 00000006.00000003.330983935.0000000005E62000.00000004.00000001.sdmp, Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	false		high
http://www.zhongyicts.com.cna	Szallitasi adatok.exe, 00000006.00000003.328730706.0000000005E61000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.monotype.	Szallitasi adatok.exe, 00000006.00000003.333277327.0000000005E61000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://wjANZKRbswl5oYyv5U.com	Szallitasi adatok.exe, 00000007.00000002.590323403.0000000003481000.00000004.00000001.sdmp, Szallitasi adatok.exe, 00000007.00000003.544547709.00000000015E4000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	Szallitasi adatok.exe, 00000006.00000003.329656338.0000000005E37000.00000004.00000001.sdmp, Szallitasi adatok.exe, 00000006.00000003.329458297.0000000005E34000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/n	Szallitasi adatok.exe, 00000006.00000003.329810137.0000000005E3A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comn-u0	Szallitasi adatok.exe, 00000006.00000003.329128388.0000000005E61000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers8	Szallitasi adatok.exe, 00000006.00000002.347842702.0000000007042000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/i	Szallitasi adatok.exe, 00000006.00000003.330590528.0000000005E62000.00000004.00000001.sdmp	false		high
http://www.carterandcone.com.N	Szallitasi adatok.exe, 00000006.00000003.328759345.0000000005E61000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/	Szallitasi adatok.exe, 00000006.00000003.330798629.0000000005E62000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
212.227.15.158	smtp.1and1.es	Germany		8560	ONEANDONE-ASBrauerstrasse48DE	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	383998
Start date:	08.04.2021
Start time:	13:53:46
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Szallitasi adatok.tar
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winTAR@11/4@1/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 0.2% (good quality ratio 0%) Quality average: 14% Quality standard deviation: 31.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 164 Number of non-executed functions: 1
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .tar
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 168.61.161.212, 13.88.21.125, 20.82.210.154, 13.64.90.137, 23.10.249.43, 23.10.249.26, 52.155.217.156, 20.54.26.129, 104.43.139.144, 104.42.151.234, 52.255.188.83, 95.100.54.203 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, consumerrp-displaycatalog-aks2eap.md.mp.microsoft.com.akadns.net, prod.fs.microsoft.com.akadns.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, skypedataprdcolcus16.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net, skypedataprdcolwus16.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:54:41	API Interceptor	778x Sleep call for process: Szallitasi adatok.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
212.227.15.158	Recibo de transferencia de dinero.exe	Get hash	malicious	Browse
	Geldtransferbeleg.exe	Get hash	malicious	Browse
	Factur#U0103 pl#U0103tit#U0103.exe	Get hash	malicious	Browse
	JUSTT1.exe	Get hash	malicious	Browse
	Facturas pagadas.exe	Get hash	malicious	Browse
	kjhh087.exe	Get hash	malicious	Browse
	Facturas pagadas.exe	Get hash	malicious	Browse
	Facturas_pagadas.exe	Get hash	malicious	Browse
	PAG00.exe	Get hash	malicious	Browse
	312000123.exe	Get hash	malicious	Browse
	TRANF1.exe	Get hash	malicious	Browse
	Orden de pago.exe	Get hash	malicious	Browse
	Orden de pago.exe	Get hash	malicious	Browse
	OrdenPago2.exe	Get hash	malicious	Browse
	3d#U044f.exe	Get hash	malicious	Browse
	Orden de pago.exe	Get hash	malicious	Browse
	Orden de pago.exe	Get hash	malicious	Browse
	PAP001.exe	Get hash	malicious	Browse
	Fizetesi felszolitas.exe	Get hash	malicious	Browse
	P0.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
smtp.1and1.es	Recibo de transferencia de dinero.exe	Get hash	malicious	Browse	212.227.15.158
	Geldtransferbeleg.exe	Get hash	malicious	Browse	212.227.15.158
	Factur#U0103 pl#U0103tit#U0103.exe	Get hash	malicious	Browse	212.227.15.158
	factura.exe	Get hash	malicious	Browse	212.227.15.142
	JUSTT1.exe	Get hash	malicious	Browse	212.227.15.158
	Facturas pagadas.exe	Get hash	malicious	Browse	212.227.15.158
	kjhh087.exe	Get hash	malicious	Browse	212.227.15.158
	Facturas pagadas.exe	Get hash	malicious	Browse	212.227.15.142
	Facturas pagadas.exe	Get hash	malicious	Browse	212.227.15.158
	Facturas_pagadas.exe	Get hash	malicious	Browse	212.227.15.158
	#U0420#U0430#U0445#U0443#U043d#U043a#U0438 #U043e#U043f#U043b#U0430#U0447#U0435#U043d#U0456.exe	Get hash	malicious	Browse	212.227.15.142
	PAG00.exe	Get hash	malicious	Browse	212.227.15.158
	312000123.exe	Get hash	malicious	Browse	212.227.15.158
	Facturi pl#U0103tite la scaden#U021b#U0103.exe	Get hash	malicious	Browse	212.227.15.142
	TRANF1.exe	Get hash	malicious	Browse	212.227.15.158
	Betalingsadvies Opmerking.exe	Get hash	malicious	Browse	212.227.15.142
	42#U0438.exe	Get hash	malicious	Browse	212.227.15.142
	WYX-09901.exe	Get hash	malicious	Browse	212.227.15.142
	Nota de aviso de pago.exe	Get hash	malicious	Browse	212.227.15.142
	Ordesss.exe	Get hash	malicious	Browse	212.227.15.142

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ONEANDONE-ASBrauerstrasse48DE	mal5.exe	Get hash	malicious	Browse	74.208.5.15
	invoice.exe	Get hash	malicious	Browse	74.208.236.64
	PO7321.exe	Get hash	malicious	Browse	217.160.0.101
	BL01345678053567.exe	Get hash	malicious	Browse	74.208.236.134
	A409043090.exe	Get hash	malicious	Browse	74.208.5.2
	Old9BZy7jO.dll	Get hash	malicious	Browse	82.223.21.211
	mULT14gGmy.dll	Get hash	malicious	Browse	82.223.21.211
	yWA1Ay0538.dll	Get hash	malicious	Browse	82.223.21.211
	27XuTqKwYF.dll	Get hash	malicious	Browse	82.223.21.211
	Old9BZy7jO.dll	Get hash	malicious	Browse	82.223.21.211
	mULT14gGmy.dll	Get hash	malicious	Browse	82.223.21.211
	JI63JG7EMo.dll	Get hash	malicious	Browse	82.223.21.211
	F7aZDNx6UM.dll	Get hash	malicious	Browse	82.223.21.211
	yWA1Ay0538.dll	Get hash	malicious	Browse	82.223.21.211
	27XuTqKwYF.dll	Get hash	malicious	Browse	82.223.21.211
	NYDhNBQlYM.dll	Get hash	malicious	Browse	82.223.21.211
	ydKCqL4sTG.dll	Get hash	malicious	Browse	82.223.21.211
	F7aZDNx6UM.dll	Get hash	malicious	Browse	82.223.21.211
	JI63JG7EMo.dll	Get hash	malicious	Browse	82.223.21.211
	TI8E08zJuu.dll	Get hash	malicious	Browse	82.223.21.211

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log Download File
Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	388
Entropy (8bit):	5.2529463157768355
Encrypted:	false
SSDEEP:	12:Q3LaJU20NaL10U29hJ5g1B0U2ukyrFk7v:MLF20NaL329hJ5g522r0
MD5:	FF3B761A021930205BEC9D7664AE9258
SHA1:	1039D595C6333358D5F7EE5619FE6794E6F5FDB1
SHA-256:	A3517BC4B1E6470905F9A38466318B302186496E8706F1976F1ED76F3E87AF0F
SHA-512:	1E77D09CF965575EF9800B1EE8947A02D98F88DBFA267300330860757A0C7350AF857A2CB7001C49AFF1F5BD1E0AE6E90F643B27054522CADC730DD14BC3DE11
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Szallitasi adatok.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Temp\mcgybaxf.vdb\unarchiver.log Download File
Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1615
Entropy (8bit):	5.10186681558097
Encrypted:	false
SSDEEP:	48:CZVvUG/G3/Gb3/G3/Gpp/G//G3/GpPv/Gb1/Gcv/GP/Gu/GO/Ge/G3/G4/G3/G2a:UzBUQ
MD5:	C4B67CF81A0C227827D36C996CC306DD
SHA1:	9D9E9E32BEFB33BB6B99BF76D54960A7A9E4B8EB
SHA-256:	3027A6AE557DCC0ACC8C324F766CA3E4FC0BC463799EB8D3AA96484988BC882B
SHA-512:	560D400BEB0DDD24875233192A1E50356C96EBE2D8C4993DB0BF1530E73EA570E69B6883CDC155C4996E211E9390CBC358149F069D77B97BFAAF8D6C7972FD64
Malicious:	false
Reputation:	low
Preview:	04/08/2021 1:54 PM: Unpack: C:\Users\user\Desktop\Szallitasi adatok.tar..04/08/2021 1:54 PM: Tmp dir: C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s..04/08/2021 1:54 PM: Received from standard out: ..04/08/2021 1:54 PM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..04/08/2021 1:54 PM: Received from standard out: ..04/08/2021 1:54 PM: Received from standard out: Scanning the drive for archives:..04/08/2021 1:54 PM: Received from standard out: 1 file, 874496 bytes (854 KiB)..04/08/2021 1:54 PM: Received from standard out: ..04/08/2021 1:54 PM: Received from standard out: Extracting archive: C:\Users\user\Desktop\Szallitasi adatok.tar..04/08/2021 1:54 PM: Received from standard out: --..04/08/2021 1:54 PM: Received from standard out: Path = C:\Users\user\Desktop\Szallitasi adatok.tar..04/08/2021 1:54 PM: Received from standard out: Type = tar..04/08/2021 1:54 PM: Received from standard out: Physical Size = 874496..04/08/20

C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe Download File
Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	872960
Entropy (8bit):	7.186249660947472
Encrypted:	false
SSDEEP:	12288:2RWcIIK2eESLm1OYOtc7t/0t5v3QUynop8O1lDGbT1tB5IKUa/+:20/IVlOYOSUXynof1wt/IE
MD5:	C615C5F811E05D5743CE4DD4AFAD4055
SHA1:	D37B5D2BCCC12CC995B08A9D3200ECF3A7C21D37
SHA-256:	2154D40FF4FC639A9F8CE0208D0F71D75D664FFAF1D92DC6802CE9EE1DC76DB2
SHA-512:	13C828E61E7E9E12096781F4D0567EA402B42E9E01CF6B5B0CAD2A7749B9B4664A23D3F181E398FAB73D4AAB9AE1BD867868D4651636620CACE3F8E30438B6D2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 19%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....n`..............P......F.......)... ...@....@.. ....................................@..................................)..O....@...B........................................................................... ............... ..H............text........ ...................... ..`.rsrc....B...@...D..................@..@.reloc...............P..............@..B.................)......H........?..DH.........................................................0............(....( .........(.....o!.........................("......(#......($......(%......(&....N..(....ol...('....&..((.....s)........s........s+........s,........s-............0...........~....o.....+...0...........~....o/....+...0...........~....o0....+...0...........~....o1....+...0...........~....o2....+...0..<........~.....(3.....,!r...p.....(4...o5...s6............~.....+...0......

Static File Info

General
File type:	tar archive
Entropy (8bit):	7.17922383389497
TrID:
File name:	Szallitasi adatok.tar
File size:	874496
MD5:	fa2c7acf057d7ecf693cbb13fab9b1b3
SHA1:	b67cd39674b6d039e235fbb9cf0272a103afa475
SHA256:	1b90e29a9f49905ead7832ff25d7ba91fddeb4827d7c8ca506c6c0b6f96acda7
SHA512:	c0db03c358d2e99f1a801c7fdb7a7155fadca26ac43d0cb76636d2d3962494aedf4cabc6611530138ab67ba40119421ea275c840c2c7a18fc803125a3ca5e981
SSDEEP:	12288:iRWcIIK2eESLm1OYOtc7t/0t5v3QUynop8O1lDGbT1tB5IKUa/+:i0/IVlOYOSUXynof1wt/IE
File Content Preview:	Szallitasi adatok.exe...............................................................................0000755.0000000.0000000.00003251000.14033527302.0010636.0..................................................................................................

File Icon


Icon Hash:	00828e8e8686b000

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 8, 2021 13:56:24.634834051 CEST	49748	587	192.168.2.6	212.227.15.158
Apr 8, 2021 13:56:24.655982018 CEST	587	49748	212.227.15.158	192.168.2.6
Apr 8, 2021 13:56:24.656105995 CEST	49748	587	192.168.2.6	212.227.15.158
Apr 8, 2021 13:56:24.680350065 CEST	587	49748	212.227.15.158	192.168.2.6
Apr 8, 2021 13:56:24.680680037 CEST	49748	587	192.168.2.6	212.227.15.158
Apr 8, 2021 13:56:24.700917959 CEST	587	49748	212.227.15.158	192.168.2.6
Apr 8, 2021 13:56:24.700939894 CEST	587	49748	212.227.15.158	192.168.2.6
Apr 8, 2021 13:56:24.701294899 CEST	49748	587	192.168.2.6	212.227.15.158
Apr 8, 2021 13:56:24.721739054 CEST	587	49748	212.227.15.158	192.168.2.6
Apr 8, 2021 13:56:24.763144016 CEST	49748	587	192.168.2.6	212.227.15.158
Apr 8, 2021 13:56:24.854901075 CEST	49748	587	192.168.2.6	212.227.15.158
Apr 8, 2021 13:56:24.877895117 CEST	587	49748	212.227.15.158	192.168.2.6
Apr 8, 2021 13:56:24.877954006 CEST	587	49748	212.227.15.158	192.168.2.6
Apr 8, 2021 13:56:24.877990961 CEST	587	49748	212.227.15.158	192.168.2.6
Apr 8, 2021 13:56:24.878241062 CEST	49748	587	192.168.2.6	212.227.15.158
Apr 8, 2021 13:56:24.882872105 CEST	49748	587	192.168.2.6	212.227.15.158
Apr 8, 2021 13:56:24.903430939 CEST	587	49748	212.227.15.158	192.168.2.6
Apr 8, 2021 13:56:24.945874929 CEST	49748	587	192.168.2.6	212.227.15.158
Apr 8, 2021 13:56:25.274348021 CEST	49748	587	192.168.2.6	212.227.15.158
Apr 8, 2021 13:56:25.294574022 CEST	587	49748	212.227.15.158	192.168.2.6
Apr 8, 2021 13:56:25.307136059 CEST	49748	587	192.168.2.6	212.227.15.158
Apr 8, 2021 13:56:25.327366114 CEST	587	49748	212.227.15.158	192.168.2.6
Apr 8, 2021 13:56:25.328071117 CEST	49748	587	192.168.2.6	212.227.15.158
Apr 8, 2021 13:56:25.354927063 CEST	587	49748	212.227.15.158	192.168.2.6
Apr 8, 2021 13:56:25.357798100 CEST	49748	587	192.168.2.6	212.227.15.158
Apr 8, 2021 13:56:25.391242981 CEST	587	49748	212.227.15.158	192.168.2.6
Apr 8, 2021 13:56:25.391863108 CEST	49748	587	192.168.2.6	212.227.15.158
Apr 8, 2021 13:56:25.415335894 CEST	587	49748	212.227.15.158	192.168.2.6
Apr 8, 2021 13:56:25.418555021 CEST	49748	587	192.168.2.6	212.227.15.158
Apr 8, 2021 13:56:25.439104080 CEST	587	49748	212.227.15.158	192.168.2.6
Apr 8, 2021 13:56:25.447356939 CEST	49748	587	192.168.2.6	212.227.15.158
Apr 8, 2021 13:56:25.447470903 CEST	49748	587	192.168.2.6	212.227.15.158
Apr 8, 2021 13:56:25.450865984 CEST	49748	587	192.168.2.6	212.227.15.158
Apr 8, 2021 13:56:25.450938940 CEST	49748	587	192.168.2.6	212.227.15.158
Apr 8, 2021 13:56:25.467780113 CEST	587	49748	212.227.15.158	192.168.2.6
Apr 8, 2021 13:56:25.471020937 CEST	587	49748	212.227.15.158	192.168.2.6
Apr 8, 2021 13:56:25.475791931 CEST	587	49748	212.227.15.158	192.168.2.6
Apr 8, 2021 13:56:25.527986050 CEST	49748	587	192.168.2.6	212.227.15.158

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 8, 2021 13:54:29.310831070 CEST	64267	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:54:29.323438883 CEST	53	64267	8.8.8.8	192.168.2.6
Apr 8, 2021 13:54:30.150109053 CEST	49448	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:54:30.162914991 CEST	53	49448	8.8.8.8	192.168.2.6
Apr 8, 2021 13:54:58.056195021 CEST	60342	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:54:58.068922043 CEST	53	60342	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:00.362915993 CEST	61346	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:00.375672102 CEST	53	61346	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:01.744673014 CEST	51774	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:01.764659882 CEST	53	51774	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:15.327439070 CEST	56023	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:15.339849949 CEST	53	56023	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:16.030726910 CEST	58384	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:16.044173956 CEST	53	58384	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:16.076661110 CEST	60261	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:16.090249062 CEST	53	60261	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:16.503767014 CEST	56061	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:16.516599894 CEST	53	56061	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:16.855788946 CEST	58336	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:16.869081020 CEST	53	58336	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:17.018145084 CEST	53781	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:17.046446085 CEST	53	53781	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:17.291961908 CEST	54064	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:17.304398060 CEST	53	54064	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:17.742532969 CEST	52811	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:17.756438971 CEST	53	52811	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:17.772445917 CEST	55299	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:17.791837931 CEST	53	55299	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:18.222578049 CEST	63745	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:18.235402107 CEST	53	63745	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:18.547561884 CEST	50055	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:18.560071945 CEST	53	50055	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:19.110074997 CEST	61374	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:19.123141050 CEST	53	61374	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:20.157962084 CEST	50339	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:20.170722961 CEST	53	50339	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:20.609410048 CEST	63307	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:20.621942043 CEST	53	63307	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:24.486260891 CEST	49694	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:24.498848915 CEST	53	49694	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:25.246932983 CEST	54982	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:25.259480000 CEST	53	54982	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:26.208298922 CEST	50010	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:26.221723080 CEST	53	50010	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:27.153976917 CEST	63718	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:27.167279959 CEST	53	63718	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:31.936496019 CEST	62116	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:31.948426962 CEST	53	62116	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:33.254976988 CEST	63816	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:33.281289101 CEST	53	63816	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:35.488033056 CEST	55014	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:35.501447916 CEST	53	55014	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:45.156191111 CEST	62208	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:45.168934107 CEST	53	62208	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:46.059092999 CEST	57574	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:46.072094917 CEST	53	57574	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:48.830485106 CEST	51818	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:48.842998981 CEST	53	51818	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:52.643460035 CEST	56628	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:52.656511068 CEST	53	56628	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:53.470834970 CEST	60778	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:53.484002113 CEST	53	60778	8.8.8.8	192.168.2.6
Apr 8, 2021 13:55:54.145735025 CEST	53799	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:55:54.158551931 CEST	53	53799	8.8.8.8	192.168.2.6
Apr 8, 2021 13:56:06.882749081 CEST	54683	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:56:06.895538092 CEST	53	54683	8.8.8.8	192.168.2.6
Apr 8, 2021 13:56:07.708811045 CEST	59329	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:56:07.727602005 CEST	53	59329	8.8.8.8	192.168.2.6
Apr 8, 2021 13:56:08.603001118 CEST	64021	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:56:08.635907888 CEST	53	64021	8.8.8.8	192.168.2.6
Apr 8, 2021 13:56:24.476588964 CEST	56129	53	192.168.2.6	8.8.8.8
Apr 8, 2021 13:56:24.499018908 CEST	53	56129	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 8, 2021 13:56:24.476588964 CEST	192.168.2.6	8.8.8.8	0xb5a0	Standard query (0)	smtp.1and1.es	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 8, 2021 13:56:24.499018908 CEST	8.8.8.8	192.168.2.6	0xb5a0	No error (0)	smtp.1and1.es		212.227.15.158	A (IP address)	IN (0x0001)
Apr 8, 2021 13:56:24.499018908 CEST	8.8.8.8	192.168.2.6	0xb5a0	No error (0)	smtp.1and1.es		212.227.15.142	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 8, 2021 13:56:24.680350065 CEST	587	49748	212.227.15.158	192.168.2.6	220 kundenserver.de (mreue109) Nemesis ESMTP Service ready
Apr 8, 2021 13:56:24.680680037 CEST	49748	587	192.168.2.6	212.227.15.158	EHLO 899552
Apr 8, 2021 13:56:24.700939894 CEST	587	49748	212.227.15.158	192.168.2.6	250-kundenserver.de Hello 899552 [185.32.222.8] 250-8BITMIME 250-AUTH LOGIN PLAIN 250-SIZE 140000000 250 STARTTLS
Apr 8, 2021 13:56:24.701294899 CEST	49748	587	192.168.2.6	212.227.15.158	STARTTLS
Apr 8, 2021 13:56:24.721739054 CEST	587	49748	212.227.15.158	192.168.2.6	220 OK

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: unarchiver.exe PID: 6880 Parent PID: 5844

General

Start time:	13:54:32
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\Desktop\Szallitasi adatok.tar'
Imagebase:	0xb90000
File size:	10240 bytes
MD5 hash:	DB55139D9DD29F24AE8EA8F0E5606901
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: 7za.exe PID: 6916 Parent PID: 6880

General

Start time:	13:54:33
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s' 'C:\Users\user\Desktop\Szallitasi adatok.tar'
Imagebase:	0x70000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6964 Parent PID: 6916

General

Start time:	13:54:33
Start date:	08/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 7008 Parent PID: 6880

General

Start time:	13:54:34
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe'
Imagebase:	0x2a0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 7028 Parent PID: 7008

General

Start time:	13:54:34
Start date:	08/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: Szallitasi adatok.exe PID: 7056 Parent PID: 7008

General

Start time:	13:54:35
Start date:	08/04/2021
Path:	C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe
Imagebase:	0xa30000
File size:	872960 bytes
MD5 hash:	C615C5F811E05D5743CE4DD4AFAD4055
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.344267324.0000000003FF6000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000006.00000002.343156984.0000000002E03000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 19%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: Szallitasi adatok.exe PID: 7104 Parent PID: 7056

General

Start time:	13:54:42
Start date:	08/04/2021
Path:	C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\nqvbpsxm.54s\Szallitasi adatok.exe
Imagebase:	0xf80000
File size:	872960 bytes
MD5 hash:	C615C5F811E05D5743CE4DD4AFAD4055
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.590323403.0000000003481000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.590323403.0000000003481000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.586946181.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: unarchiver.exe PID: 6880 Parent PID: 5844 unarchiver.exeCOMMON

Execution Graph

Execution Coverage:	20.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6%
Total number of Nodes:	67
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02EB02A8, Relevance: 3.0, Strings: 2, Instructions: 481
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@Dr, xrefs: 02EB062E
X1kr, xrefs: 02EB06FA

Memory Dump Source

Source File: 00000000.00000002.349815690.0000000002EB0000.00000040.00000001.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_unarchiver.jbxd

Similarity

API ID:
String ID: :@Dr$X1kr
API String ID: 0-2776031997
Opcode ID: a787740df63da0687995ad0e814fd45c808772357dcd669b3f49c00c53cad410
Instruction ID: 1f62124623bdde6c3ed4fd94842e5189dc20362410b786a1790d1ed1dfb3211b
Opcode Fuzzy Hash: a787740df63da0687995ad0e814fd45c808772357dcd669b3f49c00c53cad410
Instruction Fuzzy Hash: 0322D674E00258CFDB25DFA9E844B9EBBB2FBA9301F1091A9E409B7265DB345D81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0146B042, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0146B074

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 46ebe64adec0612004d5104c5e18106a85a072c4136fecae34465ce983c29fb3
Instruction ID: c1cb57e973fa3f223057863cfe395219707725791d3f1e2caf900463ef46d6f6
Opcode Fuzzy Hash: 46ebe64adec0612004d5104c5e18106a85a072c4136fecae34465ce983c29fb3
Instruction Fuzzy Hash: AA018F709042449FDB10CF19D885756FF98DF44224F18C4ABDE488F252D2B5A404CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0146B0B2, Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0146B15F

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 484166cbe7f876846cf15185711757aef4e9b5c09fcde417cab3ca9fd2955bf1
Instruction ID: 88be73b194748be3dbdaccb6ecf53bbb17449c73aa386d6938f12d9ca04971f8
Opcode Fuzzy Hash: 484166cbe7f876846cf15185711757aef4e9b5c09fcde417cab3ca9fd2955bf1
Instruction Fuzzy Hash: 5E31B272504344AFEB228F65DC44FA7BFACEF46310F04859BE985DB152D364A819CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0146AB70, Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0146AC13

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cd6ebd3516e646aa7bd16e05a4194738fa86d8ec4d4fcc8dd225b8327dc79dc3
Instruction ID: ef61e0960b5872a2d29259cac7018a2e2f4c124e67884c0fac1ff359ce1803a2
Opcode Fuzzy Hash: cd6ebd3516e646aa7bd16e05a4194738fa86d8ec4d4fcc8dd225b8327dc79dc3
Instruction Fuzzy Hash: C531D372104344AFEB228B64CC44F67BFACEF46310F0888ABF985DB252D264A419CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0146A9E2, Relevance: 1.6, APIs: 1, Instructions: 93
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 0146AAA2

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: e2954f9e149345715ec80e65033f0e949e41b5b3ba8858bfdebb6263a4757d07
Instruction ID: 8e9d1e8089b101f0af1acff7105c967f997fad96cb11e32b4b5b6f5c886031d2
Opcode Fuzzy Hash: e2954f9e149345715ec80e65033f0e949e41b5b3ba8858bfdebb6263a4757d07
Instruction Fuzzy Hash: E1318E6640E3C06FD3038B718C65A52BFB4AF47610F1D84DBD8C48F1A3D2696919C766

Uniqueness

Uniqueness Score: -1.00%

Function 0146A504, Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0146A5A9

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 082e816e710fc5061cbab08e21257d421e796303c7293480be041669bb1ea2a9
Instruction ID: 39134e738cd7c5d1c83cca37f75e82d9fda69a523e860e440e69de424240e6fd
Opcode Fuzzy Hash: 082e816e710fc5061cbab08e21257d421e796303c7293480be041669bb1ea2a9
Instruction Fuzzy Hash: E5319EB1504780AFE722CF25CC44F66BFE8EF45210F1884AEE9859B252D375E809CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0146A120, Relevance: 1.6, APIs: 1, Instructions: 83
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 0146A1C2

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 221b500f6a42ce5ec3dff5a4ce22a4b8bcc47df5a426958bf1c3c2404cf4378b
Instruction ID: 519f969d5cc72a95b529e4607a823f637effa3879de449df12cf4c1fcda98b3e
Opcode Fuzzy Hash: 221b500f6a42ce5ec3dff5a4ce22a4b8bcc47df5a426958bf1c3c2404cf4378b
Instruction Fuzzy Hash: 5F21D37140D3C06FD7128B358C55BA2BFB4EF47620F1981DBED848F293D265A919C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0146B0E2, Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0146B15F

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4bd92241f7654def6d0ee2d08e1a5fcadc39874389958caf80e481c0365da3de
Instruction ID: cfd22749970100d7bc9b59f2df01dd056bef7342d4c90730f82c43b5fec3609c
Opcode Fuzzy Hash: 4bd92241f7654def6d0ee2d08e1a5fcadc39874389958caf80e481c0365da3de
Instruction Fuzzy Hash: 97219D72500204EFEB219F69DC85FABFBACEF04320F14896BEE45DB251D670A4198B71

Uniqueness

Uniqueness Score: -1.00%

Function 0146AB96, Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0146AC13

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e8634ae194fe9bdbd855c63664912584dbb037d0f1fdd8893e8c03d2af1dee73
Instruction ID: 8a0b497748e48f30cf23e0b65d0abe6e39727109cf49a2c8d95ce42048187c4f
Opcode Fuzzy Hash: e8634ae194fe9bdbd855c63664912584dbb037d0f1fdd8893e8c03d2af1dee73
Instruction Fuzzy Hash: E521CF72500604AFEB21CF68DC84F6BFBECEF04320F14896BEE459B251D670A4198BB1

Uniqueness

Uniqueness Score: -1.00%

Function 0146A77C, Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E2C,796FD4D2,00000000,00000000,00000000,00000000), ref: 0146A80A

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9656841bba64c27b2b3af1f67ee6a6f5a99d117804790201f7507f2f674347e6
Instruction ID: 55cfddcac89e4e1d260ac68c798f16c73babacf28dd40bbcf43d7c3966b90f7a
Opcode Fuzzy Hash: 9656841bba64c27b2b3af1f67ee6a6f5a99d117804790201f7507f2f674347e6
Instruction Fuzzy Hash: 2621A171408380AFE7128B24DC44F66BFB8EF46714F1884EBEE849F253D265A809C772

Uniqueness

Uniqueness Score: -1.00%

Function 0146A85F, Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,00000E2C,796FD4D2,00000000,00000000,00000000,00000000), ref: 0146A8ED

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 71274eeab13acaf28e6f9ccea2b55eff3c02be3692c49cfe1df4c7631300ff51
Instruction ID: 0d6f017ccb99fd70b87631836625fa44901b8c7403a05da3b2a17fd6854aa793
Opcode Fuzzy Hash: 71274eeab13acaf28e6f9ccea2b55eff3c02be3692c49cfe1df4c7631300ff51
Instruction Fuzzy Hash: 2221A171009380AFDB228F65DC44F57BFB8EF06310F18849BEA849F262C275A409CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0146A52A, Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0146A5A9

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d44d7302feeca3d9404b98d1937d74b0ba02d830f4bba4743b96d7f8cec5f854
Instruction ID: aa6ac9482a563f17e11b968e1a91234a0cc4147fb76b4dd1a31ad95947716af1
Opcode Fuzzy Hash: d44d7302feeca3d9404b98d1937d74b0ba02d830f4bba4743b96d7f8cec5f854
Instruction Fuzzy Hash: B4219A71600640AFEB21CF29C884B66FBE8EF08214F14846AEA859B252D371E405CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0146A6BB, Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E2C,796FD4D2,00000000,00000000,00000000,00000000), ref: 0146A741

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 0057df69e52c1dba6951cba5efb37763de87d67e1695d8e259bfd058da4f4fa3
Instruction ID: 55451ad8410b64cc8a59d07f7ed00e2669354665842e22a8a10381ed8c8f1ee7
Opcode Fuzzy Hash: 0057df69e52c1dba6951cba5efb37763de87d67e1695d8e259bfd058da4f4fa3
Instruction Fuzzy Hash: CC21C6754087846FE7128B25DC40FA6BFB8DF47714F1880D7ED849B253D264A909D771

Uniqueness

Uniqueness Score: -1.00%

Function 0146A600, Relevance: 1.6, APIs: 1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0146A674

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 00fcd341dbafd1f931b631c71bd6f00ed67affa0f9a54209882d285a9f639c52
Instruction ID: cd5f547dd1baf7efbc1a0a115ce198da72c4de4bc89c5d18ed96246e68651a77
Opcode Fuzzy Hash: 00fcd341dbafd1f931b631c71bd6f00ed67affa0f9a54209882d285a9f639c52
Instruction Fuzzy Hash: 4A21C27550A3C05FD7038B25DC95752BFB8AF47220F1980DBED858F6A3D2655908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0146A448, Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0146A4AF

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: a3d6b044834f4fa9c2246e04eda5ebb9decb3144d5d7401b7fdfea2877a1456e
Instruction ID: 6243d319b45a70b35728c6593bd9fb986fcadead0391fae46062c07bf0dbae76
Opcode Fuzzy Hash: a3d6b044834f4fa9c2246e04eda5ebb9decb3144d5d7401b7fdfea2877a1456e
Instruction Fuzzy Hash: 8D1172715057849FD711CF29DC89B56BFE8EF06220F1880AAED45DF252D274E904CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0146A88E, Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,00000E2C,796FD4D2,00000000,00000000,00000000,00000000), ref: 0146A8ED

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: c0d7df619f73af2bf7c210d4725b4455de29ddfef86dc10239bbe78e9edd83ed
Instruction ID: 22260b0c8d543e929eae9af739c810b9cb299017e63b81aa1883c986a4ddf6cc
Opcode Fuzzy Hash: c0d7df619f73af2bf7c210d4725b4455de29ddfef86dc10239bbe78e9edd83ed
Instruction Fuzzy Hash: E611BF71400604EEEB218F55DC84F67FBA8EF04324F24886BEE459B251D275A4098B72

Uniqueness

Uniqueness Score: -1.00%

Function 0146A7AE, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000E2C,796FD4D2,00000000,00000000,00000000,00000000), ref: 0146A80A

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 891b0a14cee8ed037b9fb2122aa3949427dd9cde21d3f60244910611c8077962
Instruction ID: f985d042f29a3a4542acec70378724a127599febf50f1e0b6de56daebbe1f1bc
Opcode Fuzzy Hash: 891b0a14cee8ed037b9fb2122aa3949427dd9cde21d3f60244910611c8077962
Instruction Fuzzy Hash: 0E11C171400600AFEB21CF58DC84F67FBACEF44324F14C46BEE459B251D274A4098BB2

Uniqueness

Uniqueness Score: -1.00%

Function 0146A6EE, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,796FD4D2,00000000,00000000,00000000,00000000), ref: 0146A741

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 9828e3dfd12ce29f92199addc7fffa6cf8ea38300c9af2572a6e456b236d32f6
Instruction ID: 655ecac3ee857a5486ec7e463a429a7bbb8b2fc256fed3d88924c344a628d0b3
Opcode Fuzzy Hash: 9828e3dfd12ce29f92199addc7fffa6cf8ea38300c9af2572a6e456b236d32f6
Instruction Fuzzy Hash: 93012631500604AEE710CB19DC84F67FBACDF05725F24C057EE45AB351D678E4058B72

Uniqueness

Uniqueness Score: -1.00%

Function 0146A46A, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0146A4AF

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 38fe5599d636f4e37283588623c4201e1074869ac0141143bcaa403a13eb6645
Instruction ID: 2fa5ea7609691a8594e88adaf889e4e9064443b43a6e091763ab4deeb980ed6a
Opcode Fuzzy Hash: 38fe5599d636f4e37283588623c4201e1074869ac0141143bcaa403a13eb6645
Instruction Fuzzy Hash: 0E118E716006009FEB10CF29DC89766FBD8EF04224F1880BBDE49DB752E675E404CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0146ADF7, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0146AE50

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 976baaca99347303d9c65a2083ebcb8351a6d5055803ca3a4d78a070e11d8038
Instruction ID: b81469a21821656bda768db92e531cf540d43e59d1d12705ff22f2709224a2eb
Opcode Fuzzy Hash: 976baaca99347303d9c65a2083ebcb8351a6d5055803ca3a4d78a070e11d8038
Instruction Fuzzy Hash: BC1191715097809FD7128B29DC45A52FFF8EF06220F0980DBDD858B263C275A848CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0146B020, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0146B074

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 6577bc10bed7be201dfefbe54d9e918718577c3b62cf36a910088a0fa6fb307d
Instruction ID: 386f2dd124d682f86268475d41b9dc02543e6b202f2d737f030533998e75687f
Opcode Fuzzy Hash: 6577bc10bed7be201dfefbe54d9e918718577c3b62cf36a910088a0fa6fb307d
Instruction Fuzzy Hash: 67117071509384AFDB12CF25DC84B56FFA8DF46224F1884EBED848F253D275A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0146A23C, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0146A290

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: a170be37fc7a27a57bf0c2464f2f6da8440207b5bd879778183bd386feb620dc
Instruction ID: 054d1fbda966df4d0b511bce74c14873ef730ee06072eb01fe5f160ab3698708
Opcode Fuzzy Hash: a170be37fc7a27a57bf0c2464f2f6da8440207b5bd879778183bd386feb620dc
Instruction Fuzzy Hash: B511A171409384AFD7128B15DC84B62FFB8DF46224F0880DBED849F263D275A808CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0146AA52, Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 0146AAA2

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: f55e3ab8c2752a9737363cfb2b12d3842bc7e5e907b875c2983121619da75dfe
Instruction ID: bdf58013ff92483a527af92be071b09fea90b7c1f84801606a51cf67468c60ef
Opcode Fuzzy Hash: f55e3ab8c2752a9737363cfb2b12d3842bc7e5e907b875c2983121619da75dfe
Instruction Fuzzy Hash: 79017172500600ABD710DF16DC86F26FBA8FB88B20F14816AED089B741E371B515CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0146A172, Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 0146A1C2

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: dff6563bb1ce7a4649aafd9ec950166df721e6bd255c8fd4375c3bb5f9352ecf
Instruction ID: 038c258f7f4a11a06e0837f213697b4ba20ca2c8a22d2739c94558739bada3f0
Opcode Fuzzy Hash: dff6563bb1ce7a4649aafd9ec950166df721e6bd255c8fd4375c3bb5f9352ecf
Instruction Fuzzy Hash: 11017171500600ABD710DF16DC86B26FBA8EB88A20F14816AED089B741E375B515CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0146A642, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0146A674

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 22fa2a2abc60a8ce63c4118f4f2553bfcc8c52299f15fda13d2b2b3b7da2cdac
Instruction ID: 03b7c9e4def6e9a4b0a59e1dff56a6a4f972b1231f42949ef8036488c4b1372e
Opcode Fuzzy Hash: 22fa2a2abc60a8ce63c4118f4f2553bfcc8c52299f15fda13d2b2b3b7da2cdac
Instruction Fuzzy Hash: 79018F719006409FDB11CF29D885766FFA8EF44224F18C0ABDE499F752D6B5A818CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0146AE1E, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0146AE50

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: a7e7c6d2eb2b76b34dd66e2f52ba3857d4a712eac564a478bb178ba787d2e757
Instruction ID: 840f0335e4cb305f0bffd3b92bccabe00dba3863d9f2aa214c5e5fc5a758d5f5
Opcode Fuzzy Hash: a7e7c6d2eb2b76b34dd66e2f52ba3857d4a712eac564a478bb178ba787d2e757
Instruction Fuzzy Hash: D701D135640A409FDB108F19DC85766FF98DF04334F18C0ABDD499B762D2B5E808CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0146A25E, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0146A290

Memory Dump Source

Source File: 00000000.00000002.349594090.000000000146A000.00000040.00000001.sdmp, Offset: 0146A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: ce35d0b85879b1f0d48a3ca47086877b4c9306b5f5ec2482ce31e9e0f6393779
Instruction ID: a2fc72592afc0f20727de126ccd7c930a6c8bc3dab6ada1c876ca1bd5be92c17
Opcode Fuzzy Hash: ce35d0b85879b1f0d48a3ca47086877b4c9306b5f5ec2482ce31e9e0f6393779
Instruction Fuzzy Hash: 55F0AF35904A44DFDB10CF19D884762FFA4EF04724F28C09BDE495B762D2B6A408CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 02EC08A2, Relevance: 1.0, Instructions: 976COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349823107.0000000002EC0000.00000040.00000040.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c31217d2c1a5695f778c19ad1ed92777cbf095560f89046faa1fc5f2e242edd7
Instruction ID: 585bbb42aad044d51ed4f2fbde18b1f0c446cf5d26db9de1adeb3430bcf27186
Opcode Fuzzy Hash: c31217d2c1a5695f778c19ad1ed92777cbf095560f89046faa1fc5f2e242edd7
Instruction Fuzzy Hash: CC11C0E39492401FE7424A146C978E5BBF4CD93034B1981EBEC89CB213F21A591B8BE7

Uniqueness

Uniqueness Score: -1.00%

Function 02EB0C30, Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349815690.0000000002EB0000.00000040.00000001.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca1af7f7c15cb6d847131aaf34403e50f68ac1ab70fae22bb33e7c05db0ea15
Instruction ID: 07c62c1b48d2fdc248ba3f7c2cc96b127edc4431856bd7710bc6e077221da856
Opcode Fuzzy Hash: 9ca1af7f7c15cb6d847131aaf34403e50f68ac1ab70fae22bb33e7c05db0ea15
Instruction Fuzzy Hash: 5451E570E42218DFCB58DFB9D490AAEBBB2BF89300F20A469E405B7354DB35A941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02EB0ACA, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349815690.0000000002EB0000.00000040.00000001.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea7c478e1237ad87e6fd34cb332ad7dd31c1b0d8300afc0b394e34f9e7a724ac
Instruction ID: 7f3b0449c3f631ff9683f677aa6a8131ef9d99953edd4749f2806b23c15ecc1b
Opcode Fuzzy Hash: ea7c478e1237ad87e6fd34cb332ad7dd31c1b0d8300afc0b394e34f9e7a724ac
Instruction Fuzzy Hash: 93214A75E01208CFCB04DFA8E4946EEBBB6FB98314F20952AE501B3260DB746D16CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02EB0AD8, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349815690.0000000002EB0000.00000040.00000001.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 140e823b09b1796d909910376e32b682c182ffd9160f0dcb28f40cad66db12a5
Instruction ID: 77d72fb872d932d39570f43b36836d8da6e4edcb55feed76b481ef222050e44c
Opcode Fuzzy Hash: 140e823b09b1796d909910376e32b682c182ffd9160f0dcb28f40cad66db12a5
Instruction Fuzzy Hash: B0213A75E01208CFCB05DFA8E4946EEBBB6FB89314F20952AE50073264DB746E16CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02EC07F7, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349823107.0000000002EC0000.00000040.00000040.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e8c63ea1cbcf2b38d5df54bf778d4a396d14dd27ed14b448edfa6cdb6fa968
Instruction ID: 098a87e35f9dfb2a5dad111db0e90f6b083fad28821c1b8f12d99b31b1a25b55
Opcode Fuzzy Hash: 78e8c63ea1cbcf2b38d5df54bf778d4a396d14dd27ed14b448edfa6cdb6fa968
Instruction Fuzzy Hash: E001D4B24093406FD301CF15EC41C57BBE8DF86520B09C96BFD488B202D266B9188BB2

Uniqueness

Uniqueness Score: -1.00%

Function 02EC05CF, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349823107.0000000002EC0000.00000040.00000040.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 977cccf36b50e8053c655a7e4b642988dd5c77820ddf734d437b5890b9abe566
Instruction ID: faab1a8901b1f50a241ad043878dbf0cb70e332ebd467fe4eb2711fef997e11e
Opcode Fuzzy Hash: 977cccf36b50e8053c655a7e4b642988dd5c77820ddf734d437b5890b9abe566
Instruction Fuzzy Hash: 4A01D6B25097806FD7128F16AC40862FFB8DF86220709C49FED498B612D225B809CB72

Uniqueness

Uniqueness Score: -1.00%

Function 02EB0E38, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349815690.0000000002EB0000.00000040.00000001.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6e6f3716ecdcaf007b315d792ebe005fe2e31ac42a8245de87414bf19f4c25e
Instruction ID: 68ad386d540de614214abee25f1132d87c5af31167ae36f3a46686bfd90c0ee0
Opcode Fuzzy Hash: c6e6f3716ecdcaf007b315d792ebe005fe2e31ac42a8245de87414bf19f4c25e
Instruction Fuzzy Hash: 8001C270D413488FCF19DFA8D554BAEBBB1AF46309F20A9AAC40177291D7755A84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02EB0E48, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349815690.0000000002EB0000.00000040.00000001.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445b39ab20dfa5d58b03f752cb61e314aaa5035c14df2a5427525e9de82e5718
Instruction ID: a41e23169f4e54fe63c0c6f10956c1415d2d53455a9a9b1adf82d6d68a8ebd07
Opcode Fuzzy Hash: 445b39ab20dfa5d58b03f752cb61e314aaa5035c14df2a5427525e9de82e5718
Instruction Fuzzy Hash: 0101D274D41309DFCB08EFA8D144BAEBBB1AF45305F20A9A9C40177290DB78AA84CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02EB0BBF, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349815690.0000000002EB0000.00000040.00000001.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c9f0c609d946a6dd3f5a857d8a951670c1e50691e02d1c97e727424e665f49d
Instruction ID: 89dd0211d63c8d8b040d8da943ee058b6afc421aa97a9b8bb77cb02629835109
Opcode Fuzzy Hash: 2c9f0c609d946a6dd3f5a857d8a951670c1e50691e02d1c97e727424e665f49d
Instruction Fuzzy Hash: 8201F2B4D04209DFCF04DFA9D584AEEBFF1EF85300F2098AA8819A3214EB785A01DF51

Uniqueness

Uniqueness Score: -1.00%

Function 02EC081E, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349823107.0000000002EC0000.00000040.00000040.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c91a980880d3f86d29f3c1faf7065e45c8683ff0b9f61dab7f8f66753a28799
Instruction ID: 221e2802f34df01c06364ebf7d063cc9c66e6bb74b16b1d9d4054dba2e2cb03c
Opcode Fuzzy Hash: 1c91a980880d3f86d29f3c1faf7065e45c8683ff0b9f61dab7f8f66753a28799
Instruction Fuzzy Hash: D9F082B29052046BD340DF05EC41896F7ECDFC4921B14C52EFD488B700E376B9154AF6

Uniqueness

Uniqueness Score: -1.00%

Function 02EC05F6, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349823107.0000000002EC0000.00000040.00000040.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96fe71e70594553670f74a5a11ec508f45ed1f126b70fbc6a6fba5bb96ed481a
Instruction ID: aedd5c6f8c88ded0dece6b6b1586538973e474e7f09a83072dd565b4565f628f
Opcode Fuzzy Hash: 96fe71e70594553670f74a5a11ec508f45ed1f126b70fbc6a6fba5bb96ed481a
Instruction Fuzzy Hash: BCE06D766006008B9750CF0AEC81452F798EB88630B58C16FDD0D8BB00E236B5058EA5

Uniqueness

Uniqueness Score: -1.00%

Function 014623F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349583530.0000000001462000.00000040.00000001.sdmp, Offset: 01462000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1462000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c50b1ef3c31e146658771badbcaee739737c87fba915802da88cf4717435f24f
Instruction ID: 5c2241bf6b8951d4ee3301e644403f33c92a82113f784c64495a036f9f1d861d
Opcode Fuzzy Hash: c50b1ef3c31e146658771badbcaee739737c87fba915802da88cf4717435f24f
Instruction Fuzzy Hash: B3D05B752156915FD3168A1CC168F653FA4AF51B04F4644FEE8008B773C764D581D101

Uniqueness

Uniqueness Score: -1.00%

Function 014623BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349583530.0000000001462000.00000040.00000001.sdmp, Offset: 01462000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1462000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa41b08126a353943b66474bc074b7e3b7cb086a9fd958d9ac68de37bf6bd21c
Instruction ID: 26bb0cdb04bec96a8d0cd0c67f8bc1084db2c4c1c6803f8e6183c78e9bf10735
Opcode Fuzzy Hash: fa41b08126a353943b66474bc074b7e3b7cb086a9fd958d9ac68de37bf6bd21c
Instruction Fuzzy Hash: E2D05E342002818BD715DB1CC594F5A3BD8AB41B04F0644EAAD00CB772C3B4D8C1C600

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02EB0299, Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349815690.0000000002EB0000.00000040.00000001.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e8bf58c8d5764f0faa3445b5962d5c171eaf49b86e8985276f142ead6de383b
Instruction ID: f512c9fa661e154c0b60152da8033c71cbfe0ce46bf14938d218a3862ba2cdff
Opcode Fuzzy Hash: 7e8bf58c8d5764f0faa3445b5962d5c171eaf49b86e8985276f142ead6de383b
Instruction Fuzzy Hash: 9991FC74E00244DFDB15CFA9E848A9DBBB3FBA9301F10D1A9E809B7264DB345945DF60

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Szallitasi adatok.exe PID: 7056 Parent PID: 7008 Szallitasi adatok.exeCOMMON

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	160
Total number of Limit Nodes:	6

Executed Functions

Function 014C6A40, Relevance: 6.1, APIs: 4, Instructions: 124
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 014C6AB0
GetCurrentThread.KERNEL32 ref: 014C6AED
GetCurrentProcess.KERNEL32 ref: 014C6B2A
GetCurrentThreadId.KERNEL32 ref: 014C6B83

Memory Dump Source

Source File: 00000006.00000002.342874409.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_14c0000_Szallitasi adatok.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4b7cae525a9f378c1555aaa006d2b9a735d97c2a2ac6aebc2810f65447a883dc
Instruction ID: 9a59d8735854933155a70263a50e40e66aaff287b24c1b0d9fc4af2f6d592388
Opcode Fuzzy Hash: 4b7cae525a9f378c1555aaa006d2b9a735d97c2a2ac6aebc2810f65447a883dc
Instruction Fuzzy Hash: CC5163B4904648CFDB54CFA9D948B9EBBF0BF49304F20845EE519A7361D7749844CB61

Uniqueness

Uniqueness Score: -1.00%

Function 014C6A50, Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 014C6AB0
GetCurrentThread.KERNEL32 ref: 014C6AED
GetCurrentProcess.KERNEL32 ref: 014C6B2A
GetCurrentThreadId.KERNEL32 ref: 014C6B83

Memory Dump Source

Source File: 00000006.00000002.342874409.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_14c0000_Szallitasi adatok.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 56fdd089a6ad757ebe81d7e326e909085d32d832098216c0b05e4710d69b25d8
Instruction ID: d323408bb34a56c51625070fb461f67b6cb12e6d9fc4fef1abd837e8d207f73a
Opcode Fuzzy Hash: 56fdd089a6ad757ebe81d7e326e909085d32d832098216c0b05e4710d69b25d8
Instruction Fuzzy Hash: 295144B4904648CFDB54CFAAD948BEEBBF0BF49314F20845EE119A7360D7749844CB65

Uniqueness

Uniqueness Score: -1.00%

Function 04E6430C, Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 04E64546

Memory Dump Source

Source File: 00000006.00000002.344602286.0000000004E60000.00000040.00000001.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_Szallitasi adatok.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c084a664251999c8c908bfb4022fd8e91d49a3b5e979d130ba323a7a122ee92b
Instruction ID: cbf080530ead22bdb757027f8eaf69b348f01cd5040fc3e3a0e3a105613ce85c
Opcode Fuzzy Hash: c084a664251999c8c908bfb4022fd8e91d49a3b5e979d130ba323a7a122ee92b
Instruction Fuzzy Hash: 3E917E71D00219DFEF20DF68C9417EDBBB2BF48358F049569E81AA7280DB74A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04E64310, Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 04E64546

Memory Dump Source

Source File: 00000006.00000002.344602286.0000000004E60000.00000040.00000001.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_Szallitasi adatok.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 524f6438ce8e4306195a8b1ac5ecabb1e6b47d0121e880f82cbedc180c477d2a
Instruction ID: 0eb18f94d232f461b692314aae984aae87dd185c16838896c5a1419b2101b0cc
Opcode Fuzzy Hash: 524f6438ce8e4306195a8b1ac5ecabb1e6b47d0121e880f82cbedc180c477d2a
Instruction Fuzzy Hash: A0916E71D00219DFEF20DF69C9417EDBBB2BF48358F048569E81AA7280DB74A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 014CBA50, Relevance: 1.7, APIs: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 014CBCA6

Memory Dump Source

Source File: 00000006.00000002.342874409.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_14c0000_Szallitasi adatok.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 458e20302c7134698996139b10ec3e6ab397d1d51005a4fe2acf8892db024d92
Instruction ID: 513f52f442d90cb1180feefd3977a6a0f7410eb2eb76366e9d85a692e1747017
Opcode Fuzzy Hash: 458e20302c7134698996139b10ec3e6ab397d1d51005a4fe2acf8892db024d92
Instruction Fuzzy Hash: 90812574A00B058FD764CF2AD45169ABBF1FF88644F10892ED48ADBB50E775E805CB91

Uniqueness

Uniqueness Score: -1.00%

Function 014CDB0D, Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 014CDC2A

Memory Dump Source

Source File: 00000006.00000002.342874409.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_14c0000_Szallitasi adatok.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 222a8af4d974536bb41b7fff4508bbcada3f1e7f9f5c841f891b52167fd31553
Instruction ID: 87d13aa8b8937b62bed28e97370ceb83f91ed5c105fd7ed7dbbd3289b6e1ac74
Opcode Fuzzy Hash: 222a8af4d974536bb41b7fff4508bbcada3f1e7f9f5c841f891b52167fd31553
Instruction Fuzzy Hash: 6C51C1B5D00309DFDF14CFA9D984ADEBBB1BF48310F24862AE819AB210D7709885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 014CDB18, Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 014CDC2A

Memory Dump Source

Source File: 00000006.00000002.342874409.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_14c0000_Szallitasi adatok.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 5ce00bbd0f911c80b7ca578f3548db2ef0ecd0176b94ba3bdde7bd546350735a
Instruction ID: 4d35977b45562910ce2070e5119af653b3c25796beab4d896485c675fe009fd8
Opcode Fuzzy Hash: 5ce00bbd0f911c80b7ca578f3548db2ef0ecd0176b94ba3bdde7bd546350735a
Instruction Fuzzy Hash: 2441C0B5D00308DFDF14CF99D984ADEBBB5BF88714F24852AE819AB210D7749885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 014C7009, Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 014C7107

Memory Dump Source

Source File: 00000006.00000002.342874409.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_14c0000_Szallitasi adatok.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 14f7845cb5b0b1f6a22e37605e911b48b25446b2a304014228e71336233a72ea
Instruction ID: f1d1efeff6a7f9270f063f417061d9f4f3ab2bf8d8b53e35e94d5dbef6c9e0b9
Opcode Fuzzy Hash: 14f7845cb5b0b1f6a22e37605e911b48b25446b2a304014228e71336233a72ea
Instruction Fuzzy Hash: 5141457A900259AFDB01CF99D844AEEBFF5FF89310F14806AE944A7321C7349915CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04E63C81, Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04E63D18

Memory Dump Source

Source File: 00000006.00000002.344602286.0000000004E60000.00000040.00000001.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_Szallitasi adatok.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2c202d43c0ddeebb441b8ad728271f92e76217494141cadbdba5bf3a1e5fab6d
Instruction ID: 78fad8ef2b06ca2ec3e4eef8c1b2ab09b7061d9bfed9ac4ccc6a63257a2e323e
Opcode Fuzzy Hash: 2c202d43c0ddeebb441b8ad728271f92e76217494141cadbdba5bf3a1e5fab6d
Instruction Fuzzy Hash: 2A2144B59043499FCF00CFA9C9817EEBBF1FF48314F14842AE919A7240C778A955CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04E63C88, Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04E63D18

Memory Dump Source

Source File: 00000006.00000002.344602286.0000000004E60000.00000040.00000001.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_Szallitasi adatok.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0a244ddc63b9559f2d81b3e63c88df8ca480e6639627718ed6332605903dc3b2
Instruction ID: 6f407a2ce34b6249db568cbed9a1562417d43541ea4b93e8937ecdc979699075
Opcode Fuzzy Hash: 0a244ddc63b9559f2d81b3e63c88df8ca480e6639627718ed6332605903dc3b2
Instruction Fuzzy Hash: 882136719043499FCF10CFAAC984BEEBBF5FF48354F10842AE919A7240D778A955CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04E64171, Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04E641F8

Memory Dump Source

Source File: 00000006.00000002.344602286.0000000004E60000.00000040.00000001.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_Szallitasi adatok.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 9240bab1786c62ee3d03d2a61e47dfd00478559c0a7cd3a0668c689be808401f
Instruction ID: 621c49bfb381594ddcc791fdf79b5fd1c8a4a8c50c5affe71ec92758286e418c
Opcode Fuzzy Hash: 9240bab1786c62ee3d03d2a61e47dfd00478559c0a7cd3a0668c689be808401f
Instruction Fuzzy Hash: 172116B1D042599FDF00CFA9C9807EEBBF1FF58314F54842AD529A7240C7789545CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04E64178, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04E641F8

Memory Dump Source

Source File: 00000006.00000002.344602286.0000000004E60000.00000040.00000001.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_Szallitasi adatok.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 80e9d7919ffc13153277e54c1f3ef27cf226423a6f2d6ec54d5c04a29c28a84f
Instruction ID: d67673a6a5b62fb0c76bbcc30ea312495a1b1fc8f76b5c5d4a4a051ea001c3f3
Opcode Fuzzy Hash: 80e9d7919ffc13153277e54c1f3ef27cf226423a6f2d6ec54d5c04a29c28a84f
Instruction Fuzzy Hash: EB2128718043599FDF10CFAAC880BEEBBF5FF48354F10842AE919A7240C778A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04E63AF0, Relevance: 1.6, APIs: 1, Instructions: 63
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 04E63B6E

Memory Dump Source

Source File: 00000006.00000002.344602286.0000000004E60000.00000040.00000001.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_Szallitasi adatok.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: f3a2fff541d0dcfcaa99d14dfb8654a138a0928e78bd9bee6f6b80f1d29a7e37
Instruction ID: 5f5207060f72d454f0ecf980d69620b5a53adead4678c663011942c2f9ab02ea
Opcode Fuzzy Hash: f3a2fff541d0dcfcaa99d14dfb8654a138a0928e78bd9bee6f6b80f1d29a7e37
Instruction Fuzzy Hash: 972118719043099FDB10CFAAC4847EEBBF4EF58368F14842AD959A7240DB78A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014C7078, Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 014C7107

Memory Dump Source

Source File: 00000006.00000002.342874409.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_14c0000_Szallitasi adatok.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6dd0185125330921298a996443ed364c564129b82d58b6ac2385bbd65a2a57a4
Instruction ID: 4dfcc8c9405a12765e8fe500f2d513ed41bf159bd7c0377412210c10ee9b99da
Opcode Fuzzy Hash: 6dd0185125330921298a996443ed364c564129b82d58b6ac2385bbd65a2a57a4
Instruction Fuzzy Hash: 4B2103B5900208EFDB00CFA9D984ADEBFF4EF48364F14845AE954A7311D374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014C7080, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 014C7107

Memory Dump Source

Source File: 00000006.00000002.342874409.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_14c0000_Szallitasi adatok.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5966eac2f1c5515196d5684761209e6a621d61da8cf7dd91260f6070e99dd69e
Instruction ID: 46984db62129a1b5b9768f1303bd2d6473839bada33895337f64148f69267b7d
Opcode Fuzzy Hash: 5966eac2f1c5515196d5684761209e6a621d61da8cf7dd91260f6070e99dd69e
Instruction Fuzzy Hash: ED21E2B5900208EFDB10CFAAD984ADEBBF9EB48324F14841AE914A7310D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014CA988, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,014CBD21,00000800,00000000,00000000), ref: 014CBF32

Memory Dump Source

Source File: 00000006.00000002.342874409.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_14c0000_Szallitasi adatok.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: cbbdd05d37aa941e9b4655fa49f704bd29dc3c0c03469ba5d555845258c1a8d2
Instruction ID: d347c94308b4a06c65d6c3f0475de32af05b66b8c3c6a46fb97975e82f4c1f15
Opcode Fuzzy Hash: cbbdd05d37aa941e9b4655fa49f704bd29dc3c0c03469ba5d555845258c1a8d2
Instruction Fuzzy Hash: CE1103B69042099FDB10CF9AD444BDEBBF4EB88764F04842EE515A7310C375A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014CAAC6, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 014CE1C5

Memory Dump Source

Source File: 00000006.00000002.342874409.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_14c0000_Szallitasi adatok.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 8e8d07524fd5c61fb5d91077c3a4b109eb7a5b3780c390cf711fc75e0b3aba59
Instruction ID: de104f552f88cca2b26b2b254b56a00b2bcedcd93be9a022f081bd554279841e
Opcode Fuzzy Hash: 8e8d07524fd5c61fb5d91077c3a4b109eb7a5b3780c390cf711fc75e0b3aba59
Instruction Fuzzy Hash: 311189B5804348DFEB11CFA9C444BDEBFF8EF48224F14845AD954A7211C374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014CBEC0, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,014CBD21,00000800,00000000,00000000), ref: 014CBF32

Memory Dump Source

Source File: 00000006.00000002.342874409.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_14c0000_Szallitasi adatok.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f2dbaa553066feefaae0b833daeb26bcbfc9ba22c4908ef6fc67199cc72c6b47
Instruction ID: 0d2f320766955ffd3c3b3e5585b3e75dc4ae384d49d6216de640002afa10c89e
Opcode Fuzzy Hash: f2dbaa553066feefaae0b833daeb26bcbfc9ba22c4908ef6fc67199cc72c6b47
Instruction Fuzzy Hash: D21103B68042099FDB10CF9AD844ADEFBF4EB88754F15842AE515A7300C375A549CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04E63BC8, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04E63C36

Memory Dump Source

Source File: 00000006.00000002.344602286.0000000004E60000.00000040.00000001.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_Szallitasi adatok.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0a1cd315ea9b5668fdbeef9aedd92590b594662c8d787c5463db528758c71dc1
Instruction ID: 0da412a108cdfbeba5414c0d7c8c806693082b8dea50531add0dfced42ba94d5
Opcode Fuzzy Hash: 0a1cd315ea9b5668fdbeef9aedd92590b594662c8d787c5463db528758c71dc1
Instruction Fuzzy Hash: B31167718043489FDF10CFAAC844BEFBBF5AF88324F14841AE925A7210C775A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04E61A50, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNELBASE(00000000), ref: 04E61AC0

Memory Dump Source

Source File: 00000006.00000002.344602286.0000000004E60000.00000040.00000001.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_Szallitasi adatok.jbxd

Similarity

API ID: DebugOutputString
String ID:
API String ID: 1166629820-0
Opcode ID: 40e5ae2249e21c36ceb2afca03f0433257df060398e876cb0ec24b7f6ef2320e
Instruction ID: 5d91701b987989392c1eb2bf5ef7e632da79ef95e81b553bd33b0419a1e55b2c
Opcode Fuzzy Hash: 40e5ae2249e21c36ceb2afca03f0433257df060398e876cb0ec24b7f6ef2320e
Instruction Fuzzy Hash: 7211F0B1D046599BCB10CF9AD944B9EFBF4FB88324F14822AD819B7640D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04E63A40, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04E63AA2

Memory Dump Source

Source File: 00000006.00000002.344602286.0000000004E60000.00000040.00000001.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_Szallitasi adatok.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 30ea96a0ebfa15d2e569095feb84448d0e210b92dcf5bdf7fdb8a907d57e87cc
Instruction ID: 9ee36208626f50bdaa44c0ff0f34fcb0040bf1e2eff758cf1d62fd7f76cfd167
Opcode Fuzzy Hash: 30ea96a0ebfa15d2e569095feb84448d0e210b92dcf5bdf7fdb8a907d57e87cc
Instruction Fuzzy Hash: EB112571D042488BDB10DFAAC4447EEFBF5AF98268F14842AD529A7240CB74A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04E63DA0, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 04E67285

Memory Dump Source

Source File: 00000006.00000002.344602286.0000000004E60000.00000040.00000001.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_Szallitasi adatok.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 201848ab34d9df3996f535d845e8bdafd15e2a6f5810eb1210819db6dc7226f3
Instruction ID: 568d9b3ec1dab39185a30f470592a700b93834695135a728bb46bb30bcd64730
Opcode Fuzzy Hash: 201848ab34d9df3996f535d845e8bdafd15e2a6f5810eb1210819db6dc7226f3
Instruction Fuzzy Hash: 7211E3B5904348DFDB10CF99D445BDEBBF8EB48364F14841AE555A7300D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04E67221, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 04E67285

Memory Dump Source

Source File: 00000006.00000002.344602286.0000000004E60000.00000040.00000001.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_Szallitasi adatok.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 0b43ca8840c626797a186bcbf59999472cbb4f6dc5efd97b450b1e560b89951c
Instruction ID: 7a639d5a2bc2d3dd176477852cf36499b6833bd5a655ee8853bac8746643a7de
Opcode Fuzzy Hash: 0b43ca8840c626797a186bcbf59999472cbb4f6dc5efd97b450b1e560b89951c
Instruction Fuzzy Hash: 571103B5800348DFDB10CF99D885BDEBBF4EB58324F14841AE919A7200D374A985CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014CAADC, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 014CE1C5

Memory Dump Source

Source File: 00000006.00000002.342874409.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_14c0000_Szallitasi adatok.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: ef65709a698cb16e5830bb87d9451df9444b4c9d31fc25e22d0711b34996d750
Instruction ID: 968971e8b0ff27878db71137875d27a50ba5539f56b81bd85bf2540f4443b8e3
Opcode Fuzzy Hash: ef65709a698cb16e5830bb87d9451df9444b4c9d31fc25e22d0711b34996d750
Instruction Fuzzy Hash: 7C11E3B5804208DFDB50CF99D584BDEBBF8EB88624F10841AD915B7600C374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014CBC40, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 014CBCA6

Memory Dump Source

Source File: 00000006.00000002.342874409.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_14c0000_Szallitasi adatok.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4689d990f612fd2591184f13c79c8aca5d327a4f399430caa7c99f20352aa807
Instruction ID: ddd8937c1511ea464840bc1146381cd52e9cbed74cd766645e1bac8d0655ec43
Opcode Fuzzy Hash: 4689d990f612fd2591184f13c79c8aca5d327a4f399430caa7c99f20352aa807
Instruction Fuzzy Hash: 52110FB5C002098FDB10CF9AD444BDEFBF4EB88624F14842ED819B7610D374A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014CE161, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 014CE1C5

Memory Dump Source

Source File: 00000006.00000002.342874409.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_14c0000_Szallitasi adatok.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 43cf20f33576ba5042c042e4eaeb9e54b54163603bf8750a8052d2e3e53b5308
Instruction ID: f403fe536bb7965a1ed009d9baa5567276851115a1a4b99bedfbd4338a436557
Opcode Fuzzy Hash: 43cf20f33576ba5042c042e4eaeb9e54b54163603bf8750a8052d2e3e53b5308
Instruction Fuzzy Hash: DC11F2B59003499FDB50CF9AD588BDEBBF8EB88324F14841AD919B7600D3B4A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: Szallitasi adatok.exe PID: 7104 Parent PID: 7056 Szallitasi adatok.exeCOMMON

Execution Graph

Execution Coverage:	12.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	74
Total number of Limit Nodes:	7

Executed Functions

Function 01880040, Relevance: 3.5, Instructions: 3518COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b64994f4a5bffb6c813bf143cf4d69dc0d88ef965c86b0ee24d0dd569b1795d7
Instruction ID: 214d763dbe9d0e004760cd88c989678bbdc862f96877d10c14d1d03104c20bcd
Opcode Fuzzy Hash: b64994f4a5bffb6c813bf143cf4d69dc0d88ef965c86b0ee24d0dd569b1795d7
Instruction Fuzzy Hash: 04733F31D147198ECB11EF68C8846D9F7B1FF99300F15C69AE449AB261EB70AAC5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 01880014, Relevance: 2.8, Instructions: 2785COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7caa79e3849a5ffc6066389f810789f49f0faaaa7d0a9260768d5a802971b6
Instruction ID: e0ae03f56ac10a2b8e8cb081b7068d24d2fb85c5b74cac70c133dcb57d50a94f
Opcode Fuzzy Hash: 3d7caa79e3849a5ffc6066389f810789f49f0faaaa7d0a9260768d5a802971b6
Instruction Fuzzy Hash: AF53EC30D1471A8ECB11EF68C894699F7B1FF99300F15D79AE458A7221EB70AAC5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0188F3C0, Relevance: 2.3, Strings: 1, Instructions: 1092COMMON

Download Yara Rule

Strings

j, xrefs: 0188F3DA

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID: j
API String ID: 0-2137352139
Opcode ID: 6687c0d730eb77f01419448763298a2137e0a3d57a5c3ba734a4c815dac78138
Instruction ID: 170fcab6686d2ba8034924b305149ea1b6596833d2bd1a5965a28b70dae63675
Opcode Fuzzy Hash: 6687c0d730eb77f01419448763298a2137e0a3d57a5c3ba734a4c815dac78138
Instruction Fuzzy Hash: 4162D230A042498FDB25EF6CC880BAEBBF2EF85314F15846AE205DB396D635ED45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 018377A0, Relevance: 2.3, APIs: 1, Instructions: 760
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 01837F28

Memory Dump Source

Source File: 00000007.00000002.588969908.0000000001830000.00000040.00000001.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1830000_Szallitasi adatok.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dcc59e2b6f5e6f02f8bc70c6ff56bb9e0c7d3db6b713615ca3063a8caf99c39c
Instruction ID: 8c95a8e6f09cae7ca654fe572eec0cde409a2265b773ac589b30d62353a74f3e
Opcode Fuzzy Hash: dcc59e2b6f5e6f02f8bc70c6ff56bb9e0c7d3db6b713615ca3063a8caf99c39c
Instruction Fuzzy Hash: F7622B31E006198FCB25EF78C95469DB7F2AF89304F1486A9D54AAB354EF309E85CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0183C490, Relevance: 1.7, APIs: 1, Instructions: 180
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 0183C4D1

Memory Dump Source

Source File: 00000007.00000002.588969908.0000000001830000.00000040.00000001.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1830000_Szallitasi adatok.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9ed568bfeec2eb45d1d250f13bb158b7b8990c39de05654eef365f15206e05c1
Instruction ID: 8e1ef9bec07580e2432fb4b3aeaf0f6a34514e47e3ca6bf768cbe96cfdb37f25
Opcode Fuzzy Hash: 9ed568bfeec2eb45d1d250f13bb158b7b8990c39de05654eef365f15206e05c1
Instruction Fuzzy Hash: 5F616E31A0020A9BDB14EFB8D8587AEBBB2AF94305F14882DD502E7394DF79D945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 017FAB70, Relevance: 1.1, Instructions: 1104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2be0c076da783c22eb4a5b1b6d0e90e8dc40b172710e946560ee1c28708181fc
Instruction ID: 5bed82ae0c87cfcf9a51ee435f63c3c9eaa439f6a330bd917c1ee57ca3c447e2
Opcode Fuzzy Hash: 2be0c076da783c22eb4a5b1b6d0e90e8dc40b172710e946560ee1c28708181fc
Instruction Fuzzy Hash: 8792D130A042058FCB15DFB8D8586AEBBB2EF89304F19846DE609DB396DB35DC46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01889180, Relevance: 1.1, Instructions: 1102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4431502cce4d6e5f5bee2b791d4ba7a384e6b86c5ddbd87df0879add96b85a3c
Instruction ID: 177552ddc557430d57d2d1b1a47c7571adf3ed5f56e28a4fe8e76e16e73bf5e1
Opcode Fuzzy Hash: 4431502cce4d6e5f5bee2b791d4ba7a384e6b86c5ddbd87df0879add96b85a3c
Instruction Fuzzy Hash: DB923874E002188FDB28EB78CC587AE76F2AF99344F1484A9D50AEB384DF319D81CB55

Uniqueness

Uniqueness Score: -1.00%

Function 01885D40, Relevance: 1.0, Instructions: 1031COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df84b7a5acba019e664012ee24d20d43301e350a4e7b9db576f1c89203a93207
Instruction ID: 7e6e2f544cc4c5a965087b4ae7faa4a5244da7705c5dc5f16124fb62d01daea5
Opcode Fuzzy Hash: df84b7a5acba019e664012ee24d20d43301e350a4e7b9db576f1c89203a93207
Instruction Fuzzy Hash: 9F720231B042158FDB15EB78C854BAEBBF2AF89304F258469E506DB386EB34DD42C791

Uniqueness

Uniqueness Score: -1.00%

Function 0188B7D4, Relevance: .7, Instructions: 684COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f1e8ec94a8d0577ca254714d93fa8468c3ce56dcea1460354d1f74adb6c4db2
Instruction ID: 52623b39359746c552368c769640129e21f2a1949582afd67f7b0b010d6d68e9
Opcode Fuzzy Hash: 2f1e8ec94a8d0577ca254714d93fa8468c3ce56dcea1460354d1f74adb6c4db2
Instruction Fuzzy Hash: B642A230A042488FDB25EB6CC85479EBBB2AF85344F25C169D109DF38ACB75DD46CB61

Uniqueness

Uniqueness Score: -1.00%

Function 017F2020, Relevance: .5, Instructions: 493COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21e29ad59c10f2631290f1b8922a1f7a8d15872e05049545d74bfec3ea2ab67d
Instruction ID: 179f52e45dd453ab8730366f1640a5fa4c7651440eba21831e2e4e325f835788
Opcode Fuzzy Hash: 21e29ad59c10f2631290f1b8922a1f7a8d15872e05049545d74bfec3ea2ab67d
Instruction Fuzzy Hash: 9A127C74A042199FDB15DFA8C854AAFBBF2AF88304F15806DE606DB396DB34DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 017F2618, Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d656eb2580d357729530a6ad773c8765cfffbad2ec6d39be9880154daed0e657
Instruction ID: 0941009fd70fde45be22127503309ef6d17c70da0a7891ca9df32a31943f5a5b
Opcode Fuzzy Hash: d656eb2580d357729530a6ad773c8765cfffbad2ec6d39be9880154daed0e657
Instruction Fuzzy Hash: DC026E31A04109DFDB15CFA8C984AAEFBB6FF48310F158069EA15AB366DB34ED45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 017FDDA8, Relevance: 5.3, Strings: 4, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\, xrefs: 017FDFE6
\, xrefs: 017FDE21
\, xrefs: 017FDFAB
\, xrefs: 017FDEF1

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID: \$\$\$\
API String ID: 0-3238275731
Opcode ID: aadea5d0fc8c0b77f71fecdc99b1b35413ab2d2fc186e788a9a5a17cf1dc007f
Instruction ID: 22ebc8f876369ee41b799b6204b9940841328f3586553f89e010aa8d2e9a1e0b
Opcode Fuzzy Hash: aadea5d0fc8c0b77f71fecdc99b1b35413ab2d2fc186e788a9a5a17cf1dc007f
Instruction Fuzzy Hash: B9B11130B002058BDB29EBB9C844BBFB6E2EB98314F15856DD61AD7381EF34DC458B91

Uniqueness

Uniqueness Score: -1.00%

Function 0183BDB9, Relevance: 1.7, APIs: 1, Instructions: 221
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 0183BEC7

Memory Dump Source

Source File: 00000007.00000002.588969908.0000000001830000.00000040.00000001.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1830000_Szallitasi adatok.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f6d3a847d0286b023eb2bf5fd4db7f88d9b392a8b26616097cdea378fea3d32c
Instruction ID: c4680bcb6c548eba65611fa1d00627aa3148e5e248df2aae8bea9079234292cc
Opcode Fuzzy Hash: f6d3a847d0286b023eb2bf5fd4db7f88d9b392a8b26616097cdea378fea3d32c
Instruction Fuzzy Hash: D8713771B043459FCB05EB78C858AAA7BB5AF95304F1884BEE101DB392DB31DD05CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0183BE68, Relevance: 1.6, APIs: 1, Instructions: 148
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 0183BEC7

Memory Dump Source

Source File: 00000007.00000002.588969908.0000000001830000.00000040.00000001.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1830000_Szallitasi adatok.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 66a29fe08466325beed244b956d9b304bf1aaf702a288b2e2497a07940d27e89
Instruction ID: 2b5d249894c48918da4d4270a768f8a454b047ea8c155c08c168dc1ac87a7700
Opcode Fuzzy Hash: 66a29fe08466325beed244b956d9b304bf1aaf702a288b2e2497a07940d27e89
Instruction Fuzzy Hash: 9F518371B002059FCB05EFB4D858AAEB7B6BF94344F14896AE502DB395DF31E904CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0183EE18, Relevance: 1.6, APIs: 1, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.588969908.0000000001830000.00000040.00000001.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1830000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9d084e14a3f5dbd8a1bd07886222b619c0298f9994a51350a18440556daab10
Instruction ID: 7827a7837b76e419cbe3c8bcd8d6a408f470ab1492b309bff2d937d2b112dae4
Opcode Fuzzy Hash: f9d084e14a3f5dbd8a1bd07886222b619c0298f9994a51350a18440556daab10
Instruction Fuzzy Hash: B3415572D043598FCB10DFA9D4002EEBBF0EF89324F0986AAD518E7241DB789945CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 01833068, Relevance: 1.6, APIs: 1, Instructions: 118
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 01833181

Memory Dump Source

Source File: 00000007.00000002.588969908.0000000001830000.00000040.00000001.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1830000_Szallitasi adatok.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: cfce304a0d31ed6f9f23122291c7b1f855616b328b57312e72a0f54f017cfd2c
Instruction ID: 60564219d39aa401e6860fd9dd3b02a2f470d0e6c2a2ce52d7462f8a60ad329e
Opcode Fuzzy Hash: cfce304a0d31ed6f9f23122291c7b1f855616b328b57312e72a0f54f017cfd2c
Instruction Fuzzy Hash: A6414670E047599FCB21CFA9C884A9EBBF1BF88310F19806AE819EB350C7749905CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01832DB8, Relevance: 1.6, APIs: 1, Instructions: 113
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(?,00000000,?,00000001,?), ref: 01832EC4

Memory Dump Source

Source File: 00000007.00000002.588969908.0000000001830000.00000040.00000001.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1830000_Szallitasi adatok.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 3a7466af8167309112ed2ef91381b8c9394fccb9469486f0576552035ced15be
Instruction ID: 345a72f4dfaa9b3879fd47d2655ebf6cb0648724dc33f2e880b411414c5075bb
Opcode Fuzzy Hash: 3a7466af8167309112ed2ef91381b8c9394fccb9469486f0576552035ced15be
Instruction Fuzzy Hash: AB4149B1D043498FDB10CF98C54469EFBF2AF88314F29C56AE908EB341D7759945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0183C430, Relevance: 1.6, APIs: 1, Instructions: 90
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 0183C4D1

Memory Dump Source

Source File: 00000007.00000002.588969908.0000000001830000.00000040.00000001.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1830000_Szallitasi adatok.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f6ffd092cf854196e7c129e60c9ba01cddbb602b9fd6f4958da9ed7232b4824c
Instruction ID: de8df2ff0e00ce89067f99e7a73e1650cdd7c7b65ae64c3e9d162cb80fa463b9
Opcode Fuzzy Hash: f6ffd092cf854196e7c129e60c9ba01cddbb602b9fd6f4958da9ed7232b4824c
Instruction Fuzzy Hash: E031BE30A053489FDB15DFB8D994AED7BB1AF86304F2884AEE001EB292D735D949CF51

Uniqueness

Uniqueness Score: -1.00%

Function 018330C8, Relevance: 1.6, APIs: 1, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 01833181

Memory Dump Source

Source File: 00000007.00000002.588969908.0000000001830000.00000040.00000001.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1830000_Szallitasi adatok.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c75f794df0d535ba285097c453651113131044b6c9d45be612d36d5f8d7edcf6
Instruction ID: 0521c451902289ef1063bce0575a1e08fcb44c17f326e7ee68f454147888eb8f
Opcode Fuzzy Hash: c75f794df0d535ba285097c453651113131044b6c9d45be612d36d5f8d7edcf6
Instruction Fuzzy Hash: E531D0B1D006589FCB20CF9AC884A9EBBF5BF48714F18812AE819AB310D7749945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01832E10, Relevance: 1.6, APIs: 1, Instructions: 80
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(?,00000000,?,00000001,?), ref: 01832EC4

Memory Dump Source

Source File: 00000007.00000002.588969908.0000000001830000.00000040.00000001.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1830000_Szallitasi adatok.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 7cbe58f010aa1f829ebc4cc059650573118247715cbecb44d75ae75c6975bb2d
Instruction ID: 84f8b2c5af10e64cc61ef65ac5f607f48e9a16159afcc529b86eb08a71b503fc
Opcode Fuzzy Hash: 7cbe58f010aa1f829ebc4cc059650573118247715cbecb44d75ae75c6975bb2d
Instruction Fuzzy Hash: 0431F0B1D042498FDB10CF99C584A8EFFF5BF88314F28816AE809AB341C7759985CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0183D96C, Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,0183EE6A), ref: 0183EF57

Memory Dump Source

Source File: 00000007.00000002.588969908.0000000001830000.00000040.00000001.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1830000_Szallitasi adatok.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: a3539a861ca500766e4cd3595531e6bb2737b16d9d44639642c8076c6a0c3c26
Instruction ID: 486638c075c9a7d45d242fad0a445eef514aed8b4dc736d968369a3359835f10
Opcode Fuzzy Hash: a3539a861ca500766e4cd3595531e6bb2737b16d9d44639642c8076c6a0c3c26
Instruction Fuzzy Hash: 461144B1C046599BCB10CF9AC4447DEFBF4AF48324F05816AE918B7240D378AA45CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 017FC0D8, Relevance: 1.3, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P@k, xrefs: 017FC14F

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID: P@k
API String ID: 0-782922107
Opcode ID: 986b7d8f281f8f0dbf970a52a87a09271165426aa27fc9fd2247caaa2dc4a753
Instruction ID: aec82010e75e44292369fc955d3d995b2930f8c1aa47ce9d5b2486583749cf61
Opcode Fuzzy Hash: 986b7d8f281f8f0dbf970a52a87a09271165426aa27fc9fd2247caaa2dc4a753
Instruction Fuzzy Hash: 7D31E130B001058FDB1AAFB8D8146AFBBE3AF99244B24846DD506EB384DF34CD15CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 017FC0D7, Relevance: 1.3, Strings: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P@k, xrefs: 017FC14F

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID: P@k
API String ID: 0-782922107
Opcode ID: bdd6eee29f4a613b40700876cdcf67be7b9b82fc195a0763508749590b7215e9
Instruction ID: a424273d2090d859b55b80a1ed1c4d98befdc6d7ffca96dcac608911d6237c68
Opcode Fuzzy Hash: bdd6eee29f4a613b40700876cdcf67be7b9b82fc195a0763508749590b7215e9
Instruction Fuzzy Hash: D431B071B001058FDB1AAFB8D8146AFBBE3AF98244B14886DD506EB784DF34CD15CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 017FDD99, Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

\, xrefs: 017FDE21

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: 19d06d0d05e4b40e249cd9b36034aa8ee0fbf5dffc4e0f71aefa76341656b426
Instruction ID: 353c719471bc4c5540ff564964f7f8c6cac6052007df28c9a82128d9b67519e3
Opcode Fuzzy Hash: 19d06d0d05e4b40e249cd9b36034aa8ee0fbf5dffc4e0f71aefa76341656b426
Instruction Fuzzy Hash: 6A21E471A002155FDB26DBA8C8016BFF6B6AFA8310F10816FD215D7392EB70994587E2

Uniqueness

Uniqueness Score: -1.00%

Function 0188C600, Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7967ffcf67e370ed713e718aacb1cc75c260014b68d83cdb6b163c1269794d34
Instruction ID: 117fb6a564bd0e012cb2e0240804e2746a896a494aef9b97a7b3f69fd93a366d
Opcode Fuzzy Hash: 7967ffcf67e370ed713e718aacb1cc75c260014b68d83cdb6b163c1269794d34
Instruction Fuzzy Hash: 3B2292307006098FDB25EF6DC9546BD7BA6AF85708F1540AAE502CF3AADB34DE41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 017FBBF8, Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acc471a6fc737f340ec640ad964d08115c49e19dd6763cfea68349ed28943eda
Instruction ID: 46413a4dcf67883adeb8d42f4db196d51d6d9b52c6cc3f953c73ad9a6082af96
Opcode Fuzzy Hash: acc471a6fc737f340ec640ad964d08115c49e19dd6763cfea68349ed28943eda
Instruction Fuzzy Hash: 7C027471A0D3858FD7079B78C8646A6BFF1AF57304F1980EAD644CB397E6299C09C722

Uniqueness

Uniqueness Score: -1.00%

Function 017F32D0, Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 332f1617e9e9ca19f4f398b9f8830d9734fa2333aa29282d464e3dd138eb2fb0
Instruction ID: 2fcd9dee0b933ae13f40b1e23ae8a5ef4a32e1729265374cd33847d5b331baa1
Opcode Fuzzy Hash: 332f1617e9e9ca19f4f398b9f8830d9734fa2333aa29282d464e3dd138eb2fb0
Instruction Fuzzy Hash: 83124870A04109DFCB15CF68C588AAFBBB2FF88355F158559E6499B3A2C734EC81CB61

Uniqueness

Uniqueness Score: -1.00%

Function 017F2D50, Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976dcfe87cdaf289f767e5427244b9af77b53109a94df350a9519260a1848cc0
Instruction ID: 1a5adb38e1626b795562c856d9acf68ff76c4a8720d82581f13aa623b397f895
Opcode Fuzzy Hash: 976dcfe87cdaf289f767e5427244b9af77b53109a94df350a9519260a1848cc0
Instruction Fuzzy Hash: CF124734A046099FDB25CF69C884AAEFBF2BF48314F15855DEA499B362DB31EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 017F16C8, Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c3909fd5999d9a36c79f15a155521fe755f243a724fa9385b65662c704d6a41
Instruction ID: f02ee440a8b06217ca4611ba69ab24b2c2d3d0e2369bff30b202b150f5fecb19
Opcode Fuzzy Hash: 4c3909fd5999d9a36c79f15a155521fe755f243a724fa9385b65662c704d6a41
Instruction Fuzzy Hash: B3C1E334704250DFDB269B28C89466FBBE2AF89255F45846DE60ACB389CF74CC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 017F4C78, Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccb4edade111ab648492531369dd48f901efcd3204e6bf2165793c72edf6ddce
Instruction ID: fca1e35086c36c74f0ea1e3168be0cbd86be2f0072523ce689506c8379dcf3d3
Opcode Fuzzy Hash: ccb4edade111ab648492531369dd48f901efcd3204e6bf2165793c72edf6ddce
Instruction Fuzzy Hash: 97D1DB75A041148FCB15CF69D588D9EBBF6BF89314F1A8499E60AAB376CB30EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 017F4B58, Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acff7875765a499cbff0175cd6c54d5a6bf0728b561fef2522912ee3fa6a9fc8
Instruction ID: bc7114bbd3258046a353a064f0a87a0ef0196ec2e57f73ea2a20dc9c3afb7f00
Opcode Fuzzy Hash: acff7875765a499cbff0175cd6c54d5a6bf0728b561fef2522912ee3fa6a9fc8
Instruction Fuzzy Hash: 14C1FD71E041158FCB05CF69D58899EFBF2BF89314F1A8099E61AAB366CB30EC41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 017FE408, Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcf0ad9b9ece9c88a4aaccf42c47b64295202940e0412f76266d25268b4783de
Instruction ID: 337432389c07ace5c6238f4a4fe5bf2467113afa2318ba8548702deed24f9b03
Opcode Fuzzy Hash: dcf0ad9b9ece9c88a4aaccf42c47b64295202940e0412f76266d25268b4783de
Instruction Fuzzy Hash: D0A17F34B002059FEB119B74DC58B6EB7A6EF84325F158629E6129B3E8DF31DC42CB61

Uniqueness

Uniqueness Score: -1.00%

Function 017F2D48, Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d52b4f69c8c907ef80bc491e4e101f20ef07985fcf7ae8f6e6102d936572cf6
Instruction ID: 1f15d5767845b85d817956ddfedaa830d7d9af66fd7a3e513b70549a01ca6993
Opcode Fuzzy Hash: 3d52b4f69c8c907ef80bc491e4e101f20ef07985fcf7ae8f6e6102d936572cf6
Instruction Fuzzy Hash: 0AC14830A046099FCB15CFA9C884AAEFBF2BF48314F15855DEA55AB362D731ED41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0188B43E, Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34c61ee0bd4e495d538d32789c498e13e7ac4355fb13615e4a4c18da8dfe112b
Instruction ID: e3e9d96dc24af6d7ada51cf4fbd373697d1d65f3eb2ca96d916561f041db3cb0
Opcode Fuzzy Hash: 34c61ee0bd4e495d538d32789c498e13e7ac4355fb13615e4a4c18da8dfe112b
Instruction Fuzzy Hash: 0C91B130B042058FDB15FBB8D8687AE76E2AFD9304F188429E506DBB95EF34DD068791

Uniqueness

Uniqueness Score: -1.00%

Function 01886DE8, Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23fef1df4557d57ace7e13e0acb72883117144cf6717ef3cd621e35ddd36b9b7
Instruction ID: 3e44adad2fdb1983f0e78c2063fe3f403ea7ebdcd2ab0e2d6b75c14e7a00f5c1
Opcode Fuzzy Hash: 23fef1df4557d57ace7e13e0acb72883117144cf6717ef3cd621e35ddd36b9b7
Instruction Fuzzy Hash: 8CA1A035A04249DFCF15DFA8C844ADEBFB2BF89304F24816AE905EB2A1D771E945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0188DBF0, Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aac4def1bffa0f4f3d58c543dc20ef917be7fe8ac69a904bfb65edb972c1ec88
Instruction ID: 34922aef8c1308477ff748c4293287e587eb912192dbda15ac991d6b367b719a
Opcode Fuzzy Hash: aac4def1bffa0f4f3d58c543dc20ef917be7fe8ac69a904bfb65edb972c1ec88
Instruction Fuzzy Hash: 6781BC30B002049FD719ABB8C85876EBAE3ABD5308F29C52DE50ADB3D6DB75DC428751

Uniqueness

Uniqueness Score: -1.00%

Function 017F5280, Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ef3656ffe88b695b455bf7c6299a9981200ed555e100e7d807039ae0f8a3112
Instruction ID: 83f05e11d3f0c382036c166faca9181960d4a9724a0a857f346a770d365e5a3c
Opcode Fuzzy Hash: 7ef3656ffe88b695b455bf7c6299a9981200ed555e100e7d807039ae0f8a3112
Instruction Fuzzy Hash: 4D918B31A042599FCB11CF6CC884A6EBBB5FF45314F16809EEA199B3A2C770E841CB91

Uniqueness

Uniqueness Score: -1.00%

Function 017F4890, Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 262be098fa9c7b7fcbfe5337a6379981f2216163c6a48458125cbaa92765dc4a
Instruction ID: 97befed0db6131a08ed5d3ff3c09e7811b1e19f648e2135cb01a091c5822a921
Opcode Fuzzy Hash: 262be098fa9c7b7fcbfe5337a6379981f2216163c6a48458125cbaa92765dc4a
Instruction Fuzzy Hash: 6E71EE303082148FDB26DB78C89466FBBAAAF89214B15446EE657CB396DF31DC42C791

Uniqueness

Uniqueness Score: -1.00%

Function 0188B4A0, Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60c4e1f1ecb1070ca0b1b8b41db1608a31ad4694057b6206d2182295952db5df
Instruction ID: 85a09c5cf253ca09219465246955a44f0287522ab60b3878bda76a3a322381ea
Opcode Fuzzy Hash: 60c4e1f1ecb1070ca0b1b8b41db1608a31ad4694057b6206d2182295952db5df
Instruction Fuzzy Hash: 06716F30B002058FDB15BBB9D8647AE76E3AFD8314F188429D906DB784EF34DD468B91

Uniqueness

Uniqueness Score: -1.00%

Function 017FEBF8, Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d371405243fec7243d0efa9b4c550403dc224b48d19d53ac23c695834f31942
Instruction ID: 12dbf6547168eda080ff6128d6a03762a1a9d0ac5f3300d7e9f5c98ed0fad30c
Opcode Fuzzy Hash: 9d371405243fec7243d0efa9b4c550403dc224b48d19d53ac23c695834f31942
Instruction Fuzzy Hash: 7A711730A002418BEB15CF2CD84476EFBA2AFC9304F15C1AED6199F7A6DB72C885C751

Uniqueness

Uniqueness Score: -1.00%

Function 0188EBE0, Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4ee532547a081c3749517f6732357654a0e6f8f1d6391d42e58251698de46bb
Instruction ID: bf0a84f6547e671f761381c628917cdff610ba2c39f3844732a2195a36ba86c0
Opcode Fuzzy Hash: b4ee532547a081c3749517f6732357654a0e6f8f1d6391d42e58251698de46bb
Instruction Fuzzy Hash: DB61C030F001189FDB54ABB8C8157AEBAA3EFD8354F20842AD606EB7C1CE758D058B95

Uniqueness

Uniqueness Score: -1.00%

Function 01886AC8, Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e34e0f6e7b7f31b5a00a75937bd3b6d9576857433a9733ca1794f6be950c90
Instruction ID: d2ad741608d5bb2a8eb174f26ece687a2c3957c8f61d2fdd7f24cc710f7a2e61
Opcode Fuzzy Hash: c0e34e0f6e7b7f31b5a00a75937bd3b6d9576857433a9733ca1794f6be950c90
Instruction Fuzzy Hash: 00710534B006068FDB25EF2DC894A6A7BE6FF49714F2500A9E901CB3A1EB75DE41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 017FEAF8, Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d48999b5174d61d4da4b44690bccac73ea2d5dadda7c338604cdf98bf49af200
Instruction ID: e4f1fd707f2576808370de1e85074ba89b2812c8cc4e7f46dbe0838c5cf82f18
Opcode Fuzzy Hash: d48999b5174d61d4da4b44690bccac73ea2d5dadda7c338604cdf98bf49af200
Instruction Fuzzy Hash: BF518330A0D3844FE752972C885475ABFA29B93204F1A80EFD649CF7A7DA65CD49C722

Uniqueness

Uniqueness Score: -1.00%

Function 017F1B18, Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e665b84c28a3e699e5a07aec72b5e2df5ec350be2789b580a326d1b4f8bbfef2
Instruction ID: bcf0f838d4c8118d0ee813f7c36487c715b31dd55db4c3819bbe463675239ebd
Opcode Fuzzy Hash: e665b84c28a3e699e5a07aec72b5e2df5ec350be2789b580a326d1b4f8bbfef2
Instruction Fuzzy Hash: 93618B34A00105CFCB18DF6DC498AAAFBB2BF89245F9580ADD606DB3A5D731EC41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 017F3AC9, Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53bda9ac6d6c478702585cee68b9a833355e80b84a51e80b5fc41e89043aec06
Instruction ID: 91e50c59f16e9ece04d7b22dc32f6c55ad7e084af8a6e09b8858ca32363acb85
Opcode Fuzzy Hash: 53bda9ac6d6c478702585cee68b9a833355e80b84a51e80b5fc41e89043aec06
Instruction Fuzzy Hash: 4B517A353141199FDB04DF3EC894A6BBBE9FF48610B0545AEEA1ACB3A1DB21DC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0188AE48, Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 314d9e15da4d5b96fbe233b5d6e65f88db5021734f585d6426ff0363fc02a84b
Instruction ID: aef08be2488066bed78ed7d5a3d50be5cb82240a27fb61edcd6a424454825bca
Opcode Fuzzy Hash: 314d9e15da4d5b96fbe233b5d6e65f88db5021734f585d6426ff0363fc02a84b
Instruction Fuzzy Hash: A551A230B083858FD746DBBC9814A6A7BF19F87300F1584BBD549EB396EB398D0A8751

Uniqueness

Uniqueness Score: -1.00%

Function 017FB980, Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b2b3a00dc189b29cf7b0187783107151cb34b5a72454fe6c6b6efd3281335d2
Instruction ID: 361113f3085f77369e7c94af26795eb5f099c9b256ad2e82aee1f1ee222b4a10
Opcode Fuzzy Hash: 5b2b3a00dc189b29cf7b0187783107151cb34b5a72454fe6c6b6efd3281335d2
Instruction Fuzzy Hash: FB71F674D043098FDB41EFB4E89599DBBB2FF58700B14896AE801EB768EB359D05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0188912E, Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f20d7cce18db0a4eab4d681319ff52dbac21b614a65563c31499a6410ad50014
Instruction ID: 579fca3cb88c7a1710c2e38b290876fb79f500bea20b960e0fb2306e86aba19a
Opcode Fuzzy Hash: f20d7cce18db0a4eab4d681319ff52dbac21b614a65563c31499a6410ad50014
Instruction Fuzzy Hash: 93514C34E052198FDB15EF78D8586AE7BB2AF98304F1484A9E50AE7344EF34CD458F50

Uniqueness

Uniqueness Score: -1.00%

Function 017FD4F0, Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ce25c41ca6ac4ced19d9a380df7c538e2b840c8fd7db5d15e7557092126a59d
Instruction ID: 5fb9fa179019759cdd5b6a29c7fa8d476c86599208e0334809e88def38021641
Opcode Fuzzy Hash: 6ce25c41ca6ac4ced19d9a380df7c538e2b840c8fd7db5d15e7557092126a59d
Instruction Fuzzy Hash: 0061C074E00218CFCB24EFB4D858A9DBBB6FF88305F14946AE90AA7354DB359945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 017FD441, Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0cdccc1855e6607b9852dc830731c1c804cf14663f8b07cd35f3348094777e
Instruction ID: fe89b774b6b1be6d4b85d2f45dee53c98258ee2ca91734e53cb24102e0e32035
Opcode Fuzzy Hash: 2d0cdccc1855e6607b9852dc830731c1c804cf14663f8b07cd35f3348094777e
Instruction Fuzzy Hash: 0B5173709083858FCB22DBF8C9146BEBBB1AF56304F1580EED545EB753EA35990ACB11

Uniqueness

Uniqueness Score: -1.00%

Function 017F54F1, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0e6c1726f5c9a9461824002aff864083c4d6f716315442920f81ee6356d929e
Instruction ID: 70c77b01ccba4bc8d5039468dc08f004e64d89afc2432bef2fa43a7a350beee7
Opcode Fuzzy Hash: a0e6c1726f5c9a9461824002aff864083c4d6f716315442920f81ee6356d929e
Instruction Fuzzy Hash: FA41E4353042418FCB169F68E8586BB7BF3AF89211B15409EE619CB392DB34CC45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0188B78C, Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7c660822cb89238d90cc079d01bf1f543958ac11e10825de4d77013cfe51660
Instruction ID: 32ce51f45f073225325581cdb63f4b58cad08b7433cf1a37316d24523322509d
Opcode Fuzzy Hash: f7c660822cb89238d90cc079d01bf1f543958ac11e10825de4d77013cfe51660
Instruction Fuzzy Hash: 04415E34B002058FDB25BBB8D86977E76E6AFD8314F184429E906DB795DF34CD028B91

Uniqueness

Uniqueness Score: -1.00%

Function 017FE358, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74f4d911954246721415aa61ee5765cd2c81523dadfa3b7ae9b08b597db08fa1
Instruction ID: 294451a70c0e33a9c59acb6774a40ba0da1cf1cf988c7cda610bfdadd914586b
Opcode Fuzzy Hash: 74f4d911954246721415aa61ee5765cd2c81523dadfa3b7ae9b08b597db08fa1
Instruction Fuzzy Hash: 34412630A083814FDB129B789C5866BBFB1DF86210B0A45FED745CB3A7EA2488098752

Uniqueness

Uniqueness Score: -1.00%

Function 017FB9E0, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2f79541d99c6e524e3704fad9a324418a47ccbc421abe86e005e66cd4947136
Instruction ID: 2b189fc8ae5953997aaf2b27ad6a6e498d75709133d7f14534f8a89b28f6995f
Opcode Fuzzy Hash: b2f79541d99c6e524e3704fad9a324418a47ccbc421abe86e005e66cd4947136
Instruction Fuzzy Hash: 0F51B474D10308CFDB51EFA4E89599DBBB2FF68704B144969E801AB728EB35AD05CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01886F3B, Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68bc7286979eece8981805e7e1496a10c72cb210fa8bff5b37d157e25bfc18df
Instruction ID: 8f21d1fb2c5f3b0ea807fe5c6925a9450e12caf6be2748345f91988be0496221
Opcode Fuzzy Hash: 68bc7286979eece8981805e7e1496a10c72cb210fa8bff5b37d157e25bfc18df
Instruction Fuzzy Hash: A741A035A08249DFCF12DFA8C844A9EBFB1AF49314F208165E915EB296D331EA15CB90

Uniqueness

Uniqueness Score: -1.00%

Function 017FE1E1, Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee8615fa2f711918e5b1abba0490ee0aba8e2a477f2fa3a279e1393439f8bbcf
Instruction ID: 417151083e618020b995ccaed762b48216380e4f29bbb4212eec61ad2ea7461c
Opcode Fuzzy Hash: ee8615fa2f711918e5b1abba0490ee0aba8e2a477f2fa3a279e1393439f8bbcf
Instruction Fuzzy Hash: 33411635F086518FDB129BB898042AEBBB1AF45314F1A44AADA05DB363FE34CD058B91

Uniqueness

Uniqueness Score: -1.00%

Function 017F14A8, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24e23d998634b4e02c2b6071caa6551fa7ec38978851dab9418fe908c722feeb
Instruction ID: b637b288393480c9865b9a12c00ccb32ea61a1b40f5dbe31020a45247ab10ccc
Opcode Fuzzy Hash: 24e23d998634b4e02c2b6071caa6551fa7ec38978851dab9418fe908c722feeb
Instruction Fuzzy Hash: 3841C331200105DFDF069F69D8586AFBBA6EB88310F54806DFA1AC7351CB35CD66CB90

Uniqueness

Uniqueness Score: -1.00%

Function 017F38D8, Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a788ef62dd720b416fb8c17e157e531e563b1e5721a2d4a77457121e1399136
Instruction ID: 7c2bd651e24c34366fe6bdbef1f06659d7f48951ab1066d96c6adc0d0cbc485a
Opcode Fuzzy Hash: 2a788ef62dd720b416fb8c17e157e531e563b1e5721a2d4a77457121e1399136
Instruction Fuzzy Hash: B54138747041199FDB15DF29C888AAABBB5FF88318F1100A9FA56CB3A1CB31DD41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 017FE8F0, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cd7a8f34425bd6f3da7fff82de9f7970500b3bacc2022f11a99531b326cc3d2
Instruction ID: 46457e4c7830eabb3a45b4f7dfb30807a93a9700cf0e01a1f1965abf33b36f9b
Opcode Fuzzy Hash: 0cd7a8f34425bd6f3da7fff82de9f7970500b3bacc2022f11a99531b326cc3d2
Instruction Fuzzy Hash: 5531B631A043558FC782DB7CC80496FFBF5AF86610B0584AED245E7366EF349D058BA2

Uniqueness

Uniqueness Score: -1.00%

Function 017FE240, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 270e7cb1080670570dd321b2da553716351ef07375c9f1bb08bf0b389a04e3f1
Instruction ID: 1bae3c88e4cc1fce2166d745bce5e4c10fbb4f54f6002a61fca17fa8319cd6a5
Opcode Fuzzy Hash: 270e7cb1080670570dd321b2da553716351ef07375c9f1bb08bf0b389a04e3f1
Instruction Fuzzy Hash: 0D31B431F002158FCB10EBB889046AEBAF5EF88254F15446DEA05E7354FF35DD048BA5

Uniqueness

Uniqueness Score: -1.00%

Function 017F3D08, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30ae48ac5d8548d26354c6f186c72cbdab109be2205357c1856cf0411b80b8e7
Instruction ID: 0b3a6857e79c8fc3c864cad788eb0465c91d1f3e063a402d1dc6363891054f92
Opcode Fuzzy Hash: 30ae48ac5d8548d26354c6f186c72cbdab109be2205357c1856cf0411b80b8e7
Instruction Fuzzy Hash: B021B6313082054BDB2A2A39985457FBBA7BFD5558714807DD702CF7E6EE25CC82D782

Uniqueness

Uniqueness Score: -1.00%

Function 017F3D18, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 365d71e9a41d8d216c7ca19dcb189e7f4a49a9a71e1f17a3453ecd1ae4119e01
Instruction ID: 71e1299f41d4025ebf1a4a4526d23225c4bafce72d76f400323e61951709a825
Opcode Fuzzy Hash: 365d71e9a41d8d216c7ca19dcb189e7f4a49a9a71e1f17a3453ecd1ae4119e01
Instruction Fuzzy Hash: 602192303042054BEB262A29989867FBA9BBFC8658F14807DD702CF7D5DE65CCC2D782

Uniqueness

Uniqueness Score: -1.00%

Function 017F3C10, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 303ebb40a631f106bfd99cb1949d9bf2e8083619ed5f9bb6cd54e459e2ef9c11
Instruction ID: 06ecdb8eaf322fae6518d959b8eebf8eb5e29a7df3312ab847dcaf2cf3eb49d2
Opcode Fuzzy Hash: 303ebb40a631f106bfd99cb1949d9bf2e8083619ed5f9bb6cd54e459e2ef9c11
Instruction Fuzzy Hash: BD219F317091599BEB15CE2B9884B6BBFEAFF85210B06446DFA12C7381DB35DC40DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 017FAB20, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f93f59dbfe4a129255dc942c3e8a8cae798925f2802d6a7bf60e408b66ab2747
Instruction ID: c989b433e1f6a6ac95bab09109d6239de4d0aee25567ca13325ceca39e54f2ab
Opcode Fuzzy Hash: f93f59dbfe4a129255dc942c3e8a8cae798925f2802d6a7bf60e408b66ab2747
Instruction Fuzzy Hash: D3316F71A042098FCB05CFA8D9856DEFBF2EB89314F258469D608E7345E735DD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0160D53C, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.587995268.000000000160D000.00000040.00000001.sdmp, Offset: 0160D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160d000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1392d62d2097dd45223218e4ac3339a992f8d4084e4c1f5a5310ff34b7bd9c1e
Instruction ID: 0b1ef9d30f1c36c03bb1cc81ccaf9e4940c42e72e49cc60abb540eafa5564aef
Opcode Fuzzy Hash: 1392d62d2097dd45223218e4ac3339a992f8d4084e4c1f5a5310ff34b7bd9c1e
Instruction Fuzzy Hash: 4F21C1B1504244DFDB0BDF94DDC0B27BF65FB98328F248669E9094B286C336D856CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0161D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588045400.000000000161D000.00000040.00000001.sdmp, Offset: 0161D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_161d000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d943c34006f30379ccf6780996ab4dbc533c6822d30731a48c01246514cb94b5
Instruction ID: 0b304fb7f7372e60d60719610febe5bebd2022e42d63937d08186367b7f21eaf
Opcode Fuzzy Hash: d943c34006f30379ccf6780996ab4dbc533c6822d30731a48c01246514cb94b5
Instruction Fuzzy Hash: DE212575508240DFDB15CF54DCC8B26BBA5FB88355F28C56DD9094B34AC336D847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 017FEA10, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08c4cda565e366aaca1db06607ee4f4a4368a88a6f35d825416ff3753d3dabd3
Instruction ID: a2549d3528213fae9aa6c4b419ca9e2b45d0b582ed8d4ca443d89637aaa1aaf1
Opcode Fuzzy Hash: 08c4cda565e366aaca1db06607ee4f4a4368a88a6f35d825416ff3753d3dabd3
Instruction Fuzzy Hash: EF11B471F043558FCB52A77C88142BFBBE1AB56310B1644BED60AD7356EA34CE098791

Uniqueness

Uniqueness Score: -1.00%

Function 017FE821, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bd71e36240ebcf3b2e38f13bc9f50715226f246199afc90508b15f8e24110d9
Instruction ID: 51769ca58d24d0a4d4bcef8063a660637f1f51fcf681f63822c035c08b8cf5d3
Opcode Fuzzy Hash: 5bd71e36240ebcf3b2e38f13bc9f50715226f246199afc90508b15f8e24110d9
Instruction Fuzzy Hash: 8D11DC71F501198F8B40FFA8D8499AFB7F2FB89200B4081ADD609E3358EF349D058B91

Uniqueness

Uniqueness Score: -1.00%

Function 017F19E0, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b0e95361085e12d6bab05c0d8b95798bb8e36668cdc3c64a1b131258378f286
Instruction ID: 8b6dd1500e1f90d07836d6124a5b150854ec55f15718b001c5e4be42c9f9acba
Opcode Fuzzy Hash: 6b0e95361085e12d6bab05c0d8b95798bb8e36668cdc3c64a1b131258378f286
Instruction Fuzzy Hash: 04112335301641CFD72A9629C89056FFBE2EF856A1B4941BEE606CB351CF20CC4ACBC0

Uniqueness

Uniqueness Score: -1.00%

Function 0161D006, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588045400.000000000161D000.00000040.00000001.sdmp, Offset: 0161D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_161d000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4ef2248c3584e5f9bbdc93ed2e67db1b70eab76c4794c0bc6f3437732ab5342
Instruction ID: 9a144536a6cbf8209853631a1f8d8616276caf5fe8b2059c20c2dde5fab80923
Opcode Fuzzy Hash: b4ef2248c3584e5f9bbdc93ed2e67db1b70eab76c4794c0bc6f3437732ab5342
Instruction Fuzzy Hash: 23218E755093C08FDB02CF64D994B15BF71EB46214F28C5EAD8498B6A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0188904F, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80e339fdf8a093e7e19c325a6c91a2c44d55a1b12781e66f1c8aadc5220144e0
Instruction ID: 4d8df8cdcd8af89c294ae0b1cfdd5a4b61accb3dc2d3957ece7cb922bee77184
Opcode Fuzzy Hash: 80e339fdf8a093e7e19c325a6c91a2c44d55a1b12781e66f1c8aadc5220144e0
Instruction Fuzzy Hash: 6D115B30F002198FCB50EF68D8489AEB7F6FF8A600B40842DD509E7358EB349D068BA1

Uniqueness

Uniqueness Score: -1.00%

Function 01886750, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d936eaabd3d5b1c85f31a4dbc644ad8fa39f58ace1fa383d3ff5171d0596001
Instruction ID: 183851017308c34c94468dc5a00ad30474145e5c25069259c45913bcaa747b87
Opcode Fuzzy Hash: 7d936eaabd3d5b1c85f31a4dbc644ad8fa39f58ace1fa383d3ff5171d0596001
Instruction Fuzzy Hash: 0611C231B00114DFDB14FA28D448A6AB7A2EB84725F248629D90ACB344FB71DE45C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 0160D537, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.587995268.000000000160D000.00000040.00000001.sdmp, Offset: 0160D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160d000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f719be4bdebd3dfd11ebae6c118d7ee8120c9f745bda7f7f38bcb6fe184723e3
Instruction ID: 0c4c9aba36bebe0d7ad1669978f80f01510575383e97a668453f1e0a31586ee8
Opcode Fuzzy Hash: f719be4bdebd3dfd11ebae6c118d7ee8120c9f745bda7f7f38bcb6fe184723e3
Instruction Fuzzy Hash: 7011B176404280CFDF17CF94D9C4B16BF72FB84324F2886A9D8094B656C336D45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 017F5448, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16de7f5fe72a18a535d210331839c85754611a479d8da11414bd53164ee583af
Instruction ID: 75d22e73fbfdea537c93e05c4fafa3157ec4f83e92164ed67ba502d96e95e47d
Opcode Fuzzy Hash: 16de7f5fe72a18a535d210331839c85754611a479d8da11414bd53164ee583af
Instruction Fuzzy Hash: AB116AB1E0121AAFCB12DFA8C8406BFBBF5BF48215F10446EEA15E3341D7748A55CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0188AF90, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6699db4ce97243aa6444009b927a3f6c58a502cd69abf7f8f25f39e80e759711
Instruction ID: c614e3c76007160e7ea93acb352272b64401820da3d02ea958a0d89eb190c33b
Opcode Fuzzy Hash: 6699db4ce97243aa6444009b927a3f6c58a502cd69abf7f8f25f39e80e759711
Instruction Fuzzy Hash: E7115E30B0021D8F8B40EBBCC8449AEB7F2FFCA610750846DD509E7354EB359E068B91

Uniqueness

Uniqueness Score: -1.00%

Function 01889060, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41007910c8f6e3cf44cb13c02381040019f3ca7e93945d9b8c1564e34f118d31
Instruction ID: d84cd36e32b3be82e302e0c2cb76b871be5fc2e63b48891275c7bfdf59cf4159
Opcode Fuzzy Hash: 41007910c8f6e3cf44cb13c02381040019f3ca7e93945d9b8c1564e34f118d31
Instruction Fuzzy Hash: C6113C30F0011D8F8B40EFB8C8489AEB7F6FF8A610750842DD509E7354EB349D068B91

Uniqueness

Uniqueness Score: -1.00%

Function 017FE950, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a88baa4945f79c3ef162094261ace3910a06830861b43242e62db540b138e46
Instruction ID: 2f64a5af738852c38788c00baeccfa83e589d0a769e2f89dbdd281e136a017d3
Opcode Fuzzy Hash: 9a88baa4945f79c3ef162094261ace3910a06830861b43242e62db540b138e46
Instruction Fuzzy Hash: 0D113C30B001198F8B40EFBCC8499AEB7F6FF8A650740846DD609E7358EF349D098BA1

Uniqueness

Uniqueness Score: -1.00%

Function 017FE830, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da6c19d0de71a6afd17b14014c15777f8127ce589f2759471ebd34fd7d38d075
Instruction ID: 92fd909667e48cdaaf2e0053099bfbe747fb6023ef5c30aa58d05257c6f01c4b
Opcode Fuzzy Hash: da6c19d0de71a6afd17b14014c15777f8127ce589f2759471ebd34fd7d38d075
Instruction Fuzzy Hash: AF112731B001198F8B40EBA8D8499AEB7F2EB8A610750856DD609E7358EB349D068B91

Uniqueness

Uniqueness Score: -1.00%

Function 017FC008, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65dc957da84494ec9f31ded8ce82c9f02388ece7de4fa0c931f456824934bb35
Instruction ID: c69ee30561120213de32c9edf6a052940a96573c0b2a98af7439a9acb4291dc9
Opcode Fuzzy Hash: 65dc957da84494ec9f31ded8ce82c9f02388ece7de4fa0c931f456824934bb35
Instruction Fuzzy Hash: 61117C70B102198F8B50DFBCD8499AEBBF6FB8C6107108579E94AE3354EF359D028B91

Uniqueness

Uniqueness Score: -1.00%

Function 017F1629, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dab76d7411aefd9d703f413dbbd80d8cac5334b0100a5c7483de1f438d6780b
Instruction ID: cd8f4a034be4cc4b33afc5bdadaa54b8f164baa22ff3d13740ad8616eb49f966
Opcode Fuzzy Hash: 5dab76d7411aefd9d703f413dbbd80d8cac5334b0100a5c7483de1f438d6780b
Instruction Fuzzy Hash: D2017C32600025BBDF169A699C01BAF7BEBEBC87A0F18802DF605D7384DE71885597A4

Uniqueness

Uniqueness Score: -1.00%

Function 017F5458, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d718ef561ff5e14e767a9e792e845080a9b4ed45ff4f69c9f993c9cbd301df1b
Instruction ID: e827640fffad8a5cc75eaac30770f499311c45460584d7451c88faac44b8da11
Opcode Fuzzy Hash: d718ef561ff5e14e767a9e792e845080a9b4ed45ff4f69c9f993c9cbd301df1b
Instruction Fuzzy Hash: 4B111871E0121AAFCB11DFA9C8445BFBBF9FB88211F10842EEA15E3340D6749A55CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 017FAA99, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd05aa8b08322b4e77942ab895dcd8e1dad3dfaf250af0280c263391a150abd
Instruction ID: eaa28134aba39395e3fd519588916ff61094b2f0ea2616a7965963b0cee42658
Opcode Fuzzy Hash: 3cd05aa8b08322b4e77942ab895dcd8e1dad3dfaf250af0280c263391a150abd
Instruction Fuzzy Hash: 8D01D675D0C3959FCB038B795D052AABFF49F86220B0940EBD689D7243E6304949CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01886DD8, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 699e3cad1072e17ec84d0236407c72c612beac8419313a3a7b48a1d9aadf2d06
Instruction ID: 05ec7f0f5b1391f40b9c2a1d33682f780fa666fafed4c31c75648145138cbfed
Opcode Fuzzy Hash: 699e3cad1072e17ec84d0236407c72c612beac8419313a3a7b48a1d9aadf2d06
Instruction Fuzzy Hash: 97016971E0425D9FCF14CF98C9448DDBBB6FF48320F00826AE905AB254DB319A19CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 017FEA70, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0c97ede0e60c0de244f9480fd6dc346a528e34eea40a68dcdf96daed557ba4a
Instruction ID: ef2e4b0d22a413c9ab17144a90dbc0b421a1341551adab9849ec05f495b74610
Opcode Fuzzy Hash: a0c97ede0e60c0de244f9480fd6dc346a528e34eea40a68dcdf96daed557ba4a
Instruction Fuzzy Hash: 35F03771F001199F8B50BBBD98186AFBAE5EF98250B05457AD90AD3704EE348E1587D1

Uniqueness

Uniqueness Score: -1.00%

Function 0188AFEF, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd2066eaaf783a59582fe0ea0012f1310425dab81735dbff638abcb3b787767c
Instruction ID: c379f0233e2d7a5ea08c52dd33141ad0d33e66b07e08b1bdf4c93f3c64eb91a4
Opcode Fuzzy Hash: bd2066eaaf783a59582fe0ea0012f1310425dab81735dbff638abcb3b787767c
Instruction Fuzzy Hash: A6E0ED35B501198B8F05EBBCD8449DDB3E2AFD9224B044069E609E7354DE259E0A87A1

Uniqueness

Uniqueness Score: -1.00%

Function 018890BF, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e862e058993c6d4c2cf58681d8fd34f2c0430673f79d9fc890aa26656d180348
Instruction ID: 6ca2ec74a425d9799c15865f870bc8802280d9d29ee2fa78a615e9416e2b1f37
Opcode Fuzzy Hash: e862e058993c6d4c2cf58681d8fd34f2c0430673f79d9fc890aa26656d180348
Instruction Fuzzy Hash: CDE0ED35F5001D8B8F45EBBCD8489DDB3E2BFD9214B044469D609E7354EE359D098761

Uniqueness

Uniqueness Score: -1.00%

Function 017FE17F, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a2ffd41abd0973de73b38f66a770e8631bf30f1a71c2b1e05c2dd09656d7325
Instruction ID: d70c6a8c33ff964051564d4cb32dfe1809621d2e6aa38d7f3c07e4643f51bb1f
Opcode Fuzzy Hash: 5a2ffd41abd0973de73b38f66a770e8631bf30f1a71c2b1e05c2dd09656d7325
Instruction Fuzzy Hash: 67E0ED35F400198B8F05EBBCD844DDDB3F2AFD9215B0540A9EA09E7354DE259D198761

Uniqueness

Uniqueness Score: -1.00%

Function 017FE9AF, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40bfb05c65ab31e35f1597eec455559068ce8e548a9c743d7f27eb1b1893eff8
Instruction ID: cc8753adf11b1ac8686e09a50d9fbe4f8de1b960456198c499cc0dd8144573dd
Opcode Fuzzy Hash: 40bfb05c65ab31e35f1597eec455559068ce8e548a9c743d7f27eb1b1893eff8
Instruction Fuzzy Hash: 0DE06D35B000198B8F04EBBCD8488DDB3E1BFC9214B004069D609E3358DE359D098B61

Uniqueness

Uniqueness Score: -1.00%

Function 017FC069, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca3860a6ea31ce717e26db72784d6d5fbd1e7642e367e8a2fe972eef083ffdb
Instruction ID: 05dfa2d74b9a4136a2b503ead3bb8d3239d8ff5f1614e7f8cc8071c0433e2d93
Opcode Fuzzy Hash: 4ca3860a6ea31ce717e26db72784d6d5fbd1e7642e367e8a2fe972eef083ffdb
Instruction Fuzzy Hash: A7E03935B100188B8F14EBBCE8489DCB7F1EB88219B0080B9EA4AE3354DE359C058B62

Uniqueness

Uniqueness Score: -1.00%

Function 017FE88F, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec51d60be08fe0d1cef72882613cfe9a15ff29637baa82ecde17f97b7195e54
Instruction ID: fec6ff90d232b2344e7b7117fbd1d75ccf0c2bfdd4082e76a9a4b3b86f2ac715
Opcode Fuzzy Hash: 2ec51d60be08fe0d1cef72882613cfe9a15ff29637baa82ecde17f97b7195e54
Instruction Fuzzy Hash: FEE0ED35F400198B8F05FBBCD8549DDB3E1BFD9214B148069EA09E7354DE359D058B61

Uniqueness

Uniqueness Score: -1.00%

Function 017FAAA8, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b46dc1b20db2b3ab1dc8a42c2a0697b67370edad1e1915169bf0eb29ff2c8aec
Instruction ID: eec52bc8454874f6987682399e8025d62b625603d7a98c32f45c712e0b6d89c2
Opcode Fuzzy Hash: b46dc1b20db2b3ab1dc8a42c2a0697b67370edad1e1915169bf0eb29ff2c8aec
Instruction Fuzzy Hash: 09E01275E041199F87509FAD98095AF7BF9EA88211B044476E60DE3300EB704A51CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 017F4832, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 666443dc701fb73eaaebaa68d510afbbdfbb8e8000fc3e6abfb18e9dfe2a6197
Instruction ID: 7b7450ebaf684eb41638d944604bc08284b223b6c1a5de158fa037e80dd45660
Opcode Fuzzy Hash: 666443dc701fb73eaaebaa68d510afbbdfbb8e8000fc3e6abfb18e9dfe2a6197
Instruction Fuzzy Hash: F9E086367081098FEF15DA55E810BEEB36AEBC0225F2080EEC20987745C7355A169722

Uniqueness

Uniqueness Score: -1.00%

Function 017F4883, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcf1513bad1adbeba35da3398fdeffcd12497dff318d355264454d4246b5cf10
Instruction ID: 36368dcc667bc39346b0a3089b6ffae5d01c0f8fb8b2caccea10e53e6324c6b9
Opcode Fuzzy Hash: fcf1513bad1adbeba35da3398fdeffcd12497dff318d355264454d4246b5cf10
Instruction Fuzzy Hash: 33D05EB369C564ABE212404E7C05B97EA4CD7C1A75E1501BFA64EC734194429C4182E4

Uniqueness

Uniqueness Score: -1.00%

Function 017FE04C, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d1a3c7aba5be8b7897c24e6d1658e506d367314a5468d00c1d6da83d44f604b
Instruction ID: f870b80bfaa1d756c4d0d14fd74ae6f51ebc6c575667a3ef441886e89475ffd8
Opcode Fuzzy Hash: 1d1a3c7aba5be8b7897c24e6d1658e506d367314a5468d00c1d6da83d44f604b
Instruction Fuzzy Hash: 50D012017193569A5F0816B6152127F10C61E8419EB6B887A9A46CF2EAFE1DC9C123A2

Uniqueness

Uniqueness Score: -1.00%

Function 017F1D73, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa60732d38e6f451f885be8ae57de319ee984dd585ef64ba31d837e0e4f1a360
Instruction ID: f3e5b40b357205f5b7c596883be256e85c88f71da91ce42ca525a6c9e79c555d
Opcode Fuzzy Hash: fa60732d38e6f451f885be8ae57de319ee984dd585ef64ba31d837e0e4f1a360
Instruction Fuzzy Hash: 81D05E300282018ED542EB60ED9225A372BDB9151BB448D6E914449B69DB6AC9598781

Uniqueness

Uniqueness Score: -1.00%

Function 017F1D80, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecb43d8a116956e9ae9c3ad9da0efc63ecb323e9f143e451dff2277090ee6db5
Instruction ID: b4155ab9b8c5ff9e2cc4fb5142f2d5cb3f17ce75059db590f943ae380181cfd2
Opcode Fuzzy Hash: ecb43d8a116956e9ae9c3ad9da0efc63ecb323e9f143e451dff2277090ee6db5
Instruction Fuzzy Hash: E3C012300082054AD945EB61EC9142B735E9A9150A340C96D91044936CDF7599458785

Uniqueness

Uniqueness Score: -1.00%

Function 017F5721, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.588912705.00000000017F0000.00000040.00000001.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17f0000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eed0911ae1145a3d801b412841cb17991b8f7920462e265e651545c024536bc
Instruction ID: 4796f7668764f2781f9df760db07f1143a47fbbf5dbcc7528b9d8cc68091eead
Opcode Fuzzy Hash: 2eed0911ae1145a3d801b412841cb17991b8f7920462e265e651545c024536bc
Instruction Fuzzy Hash: EBC08C3AF01018DB5B00CAC8F0400DCF3A4EB88138B10C097D6195230087310B298A91

Uniqueness

Uniqueness Score: -1.00%

Function 0188A534, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.589011042.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_Szallitasi adatok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b2f520ee4a119ca5cbae29fdbe3f44ebb6b6c961b28bffad2faa463ebf5e99f
Instruction ID: 974fc077f7b29e84387881325b674e089db255d0d64c258d86b6616b28dbaecc
Opcode Fuzzy Hash: 6b2f520ee4a119ca5cbae29fdbe3f44ebb6b6c961b28bffad2faa463ebf5e99f
Instruction Fuzzy Hash: 42B01236304A100B9708EA19CD10D5B97E3EBE1228724C31501B6537E8E730D80C4611

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Szallitasi adatok.tar

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: unarchiver.exe PID: 6880 Parent PID: 5844

General

Function 02EB02A8, Relevance: 3.0, Strings: 2, Instructions: 481
COMMON

Function 0146B0B2, Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Function 0146AB70, Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0146A9E2, Relevance: 1.6, APIs: 1, Instructions: 93
pipeCOMMON

Function 0146A504, Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Function 0146A120, Relevance: 1.6, APIs: 1, Instructions: 83
fileCOMMON

Function 0146B0E2, Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Function 0146AB96, Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Function 0146A77C, Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Function 0146A85F, Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Function 0146A52A, Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Function 0146A6BB, Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Function 0146A600, Relevance: 1.6, APIs: 1, Instructions: 71
COMMON

Function 0146A448, Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 0146A88E, Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre